Edit tour

Windows Analysis Report
T0pdaslk-guangwang-winelkxcac-64.msi

Overview

General Information

Sample name:	T0pdaslk-guangwang-winelkxcac-64.msi
Analysis ID:	1621377
MD5:	09fc3a5af26388a6909a2b0643ad644e
SHA1:	83423788bb21f3a47e02f89d3e604bf135f42080
SHA256:	0c8017e92fd56f96da5b8f01c219d4a90f80da94b360c59ce81618c9df55c88b
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected GhostRat

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Detected VMProtect packer

Drops password protected ZIP file

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Injects code into the Windows Explorer (explorer.exe)

Modifies the context of a thread in another process (thread injection)

Modifies the windows firewall

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Performs DNS TXT record lookups

Sample is not signed and drops a device driver

Sets debug register (to hijack the execution of another thread)

Sigma detected: Potentially Suspicious Malware Callback Communication

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect debuggers (CloseHandle check)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Stores large binary data to the registry

Yara signature match

Classification

Process Tree

System is w10x64_ra

svchost.exe (PID: 2708 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msiexec.exe (PID: 6968 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\T0pdaslk-guangwang-winelkxcac-64.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7016 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6868 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 897DC43AA7908FBDF146DB4280A4B33E C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6508 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 1D978FC4728A444D05DF5DFC6F0CB94A MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7088 cmdline: C:\Windows\System32\MsiExec.exe -Embedding A42AD45622494486CAE464114BFDCC7F MD5: E5DA170027542E25EDE42FC54C929077)

Microsoft_Xtools.exe (PID: 5868 cmdline: "C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\\Microsoft_Xtools.exe" MD5: 9980BA3F5506EF42212CF1D44C66757D)

explorer.exe (PID: 4380 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

ToDesk_Setup.exe (PID: 4108 cmdline: "C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe" MD5: C352B397CC1BF792AE368F562AAA19BE)

ToDesk_Setup.exe (PID: 2460 cmdline: "C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe" MD5: C352B397CC1BF792AE368F562AAA19BE)

cmd.exe (PID: 6108 cmdline: cmd.exe /c sc stop ToDesk_Service MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3284 cmdline: sc stop ToDesk_Service MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 5564 cmdline: cmd.exe /c sc delete ToDesk_Service MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2864 cmdline: sc delete ToDesk_Service MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 4020 cmdline: cmd.exe /c sc stop ToDesk_Service MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 364 cmdline: sc stop ToDesk_Service MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 6444 cmdline: cmd.exe /c sc delete ToDesk_Service MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 716 cmdline: sc delete ToDesk_Service MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

netsh.exe (PID: 5852 cmdline: netsh advfirewall firewall delete rule name="ToDesk" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1920 cmdline: netsh advfirewall firewall delete rule name="ToDesk_Service" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2292 cmdline: netsh advfirewall firewall delete rule name="ToDesk_Session" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 3044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 688 cmdline: netsh advfirewall firewall add rule name="ToDesk" dir=in program="C:\Program Files\ToDesk\ToDesk.exe" edge=yes action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 4856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3488 cmdline: netsh advfirewall firewall add rule name="ToDesk" dir=out program="C:\Program Files\ToDesk\ToDesk.exe" action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1980 cmdline: netsh advfirewall firewall add rule name="ToDesk_Service" dir=in program="C:\Program Files\ToDesk\ToDesk_Service.exe" edge=yes action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3744 cmdline: netsh advfirewall firewall add rule name="ToDesk_Service" dir=out program="C:\Program Files\ToDesk\ToDesk_Service.exe" action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 3752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4596 cmdline: netsh advfirewall firewall add rule name="ToDesk_Session" dir=in program="C:\Program Files\ToDesk\ToDesk_Session.exe" edge=yes action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1596 cmdline: netsh advfirewall firewall add rule name="ToDesk_Session" dir=out program="C:\Program Files\ToDesk\ToDesk_Session.exe" action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ToDesk.exe (PID: 4896 cmdline: "C:\Program Files\ToDesk\ToDesk.exe" MD5: 461C4140E0A097BFFE2EE4B8991AAB3C)

explorer.exe (PID: 5792 cmdline: C:\windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

ToDesk.exe (PID: 5712 cmdline: "C:\Program Files\ToDesk\ToDesk.exe" MD5: 461C4140E0A097BFFE2EE4B8991AAB3C)

ToDesk.exe (PID: 72 cmdline: "C:\Program Files\ToDesk\ToDesk.exe" --runadmin=true MD5: 461C4140E0A097BFFE2EE4B8991AAB3C)

svchost.exe (PID: 6180 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6200 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 612 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6572 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 3860 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 4108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 6648 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ToDesk.exe (PID: 456 cmdline: "C:\Program Files\ToDesk\ToDesk.exe" --runservice MD5: 461C4140E0A097BFFE2EE4B8991AAB3C)

ToDesk.exe (PID: 3948 cmdline: "C:\Program Files\ToDesk\ToDesk.exe" --hide --localPort=35600 MD5: 461C4140E0A097BFFE2EE4B8991AAB3C)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000003.2019014454.000000000C199000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x3bbe8:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000000D.00000002.1586294361.000001EADCDE4000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x37ec8:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0xc49d6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000013.00000002.2496852197.0000000000880000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000013.00000002.2460978525.0000000000420000.00000020.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2dde8:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000000D.00000002.1587648854.000001EADE820000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x5ba38:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
Process Memory Space: explorer.exe PID: 5792	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 47.238.100.22, DestinationIsIpv6: false, DestinationPort: 4433, EventID: 3, Image: C:\Windows\explorer.exe, Initiated: true, ProcessId: 5792, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49909

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2708, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Winos4.0 Framework CnC Login Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T21:13:41.718752+0100	2052875	1	Malware Command and Control Activity Detected	192.168.2.16	49909	47.238.100.22	4433	TCP
2025-02-21T21:14:57.137847+0100	2052875	1	Malware Command and Control Activity Detected	192.168.2.16	49909	47.238.100.22	4433	TCP

Joe Sandbox Signatures

• Cryptography
• Compliance
• Spreading
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• E-Banking Fraud
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\CrashReport.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\ToDesk.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\uninst.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\zrtc.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\devcon.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\todeskaudio.cat	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.inf	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x64.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad\tdgamepad.cat	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad\TdGamePad.inf	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen\tdidd.cat	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.inf	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid\devcon.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid\todeskvhid.cat	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.inf	Jump to behavior
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\config.ini
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\Logs
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\Logs\servicexejnqytw_2025_02_21.log
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\Logs\sdkservicepulmxguu_2025_02_21.log
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\Logs\zrtcserviceewwszqlz_2025_02_21.log

Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Microsoft_Xtools.exe, 0000000D.00000002.1603179504.00007FFF46F85000.00000002.00000001.01000000.0000000A.sdmp, vcruntime140_1.dll.12.dr
Source:	Binary string: D:\jenkins\workspace\todesk-toc-win\bin\x64\Release\todesk\ToDesk.pdb source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\gitlab\vhid\driver\umdf2\x64\Release\TodeskVhid.pdb source: ToDesk_Setup.exe, 00000012.00000002.1874957635.000000000041E000.00000004.00000001.01000000.0000000C.sdmp, ToDesk_Setup.exe, 00000012.00000002.1874957635.000000000040A000.00000004.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\stdDllWrapper.pdb source: T0pdaslk-guangwang-winelkxcac-64.msi, 4cdca3.rbs.2.dr, MSIE927.tmp.2.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: Microsoft_Xtools.exe, 0000000D.00000002.1602453751.00007FFF415B2000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: zrtc.dll.pdb source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26671000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: E:\NiuniuCapture\niuniu_src\nsNiuniuSkin\plugin\nsNiuniuDUI.pdb source: ToDesk_Setup.exe, 00000012.00000002.1883171743.000000006D111000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Microsoft_Xtools.exe, 0000000D.00000002.1603452415.00007FFF46FA3000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Microsoft_Xtools.exe, 0000000D.00000002.1603452415.00007FFF46FA3000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: virtual_camera_x86.dll.pdb source: virtual_camera_x86.dll.18.dr
Source:	Binary string: D:\jenkins\workspace\todesk-toc-win\bin\x64\Release\todesk\ToDesk.pdb. source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy -O2 -Ob2 -MT /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -D_WIN32_WINNT=0x0501 -D_USING_V110_SDK71_crypto\ex_data.c source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: T0pdaslk-guangwang-winelkxcac-64.msi, MSIA690.tmp.1.dr, MSI2A0D.tmp.1.dr, MSIA621.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Microsoft_Xtools.exe, 0000000D.00000002.1603179504.00007FFF46F85000.00000002.00000001.01000000.0000000A.sdmp, vcruntime140_1.dll.12.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy -O2 -Ob2 -MT /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -D_WIN32_WINNT=0x0501 -D_USING_V110_SDK71_ source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp

Source: C:\Windows\explorer.exe	File opened: z:
Source: C:\Windows\explorer.exe	File opened: x:
Source: C:\Windows\explorer.exe	File opened: v:
Source: C:\Windows\explorer.exe	File opened: t:
Source: C:\Windows\explorer.exe	File opened: r:
Source: C:\Windows\explorer.exe	File opened: p:
Source: C:\Windows\explorer.exe	File opened: n:
Source: C:\Windows\explorer.exe	File opened: l:
Source: C:\Windows\explorer.exe	File opened: j:
Source: C:\Windows\explorer.exe	File opened: h:
Source: C:\Windows\explorer.exe	File opened: f:
Source: C:\Windows\System32\svchost.exe	File opened: d:
Source: C:\Windows\explorer.exe	File opened: b:
Source: C:\Windows\explorer.exe	File opened: y:
Source: C:\Windows\explorer.exe	File opened: w:
Source: C:\Windows\explorer.exe	File opened: u:
Source: C:\Windows\explorer.exe	File opened: s:
Source: C:\Windows\explorer.exe	File opened: q:
Source: C:\Windows\explorer.exe	File opened: o:
Source: C:\Windows\explorer.exe	File opened: m:
Source: C:\Windows\explorer.exe	File opened: k:
Source: C:\Windows\explorer.exe	File opened: i:
Source: C:\Windows\explorer.exe	File opened: g:
Source: C:\Windows\explorer.exe	File opened: e:
Source: C:\Program Files\ToDesk\ToDesk.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:
Source: C:\Windows\explorer.exe	File opened: [:

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2052875 - Severity 1 - ET MALWARE Winos4.0 Framework CnC Login Message : 192.168.2.16:49909 -> 47.238.100.22:4433

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 47.238.100.22 4433

Source: global traffic

TCP traffic: 192.168.2.16:49909 -> 47.238.100.22:4433

Source: Joe Sandbox View

ASN Name: CHARTER-20115US CHARTER-20115US

Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.238.100.22

Source: global traffic	DNS traffic detected: DNS query: authds.todesk.com
Source: global traffic	DNS traffic detected: DNS query: authds.kylinlot.com
Source: global traffic	DNS traffic detected: DNS query: todeskcdnspeed.todesk.com

Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF26301000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://.jpg
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http:///dump.php?dumpserver.compresstypelognamedatetimedate
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://EVSecure-crl.geotrust.com/GeoTrustPCA.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://EVSecure-ocsp.geotrust.com0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://aia.startssl.com/certs/ca.crt0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://aia.startssl.com/certs/ca.crt02
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://aia1.wosign.com/ca1-class3-server.cer0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://aia1.wosign.com/ca1g2-server3.cer0
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://apibuss.RemoteTemporaryPasswordRemoteReplicationIDUpdateTempPassCustomChangePassword:x
Source: explorer.exe, 0000000E.00000002.2534919873.0000000007280000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.000000000724F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1556114866.00000000088D7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26085000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://certs.starfieldtech.com/repository/1402
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0;
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.entrust.net/g2ca.crl0;
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.entrust.net/rootca1.crl0;
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.geotrust.com/GeoTrustPCA-G3.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26086000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/gtglobal.crl04
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26086000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0F
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26086000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0N
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0V
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF26088000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0=
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2608A000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfroot-g2.crl0L
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfroot.crl0L
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.startssl.com/sfsca.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.startssl.com/sfsca.crl0f
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA-G3.crl0
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2608A000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF26088000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: svchost.exe, 00000000.00000002.2507661800.000001EB66200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl.ws.symantec.com/universal-root.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: explorer.exe, 0000000E.00000002.2534919873.0000000007280000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.000000000724F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1556114866.00000000088D7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, virtual_camera_x86.dll.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 0000000E.00000002.2534919873.0000000007280000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2586897655.00000000088EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2060237428.00000000088EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.000000000724F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1556114866.00000000088D7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crls1.wosign.com/ca1.crl0m
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crls1.wosign.com/ca1.crl0q
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp, ToDesk.exe, 00000033.00000003.1895351771.00000208CF81B000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000003.1893771860.00000208CF80C000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000002.1903608888.00000208CF81B000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1893565314.000001B611B45000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1887714459.000001B611B35000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2208474981.00000271BDEEC000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2246294725.00000271BDF05000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F0D0000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2243853530.000001ED0F0E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dumpserver.todesk.com/dump.php
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://dumpserver.todesk.com/dump.phpSymInitialize
Source: svchost.exe, 00000000.00000003.1203206451.000001EB66130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://faac.sourceforge.net/)
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g.symcb.com/GeoTrustPCA-G3.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26086000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF26087000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF26088000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0.
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26086000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g.symcd.com0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF26087000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF26088000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g.symcd.com0L
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2608A000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g1.symcb.com/GeoTrustPCA.crl0)
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g1.symcb.com/crls/gtglobal.crl0/
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2608A000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g2.symcb.com0G
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://g2.symcb.com0L
Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF26301000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: ToDesk_Setup.exe, 0000000F.00000000.1551522906.000000000040A000.00000008.00000001.01000000.0000000C.sdmp, ToDesk_Setup.exe, 00000012.00000002.1874957635.000000000040A000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://o.ss2.us/0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF2609C000.00000002.00000001.01000000.00000018.sdmp, virtual_camera_x86.dll.18.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.digicert.com0M
Source: explorer.exe, 0000000E.00000002.2534919873.00000000071E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.00000000071CD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.entrust.net00
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.entrust.net02
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.geotrust.com0L
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF26088000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr10
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2608A000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.godaddy.com/02
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.godaddy.com/05
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26085000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0J
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/08
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/0;
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.startssl.com/ca0-
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.startssl.com/ca00
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.startssl.com00
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2608A000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.thawte.com0;
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp.ws.symantec.com0k
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp1.wosign.com/ca104
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://ocsp1.wosign.com/ca108
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://pca-g3-ocsp.geotrust.com0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26085000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://s../../net/third_party/quiche/src/quic/core/crypto/certificate_view.cc
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26085000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://s../../net/third_party/quiche/src/quic/core/crypto/certificate_view.ccInvalid
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://s.ss2.us/r.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://s2.symcb.com0k
Source: explorer.exe, 0000000E.00000002.2466701365.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: explorer.exe, 0000000E.00000000.1545905770.00000000025F0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp, ToDesk.exe.18.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp, ToDesk.exe.18.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://subca.ocsp-certum.com0.
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://t.symcb.com/ThawtePCA.crl0)
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://t.symcd.com01
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0)
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0/
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://t2.symcb.com0;
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://t2.symcb.com0A
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1889947432.000001B611B16000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDED4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2208474981.00000271BDEEC000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2246294725.00000271BDF05000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDECD000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2238552863.00000271BDE77000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2242807873.000001ED0F0AB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F0D0000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2243853530.000001ED0F0E3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0AA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0A9000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/&
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/&oq
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/2
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/4
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/8
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/AT;.CMD;.VBS;.VBE;.JS;7
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/F
Source: ToDesk.exe, 00000033.00000003.1895351771.00000208CF81B000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000003.1893771860.00000208CF80C000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000002.1903608888.00000208CF81B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/G
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/In
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/J
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/N
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/OCESSORS=4
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/OGONSERVER=9
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000002.1902486191.00000208CF7E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/P
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/R
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/SCPROCESSO
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/System32
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/TPath=C:
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/Windows
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/amW6432=C:
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/b
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/https://uc.todesk.com/https://user.todesk.com/upload.php?token=tode
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/ily
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/ineIntelPR
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/les;C:
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/m
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/m32
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/mW6432=C:
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/o
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/odules;C:
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000002.1902486191.00000208CF7E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/p
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000002.1902486191.00000208CF7E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/p_
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/rh
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/s
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/t3
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/vh
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/ws
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://todeskcdnspeed.todesk.com/~h
Source: svchost.exe, 00000005.00000002.1368418659.000001CA68213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26087000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.digicert.com/CACerts/DigiCertHighAssuranceEVRootCA.crt0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.entrust.net/CPS0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.entrust.net/rpa0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF26087000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26086000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF26088000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0)
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps06
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0;
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0A
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26087000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.keynectis.com/PC07
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26087000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.keynectis.com/PC08
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.startssl.com/intermediate.pdf0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.startssl.com/policy.pdf04
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.startssl.com/policy0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.startssl.com/sfsca.crl0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.startssl.com/sfsca.crt0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.symauth.com/rpa0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.symauth.com/rpa0)
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF260B7000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-timehttp://www.ietf.org/id/draft-holmer-rmcat-
Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-timehttp://www.webrtc.org/experiments/rtp-hdre
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/color-space
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/inband-cn
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02http://www.webrtc.org/experiments/r
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-timing
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllNULinvalid
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.wosign.com/policy/0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://x.ss2.us/x.cer0&
Source: explorer.exe, 0000000E.00000000.1556114866.0000000008888000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppche_16.dbK
Source: explorer.exe, 0000000E.00000000.1564679551.000000000BF18000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000E.00000002.2626418957.000000000BF31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2008974722.000000000BF31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1564679551.000000000BF18000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS0
Source: explorer.exe, 0000000E.00000002.2626418957.000000000BF31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2008974722.000000000BF31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1564679551.000000000BF18000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS2F
Source: explorer.exe, 0000000E.00000002.2626418957.000000000BF31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2008974722.000000000BF31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1564679551.000000000BF18000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSdf
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF26268000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
Source: explorer.exe, 0000000E.00000000.1556114866.0000000008710000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2586897655.000000000875E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000E.00000000.1545476893.0000000000B14000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1546224158.0000000002F60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2520908782.0000000002F7E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000E.00000000.1556114866.00000000087E2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2586897655.0000000008821000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 0000000E.00000002.2534919873.0000000007160000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=BD3E37D8C4964A928E655AAA177D65C1&timeOut=5000&oc
Source: explorer.exe, 0000000E.00000002.2534919873.0000000007160000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2520908782.0000000002F85000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1546224158.0000000002F60000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: explorer.exe, 0000000E.00000000.1556114866.00000000087E2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2586897655.0000000008802000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/WindyV2.svg
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://becausemomsays.com/she-wanted-to-keep-her-deceased-husbands-ring-so-she-selfishly-denied-her
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ-dark
Source: explorer.exe, 0000000E.00000002.2534919873.00000000071A1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gK0V
Source: explorer.exe, 0000000E.00000002.2534919873.00000000071A1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gK0V-dark
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2608A000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://certs.starfieldtech.com/repository/0
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cookpolitical.com/2020-national-popular-vote-tracker
Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF261FA000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://crbug.com/1053756
Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF261FA000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://crbug.com/1053756ICE
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF261FB000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://crbug.com/778929.
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF261FB000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://crbug.com/778929.%016llX%016llXKernel32.dll../../base/threading/platform_thread_win.ccJoin((
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDED4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2208474981.00000271BDEEC000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDECD000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2238552863.00000271BDE77000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2242807873.000001ED0F0AB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F0D0000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0AA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0A9000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download(
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download)
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download1
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download7v
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download8
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download86)=C:
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download:
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadC:
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadEB
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadNh
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadPATHEX
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadProgramA
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadROCESSOR_IDENT3
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadV
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadZh
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadf
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadgram
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadj
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadm
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadneIntelPROCES/
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadngComm
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadogramDa
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadram
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadstem32
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadstemDri
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadtem32
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadtions
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadverData=C:
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadws
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadwsTEMP
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadystem32
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/downloadz5
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas-personal.todesk.com/download~
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F08A000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2238241659.000001ED0F08A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDEC3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2238552863.00000271BDE77000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2243465242.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0A3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console$
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console(
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console.
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDEC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console.xS
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console0
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000002.1902486191.00000208CF7EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console0Ds
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console5
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console5x
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console9
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000002.1902486191.00000208CF7EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console:Di
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console;C:
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleA
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleC:
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleE;.J
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleF
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleG
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDEC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleH
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleP
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleRS=4
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleW7
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleY
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleZ
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleali
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleb
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consolec
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoledy
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consolee
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consolei
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consolek
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleky
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consolele
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleo
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consolep
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleq
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleq$
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoles
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consoleuy
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consolew
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/consolex
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com/console~
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.com:
Source: ToDesk.exe, 00000037.00000003.1887714459.000001B611B35000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1889100952.000001B611B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://daas.todesk.comkF
Source: explorer.exe, 0000000E.00000000.1556114866.0000000008888000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: svchost.exe, 00000005.00000002.1368925789.000001CA68259000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000005.00000003.1366314189.000001CA68262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366238872.000001CA6826E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366943277.000001CA68243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1369090764.000001CA68272000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366875764.000001CA6825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000005.00000003.1366292360.000001CA68267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.1366238872.000001CA6826E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000003.1366314189.000001CA68262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1369064034.000001CA68265000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366875764.000001CA6825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000005.00000002.1368584214.000001CA6822B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366292360.000001CA68267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000005.00000003.1366314189.000001CA68262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1368767624.000001CA6823F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1369064034.000001CA68265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000005.00000002.1368767624.000001CA6823F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000003.1366314189.000001CA68262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.todesk.com/windowsDownloadAppFilekernel32::IsWow64Process2(ps
Source: svchost.exe, 00000005.00000003.1367150084.000001CA68230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000002.1368767624.000001CA6823F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366314189.000001CA68262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366943277.000001CA68243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000005.00000003.1367150084.000001CA68230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000005.00000002.1368584214.000001CA6822B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366292360.000001CA68267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: explorer.exe, 0000000E.00000002.2626418957.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2040398375.000000000BFDE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1564679551.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comA
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://financebuzz.com/top-signs-of-financial-fitness?utm_source=msn&utm_medium=feed&synd_slide=1&s
Source: svchost.exe, 00000000.00000003.1203206451.000001EB661A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000000.00000003.1203206451.000001EB66192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF26109000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://github.com/opencv/opencv/issues/6293
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA10WNpO.img
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bAqmF.img
Source: explorer.exe, 0000000E.00000002.2534919873.00000000071A1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hIktm.img
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hMa61.img
Source: explorer.exe, 0000000E.00000002.2534919873.00000000071A1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42cl9.img
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1e6XdQ.img
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://news.gallup.com/poll/247016/conservatives-greatly-outnumber-liberals-states.aspx
Source: explorer.exe, 0000000E.00000002.2626418957.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2040398375.000000000BFDE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1564679551.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comsoft.A
Source: explorer.exe, 0000000E.00000000.1564679551.000000000BF65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2050416734.000000000C06F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp, ToDesk.exe, 00000033.00000003.1893771860.00000208CF830000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000003.1898912108.00000208CF831000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1887714459.000001B611B35000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1889100952.000001B611B4B000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1893847062.000001B611B4F000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2223054731.00000271BDF2E000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2208474981.00000271BDF2A000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2222871379.000001ED0F101000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F0F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st.todesk.com
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st.todesk.comPJ:
Source: ToDesk.exe, 00000037.00000003.1887714459.000001B611B35000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1889100952.000001B611B4B000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1893847062.000001B611B4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st.todesk.comoG
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/politics/states-most-conservatives-0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26374000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://streams.videolan.org/upload/
Source: svchost.exe, 00000005.00000003.1366943277.000001CA68243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000005.00000003.1366926488.000001CA6823D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366926488.000001CA6823D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366910703.000001CA6824A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366432207.000001CA6825D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000002.1368584214.000001CA6822B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000005.00000002.1368925789.000001CA68259000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F08A000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2238241659.000001ED0F08A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDEC3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2238552863.00000271BDE77000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2243465242.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0A3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/1y
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/;y
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/A
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/Cy
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/Dx3
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/E
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/H
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/K
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/M
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/Qy
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/T
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/Wy
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/ation
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/ay
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/d
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/erponse
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/esponseo
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/est
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/f
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/j
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/l
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/o
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/ol
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/on
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://uc.todesk.com/orderManage/buyOrder?spuId=100&orderType=0
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://uc.todesk.com/orderManage/buyOrder?spuId=100&orderType=0WhiteBoardUpdateToastinputTextinputT
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://uc.todesk.com/orderManage/buyOrder?spuId=2&orderType=0
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://uc.todesk.com/orderManage/buyOrder?spuId=2&orderType=0MatchScreenModifyMarkEndRemoteControlC
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/ormation
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/ormationry
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/p
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/pnnse
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/rol
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/t
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/u
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.com/y
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.comamession
Source: ToDesk.exe, 00000037.00000003.1887714459.000001B611B35000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1889100952.000001B611B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.comhF
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://uc.todesk.comhttps://daas.todesk.comipc__pipe134.175.254.188capture__Client_9BEF579D5A8F_Ses
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uc.todesk.comj
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://update.todesk.com/tdpdfprinter.exe
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://update.todesk.com/tdpdfprinter.exetdprinter.tmp.tmpwbab
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1889947432.000001B611B16000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDED4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2208474981.00000271BDEEC000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2246294725.00000271BDF05000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDECD000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2238552863.00000271BDE77000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2242807873.000001ED0F0AB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F0D0000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2243853530.000001ED0F0E3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0AA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0A9000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=$
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=.
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=0
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=6
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=:
Source: ToDesk.exe, 00000033.00000003.1893771860.00000208CF80C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=?
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=B
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=CESSORS=4OS=WK
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=COMPUT
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=Data=C:
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=ESSOR_I
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=FILE=user-PCUWv
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=FilesC
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=Jh
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=Program
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=S;.VBE;
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=System
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=USERNAs
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=Z
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=_REVISI
Source: ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=amily
Source: ToDesk.exe, 00000033.00000002.1902486191.00000208CF7ED000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=c
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=e
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=ePath=C:
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=fh
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=indows
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=indowsP
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=lesCOMPUTERNAW
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=n
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=onProgramFiles
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=profilek
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=r
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=rogram
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=v
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=z
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user.todesk.com/upload.php?token=~5
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDEC3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2238552863.00000271BDE77000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2243465242.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0A3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com$
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDEC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com$x
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com)
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDEC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com0
Source: ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000033.00000002.1902486191.00000208CF7EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com1
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com5
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com8
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.com:
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comA
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comC:
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comE
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comMy
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comT
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comW
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comWind
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comam
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comaxQ
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.come
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comezxD
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comn
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comnseLI-P
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comows
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comr
Source: ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.coms
Source: ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.todesk.comtionny
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wigreports.com/about/
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000E.00000000.1556114866.0000000008AA9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/gr.exel
Source: explorer.exe, 0000000E.00000002.2626418957.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2040398375.000000000BFDE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1564679551.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com8E
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.270towin.com/
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF26088000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.alphassl.com/repository/03
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.financebuzz.com/clever-debt-payoff-55mp?utm_source=msn&utm_medium=feed&synd_slide=1&synd
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.forbes.com/sites/elanagross/2020/10/28/trump-administration-uses-philadelphia-protests-t
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2608A000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.geotrust.com/resources/cps04
Source: ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.geotrust.com/resources/cps06
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26086000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.geotrust.com/resources/repository0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF26089000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/autos/buying/if-your-old-car-has-any-of-these-16-problems-consider-buying-
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/medical/mayo-clinic-minute-who-benefits-from-taking-statins/ar-AA1h
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/medical/scientists-reveal-new-findings-about-older-adults-who-take-
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/15-attributes-of-truly-good-men/ss-AA1hJKQY
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/there-are-8-types-of-intelligence-which-one-is-yo
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/if-any-of-these-11-things-describes-you-you-ve-climb
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/george-santos-former-campaign-treasurer-pleads-guilty-to-fed
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/the-state-with-the-most-liberals-isn-t-userfornia-or-new-yor
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-asks-for-jan-6-dismissal-because-coup-attempt-was-part
Source: explorer.exe, 0000000E.00000002.2534919873.00000000071A1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/the-most-stunning-space-images-captured-in-2023-so-far/ar-
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/russian-official-proposes-invading-five-nato-countries/ar-AA1hJ
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/the-nobel-peace-prize-will-be-announced-in-oslo-the-laureate-is
Source: explorer.exe, 0000000E.00000002.2534919873.0000000007160000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 0000003A.00000002.2295034169.00007FFF26088000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.thawte.com/cps0
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.thawte.com/cps0)
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.thawte.com/cps02
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.thawte.com/cps07
Source: explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.theatlantic.com/politics/archive/2014/02/the-origin-of-liberalism/283780/
Source: ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.todesk.com
Source: ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.todesk.com/download.htmlToDesk
Source: ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.todesk.com/download.htmlopen
Source: ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.todesk.com/licence.htmleditLicenselicence_
Source: ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.todesk.com/licence.htmlopen

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443

Source: explorer.exe, 00000013.00000002.2496852197.0000000000880000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

Source: C:\Windows\explorer.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp

Binary or memory string: GetRawInputData

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\cameramic\todeskaudio.cat	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\tdgamepad\tdgamepad.cat	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\vhid\todeskvhid.cat	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\tdscreen\tdidd.cat	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000E.00000003.2019014454.000000000C199000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000D.00000002.1586294361.000001EADCDE4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000013.00000002.2460978525.0000000000420000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000D.00000002.1587648854.000001EADE820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Detected VMProtect packer

Source: Microsoft_Xtools.exe.12.dr

Static PE information: .vmp0 and .vmp1 section names

Drops password protected ZIP file

Source: a11.zip.12.dr	Zip Entry: encrypted
Source: a11.zip.12.dr	Zip Entry: encrypted
Source: a11.zip.12.dr	Zip Entry: encrypted
Source: a11.zip.12.dr	Zip Entry: encrypted
Source: a11.zip.12.dr	Zip Entry: encrypted
Source: a11.zip.12.dr	Zip Entry: encrypted
Source: a11.zip.12.dr	Zip Entry: encrypted

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe

File created: C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys

Jump to behavior

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4cdca2.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE780.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7DE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{D35AFE46-73B4-4441-81DF-EDEE2029BCB9}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE927.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A7.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIE780.tmp

Jump to behavior

Source: zrtc.dll.18.dr

Static PE information: Number of sections : 18 > 10

Source: T0pdaslk-guangwang-winelkxcac-64.msi	Binary or memory string: OriginalFilenamestdDllWrapper.dllF vs T0pdaslk-guangwang-winelkxcac-64.msi
Source: T0pdaslk-guangwang-winelkxcac-64.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs T0pdaslk-guangwang-winelkxcac-64.msi

Source: 0000000E.00000003.2019014454.000000000C199000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000D.00000002.1586294361.000001EADCDE4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000013.00000002.2460978525.0000000000420000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000D.00000002.1587648854.000001EADE820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: BgWorker.dll.18.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: nsNiuniuSkin.dll.18.dr

Static PE information: Section: UPX1 ZLIB complexity 0.9916166417738971

Source: T0pdaslk-guangwang-winelkxcac-64.msi

Binary or memory string: h.slnu

Source: classification engine

Classification label: mal100.troj.evad.winMSI@79/82@6/5

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\ToDesk_Setup

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3908:120:WilError_03
Source: C:\Program Files\ToDesk\ToDesk.exe	Mutant created: \BaseNamedObjects\ToDesk_Service_9BEF579D5A8F
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_03
Source: C:\Program Files\ToDesk\ToDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4856:120:WilError_03
Source: C:\Program Files\ToDesk\ToDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\ToDesk_Client_9BEF579D5A8F
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:736:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSIA621.tmp

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS

Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS AdInfoMsg(autoid INTEGER PRIMARY KEY AUTOINCREMENT,adid INTEGER NOT NULL,platform CHAR(256),position CHAR(256),imgurl CHAR(256),refurl CHAR(256),title CHAR(256),tip CHAR(256),begin CHAR(256),end CHAR(256),tipPriority INTEGER NOT NULL,start_timestamp INTEGER NOT NULL,expire_timestamp INTEGER NOT NULL,read INTEGER NOT NULL,push_timestamp INTEGER NOT NULL,adinfoid CHAR(256),userid CHAR(256) );
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: INSERT INTO AdInfoMsg VALUES(NULL, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, %d, %d, %d, '%s','%s');
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp, ToDesk.exe.18.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS SysMsg(autoid INTEGER PRIMARY KEY AUTOINCREMENT,msgid INTEGER NOT NULL,type INTEGER NOT NULL,push_timestamp INTEGER NOT NULL,title CHAR(256),content CHAR(256),refurl CHAR(512),read INTEGER NOT NULL,userid CHAR(256) );
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: INSERT INTO SysMsg VALUES(NULL, %d, %d, %d, '%s', '%s', '%s', %d, '%s');
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp, ToDesk.exe.18.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: INSERT INTO AdInfoMsg VALUES(NULL, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, %d, %d, %d,'%s','%s');
Source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp, ToDesk.exe.18.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\T0pdaslk-guangwang-winelkxcac-64.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 897DC43AA7908FBDF146DB4280A4B33E C
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1D978FC4728A444D05DF5DFC6F0CB94A
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding A42AD45622494486CAE464114BFDCC7F
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe "C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\\Microsoft_Xtools.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe "C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe "C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\windows\explorer.exe
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc stop ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc delete ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc stop ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc delete ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk_Service"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk_Session"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk" dir=in program="C:\Program Files\ToDesk\ToDesk.exe" edge=yes action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk" dir=out program="C:\Program Files\ToDesk\ToDesk.exe" action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Service" dir=in program="C:\Program Files\ToDesk\ToDesk_Service.exe" edge=yes action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Service" dir=out program="C:\Program Files\ToDesk\ToDesk_Service.exe" action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Session" dir=in program="C:\Program Files\ToDesk\ToDesk_Session.exe" edge=yes action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Session" dir=out program="C:\Program Files\ToDesk\ToDesk_Session.exe" action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Program Files\ToDesk\ToDesk.exe "C:\Program Files\ToDesk\ToDesk.exe"
Source: unknown	Process created: C:\Program Files\ToDesk\ToDesk.exe "C:\Program Files\ToDesk\ToDesk.exe" --runservice
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\ToDesk\ToDesk.exe	Process created: C:\Program Files\ToDesk\ToDesk.exe "C:\Program Files\ToDesk\ToDesk.exe" --hide --localPort=35600
Source: C:\Windows\explorer.exe	Process created: C:\Program Files\ToDesk\ToDesk.exe "C:\Program Files\ToDesk\ToDesk.exe"
Source: C:\Program Files\ToDesk\ToDesk.exe	Process created: C:\Program Files\ToDesk\ToDesk.exe "C:\Program Files\ToDesk\ToDesk.exe" --runadmin=true
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 897DC43AA7908FBDF146DB4280A4B33E C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1D978FC4728A444D05DF5DFC6F0CB94A
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding A42AD45622494486CAE464114BFDCC7F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe "C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\\Microsoft_Xtools.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe "C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Program Files\ToDesk\ToDesk.exe "C:\Program Files\ToDesk\ToDesk.exe"
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc stop ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc delete ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc stop ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc delete ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk"
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk_Service"
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk_Session"
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk" dir=in program="C:\Program Files\ToDesk\ToDesk.exe" edge=yes action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk" dir=out program="C:\Program Files\ToDesk\ToDesk.exe" action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Service" dir=in program="C:\Program Files\ToDesk\ToDesk_Service.exe" edge=yes action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Service" dir=out program="C:\Program Files\ToDesk\ToDesk_Service.exe" action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Session" dir=in program="C:\Program Files\ToDesk\ToDesk_Session.exe" edge=yes action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Session" dir=out program="C:\Program Files\ToDesk\ToDesk_Session.exe" action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Program Files\ToDesk\ToDesk.exe "C:\Program Files\ToDesk\ToDesk.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete ToDesk_Service
Source: C:\Program Files\ToDesk\ToDesk.exe	Process created: C:\Program Files\ToDesk\ToDesk.exe "C:\Program Files\ToDesk\ToDesk.exe" --hide --localPort=35600

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: riched20.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: usp10.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: unityplayer.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: feclient.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: iertutil.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: wininet.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: mscoree.dll
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: iconcodecservice.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: riched20.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: usp10.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: msls31.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: windows.globalization.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: bcp47mrm.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: globinputhost.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: linkinfo.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: ntshrui.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: cscapi.dll
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: mscoree.dll
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll
Source: C:\Windows\explorer.exe	Section loaded: dinput8.dll
Source: C:\Windows\explorer.exe	Section loaded: inputhost.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\explorer.exe	Section loaded: devenum.dll
Source: C:\Windows\explorer.exe	Section loaded: devobj.dll
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll
Source: C:\Windows\explorer.exe	Section loaded: msdmo.dll
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Source: ToDesk.lnk.18.dr	LNK file: ..\..\..\Program Files\ToDesk\ToDesk.exe
Source: ToDesk.lnk0.18.dr	LNK file: ..\..\..\..\..\..\Program Files\ToDesk\ToDesk.exe
Source: Uninstall ToDesk.lnk.18.dr	LNK file: ..\..\..\..\..\..\Program Files\ToDesk\uninst.exe

Source: C:\Program Files\ToDesk\ToDesk.exe

File written: C:\Program Files\ToDesk\config.ini

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\CrashReport.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\ToDesk.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\uninst.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\zrtc.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\devcon.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\todeskaudio.cat	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.inf	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x64.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad\tdgamepad.cat	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad\TdGamePad.inf	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen\tdidd.cat	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.inf	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid\devcon.exe	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid\todeskvhid.cat	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.dll	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Directory created: C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.inf	Jump to behavior
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\config.ini
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\Logs
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\Logs\servicexejnqytw_2025_02_21.log
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\Logs\sdkservicepulmxguu_2025_02_21.log
Source: C:\Program Files\ToDesk\ToDesk.exe	Directory created: C:\Program Files\ToDesk\Logs\zrtcserviceewwszqlz_2025_02_21.log

Source: T0pdaslk-guangwang-winelkxcac-64.msi

Static file information: File size 95763456 > 1048576

Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Microsoft_Xtools.exe, 0000000D.00000002.1603179504.00007FFF46F85000.00000002.00000001.01000000.0000000A.sdmp, vcruntime140_1.dll.12.dr
Source:	Binary string: D:\jenkins\workspace\todesk-toc-win\bin\x64\Release\todesk\ToDesk.pdb source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\gitlab\vhid\driver\umdf2\x64\Release\TodeskVhid.pdb source: ToDesk_Setup.exe, 00000012.00000002.1874957635.000000000041E000.00000004.00000001.01000000.0000000C.sdmp, ToDesk_Setup.exe, 00000012.00000002.1874957635.000000000040A000.00000004.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\stdDllWrapper.pdb source: T0pdaslk-guangwang-winelkxcac-64.msi, 4cdca3.rbs.2.dr, MSIE927.tmp.2.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: Microsoft_Xtools.exe, 0000000D.00000002.1602453751.00007FFF415B2000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: zrtc.dll.pdb source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26671000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: E:\NiuniuCapture\niuniu_src\nsNiuniuSkin\plugin\nsNiuniuDUI.pdb source: ToDesk_Setup.exe, 00000012.00000002.1883171743.000000006D111000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Microsoft_Xtools.exe, 0000000D.00000002.1603452415.00007FFF46FA3000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Microsoft_Xtools.exe, 0000000D.00000002.1603452415.00007FFF46FA3000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: virtual_camera_x86.dll.pdb source: virtual_camera_x86.dll.18.dr
Source:	Binary string: D:\jenkins\workspace\todesk-toc-win\bin\x64\Release\todesk\ToDesk.pdb. source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy -O2 -Ob2 -MT /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -D_WIN32_WINNT=0x0501 -D_USING_V110_SDK71_crypto\ex_data.c source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: T0pdaslk-guangwang-winelkxcac-64.msi, MSIA690.tmp.1.dr, MSI2A0D.tmp.1.dr, MSIA621.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Microsoft_Xtools.exe, 0000000D.00000002.1603179504.00007FFF46F85000.00000002.00000001.01000000.0000000A.sdmp, vcruntime140_1.dll.12.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy -O2 -Ob2 -MT /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -D_WIN32_WINNT=0x0501 -D_USING_V110_SDK71_ source: ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp

Source: VCRUNTIME140.dll.12.dr

Static PE information: 0xE2E02087 [Sun Aug 13 20:26:47 2090 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: MSVCP140.dll.12.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.12.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.12.dr	Static PE information: section name: _RDATA
Source: Microsoft_Xtools.exe.12.dr	Static PE information: section name: _RDATA
Source: Microsoft_Xtools.exe.12.dr	Static PE information: section name: .vmp0
Source: Microsoft_Xtools.exe.12.dr	Static PE information: section name: .vmp1
Source: SimpleSC.dll.18.dr	Static PE information: section name: .didata
Source: ToDesk.exe.18.dr	Static PE information: section name: .rodata
Source: ToDesk.exe.18.dr	Static PE information: section name: _RDATA
Source: zrtc.dll.18.dr	Static PE information: section name: .00cfg
Source: zrtc.dll.18.dr	Static PE information: section name: .nvFatBi
Source: zrtc.dll.18.dr	Static PE information: section name: .nv_fatb
Source: zrtc.dll.18.dr	Static PE information: section name: .retplne
Source: zrtc.dll.18.dr	Static PE information: section name: .rodata
Source: zrtc.dll.18.dr	Static PE information: section name: .voltbl
Source: zrtc.dll.18.dr	Static PE information: section name: .xdata
Source: zrtc.dll.18.dr	Static PE information: section name: IPPCODE
Source: zrtc.dll.18.dr	Static PE information: section name: IPPDATA
Source: zrtc.dll.18.dr	Static PE information: section name: _RDATA
Source: virtual_camera_x64.dll.18.dr	Static PE information: section name: _RDATA
Source: tdIdd.dll.18.dr	Static PE information: section name: _RDATA
Source: TodeskVhid.dll.18.dr	Static PE information: section name: _RDATA

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys	Jump to behavior
Source: C:\Windows\explorer.exe	File created: C:\ProgramData\kernelquick.sys

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA690.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\vhid\devcon.exe	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA6B0.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\System.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsNiuniuSkin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\pwand.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A7.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsSCM.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\cameramic\devcon.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\MSVCP140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI2A0D.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\killer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7DE.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\zrtc.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\BgWorker.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\vcruntime140_1.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\ToDesk.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE780.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA7BC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\uninst.exe	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsExec.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA621.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA78D.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x64.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\CrashReport.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIA6C0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\UnityPlayer.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\pwand.dll

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE780.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7DE.tmp	Jump to dropped file

Source: C:\Program Files\ToDesk\ToDesk.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ToDesk_Service

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ToDesk	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ToDesk\ToDesk.lnk	Jump to behavior
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ToDesk\Uninstall ToDesk.lnk	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop ToDesk_Service

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Memory written: PID: 5868 base: 7FFF4F43000D value: E9 BB CB EC FF
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Memory written: PID: 5868 base: 7FFF4F2FCBC0 value: E9 5A 34 13 00

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\AiServer MyData

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ToDesk\ToDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ToDesk\ToDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ToDesk\ToDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ToDesk\ToDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ToDesk\ToDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ToDesk\ToDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ToDesk\ToDesk.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe

Section loaded: OutputDebugStringW count: 539

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	RDTSC instruction interceptor: First address: 7FF6DA465B86 second address: 7FF6DA422929 instructions: 0x00000000 rdtsc 0x00000002 mov al, dh 0x00000004 jmp 00007F8238BB741Ah 0x00000009 inc ecx 0x0000000a rol eax, 1 0x0000000c dec eax 0x0000000d bswap ebx 0x0000000f dec ebp 0x00000011 inc cx 0x00000013 movsx esi, al 0x00000016 inc ecx 0x00000017 dec eax 0x00000019 dec ebp 0x0000001a add eax, ebx 0x0000001c inc ecx 0x0000001d shl dl, FFFFFFA7h 0x00000020 ror bh, FFFFFF93h 0x00000023 dec eax 0x00000024 mov esi, 00000000h 0x00000029 add dword ptr [eax], eax 0x0000002b add byte ptr [eax], al 0x0000002d inc ecx 0x0000002e rcl dl, cl 0x00000030 dec esp 0x00000031 add eax, esi 0x00000033 mov al, al 0x00000035 dec esp 0x00000036 mov edx, esp 0x00000038 inc eax 0x00000039 or ch, dh 0x0000003b dec eax 0x0000003c sub esp, 00000180h 0x00000042 dec eax 0x00000043 and esp, FFFFFFF0h 0x00000049 adc ebx, esp 0x0000004b dec ecx 0x0000004c mov ebx, eax 0x0000004e rdtsc
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	RDTSC instruction interceptor: First address: 7FF6DA14AEA8 second address: 7FF6DA04EDC6 instructions: 0x00000000 rdtsc 0x00000002 mov al, dh 0x00000004 jmp 00007F8238A138D5h 0x00000009 inc ecx 0x0000000a rol eax, 1 0x0000000c dec eax 0x0000000d bswap ebx 0x0000000f dec ebp 0x00000011 inc cx 0x00000013 movsx esi, al 0x00000016 inc ecx 0x00000017 dec eax 0x00000019 dec ebp 0x0000001a add eax, ebx 0x0000001c inc ecx 0x0000001d shl dl, FFFFFFA7h 0x00000020 ror bh, FFFFFF93h 0x00000023 dec eax 0x00000024 mov esi, 00000000h 0x00000029 add dword ptr [eax], eax 0x0000002b add byte ptr [eax], al 0x0000002d inc ecx 0x0000002e rcl dl, cl 0x00000030 dec esp 0x00000031 add eax, esi 0x00000033 mov al, al 0x00000035 dec esp 0x00000036 mov edx, esp 0x00000038 inc eax 0x00000039 or ch, dh 0x0000003b dec eax 0x0000003c sub esp, 00000180h 0x00000042 dec eax 0x00000043 and esp, FFFFFFF0h 0x00000049 adc ebx, esp 0x0000004b dec ecx 0x0000004c mov ebx, eax 0x0000004e rdtsc

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe

Special instruction interceptor: First address: 7FF6DA408F85 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3185
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 5923
Source: C:\Program Files\ToDesk\ToDesk.exe	Window / User API: threadDelayed 4079

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA690.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\vhid\devcon.exe	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA6B0.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\System.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsNiuniuSkin.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\ProgramData\pwand.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\cameramic\devcon.exe	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsSCM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8A7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2A0D.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\killer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE7DE.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\BgWorker.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE780.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\uninst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA7BC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsExec.dll	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA621.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA78D.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\CrashReport.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIA6C0.tmp	Jump to dropped file
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Dropped PE file which has not been started: C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 6944	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2732	Thread sleep time: -91000s >= -30000s
Source: C:\Windows\explorer.exe TID: 1436	Thread sleep time: -31850s >= -30000s
Source: C:\Windows\explorer.exe TID: 2732	Thread sleep time: -5923000s >= -30000s
Source: C:\Program Files\ToDesk\ToDesk.exe TID: 6848	Thread sleep count: 4079 > 30
Source: C:\Program Files\ToDesk\ToDesk.exe TID: 4792	Thread sleep count: 39 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Program Files\ToDesk\ToDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files\ToDesk\ToDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files\ToDesk\ToDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files\ToDesk\ToDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files\ToDesk\ToDesk.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files\ToDesk\ToDesk.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp FullSizeInformation

Source: ToDesk.exe, 00000034.00000003.1924604887.00000257D0718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Vol
Source: ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F14A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: WebRTC-AllowMACBasedIPv6Network change was observedVMnetStartUpdatingSocket creation failedConnect failed with UpdateNetworksContinuallyNetworkManager detected networks:, active ? , IgnoredWebRTC-UseDifferentiatedCellularCostsNet[:id=Enabled
Source: svchost.exe, 00000007.00000002.2480951619.000002C780475000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@
Source: explorer.exe, 0000000E.00000003.1998697487.0000000008A54000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00lT8
Source: ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F14A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductM5HXHL0CC82742-52E4-CC1D-A08F-D3A4823E8F04VMware, Inc.None
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26383000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: explorer.exe, 0000000E.00000002.2466701365.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000000.00000002.2513968592.000001EB6625E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.2510633848.000001EB6623F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.2486931921.000001EB60C2B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2586897655.00000000088B3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1556114866.0000000008888000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1556114866.00000000088D7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000E.00000002.2466701365.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000q;
Source: ToDesk.exe, 00000034.00000003.1924604887.00000257D0718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vHyper-V Da
Source: svchost.exe, 00000007.00000002.2480951619.000002C780465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000es
Source: svchost.exe, 00000007.00000002.2483350035.000002C78047F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000003.1998697487.00000000089EA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}9d2}i
Source: ToDesk.exe, 00000033.00000003.1897883540.00000208CF7C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: netsh.exe, 00000020.00000003.1681229554.0000000000D92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: netsh.exe, 00000023.00000002.1696316811.0000000003700000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000025.00000002.1708914818.00000000035A0000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000027.00000003.1715065076.0000000000531000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000029.00000003.1721617491.0000000000F61000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000002B.00000003.1726818803.0000000000791000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000002B.00000003.1727351278.0000000000794000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000002D.00000002.1732550742.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000002D.00000003.1731252427.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000002F.00000003.1735793969.0000000000E42000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000031.00000003.1741482839.00000000011F1000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000031.00000002.1742670402.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 0000000E.00000000.1556114866.00000000088D7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000013.00000002.2466736069.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99
Source: ToDesk.exe, 00000034.00000002.2488420310.00000257CD331000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlluu
Source: ToDesk.exe, 00000037.00000003.1888490296.000001B611AF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: explorer.exe, 0000000E.00000002.2586897655.00000000089F4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000T
Source: explorer.exe, 0000000E.00000000.1547538044.00000000071FF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}W6
Source: svchost.exe, 00000007.00000002.2476731968.000002C78044C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000000.1556114866.00000000088D7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF260F8000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: VMnet
Source: explorer.exe, 0000000E.00000000.1556114866.0000000008888000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000nf
Source: ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F14A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductM5HXHL0CC82742-52E4-CC1D-A08F-D3A4823E8F04VMware, Inc.Noney*
Source: svchost.exe, 00000007.00000002.2474455248.000002C78042B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000000.1556114866.0000000008770000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWUSm32\DriverStore\en-US\usb.inf_locK
Source: ToDesk.exe, 00000034.00000003.1924604887.00000257D0718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hear
Source: explorer.exe, 0000000E.00000000.1556114866.0000000008888000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: svchost.exe, 00000007.00000002.2468413723.000002C78040B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: ToDesk.exe, 00000034.00000003.1924604887.00000257D0718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Gues
Source: ToDesk.exe, 00000033.00000002.1904483843.00000208CF88C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2742-52E4-CC1D-A08F-D3A4823E8F04VMware, Inc.
Source: svchost.exe, 00000007.00000002.2476731968.000002C78044C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000002.2466701365.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000E.00000003.1998697487.00000000089EA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: ToDesk.exe, 00000037.00000002.2294923227.00007FFF26383000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe

System information queried: ModuleInformation

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe

Thread information set: HideFromDebugger

Tries to detect debuggers (CloseHandle check)

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe

Handle closed: DEADC0DE

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Process queried: DebugPort
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Process queried: DebugObjectHandle

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process token adjusted: Debug
Source: C:\Program Files\ToDesk\ToDesk.exe	Process token adjusted: Debug
Source: C:\Program Files\ToDesk\ToDesk.exe	Process token adjusted: Debug
Source: C:\Program Files\ToDesk\ToDesk.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 47.238.100.22 4433

Allocates memory in foreign processes

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Memory allocated: C:\Windows\explorer.exe base: 2CF0000 protect: page execute and read and write
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Memory allocated: C:\Windows\explorer.exe base: 8050000 protect: page read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	NtMapViewOfSection: Indirect: 0x1EADE87D696
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	NtMapViewOfSection: Indirect: 0x1EADE87DBD3

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Memory written: PID: 4380 base: 2CF0000 value: E9
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Memory written: PID: 4380 base: 8050000 value: 00
Source: C:\Windows\explorer.exe	Memory written: PID: 5792 base: 420000 value: E8

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\explorer.exe

Thread register set: target process: 5792

Performs DNS TXT record lookups

Source: Traffic	DNS traffic detected: queries for: authds.kylinlot.com
Source: Traffic	DNS traffic detected: queries for: authds.kylinlot.com
Source: Traffic	DNS traffic detected: queries for: authds.kylinlot.com
Source: Traffic	DNS traffic detected: queries for: authds.kylinlot.com

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\explorer.exe

Thread register set: 5792 C1A6E00

Writes to foreign memory regions

Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Memory written: C:\Windows\explorer.exe base: 2CF0000
Source: C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	Memory written: C:\Windows\explorer.exe base: 8050000

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc stop ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc delete ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc stop ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c sc delete ToDesk_Service
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk"
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk_Service"
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk_Session"
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk" dir=in program="C:\Program Files\ToDesk\ToDesk.exe" edge=yes action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk" dir=out program="C:\Program Files\ToDesk\ToDesk.exe" action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Service" dir=in program="C:\Program Files\ToDesk\ToDesk_Service.exe" edge=yes action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Service" dir=out program="C:\Program Files\ToDesk\ToDesk_Service.exe" action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Session" dir=in program="C:\Program Files\ToDesk\ToDesk_Session.exe" edge=yes action=allow
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="ToDesk_Session" dir=out program="C:\Program Files\ToDesk\ToDesk_Session.exe" action=allow
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop ToDesk_Service
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete ToDesk_Service

Source: explorer.exe, 0000000E.00000000.1556114866.00000000089C9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2534062078.0000000004550000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.1998697487.0000000008A15000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000E.00000002.2507661761.0000000001114000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1545792498.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000E.00000002.2466701365.0000000000AFA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1545476893.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Progman
Source: explorer.exe, 0000000E.00000002.2507661761.0000000001114000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1545792498.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: bProgram Manager]
Source: explorer.exe, 0000000E.00000002.2507661761.0000000001114000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1545792498.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: ToDesk.exe, 00000038.00000002.2295229401.00007FFF26301000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: ../../third_party/webrtc/modules/desktop_capture/win/window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_ProgmanButton

Source: C:\Program Files\ToDesk\ToDesk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\ToDesk\ToDesk.exe	Queries volume information: C:\Program Files\ToDesk\Logs\servicexejnqytw_2025_02_21.log VolumeInformation
Source: C:\Program Files\ToDesk\ToDesk.exe	Queries volume information: C:\Program Files\ToDesk\Logs\servicexejnqytw_2025_02_21.log VolumeInformation
Source: C:\Program Files\ToDesk\ToDesk.exe	Queries volume information: C:\Program Files\ToDesk\Logs\sdkservicepulmxguu_2025_02_21.log VolumeInformation
Source: C:\Program Files\ToDesk\ToDesk.exe	Queries volume information: C:\Program Files\ToDesk\Logs\sdkservicepulmxguu_2025_02_21.log VolumeInformation
Source: C:\Program Files\ToDesk\ToDesk.exe	Queries volume information: C:\Program Files\ToDesk\Logs\servicexejnqytw_2025_02_21.log VolumeInformation
Source: C:\Program Files\ToDesk\ToDesk.exe	Queries volume information: C:\Program Files\ToDesk\Logs\zrtcserviceewwszqlz_2025_02_21.log VolumeInformation
Source: C:\Program Files\ToDesk\ToDesk.exe	Queries volume information: C:\Program Files\ToDesk\Logs\sdkservicepulmxguu_2025_02_21.log VolumeInformation
Source: C:\Program Files\ToDesk\ToDesk.exe	Queries volume information: C:\Program Files\ToDesk\Logs\servicexejnqytw_2025_02_21.log VolumeInformation

Source: C:\Program Files\ToDesk\ToDesk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall delete rule name="ToDesk"

Source: svchost.exe, 00000008.00000002.2486089087.0000025ACAB02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000008.00000002.2486089087.0000025ACAB02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: 00000013.00000002.2496852197.0000000000880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5792, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: 00000013.00000002.2496852197.0000000000880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 5792, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	3 Disable or Modify Tools	1 Credential API Hooking	11 Peripheral Device Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	21 Windows Service	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	31 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	21 Windows Service	1 Obfuscated Files or Information	Security Account Manager	244 System Information Discovery	SMB/Windows Admin Shares	31 Input Capture	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	612 Process Injection	21 Software Packing	NTDS	461 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	25 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	23 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	25 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	612 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
T0pdaslk-guangwang-winelkxcac-64.msi	2%	Virustotal		Browse
T0pdaslk-guangwang-winelkxcac-64.msi	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe	0%	ReversingLabs
C:\Program Files\ToDesk\CrashReport.exe	2%	ReversingLabs
C:\Program Files\ToDesk\ToDesk.exe	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\cameramic\devcon.exe	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x64.dll	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.dll	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.dll	0%	ReversingLabs
C:\Program Files\ToDesk\drivers\vhid\devcon.exe	0%	ReversingLabs
C:\Program Files\ToDesk\uninst.exe	0%	ReversingLabs
C:\Program Files\ToDesk\zrtc.dll	0%	ReversingLabs
C:\ProgramData\pwand.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI2A0D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA621.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA690.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA6B0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA6C0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA78D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIA7BC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\BgWorker.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\SimpleSC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\killer.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsNiuniuSkin.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsSCM.dll	0%	ReversingLabs
C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\MSVCP140.dll	0%	ReversingLabs
C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe	3%	ReversingLabs
C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\vcruntime140_1.dll	0%	ReversingLabs
C:\Windows\Installer\MSI8A7.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE780.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE7DE.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://daas-personal.todesk.com/downloadm	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/downloadj	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/downloadf	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/downloadROCESSOR_IDENT3	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/downloadPATHEX	0%	Avira URL Cloud	safe
http://faac.sourceforge.net/)	0%	Avira URL Cloud	safe
https://daas.todesk.com/consoleali	0%	Avira URL Cloud	safe
https://user.todesk.com/upload.php?token=Jh	0%	Avira URL Cloud	safe
https://www.todesk.com/download.htmlToDesk	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/downloadV	0%	Avira URL Cloud	safe
https://daas.todesk.com/console	0%	Avira URL Cloud	safe
https://uc.todesk.com/ol	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/download~	0%	Avira URL Cloud	safe
https://www.todesk.com/licence.htmlopen	0%	Avira URL Cloud	safe
https://user.todesk.com/upload.php?token=ePath=C:	0%	Avira URL Cloud	safe
https://uc.todesk.com/on	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/download	0%	Avira URL Cloud	safe
https://uc.todesk.com/orderManage/buyOrder?spuId=2&orderType=0	0%	Avira URL Cloud	safe
http:///dump.php?dumpserver.compresstypelognamedatetimedate	0%	Avira URL Cloud	safe
https://dl.todesk.com/windowsDownloadAppFilekernel32::IsWow64Process2(ps	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/downloadProgramA	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ-dark	0%	Avira URL Cloud	safe
https://user.todesk.com/upload.php?token=ESSOR_I	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/downloadngComm	0%	Avira URL Cloud	safe
https://daas.todesk.com/console;C:	0%	Avira URL Cloud	safe
https://uc.todesk.com/esponseo	0%	Avira URL Cloud	safe
https://wechat.todesk.comtionny	0%	Avira URL Cloud	safe
https://uc.todesk.com/y	0%	Avira URL Cloud	safe
https://wechat.todesk.comaxQ	0%	Avira URL Cloud	safe
https://www.todesk.com/download.htmlopen	0%	Avira URL Cloud	safe
https://user.todesk.com/upload.php?token=USERNAs	0%	Avira URL Cloud	safe
https://user.todesk.com/upload.php?token=lesCOMPUTERNAW	0%	Avira URL Cloud	safe
https://uc.todesk.com/f	0%	Avira URL Cloud	safe
https://daas-personal.todesk.com/downloadwsTEMP	0%	Avira URL Cloud	safe
https://crbug.com/1053756ICE	0%	Avira URL Cloud	safe
http://dumpserver.todesk.com/dump.phpSymInitialize	0%	Avira URL Cloud	safe
https://uc.todesk.com/1y	0%	Avira URL Cloud	safe
https://uc.todesk.com/d	0%	Avira URL Cloud	safe
https://wechat.todesk.comMy	0%	Avira URL Cloud	safe
https://uc.todesk.com/j	0%	Avira URL Cloud	safe
https://outlook.comsoft.A	0%	Avira URL Cloud	safe
https://uc.todesk.com/l	0%	Avira URL Cloud	safe
https://uc.todesk.com/o	0%	Avira URL Cloud	safe
https://uc.todesk.com/u	0%	Avira URL Cloud	safe
https://uc.todesk.com/p	0%	Avira URL Cloud	safe
https://uc.todesk.com/t	0%	Avira URL Cloud	safe
https://user.todesk.com/upload.php?token=FILE=user-PCUWv	0%	Avira URL Cloud	safe
https://uc.todesk.com/A	0%	Avira URL Cloud	safe
https://wechat.todesk.comnseLI-P	0%	Avira URL Cloud	safe
https://uc.todesk.com/Qy	0%	Avira URL Cloud	safe
https://uc.todesk.com/E	0%	Avira URL Cloud	safe
https://android.notify.windows.com/iOS0	0%	Avira URL Cloud	safe
https://user.todesk.com/upload.php?token=fh	0%	Avira URL Cloud	safe
https://uc.todesk.com/H	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
authds.todesk.com	43.135.63.118	true	false	high
g8e1l8qd.ovslegodl.sched.ovscdns.com	43.175.152.66	true	false	unknown
todeskcdnspeed.todesk.com	unknown	unknown	false	high
authds.kylinlot.com	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://daas-personal.todesk.com/downloadm	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://faac.sourceforge.net/)	ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB2FB000.00000002.00000001.01000000.00000017.sdmp	false	Avira URL Cloud: safe	unknown
https://daas-personal.todesk.com/downloadj	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://daas-personal.todesk.com/downloadf	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user.todesk.com/upload.php?token=Jh	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://todeskcdnspeed.todesk.com/Windows	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 0000000E.00000002.2534919873.0000000007160000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2520908782.0000000002F85000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1546224158.0000000002F60000.00000004.00000001.00020000.00000000.sdmp	false		high
https://daas-personal.todesk.com/downloadPATHEX	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	explorer.exe, 0000000E.00000000.1556114866.0000000008888000.00000004.00000001.00020000.00000000.sdmp	false		high
https://daas-personal.todesk.com/downloadV	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.todesk.com/download.htmlToDesk	ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://streams.videolan.org/upload/	ToDesk.exe, 00000037.00000002.2294923227.00007FFF26374000.00000002.00000001.01000000.00000018.sdmp	false		high
https://daas-personal.todesk.com/downloadROCESSOR_IDENT3	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://daas.todesk.com/consoleali	ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://daas.todesk.com/console	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDEC3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2238552863.00000271BDE77000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2243465242.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0A3000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0C4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2219526305.000001ED0F0CB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://daas-personal.todesk.com/download~	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theatlantic.com/politics/archive/2014/02/the-origin-of-liberalism/283780/	explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppche_16.dbK	explorer.exe, 0000000E.00000000.1556114866.0000000008888000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/george-santos-former-campaign-treasurer-pleads-guilty-to-fed	explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000003.1366314189.000001CA68262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1369064034.000001CA68265000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366875764.000001CA6825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	false		high
https://user.todesk.com/upload.php?token=ePath=C:	ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.todesk.com/licence.htmlopen	ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/ol	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/on	ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/there-are-8-types-of-intelligence-which-one-is-yo	explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000000.00000002.2507661800.000001EB66200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	false		high
https://daas-personal.todesk.com/download	ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDED4000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2208474981.00000271BDEEC000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDECD000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2238552863.00000271BDE77000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000002.2242807873.000001ED0F0AB000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2206614243.000001ED0F0D0000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0B6000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2228056997.000001ED0F0AA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2214293420.000001ED0F0A2000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0A9000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 0000003A.00000003.2220802918.000001ED0F0B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.godaddy.com/gdroot-g2.crl0F	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	false		high
http://www.symauth.com/rpa0)	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	false		high
https://dynamic.t	svchost.exe, 00000005.00000003.1367150084.000001CA68230000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000000.00000003.1203206451.000001EB661A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc.todesk.com/orderManage/buyOrder?spuId=2&orderType=0	ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	false		high
http://todeskcdnspeed.todesk.com/&oq	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000002.2243439389.00000271BDED4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=BD3E37D8C4964A928E655AAA177D65C1&timeOut=5000&oc	explorer.exe, 0000000E.00000002.2534919873.0000000007160000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dl.todesk.com/windowsDownloadAppFilekernel32::IsWow64Process2(ps	ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aia.startssl.com/certs/ca.crt02	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	false		high
http:///dump.php?dumpserver.compresstypelognamedatetimedate	ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	false	Avira URL Cloud: safe	unknown
https://daas-personal.todesk.com/downloadProgramA	ToDesk.exe, 00000037.00000003.1888162264.000001B611B1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13g0vJ-dark	explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user.todesk.com/upload.php?token=ESSOR_I	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://daas.todesk.com/console;C:	ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wechat.todesk.comtionny	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	ToDesk.exe, 00000038.00000002.2295229401.00007FFF26301000.00000002.00000001.01000000.00000018.sdmp	false		high
https://certs.starfieldtech.com/repository/0	ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	false		high
https://daas-personal.todesk.com/downloadngComm	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000005.00000003.1366669919.000001CA68258000.00000004.00000020.00020000.00000000.sdmp	false		high
http://todeskcdnspeed.todesk.com/https://uc.todesk.com/https://user.todesk.com/upload.php?token=tode	ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	false		high
http://todeskcdnspeed.todesk.com/les;C:	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false		high
https://crbug.com/1053756	ToDesk.exe, 00000038.00000002.2295229401.00007FFF261FA000.00000002.00000001.01000000.00000018.sdmp	false		high
http://aia1.wosign.com/ca1-class3-server.cer0	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	false		high
https://uc.todesk.com/esponseo	ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wechat.todesk.comaxQ	ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 0000000E.00000000.1545905770.00000000025F0000.00000002.00000001.00040000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 0000000E.00000000.1547538044.0000000007147000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.todesk.com/download.htmlopen	ToDesk_Setup.exe, 00000012.00000002.1875989381.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://todeskcdnspeed.todesk.com/ily	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com0.	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	false		high
https://uc.todesk.com/y	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://todeskcdnspeed.todesk.com/AT;.CMD;.VBS;.VBE;.JS;7	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false		high
https://user.todesk.com/upload.php?token=USERNAs	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/g2ca.crl0;	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp	false		high
http://todeskcdnspeed.todesk.com/ineIntelPR	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	ToDesk.exe, 00000033.00000002.2294923949.00007FFF2609D000.00000002.00000001.01000000.00000018.sdmp	false		high
https://user.todesk.com/upload.php?token=lesCOMPUTERNAW	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.jpg	ToDesk.exe, 00000038.00000002.2295229401.00007FFF26301000.00000002.00000001.01000000.00000018.sdmp	false		high
https://crbug.com/1053756ICE	ToDesk.exe, 00000038.00000002.2295229401.00007FFF261FA000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://daas-personal.todesk.com/downloadwsTEMP	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dumpserver.todesk.com/dump.phpSymInitialize	ToDesk.exe, 00000033.00000000.1798291079.00007FF6FB49B000.00000002.00000001.01000000.00000017.sdmp	false	Avira URL Cloud: safe	unknown
http://todeskcdnspeed.todesk.com/SCPROCESSO	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000005.00000003.1366238872.000001CA6826E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uc.todesk.com/f	ToDesk.exe, 00000034.00000002.2488420310.00000257CD379000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/1y	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/d	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wechat.todesk.comMy	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/j	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://todeskcdnspeed.todesk.com/~h	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000005.00000003.1366314189.000001CA68262000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.comsoft.A	explorer.exe, 0000000E.00000002.2626418957.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2040398375.000000000BFDE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1564679551.000000000BF65000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/l	ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crls1.wosign.com/ca1.crl0m	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	false		high
https://uc.todesk.com/o	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/p	ToDesk.exe, 00000033.00000003.1896854871.00000208CF7DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/u	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/t	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/cps02	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000005.00000002.1368767624.000001CA6823F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://user.todesk.com/upload.php?token=FILE=user-PCUWv	ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wechat.todesk.comnseLI-P	ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/A	ToDesk.exe, 00000033.00000003.1897883540.00000208CF7D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/cps0)	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2608B000.00000002.00000001.01000000.00000018.sdmp, ToDesk.exe, 00000038.00000002.2295229401.00007FFF2609E000.00000002.00000001.01000000.00000018.sdmp	false		high
http://aia.startssl.com/certs/ca.crt0	ToDesk.exe, 00000037.00000002.2294923227.00007FFF2609F000.00000002.00000001.01000000.00000018.sdmp	false		high
https://uc.todesk.com/E	ToDesk.exe, 00000037.00000002.1889947432.000001B611B01000.00000004.00000020.00020000.00000000.sdmp, ToDesk.exe, 00000037.00000003.1888490296.000001B611B00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS0	explorer.exe, 0000000E.00000002.2626418957.000000000BF31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2008974722.000000000BF31000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1564679551.000000000BF18000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/Qy	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user.todesk.com/upload.php?token=fh	ToDesk.exe, 00000038.00000003.2219133688.00000271BDEB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uc.todesk.com/H	ToDesk.exe, 00000034.00000002.2488420310.00000257CD359000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
43.135.63.118	authds.todesk.com	Japan	4249	LILLY-ASUS	false
101.42.127.254	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
119.45.2.35	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
47.238.100.22	unknown	United States	20115	CHARTER-20115US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1621377
Start date and time:	2025-02-21 21:12:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T0pdaslk-guangwang-winelkxcac-64.msi
Detection:	MAL
Classification:	mal100.troj.evad.winMSI@79/82@6/5
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, SIHClient.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 2.19.106.160, 20.109.210.53, 13.107.246.60
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:12:51	API Interceptor	2x Sleep call for process: svchost.exe modified
15:13:39	API Interceptor	816275x Sleep call for process: explorer.exe modified
15:13:59	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
15:14:34	API Interceptor	449x Sleep call for process: ToDesk.exe modified

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	27497
Entropy (8bit):	6.650412583586428
Encrypted:	false
SSDEEP:	768:KMgUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5h:dxXVoSnrfyjf5brQ0rPxp
MD5:	B4290AAAB96155A1F7A7506045F1E0C0
SHA1:	90B894D573D9D7321785391D9EEA838F3E3A2A5D
SHA-256:	59341380C67161E8584F0DEDFD1B2AD3D66E87194FF051EEA080277E5963E729
SHA-512:	F83592764EDE533536D2EA666FEDADC56D372380CFA084677B6AFD3271F4BC1B3DA09878772E6F94692BDBA0F31037446F68B727F2AB8533AFEFF638D79E5066
Malicious:	false
Preview:	...@IXOS.@.....@.yUZ.@.....@.....@.....@.....@.....@......&.{D35AFE46-73B4-4441-81DF-EDEE2029BCB9}..ToDesk_Setup$.T0pdaslk-guangwang-winelkxcac-64.msi.@.....@.....@.....@........&.{B54FEEA7-07D2-4A02-96E4-0A412A2D9E16}.....@.....@.....@.....@.......@.....@.....@.......@......ToDesk_Setup......Rollback..ck(W.V.n.d\O:.....RollbackCleanup..ck(W Rd..Y.N.e.N...e.N:. .[.1.].....ProcessComponents..ck(W.f.e.~.N.l.Qh...&.{A879BE35-2F8E-470B-92C5-570B7EAF4274}&.{D35AFE46-73B4-4441-81DF-EDEE2029BCB9}.@......&.{668E887C-215E-477A-8E33-D58E087A0DD8}&.{D35AFE46-73B4-4441-81DF-EDEE2029BCB9}.@......&.{253CEC5A-F1B0-4339-AFCB-78E1847BFC0A}&.{D35AFE46-73B4-4441-81DF-EDEE2029BCB9}.@......&.{D31BF6B0-8ED1-4F80-BA4E-9BDE93143885}&.{D35AFE46-73B4-4441-81DF-EDEE2029BCB9}.@........CreateFolders..ck(W.R.^.e.N9Y...e.N9Y:. .[.1.].#.1.C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\.@........InstallFiles..ck(W.Y6R.e.e.N...e.N:. .[.1.]....vU_:. .[.9.]...'Y.\:. .[.6.]...1.C:\Program Files (x86)\ToDesk_Setup\ToDesk

C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	88336056
Entropy (8bit):	7.997682166365818
Encrypted:	true
SSDEEP:
MD5:	C352B397CC1BF792AE368F562AAA19BE
SHA1:	8095021984996818E89D7569CDAFA3C4AC4F706C
SHA-256:	B51BB47D3F9E58AC12D55FEE568E950AA9811E5D1655A15D8ED1AF28C3112BD4
SHA-512:	8B215FC586873293A45534246A42D20F2E3AE22C06A3E0BF0DB8FC8727BAA918BF9896C981C7136082C31D317ED8F5D58DA34BEE26CB9DAF1FEA0FE693934487
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........18..PV..PV..PV._...PV..PW.MPV._...PV.sf..PV..VP..PV.Rich.PV.........PE..L......].................h...........3............@..........................0......*.D...@.............................................8............C..3...........................................................................................text....f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata.......P...........................rsrc...8........0..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\ToDesk\CrashReport.exe

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	681360
Entropy (8bit):	7.555621871257949
Encrypted:	false
SSDEEP:	12288:xJNMif+Y8uOLz9/C29bU/sFiWZanNGbf/ZRLQ24tSv2MJ9hVu7n2qBHvi:PNMiGRuOLz98/cZan4D/ZtQ7tNg9hVuy
MD5:	B5D1070DDACB40C543E5112847C0AED2
SHA1:	5E799B02738B67F0B2768404817B67A08FF38E0B
SHA-256:	0E51C2AA36DB9C6CC674B823562C4D99912F18B6825A5C5C3629235224E8BCF6
SHA-512:	2483C8625A136397A4E58B496EF3FA634D56B80DCA52150DCFA66072AC8C3A95221F4CD578DC5DF2CD409264DE8106A99254E5143396A8F4CC40EE3D80C9011D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5.e.5.e.5.e....2.e.Z.....e.Z...(.e.Z....e.<...?.e...8.6.e.5.d..e.5.e.!.e.<.....e.....~.e.Z...7.e.....4.e.Z...4.e.Rich5.e.........................PE..L......a.............................N.......`....@..........................0.......w....@..................................'..@....`...............@...%...(.......................................P..H...........................................UPX0....................................UPX1.............r..................@....rsrc........`.......v..............@......................................................................................................................................................................................................................................................................................................................................................3.96.UPX!....

C:\Program Files\ToDesk\Logs\servicexejnqytw_2025_02_21.log

Download File

Process:	C:\Program Files\ToDesk\ToDesk.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	13406
Entropy (8bit):	5.104960307970408
Encrypted:	false
SSDEEP:	384:5of/WmZ6yx5vvQI+HFrjN/u9mxohwEhrrk8+rh:wx5vvQIWBh
MD5:	8D7B07F464C0F87872F74ACBFBC98418
SHA1:	4D1A1770F38A645A2972425774CF8EB3DA93C455
SHA-256:	1749A3223146F3AFCBEF239940E69037BD510C4B60107601525F57FD3E39DF19
SHA-512:	771BE83AACB00FDA33272CF4CBA3D4CA3711FB07AB57ACDD580289D2019C480C31C42C1372D9D8AC43A419EC623A32A9B4F785989527939B99EA3B6F5889AB5A
Malicious:	false
Preview:	2025-02-21 16:35:41,867: INFO infoCategory : isWin7OrGreater =true licodeLoaded=true ..2025-02-21 16:35:42,001: INFO infoCategory : CCenterClient doConnect start sock 43.135.63.118..2025-02-21 16:35:42,001: INFO infoCategory : tcp begin connect! address=43.135.63.118 port=443..2025-02-21 16:35:42,002: INFO infoCategory : tcp end connect! ret=-1..2025-02-21 16:35:42,002: INFO infoCategory : tcp connect err! begin select!!..2025-02-21 16:35:42,272: INFO infoCategory : sessionInfo.SessionId=0 state:4..2025-02-21 16:35:42,272: INFO infoCategory : sessionInfo.SessionId=1 state:0..2025-02-21 16:35:42,272: INFO infoCategory : launchclient! sessionId=1..2025-02-21 16:35:42,384: INFO infoCategory : process=explorer.exe sessionid=1..2025-02-21 16:35:42,384: INFO infoCategory : current system login usernameA = user..2025-02-21 16:35:42,384: INFO infoCategory : zhe service start username = ..2025-02-21 16:35:42,384: INFO infoCategory : CreateProcessAsUserA localprocess is show = 0 processPath=

C:\Program Files\ToDesk\ToDesk.exe

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51634120
Entropy (8bit):	7.231420250439017
Encrypted:	false
SSDEEP:
MD5:	461C4140E0A097BFFE2EE4B8991AAB3C
SHA1:	EA2E127D7CD89BD59D2C6A8743443E7CEC3E02AB
SHA-256:	EF24CE906D3D2A611C5ADBA6CD5E536007BA7B4CA2253125C414E231EA172298
SHA-512:	8EDF8E2FCD4C3FCE78C3E27BB490D263E0E8088521CDDAD926CD876714883DE639847A587083356425CE32E95F98371E9007AD91BF0271A9E7ABF554E4540F2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$..........>...m...m...m...l...m...l...m98/m...m...l4..m...l...m...l...m<..l...m...l...m...lq..m...lR..m...lw..m...m..m...l...m...l...m...l...m...lW..m...l...m...l..m...m..m...l...m...l...m...m...m...m...m...l...mRich...m................PE..d..... g..........".......y..0.......Je........@..............................O...........`.........................................`...X....c........@.`.... 2.4........3....K.p)..P`..T....................a..(....`................y..(...........................text....y.......y................. ..`.rdata...wr...y..xr...y.............@..@.data...L.E..0......................@....pdata..4.... 2.....................@..@.rodata.P.....?......~..............@..@_RDATA..0!....?.."..................@..@.rsrc...`.....@.....................@..@.reloc..p)....K..*..................@..B........................................................

C:\Program Files\ToDesk\config.ini

Download File

Process:	C:\Program Files\ToDesk\ToDesk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.786661921889575
Encrypted:	false
SSDEEP:	3:9L/ovyOgMDKIG7yPy3G65EKMJA/yUCvn:9To6kG7y14E/JA/yUCv
MD5:	01BFB885274AD6D951DCA2AB0E31F3B3
SHA1:	902AA84F0EE492537FB35B9DE6C0D13AC7A73E27
SHA-256:	B28B8E9079EC2773D3AE7ADAF1670333FACD696D4B47A0750F9F625E9F691FFB
SHA-512:	AB55678DB722BFA5D45C153A6A1622435E9602B04FE539220FB35A71D0251C2EB63A2C49C3714102BD7630957E0A268BECB7F8E9EB48F307BDFA0B17529EEE01
Malicious:	false
Preview:	[ConfigInfo]..passUpdate=3..PrivateScreenLockScreen=1..autoLockScreen=0..downloadtimes=202502210..

C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.inf

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5534
Entropy (8bit):	5.599669965480823
Encrypted:	false
SSDEEP:	96:5kL1qL/bL7P7ZuTZJOXJ7W+ShEZuTZJXgg21gg2O6J6oBvAalNIMFgWCXgGU4:y5KzLxiJCiJXgz1gzs8CgGU4
MD5:	85F2A36BF518656361C9985839EF626E
SHA1:	FFCB78A7F99F7F732A73A96E90819A5BABD7B083
SHA-256:	616722A9E55D62B1DB76947A1EEDA3A47C24D65FC6252655827B62A260F28765
SHA-512:	AB453998E8CCB4889F5F835C0D252166836B9FE0B2A3E95C716AAB428FB7FF7837AC230D32666FEAF6F31A258F07312685A5F12921D3C8AABCD19157E00C9FC2
Malicious:	false
Preview:	;..; ToDeskAudio.inf..;....[Version]..Signature="$WINDOWS NT$"..Class = Media..ClassGuid = {4d36e96c-e325-11ce-bfc1-08002be10318}..Provider=%OrganizationName% ; defined later in Strings section..CatalogFile=ToDeskAudio.cat..DriverVer = 11/24/2022,12.48.42.476..DriverPackageDisplayName=%DriverDisplayName%....[DestinationDirs]..DefaultDestDir = 12 ; DIRID_DRIVERS..ToDeskAudio_Device_CoInstaller_CopyFiles = 11....; ================= Class section =====================....[SourceDisksNames]..1 = %DiskName%,,,""....[SourceDisksFiles]..ToDeskAudio.sys = 1,,....;***************************************..; Install Section..;***************************************....[Manufacturer]..%OrganizationName%=Standard,NTamd64....[Standard.NTamd64]..%ToDeskAudio.DeviceDesc%=ToDeskAudio_Device, Root\ToDeskAudio....[ToDeskAudio_Device.NT]..Include=ks.inf,wdmaudio.inf..Needs=KS.Registration, WDMAUDIO.Registration..CopyFiles=Drivers_Dir....[Drivers_Dir]..ToDeskAudio.sys....;-------------- Service instal

C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104984
Entropy (8bit):	7.1841203338893695
Encrypted:	false
SSDEEP:	3072:dm5ytu//ZDkPaEKTqq1J6bKDZfZhLoUcGO4/k:dYyYZ0rSJ6uDZf7LoUcx4c
MD5:	92E23086F2628BF938FD0B6E7FB4D28C
SHA1:	39372FF79F1BCAA1842E6BCD76DCE642EDEA1BC7
SHA-256:	D834C5D6C9232717FE2B2271B0C215E7148AAF5A5DF30EAB2521CAF85444BDD5
SHA-512:	5281D1704CF50BFEED3030C441B3F165AE624BE1829E28533F98AA1FF9F4BCB6154BB017183D30037A22AB28556F8CFD0F08BD2D4C58592D1D97CD2BA18F9E5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..+..+..+.....+.....+.....+.....+..+..+.....+.....+Rich..+................PE..d.....~c.........."......t..........PH.........@..........................................`A................................................0...d............`.......r...(......x...P<..8............................<...............`...............................text...zD.......F.................. ..h.rdata..$....`.......J..............@..H.data...(....P.......0..............@....pdata.......`.......<..............@..HPAGE.....$...p...&...B.............. ..`INIT.................h.............. ..b.reloc..x............p..............@..B........................................................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\cameramic\devcon.exe

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	4.918650269177866
Encrypted:	false
SSDEEP:	1536:11Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WH:11M2fAggGnD89NJ1cPZCM3W
MD5:	816C4E245B286B4E4903131F75A94948
SHA1:	EDA70C1FC8A461EFB0E376D42E35A72B96175E4D
SHA-256:	ACA1BDA08690DCCA930254F96F9185C776671A85A58FFA1B59CF16017546F218
SHA-512:	D0DC74956C57403C0638E6595AAF1C2EB75233997A15170B064261A5D3F1F525A3E35E13FEF04C36CC20FD1D5D1CF000A5FB7A646BF2CF1CEA73817E5D3335B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'...'...'...L...'...L...'...L...'...L...'...'...'...L...'...L...'...L...'..Rich.'..........PE..d...'..S.........."......f...........n.........@.....................................O....`.......... ..................................................p...............................T...........................................(................................text....e.......f.................. ..`.rdata...!......."...j..............@..@.data...............................@....pdata..............................@..@.rsrc...p...........................@..@.reloc...............D..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\cameramic\todeskaudio.cat

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	11888
Entropy (8bit):	7.331333737899448
Encrypted:	false
SSDEEP:	192:+fUt1cJCYrfXEwI+CYhYCo7RWMMBdRgjLX01k9z3Azskaby:zqLriMh3o7RWleLR9zuskOy
MD5:	4BB63A0AB8D09514C6D59373BE8257FA
SHA1:	C2489D3E041B09905E8C11893692C0FDBDB12438
SHA-256:	6B0C665EA030FBBA2A8E7A51BA9965EDB369B19E6FC9FA73DD14E8FDC7A7C40E
SHA-512:	BB244CC4A4088F2951CA5B87221075A9004D2AD7A4DD0AFDC2BC980A87E9330FFCD8AA4FC37436C5DE06B1BCB8B1B60AAF57D97762E31AE852E4BC30FCE3ECBE
Malicious:	false
Preview:	0..l...H.........]0..Y...1.0...`.H.e......0.....+.....7......0...0...+.....7.....V...{.#I..o%..@!..221124051919Z0...+.....7.....0..p0.... ag"..]b..v.z..\|$._.%&U.{b.`.e1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... t.o.d.e.s.k.a.u.d.i.o...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ag"..]b..v.z..\|$._.%&U.{b.`.e0.....'....0..f .1Xy.B@..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... t.o.d.e.s.k.a.u.d.i.o...s.y.s...0.... ._..A..(...U-%..@c..........?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... t.o.d.e.s.k.a.u.d.i.o...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ._..A..(...U-%..@c..........?0......x....ss.n...[...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... t.o.d.e.s.k.a.u.d.i

C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x64.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2204944
Entropy (8bit):	6.635106814626019
Encrypted:	false
SSDEEP:	49152:SJ7y/sgztOQUX/OIK/A7L8DJ82qduK9Wgp7hajHL2nv:90X/OIK/AUdzlK9jwjg
MD5:	16BD5AA615DA5FD10774831ED9B980AF
SHA1:	21ECBEC227585CB76CCC59F01DBDF71EEAF4C818
SHA-256:	345830CE47E12EE08CE8C71BF1DB0EE391389DE8BB0758450786445CA6676AB8
SHA-512:	6DD527AA3D1336DC8FB1BAB92425560F94682CF22A22AAA41ADFD72260CF1551E8B01798235FD534D08C95D311453C0B8206815FA705FD4698FB2A61871F7178
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.w..o...o...o.......o.......o.......o.......o.......o......Ao.......o.......o.......o.......o...o..dn...o...m.......o.......o..Rich.o..................PE..d.....Fd.........." ...#.~..........@b.......................................@".....`g"...`A........................................`. ......! ...............!......p!..5....".8$...g..8....................h..(...Pf..@............................................text....\|.......~.................. ..`.rdata..............................@..@.data........@ ..6...* .............@....pdata........!......` .............@..@_RDATA..\....."......H!.............@..@.reloc..8$...."..&...J!.............@..B........................................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1930000
Entropy (8bit):	6.873180986632904
Encrypted:	false
SSDEEP:	24576:Q2Gcu9xL4b2N4QpJnimoBIIG9Jp71qe0Nz7c07tCsEFK2BpqianHg6BHIDot11Qh:Q5j982IG9P1KWO6K2BpqiAAaHIDKch
MD5:	BCD7519935ED637310E56F205402F912
SHA1:	D8A570D903D18F04E5076A2F4D714F2890945EB9
SHA-256:	F344150902A401BFCF8C88D118E24556E8856852FBEACFBB1DAD63A505AFD438
SHA-512:	7D247AB199350C95F4CB89A25C74E4A7FD9CB6529F78973C077EBD3BFD856F9B1C583F381D3D6C6C1EEA0C0B353EB1B321BA9179835DE8ADCDB78A0FB7D0EF0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e.F...F...F...Ro..]...Ro......x`.@....x..R....x..]....x......Ro..G...`..N...Ro..b...Ro.._...F...=...F.......y..G...y..G...RichF...................PE..L.....Fd.........."!...#............................................................`d....@A........................ Q..p....Z.......................>...5... ......P...8...............................@...............p............................text...j........................... ..`.rdata..............................@..@.data........p...(...T..............@....reloc....... .......\|..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\tdgamepad\TdGamePad.inf

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	5.3893017782902755
Encrypted:	false
SSDEEP:	48:FiEBlLNQhmodIpKE9EQ3u1BY3W8IAR5Junv3cBLkLN03LwX3LNvX3PC0eQXt4y:FiRhmoIKASUpA9vCe
MD5:	36EAE88BCCAD5CC663C418D25846AC17
SHA1:	B50BFD73FB24AC31D967FC63399B4F609C11E8E2
SHA-256:	F451A05BB2409204F3980671739AFB5A1CFF3A13C5A86AE1A89BE785371D3659
SHA-512:	9C495AA99D369539EED860C427F51097F7558227E824D03D798846282487A6B93B148325D1D51EEB77D68CFBEC14D12E2ED5B1B36CDCBA048A34488E9E01B32B
Malicious:	false
Preview:	[Version]..Signature="$WINDOWS NT$"..Class=System..ClassGuid={4D36E97D-E325-11CE-BFC1-08002BE10318}..Provider=%ManufacturerName%..CatalogFile=TdGamePad.cat..DriverVer = 06/02/2022,1.0.0.0..PnpLockdown=1....[DestinationDirs]..DefaultDestDir = 12..TdGamePad_Device_CoInstaller_CopyFiles = 11....[SourceDisksNames]..1 = %DiskName%,,,....[SourceDisksFiles]..TdGamePad.sys = 1,,..;.....;***************************************..; Install Section..;***************************************....[Manufacturer]..%ManufacturerName%=Standard,NTamd64,NTx86....[Standard.NTamd64]..%TdGamePad.DeviceDesc%=TdGamePad_Device, ToDesk\TdGamePad\Gen1....[Standard.NTx86]..%TdGamePad.DeviceDesc%=TdGamePad_Device, ToDesk\TdGamePad\Gen1....[TdGamePad_Device.NT]..CopyFiles=Drivers_Dir....[Drivers_Dir]..TdGamePad.sys....;-------------- Service installation..[TdGamePad_Device.NT.Services]..AddService = TdGamePad,%SPSVCINST_ASSOCSERVICE%, TdGamePad_Service_Inst....; -------------- TdGamePad driver install sections..[T

C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	6.391514149129202
Encrypted:	false
SSDEEP:	3072:8TEfUUF4Z6ukFj413Hcg89BkkRjn+6Gt10K3+:IUF+Wkb0RtnN
MD5:	7DEAA291554E379BA10F69F54D083B2E
SHA1:	71326240B514D36FFA85596A8D16BFC6A57D2AAF
SHA-256:	054E0D375CC3EFF471B0662BB2443987C18E6CBE938D7AF79C7388BC8A67152C
SHA-512:	33076B5FF83861C42729DE44804668E25E7D479197D47334439E867F306138C1A0750FAE4D09B811E02D0093705BF27A5ED9E0E827FD707F5557C22D554EADDB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y(O.=I!P=I!P=I!P)"&Q>I!P)" Q5I!P=I P.I!P)""Q9I!P=I!P8I!P41.P>I!P)"%Q;I!P)"'Q?I!P.<$Q I!P.<.P<I!P.<#Q<I!PRich=I!P................PE..d...48.b.........."..........N......@..........@.............................p......I.....`A.................................................A..x....P..x....@..L....... (...`..........8............................................................................text............................... ..h.rdata...'.......(..................@..H.data...x....0......................@....pdata..L....@....... ..............@..HPAGE.........`.......2.............. ..`INIT....D....@...................... ..b.rsrc...x....P......................@..B.reloc.......`......................@..B................................................................................................................................................................

C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	4.918650269177866
Encrypted:	false
SSDEEP:	1536:11Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WH:11M2fAggGnD89NJ1cPZCM3W
MD5:	816C4E245B286B4E4903131F75A94948
SHA1:	EDA70C1FC8A461EFB0E376D42E35A72B96175E4D
SHA-256:	ACA1BDA08690DCCA930254F96F9185C776671A85A58FFA1B59CF16017546F218
SHA-512:	D0DC74956C57403C0638E6595AAF1C2EB75233997A15170B064261A5D3F1F525A3E35E13FEF04C36CC20FD1D5D1CF000A5FB7A646BF2CF1CEA73817E5D3335B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'...'...'...L...'...L...'...L...'...L...'...'...'...L...'...L...'...L...'..Rich.'..........PE..d...'..S.........."......f...........n.........@.....................................O....`.......... ..................................................p...............................T...........................................(................................text....e.......f.................. ..`.rdata...!......."...j..............@..@.data...............................@....pdata..............................@..@.rsrc...p...........................@..@.reloc...............D..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\tdgamepad\tdgamepad.cat

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	11882
Entropy (8bit):	7.335581140829958
Encrypted:	false
SSDEEP:	192:jSWSFgSwS9JCY8yeF1agjEwOXP6hYCtODqF9e+X01k9z3AzsJzg44lFvn:ebz19L8x/k6h3tOe99R9zuspAPv
MD5:	244A96AB3C2FAB127A342DAE2FE31D96
SHA1:	0B2A9964B6975E6A21CD0BAA631B010F78EE2E0C
SHA-256:	C7618D707C35176E67EEA564ED7C7870AC59F0E62C95A9619D693DDF742D7CC1
SHA-512:	59D0B0CD69961657B3238E83AA510892770481C8A8E7C352D544329FA69D41AFDD26BC31A1A99496118CEDE198D2CF3551CFCB53EAEF4C5B592C707432BD7F2A
Malicious:	false
Preview:	0..f..*.H.........W0..S...1.0...`.H.e......0.....+.....7......0...0...+.....7.......7p...I..H......220602043249Z0...+.....7.....0..`0.........& 7#7._PA.Y..L.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0>..+.....7...100....F.i.l.e........t.d.g.a.m.e.p.a.d...s.y.s...0.... .;.P>.....Jc..T.....z...]{.....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0>..+.....7...100....F.i.l.e........t.d.g.a.m.e.p.a.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .;.P>.....Jc..T.....z...]{.....0.......s.$.1.g.c9.O`....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0>..+.....7...100....F.i.l.e........t.d.g.a.m.e.p.a.d...i.n.f...0.... .Q.[.@....qs..Z..:..j..7.6Y1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0>..+.....7...100....F.i.l.e........t.d.g.a.m.e.p.a.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .Q.[.@....qs..Z..:..j..7.6Y...

C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	4.918650269177866
Encrypted:	false
SSDEEP:	1536:11Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WH:11M2fAggGnD89NJ1cPZCM3W
MD5:	816C4E245B286B4E4903131F75A94948
SHA1:	EDA70C1FC8A461EFB0E376D42E35A72B96175E4D
SHA-256:	ACA1BDA08690DCCA930254F96F9185C776671A85A58FFA1B59CF16017546F218
SHA-512:	D0DC74956C57403C0638E6595AAF1C2EB75233997A15170B064261A5D3F1F525A3E35E13FEF04C36CC20FD1D5D1CF000A5FB7A646BF2CF1CEA73817E5D3335B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'...'...'...L...'...L...'...L...'...L...'...'...'...L...'...L...'...L...'..Rich.'..........PE..d...'..S.........."......f...........n.........@.....................................O....`.......... ..................................................p...............................T...........................................(................................text....e.......f.................. ..`.rdata...!......."...j..............@..@.data...............................@....pdata..............................@..@.rsrc...p...........................@..@.reloc...............D..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72744
Entropy (8bit):	6.308846918110212
Encrypted:	false
SSDEEP:	768:DR70PF2B5dGJl+14ubvPjRn2od3RMmgiqSGXQrAOIiIvLBkIOM4Roeym3kCPi9z8:DwkB5mAX1xRdGXBrDSRo7mz+z8
MD5:	7007CB6626749DD498BE493C3DB7BEA2
SHA1:	913152519A59EDE6A7E0971451E647AA1FB11A8F
SHA-256:	3B414D298E28DCAF87F478013FA7F175119AF6102949DA5D2FD2469925F5AC7D
SHA-512:	1E3E8B97CB87E391BD50026BF3E212E1A02CE372B04FDDD837C4EA8F3B2941A23AD1C1B3F6ABE5ECA13CDE89547DD95AF55F64C792CFA760EA9862995D6F0680
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'.>.F.m.F.m.F.m.3.l.F.m.3.l.F.m.3.l.F.m.>pm.F.m.-.l.F.m.F.m.F.m.-.l.F.mX3.l.F.mX3.l.F.mX3.m.F.mX3.l.F.mRich.F.m........PE..d...VAFd.........." .........f.......\.......................................P......s"....`A........................................p...L............0..................((...@..........8...............................8............................................text............................... ..`.rdata...G.......H..................@..@.data...h...........................@....pdata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.inf

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	3712
Entropy (8bit):	3.745273797765128
Encrypted:	false
SSDEEP:	48:C+oAqEj/9cbhNpAl0sOIbBn6xQYcfN4fTGiIusOgZ6qGNnijzXLfH7MyOkFZx:HmOMIJMNniUoZx
MD5:	CA02A85FC2EDE81D30E111F60101D188
SHA1:	161789B63938EBBEEE0A1D25BBEA6A0BE41DC97E
SHA-256:	F44975C016414E84828BBFCD363332F571FBA82A0EB71ABB1D69AB4402EA4922
SHA-512:	37815AC75BD93959CE539505532BB45F80D8ABE75198AF6364BF16CA86D19338216C7F4AAAE6B3C977D0DD2BD64994EBB35225D16E63FAFBA4C5C5B8D7B9E199
Malicious:	false
Preview:	..;.....;. .t.d.I.d.d...i.n.f.....;.........[.V.e.r.s.i.o.n.].....P.n.p.L.o.c.k.D.o.w.n.=.1.....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.t.d.I.d.d...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.4./.2.4./.2.0.2.3.,.1.6...4.4...2...5.0.9.....[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.a.m.d.6.4.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .R.o.o.t.\.t.d.I.d.d. .....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .t.d.I.d.d.........[.S.o.u.r.c.e.D.i.s.k.s.F.i.l.e.s.].....t.d.I.d.d...d.l.l.=.1.........[.S.o.u.r.c.e.D.i.s.k.s.N.a.m.e.s.].....1. .=. .%.D.i.s.k.N.a.m.e.%.........;. .=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.

C:\Program Files\ToDesk\drivers\tdscreen\tdidd.cat

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	11851
Entropy (8bit):	7.3408581135729225
Encrypted:	false
SSDEEP:	192:6g/ZO2MMJCYhyrEEw5EYhYC8He3O2dPaIAX01k9z3A0OANyPy:rLhyYh38+OOP5AR9zhOOMy
MD5:	A7CD4A9EB650FD62E131E700E7070DE1
SHA1:	E8E0FEAB015A89485B50D4C5244CEF7BBE7524AC
SHA-256:	A78B89580E63E68E7C13B8F9E51C5E3FCF72BB2DBEA718AF98740E954E636234
SHA-512:	E736EE56765E0E00C1365E6E21EB3ED7F2AA750EF8ADB5ADCF8CAF8853FE3AC4021F57FDCF352F2D3C1061714339C60960FD2EF0844CDA913416A3D1C5548597
Malicious:	false
Preview:	0..G...H.........80..4...1.0...`.H.e......0.....+.....7......0...0...+.....7......{...G....9.....230424085628Z0...+.....7.....0..?0........98....%..j....~1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........t.d.i.d.d...i.n.f...0.... l+Dx1...vm.\.~f.!?...{.T;C.L.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........t.d.i.d.d...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... l+Dx1...vm.\.~f.!?...{.T;C.L.0.....{..DeNb.L.g.f..u.w1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........t.d.i.d.d...d.l.l...0... .Iu..AN.....632.q.......i.D..I"1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........t.d.i.d.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .Iu..AN.....632.q..*.....i.D..I"....0...0....+.....7......0.....S.u.

C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36920
Entropy (8bit):	6.302440658068894
Encrypted:	false
SSDEEP:	384:A5dct2yaZgX3KCrgAH0PY99/b+XfwiJF8LMOO2qEC8vzGh8ph3e6zaHeR9zX9xwi:odSaZgvN2ib+vi9qECuGh8L3aC9zw3S
MD5:	9E2A45CF1EE898D5BC9BBE1749F0ABE6
SHA1:	7BA5413A255FE1871C2BF63208B27704FE0BFE3F
SHA-256:	55ADF9858FFBC0085D282487E3462FF318C5251082A58F5604872721A0244553
SHA-512:	CBFF92CF081CB9BF12D901A7C2D3AEF6EE51CA2528A446F40A2BD4A959AEAFB208996F4D61B334601EFC48D191AD168AAC4479B494DE2128C0CBEC7FB6B0B51D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P....~..~..~.F...~.F...~.F...~...F..~.....~..~.)~.....~.....~.....~...*..~.....~.Rich.~.........................PE..d....Iud.........." .....0...<.......%....................................................`A........................................ ]..T...t]..d.......@............h..8(......0....U..8............................U..8............@..H............................text............0.................. ..`.rdata..V"...@...$...4..............@..@.data........p.......X..............@....pdata...............\..............@..@_RDATA...............`..............@..@.rsrc...@............b..............@..@.reloc..0............f..............@..B................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.inf

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4470
Entropy (8bit):	3.7645850225930393
Encrypted:	false
SSDEEP:	48:4BOuxRYmBF7qUhCVARfmwCfio2SiQLt97HunOgTpd7XLdEMtEMqMxgnnjU:4BhYU7DRfmwCfijQR97On5fPtPLynI
MD5:	BD64143D79C733223B0E00645E6C6F1E
SHA1:	5721CF54C0FD1EEC31BE43AC95AB6CFD3BDC0EBF
SHA-256:	F0FC1A36FB3A7E74EEBB723D7D2D409A9675303E7F6863B5BB9D67DF392D6621
SHA-512:	DF87A3FE353E0603728C0DA14D23BE6E6CFCD963756230EC6D23DD837C1EEB9C1711382534E926D47CD2A49EAD6FBB76A0BAE3BB590E5A5750426256AD0E5D19
Malicious:	false
Preview:	..;./..+.+.....;.M.o.d.u.l.e. .N.a.m.e.:.....;.....;. . . . .T.o.d.e.s.k.V.h.i.d...i.n.f.....;.-.-../.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.I.N.D.O.W.S. .N.T.$.".....C.l.a.s.s.=.H.I.D.C.l.a.s.s.....C.l.a.s.s.G.u.i.d.=.{.7.4.5.A.1.7.A.0.-.7.4.D.3.-.1.1.D.0.-.B.6.F.E.-.0.0.A.0.C.9.0.F.5.7.D.A.}.....P.r.o.v.i.d.e.r.=.%.P.r.o.v.i.d.e.r.S.t.r.i.n.g.%.....D.r.i.v.e.r.V.e.r. .=. .0.5./.3.0./.2.0.2.3.,.8...5.5...5.6...8.6.2.....C.a.t.a.l.o.g.F.i.l.e.=.T.o.d.e.s.k.V.h.i.d...c.a.t.........;. .=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=. .D.e.v.i.c.e. .s.e.c.t.i.o.n. .=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.S.t.r.i.n.g.%.=.M.i.c.r.o.s.o.f.t.,. .N.T.a.m.d.6.4...6...3.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4...6...3.].....%.D.e.v.i.c.e.D.e.s.c.%.=.T.o.d.e.s.k.V.h.i.d.,. .r.o.o.t.\.T.o.d.e.s.k.V.h.i.d.........[.T.o.d.e.s.k.V.h.i.d...N.T.].....C.o.p.y.F.i.l.e.s.=.U.M.D.r.i.v.e.r.C.o.p.y.........[.T.o.d.e.s.k.V.h.i.d...N.T...

C:\Program Files\ToDesk\drivers\vhid\devcon.exe

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83456
Entropy (8bit):	4.918650269177866
Encrypted:	false
SSDEEP:	1536:11Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WH:11M2fAggGnD89NJ1cPZCM3W
MD5:	816C4E245B286B4E4903131F75A94948
SHA1:	EDA70C1FC8A461EFB0E376D42E35A72B96175E4D
SHA-256:	ACA1BDA08690DCCA930254F96F9185C776671A85A58FFA1B59CF16017546F218
SHA-512:	D0DC74956C57403C0638E6595AAF1C2EB75233997A15170B064261A5D3F1F525A3E35E13FEF04C36CC20FD1D5D1CF000A5FB7A646BF2CF1CEA73817E5D3335B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'...'...'...L...'...L...'...L...'...L...'...'...'...L...'...L...'...L...'..Rich.'..........PE..d...'..S.........."......f...........n.........@.....................................O....`.......... ..................................................p...............................T...........................................(................................text....e.......f.................. ..`.rdata...!......."...j..............@..@.data...............................@....pdata..............................@..@.rsrc...p...........................@..@.reloc...............D..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\ToDesk\drivers\vhid\todeskvhid.cat

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	11866
Entropy (8bit):	7.340642041168423
Encrypted:	false
SSDEEP:	192:H+edehTesebJCYGy8XKEwV+zGh8phYC6SyGI+X01k9z3AZOQHCY2l:ZIIDbL58vzGh8ph36SNrR9zQOQHve
MD5:	50931C1048EC6EE59231114818B821EB
SHA1:	53239A68424B6DC22B61842F2D7D24B48A940F31
SHA-256:	0CB791ED0A41EFACD965E052F372EDB567C241CCA18E53FE439EF7FBFC1EF667
SHA-512:	622275282FD4DD495DD500CD13DFFA2C7F702D7E9AB80FD77636F3D4F2997BF3A4DCAE7B6F40427D767DCE6C9514B563F096E85DAFEB24F25B54E9647B488127
Malicious:	false
Preview:	0..V..*.H.........G0..C...1.0...`.H.e......0.....+.....7......0...0...+.....7.....;.h..]{F..YN`.....230530011121Z0...+.....7.....0..h0....W!.T....1.C...l.;...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........t.o.d.e.s.k.v.h.i.d...i.n.f...0.... .?.....c..<"Q.c.k...1..A....1..S1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........t.o.d.e.s.k.v.h.i.d...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?.....c..<"Q.c.k...1..A....1..S0.... ...6.:~t.r=}-@..u0>.hc...g.9-f!1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........t.o.d.e.s.k.v.h.i.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ...6.:~t.r=}-@..u0>.hc...g.9-f!0..........w...8..L..Z.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........t.o.d.e.s.k.v.h.i.d...d.l

C:\Program Files\ToDesk\uninst.exe

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1828672
Entropy (8bit):	7.795245171207912
Encrypted:	false
SSDEEP:	24576:MSGQN27eDriLWLAxAnU5/w3E71UGaWNs5Z6m2P/yNOTLCC//Xm/8CTQV04vmY:MSG4ryWLUl7GGaWKy/y8LHO2V04vmY
MD5:	7C44886E01C9495B4D97AB1E3D5EB1D7
SHA1:	DA1B574E02C89B9A09C9DC389D85CC690E1D7A0A
SHA-256:	A5A01E0E198F5CCFA04A9EE9F0BD1CC9F16FFE353B08457442FB11F208FD9955
SHA-512:	9E42BC941BD1CDC800D4BDD0AF54B1F036D585A2A5213335D898731D51CED2AB48A725A7F3C8DE9FE38A0E02E5D3F42A486B23E34368AFB1744A17AAEF9720E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........18..PV..PV..PV._...PV..PW.MPV._...PV.sf..PV..VP..PV.Rich.PV.........PE..L......].................h...........3............@..........................0.......8....@.............................................X...........x....3...........................................................................................text....f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata.......P...........................rsrc...X........0..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\ToDesk\zrtc.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51693512
Entropy (8bit):	6.785821747187098
Encrypted:	false
SSDEEP:
MD5:	BD0C681F23741927087E1B98BC267776
SHA1:	A0D2BDBA5EF538119618DE5AD96EFBEFCAE04112
SHA-256:	EA03C54614C3E1F95972BD2080EC9E0381A466CD1B0815DFA0B4DDF703B2640F
SHA-512:	7890952AE5965B487AE96DABAA8D03E070C5325A367F69C7E877E7D218DB4859A843708AC7F1174766C279943E5255069EC378AE7299E9A89CF48B5AB47C09B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...PO._.........." ......z..v......@.s......................................0=...........`A................................................y...T....`;..........m.......3...p;.,...4_......................@...(.......8.............. ............................text.....z.......z................. ..`.rdata..@pl...z..rl...z.............@..@.data...X.+.. ......................@....pdata...m.......n..................@..@.00cfg..(.... ......................@..@.nvFatBi.....0......................@....nv_fatb.G...@...H..................@....pdata...G.......H...F.................@.retplneH................................rodata............................. ..`.tls..... .... .."..................@....voltbl......@ ..........................xdata.......P .....................@..@IPPCODE..(....(..*...`.............. ..`IPPDATA..>....;..@..................@..._RDATA.......P;.

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7945979436514706
Encrypted:	false
SSDEEP:	3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWb:QAgN8nj/ka4
MD5:	5124FA330918DCBF894705658D5F4079
SHA1:	FE97286EFD2B7F73410FC3B1BA9DE2EE8AFC8754
SHA-256:	7FBF3768545F93A843E6CBB7944C1975F8C2C9A57D942AF8BA2F9DE6756AFB0B
SHA-512:	E6E1266BBE065C1F0EA64A77ED6529F139DF15E3BD5834E23238CA22278F55767C522E32B5E2EF089F2AD4B4E87E89B83F117E76296B2B5493C0FA986D36956B
Malicious:	false
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xead3a4bc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7864192305318344
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/6vDfi5Wy10MctJ+t9ka4XQ0/Ykr3g16L2UPkLk+kyt4eCu3uZB:Lazaovh7uka4Es2U1RFNp3pvHzrHBHz
MD5:	B4765ACFA571BBB02DD090470C503C84
SHA1:	7ECF278790D135DE6F3E6596EBEE393732AE1C2E
SHA-256:	63356C1F57BF471D9B4F113718F3A2E714AF90AC02A6EB47A3438B1063A2811D
SHA-512:	89C6EFCE7089E4D7DC966006C75AE684A2BB6024A1AB1BD70D6ADA5557D4975DA90888281D61FDFDD892FD493F33701636FAB20F032776C402046C5433643E4A
Malicious:	false
Preview:	...... ...............X\...;...{......................0.z...... ...{..4....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................B.4....}.1..................Q#4....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07968604263248338
Encrypted:	false
SSDEEP:	3:QlllKYemATMsjv/Ss/IGYZX/PGfsAllSdLvl+/rS56/:wllKzGsYnGfsAQN0e
MD5:	4EC8D39B0CD5188C5A107C807797B2EB
SHA1:	4861A411104F66CE3440DE5FBDB093C2C867A1D2
SHA-256:	09A9B20EACD739048B4DFB330D87E1A93E5B1C113DC06C22CE4C2AC970F899F6
SHA-512:	CDCD5A18934E39D4F7775D1E556FB837D1646FEAD8713B47084CE273417AC5A4FAC251AFB0DB8650EE72F28E22DFB356ECF0DD02D194103299FFD0D93D1F8A81
Malicious:	false
Preview:	.3.}.....................................;...{..4....}... ...{........... ...{... ...{..#.#.. ...{.\|..................Q#4....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ToDesk\ToDesk.lnk

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 30 00:53:20 2024, mtime=Fri Feb 21 19:13:38 2025, atime=Wed Oct 30 00:53:20 2024, length=51634120, window=hide
Category:	dropped
Size (bytes):	843
Entropy (8bit):	4.549569053420253
Encrypted:	false
SSDEEP:	12:8mNkyaLkSlClYX+h9uTsv+dpF44Moys1xgKppv3jAG6kbdp3JUbdp30hThT4hTqc:8mNja7Y+dwonfrAydAdwTx4xqm
MD5:	F41AB7ED241BBCD0F970CE69513C0DAD
SHA1:	1A1182089041C559201CBEF92FA96DEC42011012
SHA-256:	C0FAE59ECF2EB6C2ED3C32FDF17D06FE70A8AF744297151E47D5D491F233B5AB
SHA-512:	162B812679C14A23A84D9D80EAB15F47B01FA7041FAEC50E17D1935F2F0030CADC877E5B76BDDA3E75854CCA4C75BB24DB989107651EF34CB4843E34854B6F8C
Malicious:	false
Preview:	L..................F.... ......~n..'.A........~n..........................o....P.O. .:i.....+00.../C:\.....................1.....UZ....PROGRA~1..t......O.IUZ......B...............J.....x...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....UZ....ToDesk..>......UZ..UZ...............................T.o.D.e.s.k.....`.2.....^Y.. .ToDesk.exe..F......^Y..UZ................................T.o.D.e.s.k...e.x.e.......Q...............-.......P....................C:\Program Files\ToDesk\ToDesk.exe..1.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.o.D.e.s.k.\.T.o.D.e.s.k...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.o.D.e.s.k.`.......X.......715575...........hT..CrF.f4... .!^N..........%..hT..CrF.f4... .!^N..........%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ToDesk\Uninstall ToDesk.lnk

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 30 00:53:24 2024, mtime=Fri Feb 21 19:13:36 2025, atime=Wed Oct 30 00:53:24 2024, length=1828672, window=hide
Category:	dropped
Size (bytes):	843
Entropy (8bit):	4.574740541198718
Encrypted:	false
SSDEEP:	12:8mClYX+h9uTsv+dpF44Moys1hwK3QhjAGJkbdp3UdSbdp30hgxqmV:8mLY+dwoH/3QVAxdqd2dwgxqm
MD5:	368B565F2BCF1F27F9EAE19BE6327A21
SHA1:	60BCE9F348C0A54F60A657B932206ADCEFC1D385
SHA-256:	E1B6B14958758A3F407621BD8E105843D41302D4566C6464B88597C15554D220
SHA-512:	0EDBA67E196EF89BB6923B49C6E93D9B2B358A09A6AF85625F93BBAF81C5D154F59833C3B6A596508D6AF1B6E5DBAA66AE7E63A6C55AAB4BAEFF86D475B718AA
Malicious:	false
Preview:	L..................F.... .....4.n............4.n..@.......................o....P.O. .:i.....+00.../C:\.....................1.....UZ....PROGRA~1..t......O.IUZ......B...............J.....x...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....UZ....ToDesk..>......UZ..UZ...............................T.o.D.e.s.k.....`.2.@...^Y.. .uninst.exe..F......^Y..UZ................................u.n.i.n.s.t...e.x.e.......Q...............-.......P....................C:\Program Files\ToDesk\uninst.exe..1.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.o.D.e.s.k.\.u.n.i.n.s.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.o.D.e.s.k.`.......X.......715575...........hT..CrF.f4... .!^N..........%..hT..CrF.f4... .!^N..........%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\a11.zip

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=AES Encrypted
Category:	dropped
Size (bytes):	5579540
Entropy (8bit):	7.99996720876202
Encrypted:	true
SSDEEP:	98304:RtOlWSGSlOevpRTH/7e8PHqcl5jb/KMsRHoVbF/QX1T1FyiGlMFhh:PO3OkKsqcnmMsVoV5IFxGluh
MD5:	35312BE8E1F34DAFDB7B64DC3D3B74A6
SHA1:	AF11F56B4458AEB1C5A31A1D24CC9972D94FFFD7
SHA-256:	9F089F33E8E177EE7204CA366268C6943996E1EB9F4FADC9F0BE810CF50F0DD1
SHA-512:	1D3F5467CCD8052B30108A16BAF6266EECC751EF99AF499BB961CBB374E45938E8C6E34CEACDF1B5AD5226B9CCFD50A8D3D7771F13D155A50850785BF4C4CDB6
Malicious:	false
Preview:	PK......c...QZ..V.............MSVCP140.dll......AE...C...7<d.G..lI....$.3.p8L.....a....V.-./.....n...j.zM.....TD.....;..j.3t=.o..EG?..s.q..Y.....L.].."2QvBEs4..g...2g....T.O.V.VPt.T.9...mp59..b?>..nK.uV..W.M1l9<....`/ L..S...6.!{.Bw..3f....y....X...7......@.}v\|dU?zbFGc.....O.-..Z...8............H.!M/.a...jVG.u.=...C..=......?.a.-......g%...=....%.....^.^Q..~..~.k..`..z......\.+.+&>...5......v.....;9(.vp{......3`....WY.."w....../.X.t.._]..6S7oi.".......X-...i.i.....mS.m.o.u[.:I..%d."P..xoW.z.@!..Yg..........q.-.?.j..]....~..;up..W.......D..zD....$..5....I8/...3.M..6.9.~.D.tB.W...%.....O....^S..5.....)......@.k.........@5.tz..c.@.....#...-....37.....C..G7.....y.O.9....q.\|9......"..q.f...2..S~..0.",v."..<...K.../.......(*.R..+....m.jF...~.@....!.Y..Y...D...V.nxw.#.V..q..<..E.\|.de5.v.D.._......T\|...5...a/.....}....U.a.? y..f1.0..A.4..mh$.Q.3..........#l\&.u...rs=.!.VI-r....%....f...0.x.W.=..14....=o...u Z.....<....s.-....B......

C:\ProgramData\kernelquick.sys

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	2.6616157143988106
Encrypted:	false
SSDEEP:	3:tblM6lEjln:tbhEZn
MD5:	AE50B29A0B8DCC411F24F1863B0EAFDE
SHA1:	D415A55627B1ADED8E4B2CBBA402F816B0461155
SHA-256:	6B4BBBCE480FBC50D39A8EC4B72CDB7D781B151921E063DD899FD9B736ADCF68
SHA-512:	D9A9BA42D99BE32D26667060BE1D523DCD20EAFA187A67F7919002CC6DA349FD058053C9C6F721D6FDB730EA02FBAA3013E51C0C653368BD6B3F57A4C0FCABA8
Malicious:	true
Preview:	C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.

C:\ProgramData\pwand.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	223113840
Entropy (8bit):	0.3906845062360582
Encrypted:	false
SSDEEP:
MD5:	6DF63C66D133645F6D0FE16209DEEC39
SHA1:	68DAB3A16BD612965C321A8D30B4516F49E9117D
SHA-256:	3EC2FD904D2588F247BFF6DB95E47578637D95FFF314736577BD055A6BFF3E48
SHA-512:	BD385C21EF1847FCB4EA31F1EA7DB6C5EE95E27EEB5ED73802583B352CBC98D2046A9C34499867A32B874F283D7E56023347DBB45286D1482E85F1FA38C18857
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........@S..S..S......U.............C..Bta.P..Bt..Y..Bt..]..Bt......w.........^..S......t..R...t..R...tc.R...t..R..RichS..........................PE..d......g.........." ...*.....0G.....0........................................pL...........`.........................................`...D.......x....PL.......L.8@... L.pR...`L....../..8...........................@...@............ ...............................text............................... ..`.rdata....... ......................@..@.data....^E......FE.................@....pdata..8@....L..B....K.............@..@.rsrc........PL.......L.............@..@.reloc.......`L.......L.............@..B................................................................................................................................................................................................................

C:\Users\Public\Desktop\ToDesk.lnk

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 30 00:53:20 2024, mtime=Fri Feb 21 19:13:34 2025, atime=Wed Oct 30 00:53:20 2024, length=51634120, window=hide
Category:	dropped
Size (bytes):	825
Entropy (8bit):	4.584939008859449
Encrypted:	false
SSDEEP:	12:8mNk2tkSlClYX+h9uTsv+dpF44Moys1xgKppv3jAGMbdp3JUbdp30hThT4hTqmV:8mNnt7Y+dwonfrAHdAdwTx4xqm
MD5:	9F7DEBBEA7F1B5402AFD4482DFF7B228
SHA1:	8428EA73D2A8CA87B429A28A8869DE640350E7AF
SHA-256:	2202E0246E91DB05651CFE9C1E644944893E6B24F78AFE21F782968CB2A5A693
SHA-512:	E8B38A29D8B7C54B3466A4C3D95B6F41302ACD7CEE034C6A49189BA348067289C6BABC3F96910C678EC0A95BA142A24FD7282F2185EDEC854AA1020151E58267
Malicious:	false
Preview:	L..................F.... ......~n.............~n..........................o....P.O. .:i.....+00.../C:\.....................1.....UZ....PROGRA~1..t......O.IUZ......B...............J.....x...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....UZ....ToDesk..>......UZ..UZ...............................T.o.D.e.s.k.....`.2.....^Y.. .ToDesk.exe..F......^Y..UZ................................T.o.D.e.s.k...e.x.e.......Q...............-.......P....................C:\Program Files\ToDesk\ToDesk.exe..(.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.o.D.e.s.k.\.T.o.D.e.s.k...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.T.o.D.e.s.k.`.......X.......715575...........hT..CrF.f4... .!^N..........%..hT..CrF.f4... .!^N..........%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	106408
Entropy (8bit):	4.029135252425551
Encrypted:	false
SSDEEP:	1536:3okpa6ermSgdwffVhziGGmnocFLcSKPuenr7h:Ykpa6ermSgdodhzircFLcuCrV
MD5:	D11E9099B02C8C130220915C8578C567
SHA1:	25B1DFA23638C9E362F42C68DB1F4EF83791DB0B
SHA-256:	1EAD6F80A6BE8C00A8CD12F47A42B3B97F86B2743E9D8444816013915EB865C2
SHA-512:	63E7AA6A282CC5732BE3E2B24A3D84199E6618581B699654A4FF009D0A3F9A4DAE6442DB16F4D7CACE9B5A530DE4D9DBD600B949EA6224D83E864F27F5BD934C
Malicious:	false
Preview:	....h... .......X.......P...........X...Z.......`...................@...X.......e.n.-.C.H.;.e.n.-.G.B............... ..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................c.a.l.i.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................... ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................c.a.l.i..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	105816
Entropy (8bit):	4.032620808455981
Encrypted:	false
SSDEEP:	1536:dGkaSG7ttLdYKnduhLi06G/n5QmF4/zFaMKRZSve:ska57HLdYKYhLi0qmF4bEnZt
MD5:	B749F74811EC656470B06BCC07B92225
SHA1:	09FE52076929639A08A996E1983FD1E9E4D26B02
SHA-256:	287D27749FA5D8EAF70176E08D8B5DFF45744B03683C842F00AADB48A8DA32F3
SHA-512:	4B169EA2C18EA1D755093C61B6A18DF061DCDAF3AA2319D9D5DC4A117234B7BCCA26B75B193CFCBFA64A557AEE3BA56CB7C4EA4D8C7964255764E70143477394
Malicious:	false
Preview:	....h... ...X...........P...............Z...p...`...........P..........X.......e.n.-.C.H.;.e.n.-.G.B.............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................c.a.l.i.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................... ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................c.a.l.i..

C:\Users\user\AppData\Local\Temp\MSI2A0D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA621.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA690.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA6B0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA6C0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA78D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIA7BC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\BgWorker.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	3.5703691140729785
Encrypted:	false
SSDEEP:	24:eFGS1pryjInCLWEhvaM9NUH+/ghluzarTEmpxhpYk3YkDS3O:i1pry06W+d9N42sluzarfpYw4
MD5:	33EC04738007E665059CF40BC0F0C22B
SHA1:	4196759A922E333D9B17BDA5369F14C33CD5E3BC
SHA-256:	50F735AB8F3473423E6873D628150BBC0777BE7B4F6405247CDDF22BB00FB6BE
SHA-512:	2318B01F0C2F2F021A618CA3E6E5C24A94DF5D00154766B77160203B8B0A177C8581C7B688FFE69BE93A69BC7FD06B8A589844D42447F5060FB4BCF94D8A9AEF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.4.'.Z.'.Z.'.Z.'.[.+.Z.....".Z.s.k.&.Z...^.&.Z.Rich'.Z.................PE..L......J...........!......................... ...............................0..........................................K...4...<............................ ..(.......................................................4............................text............................... ..`.reloc..B.... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\SimpleSC.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1122128
Entropy (8bit):	6.64475397399402
Encrypted:	false
SSDEEP:	12288:kRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6/:kBsmyVS151oCmJKE1dv0DX6
MD5:	C487D2C2B0F893D6CD2F5AC4589A3480
SHA1:	AD5D8F74DC98B13CB965045BEEA03F55EC75A557
SHA-256:	0AE19F11AAC80C578784D345DCCBE8288D5B39DCC53532498E4829E92BF3F848
SHA-512:	AFAE8CE314F92A928343247824701A1734E7C03DCB2942FD8616105185763699E0CD1E00BF57C72C80841149DD2205679941DEC7B4FF660AD2DCC27447321E4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...9.`............................L........ ....@.....................................................................................2..............P/......@f......................................................X............................text............................... ..`.itext..d........................... ..`.data...x;... ...<..................@....bss....@d...`...........................idata...............<..............@....didata..............L..............@....edata...............N..............@..@.rdata..E............T..............@..@.reloc..@f.......h...V..............@..B.rsrc....2.......2..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\System.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.737504888129487
Encrypted:	false
SSDEEP:	192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
MD5:	8CF2AC271D7679B1D68EEFC1AE0C5618
SHA1:	7CC1CAAA747EE16DC894A600A4256F64FA65A9B8
SHA-256:	6950991102462D84FDC0E3B0AE30C95AF8C192F77CE3D78E8D54E6B22F7C09BA
SHA-512:	CE828FB9ECD7655CC4C974F78F209D3326BA71CED60171A45A437FC3FFF3BD0D69A0997ADACA29265C7B5419BDEA2B17F8CC8CEAE1B8CE6B22B7ED9120BB5AD3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L......]...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text...O .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\killer.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22200
Entropy (8bit):	6.767884035254301
Encrypted:	false
SSDEEP:	384:jUKZ+TwlGGZSZjnYPLdy7EZJXDENZSZSR0fGZsHLs08JN77hh9d:jDgFey7wod0fj23hbd
MD5:	7D432F79D4E0AC02D41CA3A04FEA8767
SHA1:	0EF90E92BB447AD8670385B8147695A98FDC031F
SHA-256:	2B4E543B07A9E74F571D50EACF6B33E44C36E428816B39E955DB10D315606585
SHA-512:	8B86A2DD2348C59F52E3D7F3994A093D812B3137ED518CCC3C7867C1A057B383A71615113F018544D15C68A40C6226D51F210EBD924B6F67ED6DD523AF95A078
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uxxT1...1...1...<K..0...<K..3.......6...1...#.......5.......0...<K..0.......0...Rich1...................PE..L.....DW...........!......................... ...............................p...........@.......................... ..d.... ..P....P...................>...`....................................................... ..P............................text............................... ..`.rdata....... ......................@..@.data...$....0......................@....CRT.........@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\logo.ico

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	42991
Entropy (8bit):	7.963653656884613
Encrypted:	false
SSDEEP:	768:fEo8iwgIAzA7JjMLQEb+dEYi/YYoA7WjXrwnV:fEo8iw+zSjY5+OJV3WAV
MD5:	C0476E6FC096ECFBDB5FFE55AC66C770
SHA1:	9C79A72A1DB60A1BBBF4CDAA6CC0F29915D052CB
SHA-256:	0BCA8AD1AA4614944F5C520C57D7AF1437A99BC9E09E31E6AB95BA83E9A33A3D
SHA-512:	0D03DB8AFD11273943A5D1636178169337BCB177346BAFFE4DA543F56E1D28E75BA7293808AC61F99A414E608F25F0F6922E93C029D4C04F6614E671A0A05E68
Malicious:	false
Preview:	............ .........PNG........IHDR.............\r.f....IDATx..}..dE...^..3.3....V.......!&.E...w&DE$....t.xF.........%-H^..6..........^OwOO..}....K.......+..jP...D...5.A..'=..<xp.!.D..\|J.....m/g..l;..l..........n..p.'......;&....!...m.a.w...[.b....Z...!.$...CCCgx.w..se .x$..z.P.9.......>1...'k?4.,q.(p.`...L....\|>?..d..u.b..8......8....EO...$.1.k+c.Tkkk ..<..mj..G.l..D"....1......z.i1.I......b_.liiy$......i..O.T......pioo.w....'..0..6.zYWWW.I.u.nO..<..'FGG3.......=.IO......k.1{m..3Z..4.II....'..\|......022rL>...I.dC.7h1.k.....P(..'.O............c...A. ..H$..===.}2D..k.8t..2......W.4.CL......._....n.\|.p......h8.n...T3..rw...............u......{y...........B/...x..m........;...;..xi.....1...B...f.\|..m.....088..x<.4.yy.....MMM.1.J=..3....a..L.....=...n......r..&''...zR..2.:l..i..uvv6...#...=..u.]###i..<..m......4........mi.S.(.C...t...=.n.\|.p..dgW7q.4.-.z.GizD.@..m.....044._.... P.4.G..........w[.C.3.x..8...A.5Qf.............L....nF......!N.

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsExec.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.256947539891654
Encrypted:	false
SSDEEP:	96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
MD5:	F27689C513E7D12C7C974D5F8EF710D6
SHA1:	E305F2A2898D765A64C82C449DFB528665B4A892
SHA-256:	1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
SHA-512:	734E9F3989EE47A86BEE16838DF7A09353C7FE085A09D77E70D281B21C5477B0B061616E72E8AC8FCB3DDA1DF0D5152F54DCC4C5A77F90FBF0F857557BF02FBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L......]...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsNiuniuSkin.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	294400
Entropy (8bit):	7.922933703671643
Encrypted:	false
SSDEEP:	6144:EfuMPhou62ZrZxAxgGTpMayh91VDrH10nCRwbDB0Q5MeKxhwNsN:M3hC2lZxAxSpRbWnmADBpM+iN
MD5:	BB0CDFF5AC2D64723007A0B4F7962A02
SHA1:	410889522EE8EA7308B054F71BC4CAB078295E06
SHA-256:	33E460A080A621CDA7896E96B6F1BEEE802B485CF99E18B27463CD362C484B08
SHA-512:	B4DC2614F01F5F01D5DEC9E6A41E072D01E924D8A94AC0DC1050399FD1DC3CC8D53D7CCF162D750D166FCA200771B0850191B30C7CAADA8EDEA9BA6D686E2402
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._..1..1..1..6....1.....1..6....1..6..w.1.....1.....1.....1..0...1..6...1..6...1..6...1..6...1.Rich.1.................PE..L......d...........!.....@.......@..P....P...........................................\....@.........................L...D.......X....................R...,.............................................H...........................................UPX0.....@..............................UPX1.....@...P...@..................@....rsrc................D..............@......................................................................................................................................................................................................................................................................................................................................................................2.02.UPX!....

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\nsSCM.dll

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21688
Entropy (8bit):	6.879941171286156
Encrypted:	false
SSDEEP:	384:tnv43Y4lH5heTZSZjnYPLdy7EZJQ2ZSZSR0fGZsHLFybs8JN77hh3:treey700fjFe3ht
MD5:	C68ACA71E85B9615C16C45A3437B5558
SHA1:	DF730FF499AA20D2C74E2273DD13EE79E07EBF16
SHA-256:	00E701893AF9204D3E9669539BD47FD00E954C5583492B97647EFF7811D55181
SHA-512:	83420B444D35B7BECC11CD3EFCB02EB98BCC358F7649E745110E0C2ED03893414BDDD1F92F600D2E00B21695D4D4388360287E92D50DB2726CBD79546F61FCA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.w.1...1...1...1...?...S...6......0...7...0......0...Rich1...........................PE..L......B...........!......................... ...............................P......................................."......X ..P........................>...@....................................................... ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm2FF3.tmp\skin.zip

Download File

Process:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	750966
Entropy (8bit):	7.9915122821530895
Encrypted:	true
SSDEEP:	12288:Hw+KAT8alkacATdefeWU/hK4lTp+77YTStyx038GusKjWU/yK4lTDPaGWzMIMrwi:Hw+KATNTcATofe5/hh0zs+8sKj5/yhl3
MD5:	49BE7F488CE24A9FD651C0723D383DA6
SHA1:	61AE0ABF587DC451CED63057F9D203D32EC0444A
SHA-256:	F8C53FEDABEA48B40BFE0CCBE3F54B712383CA3B1C4C28F2E2E7EAB6693FEB88
SHA-512:	935C32F349ED7746C0D9016FD58BE3E2E170B495A8A15C3BA6566778641C81F6BE9C4BCEB2F199BC70917364624391C4AF036ADA805C107AEFB85E8B553740D9
Malicious:	false
Preview:	PK........B}.Y..v.....G.......configpage.xml.W...@.^+..1....5..Z..t...A.d..N22.Xu.B.N.TD.".....7D\|......I..VE].6.%9.9..w.........g\|..F,.4..6]UP.P......q....ic...\:..VQ...FC..W../~}0.?.Q..t.(b.;69h...W..j>e.I...Ck..t..Nb...:......8....v.lU.)v..Y..m..........#.B......V.bL...8.....a_.5..S.a.Zk...l..W...1..S_U......t..!.......q...e.l...".r..Gg.C.e0.e..#..l...F.=H#.xp.....i...A.2.p........'b..........e....G...&.......Z...`7......CnqH.s0,.V~ROu#K_k.]..#.v..4,1.......}U.n..).>eH.v...&!..\i.r'..O.>.Hf....7.c...8...v.f....U.G...7...F...}.N.......C..V.n.OVg.(......... f..:....ij...d..3C<bA..pFJf?"....0..A..G.A.@a....G...e.\|y5[<....\.....4.<.KL...a.k..O..).n.-]..jG2_.......sN..........,sUX..s....o%..`..V..W._...jA.!... .YH=..r.J.nK...QF.x.9......;.g..J...8.*....R...sK. .%A/...v.........../.f?a.........I..\|~F).O.~.....7...x.".1[..._S..S..i.....8.w...)}....b..6..ZU.\|I..%...V....W.s.8.a...e0..d.T.^.......r$...rv....8..8.Q..k.@.[.........P..!..I~..u..

C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\MSVCP140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	627992
Entropy (8bit):	6.360523442335369
Encrypted:	false
SSDEEP:	12288:dO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFt:s3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOo
MD5:	C1B066F9E3E2F3A6785161A8C7E0346A
SHA1:	8B3B943E79C40BC81FDAC1E038A276D034BBE812
SHA-256:	99E3E25CDA404283FBD96B25B7683A8D213E7954674ADEFA2279123A8D0701FD
SHA-512:	36F9E6C86AFBD80375295238B67E4F472EB86FCB84A590D8DBA928D4E7A502D4F903971827FDC331353E5B3D06616664450759432FDC8D304A56E7DACB84B728
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`..r$..!$..!$..!.O.!&..!-.\|!2..!v.. '..!$..!...!v.. '..!v.. o..!v.. j..!v.. %..!v..!%..!v.. %..!Rich$..!................PE..d.....0].........." .........`...... ...............................................T.....`A............................................h....................0..t@...T...A..............8............................................ ..........@....................text...<........................... ..`.rdata..<.... ......................@..@.data....;..........................@....pdata..t@...0...B..................@..@.didat..h............B..............@....rsrc................D..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................

C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4675512
Entropy (8bit):	7.790138974283466
Encrypted:	false
SSDEEP:	98304:OFwVVMQ3tGIp5eVsJvLqRyBrzfs4nZTvvhs2s57ATKer:OO7ntGYxqRExnZTv5Ts57ATKk
MD5:	9980BA3F5506EF42212CF1D44C66757D
SHA1:	10099532D767750800EA016C0AE8AF608D954AC2
SHA-256:	361A560E47C995D87EBC07A916BF796C32175F6EAF862124047190A10EE08803
SHA-512:	BDD3926FAA642A23A89A5B7AD1CCD2376EC8D6DE8A0584D6E6A87001D7B4A8A9BA305A838276E652C21733E82286733803A40E78922980C650A9F2FF6BDF228D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...hazg.........."..........p......g.O........@..............................p.......G...`.........................................p^M.......,.......h.o.....g.T<....G..)....g.....................................p.g.8.............L.x............................text............................... ..`.rdata..z...........................@..@.data...8...........................@....pdata..............................@..@_RDATA..............................@..@.vmp0.....'.........................`..h.vmp1.....>..`)...>.................`..h.reloc........g.......>.............@..@.rsrc...o.....h.......>.............@..@........................................................................................................................................................................................................................................................

C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\UnityPlayer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210822752
Entropy (8bit):	0.004525985504646134
Encrypted:	false
SSDEEP:
MD5:	726C1BAD02AE07BDF487EC401B52243F
SHA1:	D2BB062F1E2085B08B01328915CA061424AF1AAA
SHA-256:	628BF5F96ACE4ECD8DBA1C2B0C84D7C1C80FD1521BAA5C47B60E95CA5A8F9713
SHA-512:	24CED2994650557695A157822518E98658BFBAD65A2647BEA082C26F0079073D6D9F48F26B3EB782CE2992352B8AFD03D061ED381A031DF6D287AFFBF727EEA8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X...............N.....N.....N.....N.....W.......j............~........Rich..................PE..d...+).g.........." .....v...J......\y....................................................`.........................................`...L......................(.......`(.............8...............................8............................................text....u.......v.................. ..`.rdata.../.......0...z..............@..@.data...............................@....pdata..(..........................@..@.rsrc...............................@..@.reloc.............................@..B................................................................................................................................................................................................................................................

C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\VCRUNTIME140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119376
Entropy (8bit):	6.605105564769165
Encrypted:	false
SSDEEP:	1536:BqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbHecbWcmpCGtodMzDZ92zfa:BqvQFDUXqWn7CkRG7jecbWb9toaera
MD5:	E9B690FBE5C4B96871214379659DD928
SHA1:	C199A4BEAC341ABC218257080B741ADA0FADECAF
SHA-256:	A06C9EA4F815DAC75D2C99684D433FBFC782010FAE887837A03F085A29A217E8
SHA-512:	00CF9B22AF6EBBC20D1B9C22FC4261394B7D98CCAD4823ABC5CA6FDAC537B43A00DB5B3829C304A85738BE5107927C0761C8276D6CB7F80E90F0A2C991DBCD8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.... ............" ...&. ...d.......................................................:....`A.........................................e..4...4m..........................PP...........N..p............................L..@............0...............................text...V........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\data.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 605 x 390, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	563501
Entropy (8bit):	7.995374890831447
Encrypted:	true
SSDEEP:	12288:tiTfEJiX3KaRppbIamFdC4aq5Jv1T+XjsGUdKu/IF:WX3Ke74aqposGAKOs
MD5:	528315C4F9824C4B91FE40B9531DA9FD
SHA1:	9E87646C7EC3F86D6FAE217F028EEC8C5DF32B71
SHA-256:	C7A5F682B35AF092C446D4E818912D641A2731D5D4D9FAEDE567F72DF10BCEED
SHA-512:	A8EE4CB7A475EEC65979EDE74C5D8A078970F634743DBB93C20D77C9FF96C1D02F24F3155ACC0E83BF35562E2C6FC36C324BC48E7676939BD64818FFC096398D
Malicious:	false
Preview:	.PNG........IHDR...]................pHYs...%...%.IR$.....tEXtSoftware.Snipaste]..... .IDATx..W.$;.%..={...b.2.p.....+.euO1_.07..Ah........#D "b&"&.G"".c.1@...>33.~%".j&....{eK../.ML..9...t..5.3.Hd... ..[.....i..T..]... &f.....L..cP.OG...%.......>....D..g"..W.gV.. ..""..1+.^.....{T.......J...>.!.....yq.N../..f.6../...4.EL{0.@7L"F.(ha.y.A..1V....B.L.V..g.D..vs..<t ..'..~`.q!..p!$.zD$d.IB...Y.~..B......>...w......9...`..<..EA.....0./....`....BoI..^p!.h....h.<.....Ls%..g.\.C.i~,.\|Uh.VTq.1F.7..{-.6..-.....I....Z...%)C.\l\.yoX.KT.....?..k.......9....r..>l.......Z5?..+.\.P1.....!...L6....'.( ....33.$$.......h..1Q.r.e4...IhFI.Z........"d .^.0q.KQ..j..W........#....W..D..0K..h...K.........#MqW3]...\q{..*....R.m...H..."..a6O...pNs._N.......I1.@Nc.}.W0}.... b83.2.b...c.......jod5<F.o@5..Wc.4.Ekr.e.?dXb. .H=..PFU,..(..4....D.uk!lp.P.....(E}.r.......<.9.?.}.....i(.....t.&x.`_e..}./.i.SZ.....;..md'X._...Q..........j..:.G...../6...H..DJ......k..`.a.9..

C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\vcruntime140_1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.675573056871668
Encrypted:	false
SSDEEP:	768:oPIyGVrxmKqOnA4j3z6S2X7pudLAivD9zigElY7ivD9zG:XBr87uWFLpudBvpziZ1vpzG
MD5:	EB49C1D33B41EB49DFED58AAFA9B9A8F
SHA1:	61786EB9F3F996D85A5F5EEA4C555093DD0DAAB6
SHA-256:	6D3A6CDE6FC4D3C79AABF785C04D2736A3E2FD9B0366C9B741F054A13ECD939E
SHA-512:	D15905A3D7203B00181609F47CE6E4B9591A629F2BF26FF33BF964F320371E06D535912FDA13987610B76A85C65C659ADAC62F6B3176DBCA91A01374178CD5C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....=..........." ...&.<...8.......B....................................................`A........................................Pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\view.res

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 605 x 390, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	376113
Entropy (8bit):	7.990046491814966
Encrypted:	true
SSDEEP:	6144:7piTBrVIz5riKchYiO74nKaQ5DqeipZxIaUdzB7DTVH+niw03KvVfjfwYI+yBy7a:tiTfEJiX3KaRppbIaszB/TVH+iujfwY6
MD5:	A57B2F23B5884386A33AC9715B8798F6
SHA1:	F4EA5BDD2685C91DCFD917FC0ADD695B1CB9EE62
SHA-256:	D258DF1A8FD7C29D40F5BDC2B089C2AC7EDB3FFEF99A58454A0F88064DC6225A
SHA-512:	90628283FD0D90C407C6D837227B11CF7DBB0BE3433AF258D0841717D9C528A29ACCFB1B3F7FE8F0EEC8448B3F222D4BABB79D70DD7321B74CBADE742DA9CB09
Malicious:	false
Preview:	.PNG........IHDR...]................pHYs...%...%.IR$.....tEXtSoftware.Snipaste]..... .IDATx..W.$;.%..={...b.2.p.....+.euO1_.07..Ah........#D "b&"&.G"".c.1@...>33.~%".j&....{eK../.ML..9...t..5.3.Hd... ..[.....i..T..]... &f.....L..cP.OG...%.......>....D..g"..W.gV.. ..""..1+.^.....{T.......J...>.!.....yq.N../..f.6../...4.EL{0.@7L"F.(ha.y.A..1V....B.L.V..g.D..vs..<t ..'..~`.q!..p!$.zD$d.IB...Y.~..B......>...w......9...`..<..EA.....0./....`....BoI..^p!.h....h.<.....Ls%..g.\.C.i~,.\|Uh.VTq.1F.7..{-.6..-.....I....Z...%)C.\l\.yoX.KT.....?..k.......9....r..>l.......Z5?..+.\.P1.....!...L6....'.( ....33.$$.......h..1Q.r.e4...IhFI.Z........"d .^.0q.KQ..j..W........#....W..D..0K..h...K.........#MqW3]...\q{..*....R.m...H..."..a6O...pNs._N.......I1.@Nc.}.W0}.... b83.2.b...c.......jod5<F.o@5..Wc.4.Ekr.e.?dXb. .H=..PFU,..(..4....D.uk!lp.P.....(E}.r.......<.9.?.}.....i(.....t.&x.`_e..}./.i.SZ.....;..md'X._...Q..........j..:.G...../6...H..DJ......k..`.a.9..

C:\Windows\Installer\4cdca2.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 936, Revision Number: {B54FEEA7-07D2-4A02-96E4-0A412A2D9E16}, Number of Words: 2, Subject: ToDesk_Setup, Author: ToDesk_Setup, Name of Creating Application: ToDesk_Setup, Template: ;2052, Comments: Installer ToDesk_Setup , Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	95763456
Entropy (8bit):	7.992916496546297
Encrypted:	true
SSDEEP:
MD5:	09FC3A5AF26388A6909A2B0643AD644E
SHA1:	83423788BB21F3A47E02F89D3E604BF135F42080
SHA-256:	0C8017E92FD56F96DA5B8F01C219D4A90F80DA94B360C59CE81618C9DF55C88B
SHA-512:	D2ECBA8FA969EF25F0CD970090147AB95505B65A7F44F1C42B4BCCCC3CB5A72DB2D8D49ED04B21075657DADAA8920D5EF934FD41BB235D701606A41E166E923E
Malicious:	false
Preview:	......................>...........................................#...........f.......?............................................................................................................................................................................................................................................................................................................................................................................................................................... ...!...............:...........!...3............................................................................................... ...+..."...#...$...%...&...'...(...)...*...1...,...-......./...0...4...2...9...=...5...6...7...8...@...;...K...<...A...>...?...@...?...B...C...D...E...F...G.......I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...........h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI8A7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	26016
Entropy (8bit):	6.625079130232321
Encrypted:	false
SSDEEP:	768:ZUvXVoSS0rfyjfj44VbvDQe/PrnPxWE5:qXVoSnrfyjf5brQ0rPx
MD5:	81902D13C01FD8A187F3A7F2B72D5DD0
SHA1:	0AC01518C5588EB2788730C78F0C581F79CF2ED4
SHA-256:	EEF31E9195CFACDE7B4E7EB7384C8178D8811063B375FD4A28AE897CC180C6A6
SHA-512:	04D6E2E937328477803084E0EF9DA2C3636CDC9D34AF74E2D1871D7190BE21CBB2771AE835175E104E24ECCBA52ADD1BA6F58407BFD522EF82B81D76E977F24C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ACj. -9. -9. -9xR,8. -9. ,9. -9j\.8. -9j\$8. -9j\-8. -9j\.9. -9. .9. -9j\/8. -9Rich. -9........PE..d.....c.........." ...".(...........................................................R....`..........................................G..l....H..<....p.......`.......B...#...... ...0A..p............................................@...............................text...#'.......(.................. ..`.rdata.......@.......,..............@..@.data........P......................@....pdata.......`.......6..............@..@.rsrc........p.......:..............@..@.reloc.. ............@..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE780.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE7DE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570784
Entropy (8bit):	6.450187144191945
Encrypted:	false
SSDEEP:	6144:X+Sud3L4YgAc8wjVMeKRtGnm3CCRloVywX9gDAOAVafv5kh4JQCmR+gj:X+SuPgAc8+MjGCCslegDiwX5vOCmR+gj
MD5:	DB7612F0FD6408D664185CFC81BEF0CB
SHA1:	19A6334EC00365B4F4E57D387ED885B32AA7C9AA
SHA-256:	E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
SHA-512:	25E129CB22AAABC68C42ECF10BB650AC4D0609B12C08703C780572BAC7ECF4559FCC49CD595C56EA48CF55260A984CFA333C08307FFB7C62268B03FBECC724B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&r.gb..4b..4b..4.a.5o..4.a.5...4-o.5s..4-o.5z..4-o.5(..4.a.5{..4.a.5c..4.a.5E..4b..4...4.o.5...4.o.5c..4.ou4c..4b..4c..4.o.5c..4Richb..4................PE..L...f.c.........."!..."............................................................q.....@.....................................,....`...................#...p...b..8Y..p....................Y......xX..@...............<............................text...6........................... ..`.rdata..X...........................@..@.data...."...0......................@....rsrc........`.......&..............@..@.reloc...b...p...d..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE927.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	27938
Entropy (8bit):	6.629537763079556
Encrypted:	false
SSDEEP:	768:PF4UvXVoSS0rfyjfj44VbvDQe/PrnPxWE5S:/XVoSnrfyjf5brQ0rPxq
MD5:	DCDB1B34AE7DCCE141F25C82361030A7
SHA1:	463455A842A63F9C4EA490DAFF9BE129BE3ED226
SHA-256:	9FE8981662B7902ADD8D77A89102CD5FD7B1A128B173D56A17E68E42E3DD7237
SHA-512:	EB30DC9EC38136E1CFD584F61635EBCD20A9801F196CE4BA1BB48A71E61F738E4FA0AFE4DD1C5F99F3013F99DA105701235285DF53CDF800677E2165446EA0DF
Malicious:	false
Preview:	...@IXOS.@.....@.yUZ.@.....@.....@.....@.....@.....@......&.{D35AFE46-73B4-4441-81DF-EDEE2029BCB9}..ToDesk_Setup$.T0pdaslk-guangwang-winelkxcac-64.msi.@.....@.....@.....@........&.{B54FEEA7-07D2-4A02-96E4-0A412A2D9E16}.....@.....@.....@.....@.......@.....@.....@.......@......ToDesk_Setup......Rollback..ck(W.V.n.d\O:.....RollbackCleanup..ck(W Rd..Y.N.e.N...e.N:. .[.1.]....@.......@........ProcessComponents..ck(W.f.e.~.N.l.Qh....@.....@.....@.]....&.{A879BE35-2F8E-470B-92C5-570B7EAF4274}1.C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\.@.......@.....@.....@......&.{668E887C-215E-477A-8E33-D58E087A0DD8}..02:\Software\ToDesk_Setup\ToDesk_Setup\Version.@.......@.....@.....@......&.{253CEC5A-F1B0-4339-AFCB-78E1847BFC0A}A.C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe.@.......@.....@.....@......&.{D31BF6B0-8ED1-4F80-BA4E-9BDE93143885}..C:\ProgramData\pwand.dll.@.......@.....@.....@........CreateFolders..ck(W.R.^.e.N9Y...e.N9Y:. .[.1.].".1.C:\Program Files (x86)\ToDesk_Set

C:\Windows\Installer\SourceHash{D35AFE46-73B4-4441-81DF-EDEE2029BCB9}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1765409427177822
Encrypted:	false
SSDEEP:	12:JSbX72Fj/AGiLIlHVRpHh/7777777777777777777777777vDHFGRlP02iLK4l0G:JJQI5jgP6oF
MD5:	A5B62E75160CA35572089337256EB16D
SHA1:	61053640A5E95C53E2642CE4B5E374299EB84DDE
SHA-256:	86054434D0727C8468987C37253DB9186003E01EB93BF5D5F70E43FDFB5B37D4
SHA-512:	5708C0758B40C05EF9987EBF68FD62C25EE054FE07CBBBC6651D04F83B0185DE9CB44E77618C664A000457102C075CE45A7335A342A2DDCBC2A54A98C83B7057
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.580517823083893
Encrypted:	false
SSDEEP:	48:18PhcuRc06WXJOjT5tzdxSkdfVAEkrCy7yoRdxSkdbTcB:Yhc1ljTD/deRCIw
MD5:	FD81C2503A74DD4500674AA52C29A29E
SHA1:	67C64D756A1E60565D75E4F39C7A3D5C5A1BDB44
SHA-256:	BF68B8F54FE802D0EEDE0BE8DB541525774322F8768AA2D8BBD6D26587D1375E
SHA-512:	2974FCB7DD9097DA22EE239EA0BC45A3109DE483D58EAB7E814F8B219A2282B6263605A29DB852477BAE0D2D9D586B210769F0A3D39E78D2C6D5D0F37B4389F0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	454234
Entropy (8bit):	5.356163335006481
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauE:zTtbmkExhMJCIpEG90D5JG81IIgMp
MD5:	F37CFFCA704B8A029020C2998B3104F7
SHA1:	B9F863CD3D1ACE18F8FF5F4CEC2E0C2C0EFD301D
SHA-256:	6CC0303DAACFD9C6FDFF7DEC0070E94C171B03D64FC5A586EFC3752DC6865D2E
SHA-512:	402159F5ABE1CDB756037D8F23400D0883B69A34B4D3906E228D6C65C071E4580FCBE290CFEC5BEC621523EB9808899E5C2182647D68E1916C9C44FB2F41DF0D
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.2467809882852334
Encrypted:	false
SSDEEP:	48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF74v+AAHdKoqKFxcxkFj:cEOB+AAsoJjykePE4+AAsoJjyk5
MD5:	9DC82B21F9832530E684C5F84148939C
SHA1:	9E547BBDC2BE8A3747E410D54DE5546C813BEA2A
SHA-256:	0CFB4B3BB4991730019DE86027EE35E69B4835FF39C1B6A3C9800C2B79959C3F
SHA-512:	DA6BB1385973BB271D6DE633CFB7121B6A66A82EFF7FBCE8C9F668775853FCC60E16CFAB89C055571AD7072C0387B02B954534AC0DEC1D4C935FE05ECC1D0272
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\Temp\~DF12CF867D77C212EA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.14268426223619612
Encrypted:	false
SSDEEP:	24:pEQBkTx+dI5WipV+dI5U+dI5WipV+dI5WVAEV+/jCybfVKwGyWKOoz+Mqb:pByT4dxSkd2dxSkdfVAEkrCy7yoz
MD5:	D3688D7258055DDBD1FBF8E479288770
SHA1:	07AF8BF5BD553467CF1E7382212795A5CCB3EFC2
SHA-256:	B86DAC5D09C4C9B3FF00A3C4DBEFFCE76DC45BBFC39389CA53BC6C33B44085E9
SHA-512:	62B8FB09D61AE4D5E3EA2942E29DAF3AFB5FAA19FF3C302C587C73269752E3D2069FBDF164C57699E5995EF2AE54BB60E8DF8E9D7227DADBE58F28F68C831E35
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF178A567A94B68A96.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2649977283335667
Encrypted:	false
SSDEEP:	48:qtUu8I+CFXJpT5EjzdxSkdfVAEkrCy7yoRdxSkdbTcB:eUgBTuj/deRCIw
MD5:	FC049229736FD0D5103F3BF4DAD2E969
SHA1:	192F2853A1D5C05932AD4233DFB7BAC5AE03E8C8
SHA-256:	B8E6885FC950EEBDC345E758F16F1DC9639C91C274AF39D5F510391D168DF621
SHA-512:	F0902892D2D90DBF5693C8A69A21FC141838B5337277FEE588CA081C31D83ED688821BC8D1779F45B959DAFE611C8F733802AF2DF47FE9839EA185A0A3B16F2C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF408330F388389880.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF410B59C1BAB32B4B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4B65DA2B05D93D0B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.580517823083893
Encrypted:	false
SSDEEP:	48:18PhcuRc06WXJOjT5tzdxSkdfVAEkrCy7yoRdxSkdbTcB:Yhc1ljTD/deRCIw
MD5:	FD81C2503A74DD4500674AA52C29A29E
SHA1:	67C64D756A1E60565D75E4F39C7A3D5C5A1BDB44
SHA-256:	BF68B8F54FE802D0EEDE0BE8DB541525774322F8768AA2D8BBD6D26587D1375E
SHA-512:	2974FCB7DD9097DA22EE239EA0BC45A3109DE483D58EAB7E814F8B219A2282B6263605A29DB852477BAE0D2D9D586B210769F0A3D39E78D2C6D5D0F37B4389F0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF692D991500287B99.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.580517823083893
Encrypted:	false
SSDEEP:	48:18PhcuRc06WXJOjT5tzdxSkdfVAEkrCy7yoRdxSkdbTcB:Yhc1ljTD/deRCIw
MD5:	FD81C2503A74DD4500674AA52C29A29E
SHA1:	67C64D756A1E60565D75E4F39C7A3D5C5A1BDB44
SHA-256:	BF68B8F54FE802D0EEDE0BE8DB541525774322F8768AA2D8BBD6D26587D1375E
SHA-512:	2974FCB7DD9097DA22EE239EA0BC45A3109DE483D58EAB7E814F8B219A2282B6263605A29DB852477BAE0D2D9D586B210769F0A3D39E78D2C6D5D0F37B4389F0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7397F1D1628116E9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.08076038960291616
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOGRVjPmJ2C3L4JVTYVky6l4:2F0i8n0itFzDHFGRlP02iLK4
MD5:	908F146E613DDB80F9C3BC6BD3075924
SHA1:	7EBABD28AA66D533407F3A01D87D8995D488FE71
SHA-256:	3243FA52614E39C58BC5398BE1606ECBD37080470373A742BF516F57C8C521BD
SHA-512:	C6B573F6127EDB1F91AF7AEA2CEA69DB911E98FC8B0AF6B8D879BA19227CBD9ACE6C2B9E81CADED68E3E7369B6E7FBBAF2A28F2111B803E38701DA3A25D6AA40
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9A4F593F874673CA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2649977283335667
Encrypted:	false
SSDEEP:	48:qtUu8I+CFXJpT5EjzdxSkdfVAEkrCy7yoRdxSkdbTcB:eUgBTuj/deRCIw
MD5:	FC049229736FD0D5103F3BF4DAD2E969
SHA1:	192F2853A1D5C05932AD4233DFB7BAC5AE03E8C8
SHA-256:	B8E6885FC950EEBDC345E758F16F1DC9639C91C274AF39D5F510391D168DF621
SHA-512:	F0902892D2D90DBF5693C8A69A21FC141838B5337277FEE588CA081C31D83ED688821BC8D1779F45B959DAFE611C8F733802AF2DF47FE9839EA185A0A3B16F2C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB2EC7DB4B877F483.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF38DAB2E6BCB8636.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF5EE8D7199F0B875.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2649977283335667
Encrypted:	false
SSDEEP:	48:qtUu8I+CFXJpT5EjzdxSkdfVAEkrCy7yoRdxSkdbTcB:eUgBTuj/deRCIw
MD5:	FC049229736FD0D5103F3BF4DAD2E969
SHA1:	192F2853A1D5C05932AD4233DFB7BAC5AE03E8C8
SHA-256:	B8E6885FC950EEBDC345E758F16F1DC9639C91C274AF39D5F510391D168DF621
SHA-512:	F0902892D2D90DBF5693C8A69A21FC141838B5337277FEE588CA081C31D83ED688821BC8D1779F45B959DAFE611C8F733802AF2DF47FE9839EA185A0A3B16F2C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFF04A9B6715859E0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 936, Revision Number: {B54FEEA7-07D2-4A02-96E4-0A412A2D9E16}, Number of Words: 2, Subject: ToDesk_Setup, Author: ToDesk_Setup, Name of Creating Application: ToDesk_Setup, Template: ;2052, Comments: Installer ToDesk_Setup , Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.992916496546297
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	T0pdaslk-guangwang-winelkxcac-64.msi
File size:	95'763'456 bytes
MD5:	09fc3a5af26388a6909a2b0643ad644e
SHA1:	83423788bb21f3a47e02f89d3e604bf135f42080
SHA256:	0c8017e92fd56f96da5b8f01c219d4a90f80da94b360c59ce81618c9df55c88b
SHA512:	d2ecba8fa969ef25f0cd970090147ab95505b65a7f44f1c42b4bcccc3cb5a72db2d8d49ed04b21075657dadaa8920d5ef934fd41bb235d701606a41e166e923e
SSDEEP:	1572864:bnYoF8GzRDf3KGtWRmnNt3T6AkczyKEjIJnPxPsbtTHQWv3i/B5E:bTF8Gt2I9NtmYyKEjIZJPE9QWvSp
TLSH:	CE283331F1766D99E62F67BFA0A85FC88430BC90771BDEA763783FA149B16861071903
File Content Preview:	........................>...........................................#...........f.......?......................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-21T21:13:41.718752+0100	2052875	ET MALWARE Winos4.0 Framework CnC Login Message	1	192.168.2.16	49909	47.238.100.22	4433	TCP
2025-02-21T21:14:57.137847+0100	2052875	ET MALWARE Winos4.0 Framework CnC Login Message	1	192.168.2.16	49909	47.238.100.22	4433	TCP

Network Port Distribution

Total Packets: 38
• 4433 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2025 21:13:37.220143080 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:37.225507975 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:37.225621939 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:40.640151024 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:40.645397902 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:40.645437956 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:40.645451069 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:40.645543098 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:41.193378925 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:41.243555069 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:41.713567019 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:41.718693972 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:41.718732119 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:41.718751907 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:41.718763113 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:41.718796968 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:41.723843098 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.257803917 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.257847071 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.257879972 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.257903099 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:42.264161110 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:42.269335032 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.269366980 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.269398928 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.587505102 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.587584972 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.587620974 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.587654114 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:42.587655067 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.587701082 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.587709904 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:42.587712049 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:42.587769032 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.255430937 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.255491018 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.255527020 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.255556107 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.255579948 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.255615950 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.255634069 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.255980968 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.255992889 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.256047964 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.256053925 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.256082058 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.256104946 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.256118059 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.256213903 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.256957054 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.257000923 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.257045031 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.257056952 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.257349968 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.257411003 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.257448912 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.257524014 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.257543087 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.257564068 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.257590055 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.257625103 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.705029011 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705115080 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705156088 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705190897 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705224037 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705224991 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.705256939 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.705257893 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705295086 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705317020 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.705370903 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705426931 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705429077 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:43.705461025 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705495119 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:43.705568075 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:44.372838020 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.372906923 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.372931957 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.372955084 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.372977972 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.372978926 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:44.373002052 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.373020887 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:44.373049021 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:44.821891069 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.821934938 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.821970940 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.821997881 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:44.822026968 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:44.822076082 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:45.489243031 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:45.489373922 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:45.489411116 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:45.489435911 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:45.489447117 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:45.489480972 CET	4433	49909	47.238.100.22	192.168.2.16
Feb 21, 2025 21:13:45.489495993 CET	49909	4433	192.168.2.16	47.238.100.22
Feb 21, 2025 21:13:45.489520073 CET	4433	49909	47.238.100.22	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2025 21:14:00.179972887 CET	49382	53	192.168.2.16	1.1.1.1
Feb 21, 2025 21:14:00.236278057 CET	53	49382	1.1.1.1	192.168.2.16
Feb 21, 2025 21:14:01.897497892 CET	62508	53	192.168.2.16	1.1.1.1
Feb 21, 2025 21:14:01.905682087 CET	53	62508	1.1.1.1	192.168.2.16
Feb 21, 2025 21:14:26.954314947 CET	57373	53	192.168.2.16	1.1.1.1
Feb 21, 2025 21:14:27.002777100 CET	53	57373	1.1.1.1	192.168.2.16
Feb 21, 2025 21:14:52.990061045 CET	64226	53	192.168.2.16	1.1.1.1
Feb 21, 2025 21:14:53.147459030 CET	53	64226	1.1.1.1	192.168.2.16
Feb 21, 2025 21:14:59.109533072 CET	58921	53	192.168.2.16	1.1.1.1
Feb 21, 2025 21:14:59.271090984 CET	53	58921	1.1.1.1	192.168.2.16
Feb 21, 2025 21:15:17.099879980 CET	52280	53	192.168.2.16	1.1.1.1
Feb 21, 2025 21:15:17.419904947 CET	53	52280	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 21, 2025 21:14:00.179972887 CET	192.168.2.16	1.1.1.1	0x5e33	Standard query (0)	authds.todesk.com	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:01.897497892 CET	192.168.2.16	1.1.1.1	0x88d8	Standard query (0)	authds.kylinlot.com	16	IN (0x0001)	false
Feb 21, 2025 21:14:26.954314947 CET	192.168.2.16	1.1.1.1	0x92d9	Standard query (0)	authds.kylinlot.com	16	IN (0x0001)	false
Feb 21, 2025 21:14:52.990061045 CET	192.168.2.16	1.1.1.1	0xb1cb	Standard query (0)	authds.kylinlot.com	16	IN (0x0001)	false
Feb 21, 2025 21:14:59.109533072 CET	192.168.2.16	1.1.1.1	0xd3cf	Standard query (0)	todeskcdnspeed.todesk.com	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:15:17.099879980 CET	192.168.2.16	1.1.1.1	0x3e31	Standard query (0)	authds.kylinlot.com	16	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 21, 2025 21:14:00.236278057 CET	1.1.1.1	192.168.2.16	0x5e33	No error (0)	authds.todesk.com		43.135.63.118	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:01.905682087 CET	1.1.1.1	192.168.2.16	0x88d8	No error (0)	authds.kylinlot.com			TXT (Text strings)	IN (0x0001)	false
Feb 21, 2025 21:14:27.002777100 CET	1.1.1.1	192.168.2.16	0x92d9	No error (0)	authds.kylinlot.com			TXT (Text strings)	IN (0x0001)	false
Feb 21, 2025 21:14:53.147459030 CET	1.1.1.1	192.168.2.16	0xb1cb	No error (0)	authds.kylinlot.com			TXT (Text strings)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	todeskcdnspeed.todesk.com	todeskcdnspeed.todesk.com.eo.dnse1.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	todeskcdnspeed.todesk.com.eo.dnse1.com	todeskcdnspeed.todesk.com.cdn.dnsv1.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	todeskcdnspeed.todesk.com.cdn.dnsv1.com.cn	g8e1l8qd.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.175.152.66	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.28.77	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.28.43	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.26.238	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.29.72	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		101.33.11.246	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.26.197	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.28.41	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.175.152.67	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.26.142	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.26.151	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.26.209	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.28.111	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.152.26.154	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:14:59.271090984 CET	1.1.1.1	192.168.2.16	0xd3cf	No error (0)	g8e1l8qd.ovslegodl.sched.ovscdns.com		43.175.152.62	A (IP address)	IN (0x0001)	false
Feb 21, 2025 21:15:17.419904947 CET	1.1.1.1	192.168.2.16	0x3e31	No error (0)	authds.kylinlot.com			TXT (Text strings)	IN (0x0001)	false

Target ID:	0
Start time:	15:12:51
Start date:	21/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:12:52
Start date:	21/02/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\T0pdaslk-guangwang-winelkxcac-64.msi"
Imagebase:	0x7ff6a3e60000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:12:52
Start date:	21/02/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6a3e60000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:12:52
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 897DC43AA7908FBDF146DB4280A4B33E C
Imagebase:	0xcb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:12:58
Start date:	21/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: SgrmBroker.exePID: 6200, Parent PID: 656

General

Target ID:	6
Start time:	15:12:58
Start date:	21/02/2025
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7648e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:12:58
Start date:	21/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:12:58
Start date:	21/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:12:58
Start date:	21/02/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	15:13:09
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 1D978FC4728A444D05DF5DFC6F0CB94A
Imagebase:	0xcb0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: msiexec.exePID: 7088, Parent PID: 7016

General

Target ID:	12
Start time:	15:13:17
Start date:	21/02/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\MsiExec.exe -Embedding A42AD45622494486CAE464114BFDCC7F
Imagebase:	0x7ff6a3e60000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	15:13:23
Start date:	21/02/2025
Path:	C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\Microsoft_Xtools.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\E18E9999-38FB-4B56-A9DC-92053E34C6FB\\Microsoft_Xtools.exe"
Imagebase:	0x7ff6d9ed0000
File size:	4'675'512 bytes
MD5 hash:	9980BA3F5506EF42212CF1D44C66757D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000D.00000002.1586294361.000001EADCDE4000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000D.00000002.1587648854.000001EADE820000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:13:26
Start date:	21/02/2025
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff71ebd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000E.00000003.2019014454.000000000C199000.00000004.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	15:13:26
Start date:	21/02/2025
Path:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe"
Imagebase:	0x400000
File size:	88'336'056 bytes
MD5 hash:	C352B397CC1BF792AE368F562AAA19BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Analysis Process: ToDesk_Setup.exePID: 2460, Parent PID: 4380

General

Target ID:	18
Start time:	15:13:27
Start date:	21/02/2025
Path:	C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe"
Imagebase:	0x400000
File size:	88'336'056 bytes
MD5 hash:	C352B397CC1BF792AE368F562AAA19BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:13:30
Start date:	21/02/2025
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\windows\explorer.exe
Imagebase:	0x7ff71ebd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000013.00000002.2496852197.0000000000880000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000013.00000002.2460978525.0000000000420000.00000020.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Analysis Process: cmd.exePID: 6108, Parent PID: 2460

General

Target ID:	20
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c sc stop ToDesk_Service
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3168, Parent PID: 6108

General

Target ID:	21
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 3284, Parent PID: 6108

General

Target ID:	22
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop ToDesk_Service
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 5564, Parent PID: 2460

General

Target ID:	23
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c sc delete ToDesk_Service
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5000, Parent PID: 5564

General

Target ID:	24
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 2864, Parent PID: 5564

General

Target ID:	25
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc delete ToDesk_Service
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 4020, Parent PID: 2460

General

Target ID:	26
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c sc stop ToDesk_Service
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1696, Parent PID: 4020

General

Target ID:	27
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 364, Parent PID: 4020

General

Target ID:	28
Start time:	15:13:32
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop ToDesk_Service
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 6444, Parent PID: 2460

General

Target ID:	29
Start time:	15:13:33
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c sc delete ToDesk_Service
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3908, Parent PID: 6444

General

Target ID:	30
Start time:	15:13:33
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 716, Parent PID: 6444

General

Target ID:	31
Start time:	15:13:33
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc delete ToDesk_Service
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 5852, Parent PID: 2460

General

Target ID:	32
Start time:	15:13:39
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall delete rule name="ToDesk"
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1768, Parent PID: 5852

General

Target ID:	33
Start time:	15:13:39
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 1920, Parent PID: 2460

General

Target ID:	35
Start time:	15:13:40
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall delete rule name="ToDesk_Service"
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1916, Parent PID: 1920

General

Target ID:	36
Start time:	15:13:40
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 2292, Parent PID: 2460

General

Target ID:	37
Start time:	15:13:41
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall delete rule name="ToDesk_Session"
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3044, Parent PID: 2292

General

Target ID:	38
Start time:	15:13:41
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 688, Parent PID: 2460

General

Target ID:	39
Start time:	15:13:43
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="ToDesk" dir=in program="C:\Program Files\ToDesk\ToDesk.exe" edge=yes action=allow
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4856, Parent PID: 688

General

Target ID:	40
Start time:	15:13:43
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 3488, Parent PID: 2460

General

Target ID:	41
Start time:	15:13:43
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="ToDesk" dir=out program="C:\Program Files\ToDesk\ToDesk.exe" action=allow
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4712, Parent PID: 3488

General

Target ID:	42
Start time:	15:13:43
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 1980, Parent PID: 2460

General

Target ID:	43
Start time:	15:13:44
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="ToDesk_Service" dir=in program="C:\Program Files\ToDesk\ToDesk_Service.exe" edge=yes action=allow
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5144, Parent PID: 1980

General

Target ID:	44
Start time:	15:13:44
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 3744, Parent PID: 2460

General

Target ID:	45
Start time:	15:13:44
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="ToDesk_Service" dir=out program="C:\Program Files\ToDesk\ToDesk_Service.exe" action=allow
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3752, Parent PID: 3744

General

Target ID:	46
Start time:	15:13:44
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 4596, Parent PID: 2460

General

Target ID:	47
Start time:	15:13:45
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="ToDesk_Session" dir=in program="C:\Program Files\ToDesk\ToDesk_Session.exe" edge=yes action=allow
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 736, Parent PID: 4596

General

Target ID:	48
Start time:	15:13:45
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: netsh.exePID: 1596, Parent PID: 2460

General

Target ID:	49
Start time:	15:13:45
Start date:	21/02/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="ToDesk_Session" dir=out program="C:\Program Files\ToDesk\ToDesk_Session.exe" action=allow
Imagebase:	0x7ff66aaa0000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6128, Parent PID: 1596

General

Target ID:	50
Start time:	15:13:45
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: ToDesk.exePID: 4896, Parent PID: 2460

General

Target ID:	51
Start time:	15:13:46
Start date:	21/02/2025
Path:	C:\Program Files\ToDesk\ToDesk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ToDesk\ToDesk.exe"
Imagebase:	0x7ff6f9b60000
File size:	51'634'120 bytes
MD5 hash:	461C4140E0A097BFFE2EE4B8991AAB3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Analysis Process: ToDesk.exePID: 456, Parent PID: 656

General

Target ID:	52
Start time:	15:13:58
Start date:	21/02/2025
Path:	C:\Program Files\ToDesk\ToDesk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ToDesk\ToDesk.exe" --runservice
Imagebase:	0x7ff6f9b60000
File size:	51'634'120 bytes
MD5 hash:	461C4140E0A097BFFE2EE4B8991AAB3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: MpCmdRun.exePID: 3860, Parent PID: 6572

General

Target ID:	53
Start time:	15:13:58
Start date:	21/02/2025
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff715630000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4108, Parent PID: 3860

General

Target ID:	54
Start time:	15:13:58
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: ToDesk.exePID: 3948, Parent PID: 456

General

Target ID:	55
Start time:	15:14:00
Start date:	21/02/2025
Path:	C:\Program Files\ToDesk\ToDesk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ToDesk\ToDesk.exe" --hide --localPort=35600
Imagebase:	0x7ff6f9b60000
File size:	51'634'120 bytes
MD5 hash:	461C4140E0A097BFFE2EE4B8991AAB3C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: ToDesk.exePID: 5712, Parent PID: 4380

General

Target ID:	56
Start time:	15:14:27
Start date:	21/02/2025
Path:	C:\Program Files\ToDesk\ToDesk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ToDesk\ToDesk.exe"
Imagebase:	0x7ff6f9b60000
File size:	51'634'120 bytes
MD5 hash:	461C4140E0A097BFFE2EE4B8991AAB3C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: ToDesk.exePID: 72, Parent PID: 5712

General

Target ID:	58
Start time:	15:14:30
Start date:	21/02/2025
Path:	C:\Program Files\ToDesk\ToDesk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ToDesk\ToDesk.exe" --runadmin=true
Imagebase:	0x7ff6f9b60000
File size:	51'634'120 bytes
MD5 hash:	461C4140E0A097BFFE2EE4B8991AAB3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T0pdaslk-guangwang-winelkxcac-64.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4cdca3.rbs

C:\Program Files (x86)\ToDesk_Setup\ToDesk_Setup\ToDesk_Setup.exe

C:\Program Files\ToDesk\CrashReport.exe

C:\Program Files\ToDesk\Logs\servicexejnqytw_2025_02_21.log

C:\Program Files\ToDesk\ToDesk.exe

C:\Program Files\ToDesk\config.ini

C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.inf

C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys

C:\Program Files\ToDesk\drivers\cameramic\devcon.exe

C:\Program Files\ToDesk\drivers\cameramic\todeskaudio.cat

C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x64.dll

C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll

C:\Program Files\ToDesk\drivers\tdgamepad\TdGamePad.inf

C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys

Windows Analysis Report
T0pdaslk-guangwang-winelkxcac-64.msi

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre