Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
30/12/2024, 19:54
241230-ymjw9ayme1 1024/09/2024, 08:26
240924-kcchja1cla 1019/09/2024, 16:17
240919-trjptsybql 10Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
ToDesk_x64_4.7.4.8.exe
Resource
win7-20240903-en
General
-
Target
ToDesk_x64_4.7.4.8.exe
-
Size
56.3MB
-
MD5
e43eaf8183e538eb28e5dfd31ba074bc
-
SHA1
4d90bca79dbb3994fc1cf99921b1942520bee490
-
SHA256
3771d6a0594a42845193f182b177151b295e458f17749e74ae5a5320210a2fe8
-
SHA512
d43c32749ff1db235f063cc071c33af41dde25fd1c92d1fb670ad8ee0c5b7ab24f172138d7a18b0f61d9e4e959d4b765965ca3e38f0aa9cbb4e51125d6de70a5
-
SSDEEP
1572864:A4959RiO7XJ5d5crS8/JruPXzKgz5zejq4/OiV0xNnw:lT7XJ5gTJrOzKs5y//OiVwZw
Malware Config
Signatures
-
Detects PlugX payload 16 IoCs
resource yara_rule behavioral2/memory/5040-126-0x0000000000A60000-0x0000000000A9A000-memory.dmp family_plugx behavioral2/memory/2116-127-0x0000000001600000-0x000000000163A000-memory.dmp family_plugx behavioral2/memory/5080-137-0x0000000000B50000-0x0000000000B8A000-memory.dmp family_plugx behavioral2/memory/3168-138-0x00000000012E0000-0x000000000131A000-memory.dmp family_plugx behavioral2/memory/3168-152-0x00000000012E0000-0x000000000131A000-memory.dmp family_plugx behavioral2/memory/3168-151-0x00000000012E0000-0x000000000131A000-memory.dmp family_plugx behavioral2/memory/3168-155-0x00000000012E0000-0x000000000131A000-memory.dmp family_plugx behavioral2/memory/5080-153-0x0000000000B50000-0x0000000000B8A000-memory.dmp family_plugx behavioral2/memory/5040-161-0x0000000000A60000-0x0000000000A9A000-memory.dmp family_plugx behavioral2/memory/3168-150-0x00000000012E0000-0x000000000131A000-memory.dmp family_plugx behavioral2/memory/3168-139-0x00000000012E0000-0x000000000131A000-memory.dmp family_plugx behavioral2/memory/2116-174-0x0000000001600000-0x000000000163A000-memory.dmp family_plugx behavioral2/memory/4588-216-0x0000000002B30000-0x0000000002B6A000-memory.dmp family_plugx behavioral2/memory/4588-218-0x0000000002B30000-0x0000000002B6A000-memory.dmp family_plugx behavioral2/memory/4588-217-0x0000000002B30000-0x0000000002B6A000-memory.dmp family_plugx behavioral2/memory/4588-214-0x0000000002B30000-0x0000000002B6A000-memory.dmp family_plugx -
Plugx family
-
Executes dropped EXE 6 IoCs
pid Process 5040 wmicode.exe 5080 SxS.exe 1248 ToDesk.exe 2876 ToDesk.exe 1840 ToDesk.exe 228 ToDesk.exe -
Loads dropped DLL 18 IoCs
pid Process 3276 MsiExec.exe 1652 MsiExec.exe 1652 MsiExec.exe 1652 MsiExec.exe 1652 MsiExec.exe 1652 MsiExec.exe 3572 MsiExec.exe 3572 MsiExec.exe 3572 MsiExec.exe 3572 MsiExec.exe 3572 MsiExec.exe 3572 MsiExec.exe 5040 wmicode.exe 5080 SxS.exe 1248 ToDesk.exe 2876 ToDesk.exe 1840 ToDesk.exe 228 ToDesk.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\E: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\Q: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\R: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\K: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\W: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\Y: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\Z: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\L: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\V: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\I: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: ToDesk_x64_4.7.4.8.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: ToDesk_x64_4.7.4.8.exe -
Drops file in Program Files directory 32 IoCs
description ioc Process File created C:\Program Files\ToDesk\mmkv.default msiexec.exe File created C:\Program Files\ToDesk\uninst.exe msiexec.exe File created C:\Program Files\ToDesk\config.ini ToDesk.exe File created C:\Program Files\ToDesk\drivers\tdgamepad\TdGamePad.inf msiexec.exe File created C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe msiexec.exe File created C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.inf msiexec.exe File created C:\Program Files\ToDesk\CrashReport.exe msiexec.exe File created C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x64.dll msiexec.exe File created C:\Program Files\ToDesk\drivers\vhid\todeskvhid.cat msiexec.exe File created C:\Program Files\ToDesk\Tools\wmidll.dat msiexec.exe File created C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys msiexec.exe File created C:\Program Files\ToDesk\drivers\tdscreen\tdidd.cat msiexec.exe File created C:\Program Files\ToDesk\drivers\vhid\devcon.exe msiexec.exe File opened for modification C:\Program Files\ToDesk\Logs\serviceeogvutad_2024_12_30.log ToDesk.exe File created C:\Program Files\ToDesk\zrtc.dll msiexec.exe File created C:\Program Files\ToDesk\drivers\cameramic\devcon.exe msiexec.exe File created C:\Program Files\ToDesk\drivers\tdgamepad\TdGamepad.sys msiexec.exe File created C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.dll msiexec.exe File opened for modification C:\Program Files\ToDesk\Logs\sdkservicegltdmcit_2024_12_30.log ToDesk.exe File created C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.inf msiexec.exe File created C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll msiexec.exe File created C:\Program Files\ToDesk\drivers\tdgamepad\tdgamepad.cat msiexec.exe File created C:\Program Files\ToDesk\ToDesk.exe msiexec.exe File opened for modification C:\Program Files\ToDesk\config.ini ToDesk.exe File created C:\Program Files\ToDesk\drivers\cameramic\todeskaudio.cat msiexec.exe File created C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.dll msiexec.exe File created C:\Program Files\ToDesk\Tools\wmicode.exe msiexec.exe File created C:\Program Files\ToDesk\Tools\wmicodegen.dll msiexec.exe File created C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe msiexec.exe File created C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.inf msiexec.exe File created C:\Program Files\ToDesk\mmkv.default.crc msiexec.exe File opened for modification C:\Program Files\ToDesk\Logs\zrtcservicebjlkxeeb_2024_12_30.log ToDesk.exe -
Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI30EF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3288.tmp msiexec.exe File created C:\Windows\Installer\e583014.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3071.tmp msiexec.exe File created C:\Windows\Installer\e583016.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3346.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{FF125C97-8FCC-41C8-8BD8-0F17A4F0E431} msiexec.exe File opened for modification C:\Windows\Installer\MSI3219.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI32C7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3307.tmp msiexec.exe File created C:\Windows\Installer\{FF125C97-8FCC-41C8-8BD8-0F17A4F0E431}\ToDesk.exe msiexec.exe File opened for modification C:\Windows\Installer\e583014.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\{FF125C97-8FCC-41C8-8BD8-0F17A4F0E431}\ToDesk.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmicode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SxS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ToDesk_x64_4.7.4.8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f914d34881601a250000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f914d3480000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f914d348000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df914d348000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f914d34800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 25 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\SourceList\Media\1 = "Disk1;Disk1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Hainan YouQu Technology Co., Ltd\\ToDesk 4.8.4.8\\install\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\79C521FFCCF88C14B88DF0714A0F4E13 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\79C521FFCCF88C14B88DF0714A0F4E13\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\55618446287AA11419168EF299B11EAC\79C521FFCCF88C14B88DF0714A0F4E13 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\SourceList\PackageName = "ToDesk.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Hainan YouQu Technology Co., Ltd\\ToDesk 4.8.4.8\\install\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\Language = "2052" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 30003800310033004600330043004600380045003600300041004200460045000000 svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\ProductName = "ToDesk" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\PackageCode = "DA87031E272071245AB56D28732B7604" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\Version = "67633156" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\55618446287AA11419168EF299B11EAC msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79C521FFCCF88C14B88DF0714A0F4E13\SourceList msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 228 ToDesk.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3428 msiexec.exe 3428 msiexec.exe 5040 wmicode.exe 5040 wmicode.exe 2116 svchost.exe 2116 svchost.exe 5080 SxS.exe 5080 SxS.exe 5080 SxS.exe 5080 SxS.exe 3168 svchost.exe 3168 svchost.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 2876 ToDesk.exe 3168 svchost.exe 2876 ToDesk.exe 3168 svchost.exe 2876 ToDesk.exe 2876 ToDesk.exe 4588 msiexec.exe 4588 msiexec.exe 2876 ToDesk.exe 2876 ToDesk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3168 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3428 msiexec.exe Token: SeCreateTokenPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeAssignPrimaryTokenPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeLockMemoryPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeIncreaseQuotaPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeMachineAccountPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeTcbPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSecurityPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeTakeOwnershipPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeLoadDriverPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSystemProfilePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSystemtimePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeProfSingleProcessPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeIncBasePriorityPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeCreatePagefilePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeCreatePermanentPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeBackupPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeRestorePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeShutdownPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeDebugPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeAuditPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSystemEnvironmentPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeChangeNotifyPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeRemoteShutdownPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeUndockPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSyncAgentPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeEnableDelegationPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeManageVolumePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeImpersonatePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeCreateGlobalPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeCreateTokenPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeAssignPrimaryTokenPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeLockMemoryPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeIncreaseQuotaPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeMachineAccountPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeTcbPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSecurityPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeTakeOwnershipPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeLoadDriverPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSystemProfilePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSystemtimePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeProfSingleProcessPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeIncBasePriorityPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeCreatePagefilePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeCreatePermanentPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeBackupPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeRestorePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeShutdownPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeDebugPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeAuditPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSystemEnvironmentPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeChangeNotifyPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeRemoteShutdownPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeUndockPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeSyncAgentPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeEnableDelegationPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeManageVolumePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeImpersonatePrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeCreateGlobalPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeCreateTokenPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeAssignPrimaryTokenPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeLockMemoryPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeIncreaseQuotaPrivilege 960 ToDesk_x64_4.7.4.8.exe Token: SeMachineAccountPrivilege 960 ToDesk_x64_4.7.4.8.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 960 ToDesk_x64_4.7.4.8.exe 1984 msiexec.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1248 ToDesk.exe 2876 ToDesk.exe 1840 ToDesk.exe 228 ToDesk.exe 228 ToDesk.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3428 wrote to memory of 3276 3428 msiexec.exe 85 PID 3428 wrote to memory of 3276 3428 msiexec.exe 85 PID 3428 wrote to memory of 3276 3428 msiexec.exe 85 PID 960 wrote to memory of 1984 960 ToDesk_x64_4.7.4.8.exe 86 PID 960 wrote to memory of 1984 960 ToDesk_x64_4.7.4.8.exe 86 PID 960 wrote to memory of 1984 960 ToDesk_x64_4.7.4.8.exe 86 PID 3428 wrote to memory of 1652 3428 msiexec.exe 89 PID 3428 wrote to memory of 1652 3428 msiexec.exe 89 PID 3428 wrote to memory of 1652 3428 msiexec.exe 89 PID 3428 wrote to memory of 3712 3428 msiexec.exe 108 PID 3428 wrote to memory of 3712 3428 msiexec.exe 108 PID 3428 wrote to memory of 3572 3428 msiexec.exe 110 PID 3428 wrote to memory of 3572 3428 msiexec.exe 110 PID 3428 wrote to memory of 3572 3428 msiexec.exe 110 PID 3428 wrote to memory of 5040 3428 msiexec.exe 112 PID 3428 wrote to memory of 5040 3428 msiexec.exe 112 PID 3428 wrote to memory of 5040 3428 msiexec.exe 112 PID 5040 wrote to memory of 2116 5040 wmicode.exe 115 PID 5040 wrote to memory of 2116 5040 wmicode.exe 115 PID 5040 wrote to memory of 2116 5040 wmicode.exe 115 PID 5040 wrote to memory of 2116 5040 wmicode.exe 115 PID 5040 wrote to memory of 2116 5040 wmicode.exe 115 PID 5040 wrote to memory of 2116 5040 wmicode.exe 115 PID 5040 wrote to memory of 2116 5040 wmicode.exe 115 PID 5040 wrote to memory of 2116 5040 wmicode.exe 115 PID 5080 wrote to memory of 3168 5080 SxS.exe 117 PID 5080 wrote to memory of 3168 5080 SxS.exe 117 PID 5080 wrote to memory of 3168 5080 SxS.exe 117 PID 5080 wrote to memory of 3168 5080 SxS.exe 117 PID 5080 wrote to memory of 3168 5080 SxS.exe 117 PID 5080 wrote to memory of 3168 5080 SxS.exe 117 PID 5080 wrote to memory of 3168 5080 SxS.exe 117 PID 5080 wrote to memory of 3168 5080 SxS.exe 117 PID 3428 wrote to memory of 1248 3428 msiexec.exe 111 PID 3428 wrote to memory of 1248 3428 msiexec.exe 111 PID 2876 wrote to memory of 1840 2876 ToDesk.exe 119 PID 2876 wrote to memory of 1840 2876 ToDesk.exe 119 PID 2876 wrote to memory of 228 2876 ToDesk.exe 121 PID 2876 wrote to memory of 228 2876 ToDesk.exe 121 PID 3168 wrote to memory of 4588 3168 svchost.exe 122 PID 3168 wrote to memory of 4588 3168 svchost.exe 122 PID 3168 wrote to memory of 4588 3168 svchost.exe 122 PID 3168 wrote to memory of 4588 3168 svchost.exe 122 PID 3168 wrote to memory of 4588 3168 svchost.exe 122 PID 3168 wrote to memory of 4588 3168 svchost.exe 122 PID 3168 wrote to memory of 4588 3168 svchost.exe 122 PID 3168 wrote to memory of 4588 3168 svchost.exe 122 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe"C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Hainan YouQu Technology Co., Ltd\ToDesk 4.8.4.8\install\ToDesk.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup "2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1984
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C72F5FD0E2866A50ABB8F57C744CA9D8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3276
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0301A209F4205E9E68FECD8B052C789C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1652
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3712
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 69DA2104F83A159E28D867B53FEDAF722⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3572
-
-
C:\Program Files\ToDesk\ToDesk.exe"C:\Program Files\ToDesk\ToDesk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1248
-
-
C:\Program Files\ToDesk\Tools\wmicode.exe"C:\Program Files\ToDesk\Tools\wmicode.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe 100 50403⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1720
-
C:\ProgramData\NVIDIASmart\SxS.exe"C:\ProgramData\NVIDIASmart\SxS.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe 201 02⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 31683⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4588
-
-
-
C:\Program Files\ToDesk\ToDesk.exe"C:\Program Files\ToDesk\ToDesk.exe" --runservice1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files\ToDesk\ToDesk.exe"C:\Program Files\ToDesk\ToDesk.exe" --hide --localPort=356002⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1840
-
-
C:\Program Files\ToDesk\ToDesk.exe"C:\Program Files\ToDesk\ToDesk.exe" --show --localPort=356002⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD54390a8dde6a143daeaa1fb3838fa8ea7
SHA1e81d5e8d0663b2e67139ff8113c74ac0d14ef0c2
SHA2567d340c8824111373c23e3e172160eae5d577ad4f3576cf78da8a5470457da832
SHA5120599a7811d7edcfab17004d0530804e601be61e3c8d8e6a25270576fb12ff99443183c4269b2f0b1b3b4530d7632e1aa67a398a0615ee14d65938265ea2004a4
-
Filesize
48.4MB
MD585b8e15b90d8bf333f0d49c11db9b1b0
SHA170ab7088257b0121a8e39dcab2a3846923f62ac0
SHA256a9e56ee892beb3e0be3f2d412a2b4448c5a41b28fe2a15a40798faa119d4025c
SHA512844b924351752992758d881f328176f4329f8f9182ced686e51fa1fe3413b8ea3f507eac031b997b07b8886cb978655443bd6da1c018181f25ca73d4e035f64b
-
Filesize
122KB
MD5d771741bb33ab0f2f364fd10e486df33
SHA1fbb4d03ab6582627d341f76956fe995c182c98b1
SHA256d5d9fefd7a79ba0c121ba76d0cd51f9520effc490424978bd341f130ec835455
SHA51241f089d7ca755a385f68a65105e2aee0c9a34df03911746d59266db42bf3bf74372b168cebc40b034975ffe86dea93929e3a42155076bd8dcfbbefca78ba075e
-
Filesize
9KB
MD5cf23d084f48349158cb8f837a02369bd
SHA1bf2d8cee1ecbf85c29ab1ef4f157eebfb91f79e4
SHA256c9f2fd4ffc334d6e952b04b2d799714d034d6696dcff18c39f7e597ab9279451
SHA51248624f2e085dee127dc3499465ac1500d1daa8759e705af24a6f8dcfc417929a47ef973a62b79065312a2e5cda35819ef81c3fd98e62ea48c4db993943da545e
-
Filesize
130KB
MD5b1231c5483c4e1ac2e4832047364355d
SHA137b697dbee932d6cfc813ef91a8014c129df44e7
SHA25619795c19808560ea7f8595c77bf00f6db848479469ee9255bd80ee564e34867b
SHA512edee0b31b1b391baeba69bfec883de659a7aec9cf33c46d88dbbb389b9ebbf07ee4d4fcc8acd13ca611c8c16bdbd3b015834577f0b8f6dc55ab7315b6051df62
-
Filesize
98B
MD5a827ce443c1de31e595c7a9a21f7bde3
SHA16643bcb0aec960b3ca51d0e5e3f7fc8fe98f321e
SHA25664c5e1a26c85d2775c56b9612d4923286e1aba7a9df2a11663f177848c775f44
SHA512eec653335cc33af41d370ccc08cd9cc9f5df51b169b7dbb93d7fb414829815ac96aae172b34337b48433e85fcdb7c3cb10a10e25581c112de978637154d77ce7
-
Filesize
225B
MD5daab74df217e0c877b424d1de09ca8da
SHA1e912566ca7c58439d4a5c306a3a8ebb53d4646a1
SHA256590b652b2489e4eb26e77568ad8b466fa95f28b6eb73dfc791a5db78396b3656
SHA5126972005c0b8e9e4472fb561c4ceae253d381e07843f9f17a73d532f922d59058962ee80a769a6c518cc0a43ecd97204a2295a3f91da8ad136bef2a676a76dc23
-
Filesize
420B
MD5b1ca84bb4a7a62232c3b399a39b9c7e2
SHA1d24bc69f5b3cc0540ab13baeee7a32fdec3ebff0
SHA2565027504f456bd0f0deb468df46cad8cf976a01c871c4fb79654c0fa0d20eee0a
SHA5125e5465f15bd75d36331faad924a2c22d9793ba51eccc3a2f8cfce2b9927924da8026f8c166d340df3f10239e4ea9616f9993ee261bb88377e29ac4795a4bfe39
-
Filesize
49.3MB
MD5fab94e3b080e8d2dfc21b37278f73eb8
SHA173c55c05f53b9ead97a4a6acd497860efc119ca8
SHA256d3f9c273b420be3ce59a8526d11827009215f559b39291844e3f98d8306c9a69
SHA51241eb4ddb54e2e8d3e21921c06a83aa0e59cd371eaeda0708cea27a1f42e05df6e5b4aa7f8cef4d6c3185ac71e48a405f2e44c972341a9961ab8e06f91ccc0f3a
-
Filesize
349KB
MD58752c01d76bc7b3a38b6acaf5b9c387b
SHA18c7b2b5ffdf3c46d2e9a5803f3b8ac20533e7778
SHA256344abeb71ddccfdb70786849cca660982fd2ab099dcd74fd0d608a05139c8db1
SHA5125a88de5be489088d8108dc45903e5d8368b53109c45646ab14ffe8fff41d5e3f5d19dc13ee1394dedb494e36f76824424602c8c65c6227741c952c2ffb7f4a0f
-
Filesize
1.5MB
MD5fd114784173437f9c5f462c62751fc63
SHA1a34e669da0342deb4c8fcbb27fb07bf604ee2a26
SHA256e7e55be0c02d71e4188782471402557e7bbbaab85cdd95dfd08aa5b16a49f6a2
SHA512086e63466761b326ff1749bffd11a1361c0171a62018e525ae35e7838b15db34b8df32e5abbe5e10f05926eb4ff221531d685c23a84aa4a56d565c178df8b845
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
566KB
MD50e4db22ddc7c96801b65bc13e3a53455
SHA1775da57600792fb18cd0e9626afc53bb2ba07abf
SHA256675f7d999bf17ceedcd799bdf1b2fb02cc560cdc18c0609aa92eca0cd3a98961
SHA51288ddb37880af878eddf7b82c919285dcec6360cea81c3755efeec7d0fb92c4e7ffe96ec654046ec9a4c6f1087d4e95b440b745621921041676bdc170663f3772
-
Filesize
287KB
MD531a4f044c23a648c306df463302c49b5
SHA1e014c21b4b0f3b054ee3f7b6bbba6b38974ab5da
SHA256e12b2df53c66e4b3c5073682434fee7b1e070794f79e090ccc8fb803487f3a94
SHA512e9d5606325a3e3fb371738bef66566f0491d080a5d6208482543f8729cd194d9dc11e3bc3989c3c19f359d3f34da977022b8a6457b6479ce5c51e3bf091a22fc
-
Filesize
24.1MB
MD5fb3e7fea09e48867e78581ee01705661
SHA12610a3408b871e83160fc8db671ff2b2ef24be39
SHA256686e77a7f2334d94d4456d88f04d83b4a1c9db68c507120f97b6c103c42e6c37
SHA512e3819948a012c8ea614b61000ab460baafc62897394fbb8e58eba2cd57eb2bbfb36fe63b96f6cf0fe343ae6edb13d273bdef41dc0bbb9b01497f832d2dafae91
-
\??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{10cd62bc-d23c-43db-b21f-bc31c48cac10}_OnDiskSnapshotProp
Filesize6KB
MD538ebbb2e337f743c2eee84841a0a2cc3
SHA1a0de6f14900044da32c44c85eefc27ec7a5ab8eb
SHA256684ff51a8aae9e701786aa986a3522daf8b42fb84a208a1b39470beba9832036
SHA512d7742ae9fe2804793030afe11a4d6ea1fb1bb4715c5acc203b9c8fe8f4f851302bf7b7b757b31164074faae0809cee15562a59714fcbd59eba94fb1fe6661afa