6c3f42cd3651ebec33e7d5ce87269c8cc6bbe59c72700cd0776ebad01f039cf8

Analysis

user interaction
yes
max time kernel
509s
max time network
516s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
To_zdnttjqb_Desk 4.9.7.3.exe
Size 119.5MB
Sample260810-h5betstdmd
SHA256 6c3f42cd3651ebec33e7d5ce87269c8cc6bbe59c72700cd0776ebad01f039cf8
MD5 2a05f30da891c27a649733ece8e3ff18
SHA1 a77bd0f47cae6309b088468ebce5da7358446b75
SHA512 a99edfe782df846d05a853016f14cc3b614aeb65afc4bf017dd8984864847484263fc5d75a33b9fd9594d33e24cadc62479900b6ba3af2a8a967e84f4ceadee8
SSDEEP 1572864:xzWb7NW7bPf/b45A7ZN/IfDyNjs9tTXud9aez4v8fKM5GU5506m5xL01qABDMev5:1WbBWvuI9eas+Xa4O8f6UT0F7gdZvCBI
TLSH
T14558333BB64FB63EE045B67F72308650193A8D66A1079CA32FF075188F395B40E7EA45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	4064	proxy.exe

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
848	netsh.exe
3472	netsh.exe
3144	netsh.exe
4844	netsh.exe
2656	netsh.exe
2176	netsh.exe
3448	netsh.exe
772	netsh.exe
4440	netsh.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x001b00000002b443-41.dat	acprotect

Executes dropped EXE 7 IoCs

pid	Process
424	To_zdnttjqb_Desk 4.9.7.3.tmp
4064	proxy.exe
2980	ToDesk_4.8.8.9.exe
1216	ToDesk.exe
2284	ToDesk.exe
3940	ToDesk.exe
3848	CoreToolsMgrHelper.exe

Loads dropped DLL 48 IoCs

pid	Process
4064	proxy.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
1216	ToDesk.exe
1216	ToDesk.exe
1216	ToDesk.exe
1216	ToDesk.exe
2284	ToDesk.exe
2284	ToDesk.exe
2284	ToDesk.exe
2284	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3848	CoreToolsMgrHelper.exe
2284	ToDesk.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1852	wscript.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2980-44-0x0000000074370000-0x000000007442A000-memory.dmp	upx
behavioral2/files/0x001b00000002b443-41.dat	upx
behavioral2/memory/2980-164-0x0000000074370000-0x000000007442A000-memory.dmp	upx
behavioral2/memory/2980-246-0x0000000074370000-0x000000007442A000-memory.dmp	upx
behavioral2/memory/2980-391-0x0000000074370000-0x000000007442A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ToDesk\UsbRDstCore.dll	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\sentry.json	ToDesk.exe
File created	C:\Program Files\ToDesk\drivers\vhid\todeskvhid.cat	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\vHIDEx\ToDeskVhidEnhance.inf	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\zulerLog.dll	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\permission_test.tmp	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\tdscreen	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\UsbRUsb\ToDeskUsb.inf	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\UsbRVhci\ToDeskUsb_root.inf	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\UsbRUsb\todeskusb.cat	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\vhid\todeskvhid.cat	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\vHIDEx\todeskvhidenhance.cat	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\cameramic\devcon.exe	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\UsbRVhci\ToDeskVhci.sys	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.inf	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\vHIDEx\VhidCore.dll	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\cameramic\todeskaudio.cat	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\cameramic\todeskaudio.cat	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.sys	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\UsbRUsb\ToDeskUsb.sys	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\mmkv.default.crc	ToDesk.exe
File opened for modification	C:\Program Files\ToDesk\drivers\UsbRUsb	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\UsbRVhci	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\UsbRVhci\todeskvhci.cat	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\UsbRSrcCore.dll	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\zrtc.dll	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\WatchDog\CoreToolWatchDog.dll	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\config.ini	ToDesk.exe
File created	C:\Program Files\ToDesk\drivers\cameramic\ToDeskAudio.inf	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\tdgamepad\TdGamePad.inf	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\vHIDEx\ToDeskVhidEx.dll	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\sentry.json	ToDesk.exe
File opened for modification	C:\Program Files\ToDesk\ToDesk.exe	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.dll	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\config.ini	ToDesk.exe
File opened for modification	C:\Program Files\ToDesk\permission_test.tmp	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\vHIDEx\ToDeskVhidEnhance.inf	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\vHIDEx\ToDeskVhidEx.inf	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\CrashReport.exe	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\tdscreen\tdIdd.dll	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\vhid\TodeskVhid.dll	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\vHIDEx\ToDeskVhidEnhance.sys	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\UsbRVhci\ToDeskUsb_vhci.inf	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\codec_checker.exe	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\UsbRSrcCore.dll	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\Logs\meetingserviceuoouoooj_2026_08_10.log	ToDesk.exe
File opened for modification	C:\Program Files\ToDesk\drivers\tdgamepad\TdGamePad.inf	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\Logs\cache\serviceWEBRTC_DC_liieua.mmap3	ToDesk.exe
File opened for modification	C:\Program Files\ToDesk\drivers\tdscreen\tdidd.cat	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\UsbRUsb\todeskusb.cat	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\UsbRUsb\ToDeskUsb.inf	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\cameramic\virtual_camera_x86.dll	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\vhid\devcon.exe	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\tdgamepad\devcon.exe	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\UsbRUsb\ToDeskUsb.sys	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\vHIDEx\todeskvhidenhance.cat	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\uninst.exe	ToDesk_4.8.8.9.exe
File created	C:\Program Files\ToDesk\drivers\cameramic\devcon.exe	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\drivers\vhid\devcon.exe	ToDesk_4.8.8.9.exe
File opened for modification	C:\Program Files\ToDesk\mmkv.default	ToDesk.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1108	sc.exe
3668	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2196	cmd.exe
3356	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	proxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	To_zdnttjqb_Desk 4.9.7.3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDesk_4.8.8.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	To_zdnttjqb_Desk 4.9.7.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4832-0-0x0000000000BA0000-0x0000000000CB0000-memory.dmp	innosetup
behavioral2/memory/4832-35-0x0000000000BA0000-0x0000000000CB0000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ToDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ToDesk.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	ToDesk.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\ = "FPProtocol"	ToDesk_4.8.8.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\shell\open\command\ = "\"C:\\Program Files\\ToDesk\\ToDesk.exe\" \"%1\""	ToDesk_4.8.8.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ToDeskSendFile\Icon = "C:\\Program Files\\ToDesk\\ToDesk.exe"	ToDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ToDeskSendFile\command\ = "\"C:\\Program Files\\ToDesk\\ToDesk.exe\" todesk://sendfile\"%1\""	ToDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk	ToDesk_4.8.8.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\URL Protocol = "C:\\Program Files\\ToDesk\\ToDesk.exe"	ToDesk_4.8.8.9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\shell\open	ToDesk_4.8.8.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\shell\open\	ToDesk_4.8.8.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ToDeskSendFile\ = "Use ToDesk Quick Transfer"	ToDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ToDeskSendFile\command	ToDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\DefaultIcon	ToDesk_4.8.8.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\DefaultIcon\ = "C:\\Program Files\\ToDesk\\ToDesk.exe,0"	ToDesk_4.8.8.9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\shell	ToDesk_4.8.8.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ToDeskSendFile\Icon = "C:\\Program Files\\ToDesk\\ToDesk.exe"	ToDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ToDeskSendFile\command\ = "\"C:\\Program Files\\ToDesk\\ToDesk.exe\" todesk://sendfile\"%1\""	ToDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ToDeskSendFile\ = "Use ToDesk Quick Transfer"	ToDesk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\shell\	ToDesk_4.8.8.9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ToDesk\shell\open\command	ToDesk_4.8.8.9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ToDeskSendFile	ToDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ToDeskSendFile	ToDesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\ToDeskSendFile\command	ToDesk.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3940	ToDesk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
4064	proxy.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe
2980	ToDesk_4.8.8.9.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	2980	ToDesk_4.8.8.9.exe
Token: SeDebugPrivilege	1216	ToDesk.exe
Token: SeDebugPrivilege	2284	ToDesk.exe
Token: SeDebugPrivilege	3940	ToDesk.exe
Token: SeTcbPrivilege	2284	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe
Token: SeShutdownPrivilege	3940	ToDesk.exe
Token: SeCreatePagefilePrivilege	3940	ToDesk.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
424	To_zdnttjqb_Desk 4.9.7.3.tmp
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4064	proxy.exe
1216	ToDesk.exe
2284	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe
3940	ToDesk.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 424	4832	To_zdnttjqb_Desk 4.9.7.3.exe	81
PID 424 wrote to memory of 4064	424	To_zdnttjqb_Desk 4.9.7.3.tmp	82
PID 424 wrote to memory of 2980	424	To_zdnttjqb_Desk 4.9.7.3.tmp	83
PID 2980 wrote to memory of 2196	2980	ToDesk_4.8.8.9.exe	85
PID 2196 wrote to memory of 1108	2196	cmd.exe	87
PID 2980 wrote to memory of 3356	2980	ToDesk_4.8.8.9.exe	88
PID 3356 wrote to memory of 3668	3356	cmd.exe	90
PID 2980 wrote to memory of 848	2980	ToDesk_4.8.8.9.exe	91
PID 2980 wrote to memory of 2176	2980	ToDesk_4.8.8.9.exe	94
PID 2980 wrote to memory of 3448	2980	ToDesk_4.8.8.9.exe	96
PID 2980 wrote to memory of 3472	2980	ToDesk_4.8.8.9.exe	98
PID 2980 wrote to memory of 772	2980	ToDesk_4.8.8.9.exe	100
PID 2980 wrote to memory of 4440	2980	ToDesk_4.8.8.9.exe	102
PID 2980 wrote to memory of 3144	2980	ToDesk_4.8.8.9.exe	104
PID 2980 wrote to memory of 4844	2980	ToDesk_4.8.8.9.exe	106
PID 2980 wrote to memory of 2656	2980	ToDesk_4.8.8.9.exe	108
PID 2980 wrote to memory of 1216	2980	ToDesk_4.8.8.9.exe	110
PID 2284 wrote to memory of 3940	2284	ToDesk.exe	113
PID 2284 wrote to memory of 3848	2284	ToDesk.exe	114

C:\Users\Admin\AppData\Local\Temp\To_zdnttjqb_Desk 4.9.7.3.exe
"C:\Users\Admin\AppData\Local\Temp\To_zdnttjqb_Desk 4.9.7.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\is-OGJIA51UW0.tmp\To_zdnttjqb_Desk 4.9.7.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OGJIA51UW0.tmp\To_zdnttjqb_Desk 4.9.7.3.tmp" /SL5="$30248,124068868,1054720,C:\Users\Admin\AppData\Local\Temp\To_zdnttjqb_Desk 4.9.7.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Users\Admin\AppData\Local\Temp\4c87e76905adc27f6a3d82345d6f5bb2.dat\proxy.exe
    "C:\Users\Admin\AppData\Local\Temp\4c87e76905adc27f6a3d82345d6f5bb2.dat\proxy.exe" -Embedding
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\4c87e76905adc27f6a3d82345d6f5bb2.dat\ToDesk_4.8.8.9.exe
    "C:\Users\Admin\AppData\Local\Temp\4c87e76905adc27f6a3d82345d6f5bb2.dat\ToDesk_4.8.8.9.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c sc stop ToDesk_Service
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop ToDesk_Service
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1108
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c sc delete ToDesk_Service
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ToDesk_Service
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3668
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ToDesk"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:848
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ToDesk_Service"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2176
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ToDesk_Session"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3448
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="ToDesk" dir=in program="C:\Program Files\ToDesk\ToDesk.exe" edge=yes action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3472
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="ToDesk" dir=out program="C:\Program Files\ToDesk\ToDesk.exe" action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:772
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="ToDesk_Service" dir=in program="C:\Program Files\ToDesk\ToDesk_Service.exe" edge=yes action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4440
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="ToDesk_Service" dir=out program="C:\Program Files\ToDesk\ToDesk_Service.exe" action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3144
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="ToDesk_Session" dir=in program="C:\Program Files\ToDesk\ToDesk_Session.exe" edge=yes action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4844
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="ToDesk_Session" dir=out program="C:\Program Files\ToDesk\ToDesk_Session.exe" action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2656
  - - C:\Program Files\ToDesk\ToDesk.exe
      "C:\Program Files\ToDesk\ToDesk.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1216

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\interfaceNT\kcrjubsu.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1852

C:\Program Files\ToDesk\ToDesk.exe
"C:\Program Files\ToDesk\ToDesk.exe" --runservice
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files\ToDesk\ToDesk.exe
  "C:\Program Files\ToDesk\ToDesk.exe" --show --localPort=35600
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3940
- C:\Program Files\ToDesk\CoreToolsMgrHelper.exe
  "C:\Program Files\ToDesk\CoreToolsMgrHelper.exe" -Oper Install -Source ToDesk -GUID {4A234956-2B7D-4221-BADF-12593BD342A8} -Dir "C:\Program Files\ToDesk\drivers\WatchDog"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

UsbRDstCore.dll

Path C:\Program Files\ToDesk\UsbRDstCore.dll
Size 195KB
SHA256 1e00ad6ed1d22b36e4155ad5a04ac639932f93bcb2f8a301a049da4de7239002
MD5 9107ef79bba2f64f9ed6dcc286a1b664
SHA1 1e625777b178e11ac6e64af1130cd404870090d0
SHA512 282d67dfbfb296c80c8b1b2940a21ca6c7e53ff0946c0815e17e0a4b0b31a2ea6cc4235178c7d9744f56d02b7366fce5bf788dcdb0ce4a9c93fb45e99c86caac
SSDEEP 3072:SuySK8Ko92eSEt1ran9LgXFFQBRY0bsun/v/wyDQVpzsj78hCPRpYCDZextHhCqa:Sehnr+4KRYtIs79ju
TLSH
T1B5146B02B3E9047AF97786389D774512EB73B8410B30969F037042799F6BB90AD79B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsbRSrcCore.dll

Path C:\Program Files\ToDesk\UsbRSrcCore.dll
Size 245KB
SHA256 52dcddd90b393d0372ce11717c975e41f9bbaecee291543d1787c0a44c24b824
MD5 abac7e5b275fd1ba5527212eb10739ed
SHA1 600a5dc8ff14d85d68681908b5c3cef5142f5c14
SHA512 4393d54788034c9c8a6464b3a1d45cb31a4acccc4bfb7f20247156fbcbd8366bcb2d3b3e216189ff184cc13497bd502c913a8b264fc55a942ebab5322eb726af
SSDEEP 3072:EM3J6yCwi9KifJxcJ7+mnu2n4Nxrod0V9ij0BwZakvrqwvyXk9miuMT6bXhY07Zf:EMA5xQ7+CuxNJVeo/XuSxjZ
TLSH
T1FC346C5577E40CB9FDB786388DB38112DAB27C420730DA9F0760426B9F2BB915E39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Program Files\ToDesk\config.ini
Size 579B
SHA256 380bb26d6499ac62243b37f10d14796bf3ac878448b5bdc53c00da9a2c2d518d
MD5 13e15f3957f28c7de59278563c97f8c6
SHA1 fc77d485fb152540a18c09fd81d3a8a14b2a26f2
SHA512 bda11884ac702616f2f98e67ba13986a3820d0e93b3d03060ec363e87ac2a35c31711254ab453ca04da9c6b3cbbc491c89c5b87e6ff980b93b8ad4516852c5dd
TLSH
T1E4F0E1288448407A21065EF7C539037416E0162E80F3FC159B2D6CBF4D5DE21878B863
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Program Files\ToDesk\config.ini
Size 736B
SHA256 0dc0a6f8d7845a141a8fa579b7bf17b214ff4d5cf1e8702ad2f3eeb3b78a0b86
MD5 504db213e51a54202e347c9e2a6b51d8
SHA1 276c353afa3d2d84ad1786afe24dbea7c5fd25f0
SHA512 177bb0ed82a9417bfe46045d010a461d336a9bfb0ef05530932ebfbb6b0f9419785d6aca433f73dd437924211d353d1e644f36d4d87852b8c3882a722e517fad
TLSH
T1DE011534C444416724031FFBC53D076415E0361F41E6ED595F3D286B1D6DA154B4B877
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Program Files\ToDesk\config.ini
Size 843B
SHA256 9dc6a98659d27f7113c880b6e896dc02df2f051904587d7975c2c3456cb82617
MD5 b4739385df2b5e7d7a249ea71bef95f1
SHA1 005260102778b011e2df4eaab3619435fee58999
SHA512 be2d5297e93de6db373ae5e79b79064776a63dfcc4e368724df1a85aa75bc8d28689b2a03e9c424b289d4978a4648162253f9ea4c9da9d5c422cd00ef721bcd9
TLSH
T1900152348844026724031FFBC02902A416E02A1F42E6EC5D5E3D786B0D2DA55879B8B7
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Program Files\ToDesk\config.ini
Size 915B
SHA256 ae9906375ef946e5e557511776a2f4bc26533a7d18f110763c8f32516752fc13
MD5 98251d3beed9bd3298f737d9746311e1
SHA1 e6c648f8c2679826fd103e29f571595fc2ac2675
SHA512 b4c857ac5ee7fb24579140937558b0fa8ca8f3183baeffc43c096fd06e05ede02cbde18046799b808687e8e16cf267ca841e105a712b064f29da4f5a3234fad9
TLSH
T1FA114434884401772C535FFAC039065412E02A1F42E6DC595F3D786B0D2DE198B8F8B6
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Program Files\ToDesk\config.ini
Size 98B
SHA256 a93bdb155db44d2e51a7dfcd28fa8c92bd5276b79616247dee60fee8e1bee7f2
MD5 785016acd90d353fef70ee6291658d28
SHA1 86db4765f0561167371d85a8081fe198613d24b0
SHA512 5c4cc84e6833ba871b8f7286f0f2411b6afabdf6a182fa3956db2be5a83044036a1b074975ea6463b184582278caef9d14665bd98e0384958f05c9fdff4ee92a
TLSH
T1F3B012A60F1046382C045C97CB42500000F1270D0A30E807971E7D77CC1C221431B8B5
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Program Files\ToDesk\config.ini
Size 517B
SHA256 a1ce51558c2eb3aa342d7ddb68e07d8f5de4d861e3dbceb7298eb64e86555362
MD5 8bf1d9c20a63eb1454d28369fce1504f
SHA1 165fcc1e7e24759c7df966ecdfb8b2764e3a1c6d
SHA512 f3ebaf75590a1daf4302c87fc70f5562719d3e5ba9925ea19950de1232d2740b59ef05d1d15a50668bb0b18b73a6e404f6647f7b93aca38120887218f6199503
TLSH
T16EF00E28448440A9200A5EF7C53E037012F12B2F40E7FC565B2DACBF4C4CE208BCB8A3
MD5 SHA1 SHA512 TLSH

Submit Download

devcon.exe

Path C:\Program Files\ToDesk\drivers\tdscreen\devcon.exe
Size 81KB
SHA256 aca1bda08690dcca930254f96f9185c776671a85a58ffa1b59cf16017546f218
MD5 816c4e245b286b4e4903131f75a94948
SHA1 eda70c1fc8a461efb0e376d42e35a72b96175e4d
SHA512 d0dc74956c57403c0638e6595aaf1c2eb75233997a15170b064261a5d3f1f525a3e35e13fef04c36cc20fd1d5d1cf000a5fb7a646bf2cf1cea73817e5d3335b3
SSDEEP 1536:11Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WH:11M2fAggGnD89NJ1cPZCM3W
TLSH
T1D083B40263E91659F5F37A3469B552354A737CA1AE38C69E0298912D0FF3EC0DC74BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zulerLog.dll

Path C:\Program Files\ToDesk\zulerLog.dll
Size 3.7MB
SHA256 84eca9a4a239b197085de011f97b8e095cf3d4ef1cddeee3d75a1f17903da882
MD5 d2715b056bc2c759b8634fc2045b6131
SHA1 4fa2bceb65b015668d4c91b997fd771ccd337e4e
SHA512 2d57a5dcd8ba1d5409eddc73c1828559cfa4e463dcd268cfccfd344a83658394bd9c0daa327bbf75fc507bce4959155a58b8c6d5e19ffd31a6e2f4607cf27ef8
SSDEEP 49152:noy/GhYumCkmw8djHogWiFRURzfrmCv98axr5Lr/fM13ThHdPPe0vXa:PVC/RIHzBve7te0vq
TLSH
T1AD068D56A79802E9E477D13CC6974B17E7B2B81913309BCB06F986791F23BE5263E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ToDesk.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ToDesk\ToDesk.lnk
Size 850B
SHA256 fd4dbb8d2e35133fd8c06ce28ec1054ce96388cc36aba9bd6ba890eb6ddd1fdb
MD5 eae6aaeb8c09207aa7fee647701fdb6d
SHA1 1c906a2e1431df6e64ab9802698128e907562e08
SHA512 cb6586ff7b6648406848b30d14a1054a01d45538a79284e700754e82ade51d667e11845424d4552fe960e04c7b215b23e52b35f86a42bfa63815a6942366d824
TLSH
T1B301C00022BBA725D1718A709BF117308737FD40DEAD932E00C4429D5CF8640E66CF5E
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall ToDesk.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ToDesk\Uninstall ToDesk.lnk
Size 850B
SHA256 526bfb659c2e5b01ba66e82b96cfdc2538f26c825ee50c9b7943282b0502433e
MD5 679ba0f9fd8d921ddb89fbacba3990b9
SHA1 256b3277fb0749580ad25e4b593b9f14ff068a83
SHA512 5f78aa38f4a38094af967d1a01d41f49136daf23138c85b152e0626bb54948c9a65066db0caf97bb85df0ad6fe2e715015c829d3e54c1190f80f38cf84ae381d
TLSH
T1A701C00527B29B26C5B1477576F217308733BD41DEF8971D11C542DC48E8704E66CF25
MD5 SHA1 SHA512 TLSH

Submit Download

CoreToolWatchDog.dll

Path C:\ProgramData\ZulerCoreTools\{4A234956-2B7D-4221-BADF-12593BD342A8}\CoreToolWatchDog.dll
Size 611KB
SHA256 895fb5288783a3848753b4524cae164556cd9ccee651ef6a493195908240e421
MD5 4d2094c082ac8c9e511d28eec5e9949d
SHA1 e2c82e03128677dee17c07785881e48680073a3b
SHA512 80eb014380c19bc97d416d0d44bd1a8f746ed47b85c179a182b3676f56740bef97bb5b8b0272d35fee524ff441b2dc29a11878e4386b372b6e6f7fc2218adb1b
SSDEEP 6144:tkdqsg5KkxtVHW5/2aSL/n4n5fVA4e3NoK2AlgcX7tIanWhGgRF+J//t2jUKj0:kotpAuHL/45fVAf3lHZnW3Tj0
TLSH
T1A8D4F95AEBF610F4D0B6D538DA63602BF871B861073493DB97909A171F32BE09A3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameuxInstallHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\4c87e76905adc27f6a3d82345d6f5bb2.dat\GameuxInstallHelper.dll
Size 100KB
SHA256 d4393b2155368484c24df331adeb558eb4ecec47e5eee1f5c3471201518d513f
MD5 ed50e325624f44a7f76db69284fb7d4b
SHA1 e2d9419675c787ebb226f1b51e72ed4b7abd19db
SHA512 5fb80b40865a5eaa06ab0ed0ebcc607218b37f7d4b339905faf91edced4e16c9514a45bb59fb354b2b4dab87191438b65d1c74d3a4ecde1b2579875c3c03734f
SSDEEP 1536:bMftYHteQD4BW0c+iZHSMUryRixmuaVdLYuPhMmKL2CIOYGi/QL0K:bgtYN4WDQJrmixgjnSL2gYGigB
TLSH
T177A35C81FAC341F2E93B56B08CD7A7BF8631B3124579DDFBE68C9B44B813B111949289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proxy.exe

Path C:\Users\Admin\AppData\Local\Temp\4c87e76905adc27f6a3d82345d6f5bb2.dat\proxy.exe
Size 111KB
SHA256 f90b1a6b44010a5393c62431eccb7a3318f42e63cf8a66edd9ebe1305e2f395e
MD5 35ca55c796a7abb13ca96711fe010401
SHA1 720a6f37de959db9a0dee8e0533037df25990599
SHA512 12e4cab24bf51961d547bc290d747d1bb496eb5fd2748ddb574e9b88e553f2b764ed12acf6b7530bc33563b2aa07ccfaefbfb65d2a3512f45a67969f02a7a980
SSDEEP 1536:WhSUvJEGEfSySB59j+I3eTw/b7jZFVc5D4BtTGYywBu3PmeVYzi7+eLcYQ+hAnLV:ET+fSrbInY3eD4Btn2P9Ym+MrAnLvrh
TLSH
T1B6B3AE423790D072E0621A309965C6718F377C329BB985CB37907E7E3EB17C1A93636A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

To_zdnttjqb_Desk 4.9.7.3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-OGJIA51UW0.tmp\To_zdnttjqb_Desk 4.9.7.3.tmp
Size 4.3MB
SHA256 3f564dbe365c1e7e994d05d530c4c9c6cbee8ee5f379f24de99b833a12aa0692
MD5 651f52361c61f557c34bfae67205c4cc
SHA1 b76b0e6f92b2aca7fca8fd684bc7e48945a31d8c
SHA512 86912c444843d876cf1a506db229ee98a79d6212478f6d32f50a1ff047486a6f965f7e3cee8c19a66c7d498f11a3ab0abda559405239c4232166be76ae497e2a
SSDEEP 98304:i9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J/3337:pItJj90Z6RgKwk
TLSH
T113268E03B388753AE4B71A3A883FA650583F7E213926CD4B6BF4395C4F395416D2A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BgWorker.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\BgWorker.dll
Size 2KB
SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 33ec04738007e665059cf40bc0f0c22b
SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
TLSH
T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
MD5 SHA1 SHA512 TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\SimpleSC.dll
Size 1.1MB
SHA256 0ae19f11aac80c578784d345dccbe8288d5b39dcc53532498e4829e92bf3f848
MD5 c487d2c2b0f893d6cd2f5ac4589a3480
SHA1 ad5d8f74dc98b13cb965045beea03f55ec75a557
SHA512 afae8ce314f92a928343247824701a1734e7c03dcb2942fd8616105185763699e0cd1e00bf57c72c80841149dd2205679941dec7b4ff660ad2dcc27447321e4a
SSDEEP 12288:kRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6/:kBsmyVS151oCmJKE1dv0DX6
TLSH
T1B8354B27F645693EC5AF0A3E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\System.dll
Size 12KB
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
TLSH
T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

killer.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\killer.dll
Size 21KB
SHA256 2b4e543b07a9e74f571d50eacf6b33e44c36e428816b39e955db10d315606585
MD5 7d432f79d4e0ac02d41ca3a04fea8767
SHA1 0ef90e92bb447ad8670385b8147695a98fdc031f
SHA512 8b86a2dd2348c59f52e3d7f3994a093d812b3137ed518ccc3c7867c1a057b383a71615113f018544d15c68a40c6226d51f210ebd924b6f67ed6dd523af95a078
SSDEEP 384:jUKZ+TwlGGZSZjnYPLdy7EZJXDENZSZSR0fGZsHLs08JN77hh9d:jDgFey7wod0fj23hbd
TLSH
T1F8A239964F942812FE978E7531E8D5276D31B291A7A0D4DB51AAC0818FC1FE33CBC25E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\nsExec.dll
Size 7KB
SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
MD5 f27689c513e7d12c7c974d5f8ef710d6
SHA1 e305f2a2898d765a64c82c449dfb528665b4a892
SHA512 734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
SSDEEP 96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
TLSH
T1B1E11A7675C03DF7D08988706C1D3A1B93F4D5312BBA01B08EAB29E675E1AE7E538742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsNiuniuSkin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\nsNiuniuSkin.dll
Size 287KB
SHA256 33e460a080a621cda7896e96b6f1beee802b485cf99e18b27463cd362c484b08
MD5 bb0cdff5ac2d64723007a0b4f7962a02
SHA1 410889522ee8ea7308b054f71bc4cab078295e06
SHA512 b4dc2614f01f5f01d5dec9e6a41e072d01e924d8a94ac0dc1050399fd1dc3cc8d53d7ccf162d750d166fca200771b0850191b30c7caada8edea9ba6d686e2402
SSDEEP 6144:EfuMPhou62ZrZxAxgGTpMayh91VDrH10nCRwbDB0Q5MeKxhwNsN:M3hC2lZxAxSpRbWnmADBpM+iN
TLSH
T15A5422462F7D6833F8FC0E3A76844625B513E253A431C4C912BDDB80E97572B6B8A24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsSCM.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\nsSCM.dll
Size 21KB
SHA256 00e701893af9204d3e9669539bd47fd00e954c5583492b97647eff7811d55181
MD5 c68aca71e85b9615c16c45a3437b5558
SHA1 df730ff499aa20d2c74e2273dd13ee79e07ebf16
SHA512 83420b444d35b7becc11cd3efcb02eb98bcc358f7649e745110e0c2ed03893414bddd1f92f600d2e00b21695d4d4388360287e92d50db2726cbd79546f61fca8
SSDEEP 384:tnv43Y4lH5heTZSZjnYPLdy7EZJQ2ZSZSR0fGZsHLFybs8JN77hh3:treey700fjFe3ht
TLSH
T182A25BA68FA02C02FE82CE7231E5E5676D31B291A7A0D48B116AC0905FD1F937DBC15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7zU.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\nsis7zU.dll
Size 313KB
SHA256 e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9
MD5 06a47571ac922f82c098622b2f5f6f63
SHA1 8a581c33b7f2029c41edaad55d024fc0d2d7c427
SHA512 04b3d18042f1faa536e1393179f412a5644d2cf691fbc14970f79df5c0594eeedb0826b495807a3243f27aaa0380423c1f975fe857f32e057309bb3f2a529a83
SSDEEP 6144:rA9ssOlBrbYr5UP4m3mC/FvBbhQ1JzI+yQKiJGxdNtsm0:r2S165UP4mL/FvBtC8zQdSDmm0
TLSH
T196649D22B690C07AC5AF03316D18B7A491FEB6718A34C70BF7D84B5E2E771C29A14B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\nsa3A07.tmp\skin.zip
Size 854KB
SHA256 9afa065f2fdda10faad78086a2468141a903e8359dfcfa8f3e281e2c0a954d7e
MD5 a6b30245b1b794d3a6f9e72c8cfd98d7
SHA1 cd32bb02f91ecfdf4dfb59e87cd69f9460b5379d
SHA512 a09b0729f48afd2880835248afede9a36f53c333819a3faa009fb7d5a0a353fe57cca2b2d6f8324f9429e3d1e2429464c349a1fa8f1733347f069221985aa1bb
SSDEEP 24576:bzEezYdwD3qufpJu0vTRG0L1izNhoumS2IAwPR:bHzYd89pJ/paTo3IAW
TLSH
T1A01523D7EB5778EFD919C73A30A70A8DAC69C1020791A7073FEA71B86D42F084B69711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6e224c242b5a30e587d85752a87da37.tmp

Path C:\Users\Admin\AppData\Roaming\Adobe\c6e224c242b5a30e587d85752a87da37.tmp
Size 434B
SHA256 d250dbb63a434189f0cb1e8bb4a1e5e8ccf8f90876c42e5abf9f59ea68b6e117
MD5 85d644dcda86d29dc14b13689f0fc30a
SHA1 00f0d2c18f5ba220f61db506ff013729cd850f09
SHA512 47d71c18650b5da9771a49c0242b4027c2720f93c8a819933c5733758527e8e8da1f0dc54df0b240f0b78c230f511abf6c17c835687b5074c6999054d5bf4d46
TLSH
T1BAE0ED7D26FD5019F7B7E566DBE180E2F624A5A839015C1C44C682490D03E17BD63F1A
MD5 SHA1 SHA512 TLSH

Submit Download

ToDesk.lnk

Path C:\Users\Public\Desktop\ToDesk.lnk
Size 832B
SHA256 f93b5c700612fd236959a57b8f6aaeea9044ace10e22e8ea11999ad8206df948
MD5 3d8f2c36910dd2dd59aee0cb02d2f785
SHA1 e89dac5b554b1e5b464bfdc56b3129313953fc51
SHA512 fae149b632e35b33f1308e71b81aab6fec1cd9d1064f5625efcc2dbc29f7e9679063ca288989e0eebd1e42e44eb5a23ab07ad86411ea4d4330ed7704644f1de6
TLSH
T1B0017B0022BBA726D0B18A719BF117258A36F940DE5D932E40C5825D9DE4A44E66CB5E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/424-5-0x0000000003670000-0x0000000003671000-memory.dmp

Download

memory/424-34-0x0000000000B40000-0x0000000000FAB000-memory.dmp

Download

memory/2980-246-0x0000000074370000-0x000000007442A000-memory.dmp

Download

memory/2980-44-0x0000000074370000-0x000000007442A000-memory.dmp

Download

memory/2980-188-0x00000000007D0000-0x00000000008EC000-memory.dmp

Download

memory/2980-227-0x0000000002A10000-0x0000000002B2C000-memory.dmp

Download

memory/2980-164-0x0000000074370000-0x000000007442A000-memory.dmp

Download

memory/2980-391-0x0000000074370000-0x000000007442A000-memory.dmp

Download

memory/4064-106-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-157-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-116-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-126-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-127-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-128-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-135-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-136-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-134-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-132-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-133-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-131-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-130-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-129-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-144-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-147-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-154-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-153-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-152-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-151-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-150-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-149-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-146-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-145-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-143-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-142-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-148-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-137-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-156-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-121-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-163-0x0000000072FC0000-0x0000000072FE1000-memory.dmp

Download

memory/4064-122-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-167-0x0000000004170000-0x0000000004299000-memory.dmp

Download

memory/4064-123-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-124-0x0000000002930000-0x0000000002978000-memory.dmp

Download

memory/4064-115-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-107-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-108-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-109-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-110-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-111-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-112-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-113-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-114-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-71-0x0000000000850000-0x0000000000856000-memory.dmp

Download

memory/4064-84-0x000000006F570000-0x000000006F580000-memory.dmp

Download

memory/4064-87-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-104-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-105-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-94-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-95-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-97-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-98-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-96-0x00000000025F0000-0x0000000002664000-memory.dmp

Download

memory/4064-74-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/4832-0-0x0000000000BA0000-0x0000000000CB0000-memory.dmp

Download

memory/4832-35-0x0000000000BA0000-0x0000000000CB0000-memory.dmp

Download