File name:

HopToDesk.exe

Full analysis: https://app.any.run/tasks/0ce74f7a-df7d-4ec3-892f-e3718305d172
Verdict: Malicious activity
Analysis date: March 05, 2024, 11:51:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

E7F8E468320521203FA50B202F5925E4

SHA1:

7120E4F990E99E89840482F32501BE69168A485E

SHA256:

B85D91231F81820547DF65A29074CB209D20EDEA8ADC74A51C1DF48E6F71E8EE

SSDEEP:

98304:E0+iMn8ssVIER4T5BQbPHAg+bsx37kDSq9TYIPOjAUzBXeXPc+89ACadiROBeiGN:pVIUje2kosAW/Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • HopToDesk.exe (PID: 2160)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk.exe (PID: 3140)
      • cmd.exe (PID: 752)

    • Create files in the Startup directory

      • cmd.exe (PID: 752)

  • SUSPICIOUS

    • Suspicious use of NETSH.EXE

      • HopToDesk.exe (PID: 2160)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 3140)
      • cmd.exe (PID: 752)

    • Reads security settings of Internet Explorer

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1040)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk-update.exe (PID: 568)
      • HopToDesk.exe (PID: 3140)

    • Application launched itself

      • HopToDesk.exe (PID: 2160)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 2564)
      • HopToDesk.exe (PID: 2788)

    • Reads the Internet Settings

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1040)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk-update.exe (PID: 568)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 3140)
      • HopToDesk.exe (PID: 2788)
      • HopToDesk.exe (PID: 1608)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • HopToDesk.exe (PID: 1040)
      • HopToDesk-update.exe (PID: 568)
      • cmd.exe (PID: 752)

    • Executable content was dropped or overwritten

      • HopToDesk.exe (PID: 2160)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk.exe (PID: 3140)
      • cmd.exe (PID: 752)

    • Starts CMD.EXE for commands execution

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 3140)
      • HopToDesk.exe (PID: 2860)

    • Reads settings of System Certificates

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 2788)
      • HopToDesk.exe (PID: 1608)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2292)
      • cmd.exe (PID: 2808)
      • HopToDesk-update.exe (PID: 2592)
      • cmd.exe (PID: 752)
      • cmd.exe (PID: 1992)

    • Connects to unusual port

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 2860)
      • HopToDesk.exe (PID: 1608)

    • Starts itself from another location

      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk.exe (PID: 3140)

    • Executing commands from a ".bat" file

      • HopToDesk.exe (PID: 3140)

    • Starts application with an unusual extension

      • cmd.exe (PID: 752)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 752)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 752)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 752)

    • Creates a software uninstall entry

      • reg.exe (PID: 3044)
      • reg.exe (PID: 2824)
      • reg.exe (PID: 3040)
      • reg.exe (PID: 3748)
      • reg.exe (PID: 2536)
      • reg.exe (PID: 2836)
      • reg.exe (PID: 3420)
      • reg.exe (PID: 3756)
      • reg.exe (PID: 3548)
      • reg.exe (PID: 3636)
      • reg.exe (PID: 3752)
      • reg.exe (PID: 3640)

    • Searches for installed software

      • reg.exe (PID: 2824)
      • reg.exe (PID: 3040)
      • reg.exe (PID: 3748)
      • reg.exe (PID: 2536)
      • reg.exe (PID: 3548)
      • reg.exe (PID: 3044)
      • reg.exe (PID: 3640)
      • reg.exe (PID: 3420)
      • reg.exe (PID: 3756)
      • reg.exe (PID: 3752)
      • reg.exe (PID: 2836)
      • reg.exe (PID: 3636)
      • HopToDesk.exe (PID: 2472)
      • HopToDesk.exe (PID: 2788)
      • HopToDesk.exe (PID: 2564)
      • HopToDesk.exe (PID: 2860)
      • HopToDesk.exe (PID: 1608)

    • The process executes VB scripts

      • cmd.exe (PID: 752)

    • Executes as Windows Service

      • HopToDesk.exe (PID: 2472)
      • HopToDesk.exe (PID: 2564)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 752)

  • INFO

    • Reads the computer name

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1040)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk-update.exe (PID: 568)
      • HopToDesk.exe (PID: 3140)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 2472)
      • HopToDesk.exe (PID: 2564)
      • HopToDesk.exe (PID: 2860)
      • HopToDesk.exe (PID: 2788)
      • wmpnscfg.exe (PID: 3496)
      • HopToDesk.exe (PID: 1608)

    • Checks supported languages

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1040)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk-update.exe (PID: 568)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 3140)
      • chcp.com (PID: 2416)
      • chcp.com (PID: 3524)
      • chcp.com (PID: 3716)
      • HopToDesk.exe (PID: 2472)
      • HopToDesk.exe (PID: 2564)
      • HopToDesk.exe (PID: 2788)
      • HopToDesk.exe (PID: 2860)
      • wmpnscfg.exe (PID: 3496)
      • HopToDesk.exe (PID: 1608)

    • Creates files or folders in the user directory

      • HopToDesk.exe (PID: 2160)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 3140)
      • HopToDesk.exe (PID: 2788)
      • HopToDesk.exe (PID: 1608)

    • Create files in a temporary directory

      • HopToDesk.exe (PID: 2160)
      • HopToDesk-update.exe (PID: 2592)
      • HopToDesk.exe (PID: 3140)
      • cscript.exe (PID: 4028)
      • cscript.exe (PID: 3300)
      • cscript.exe (PID: 2952)

    • Checks proxy server information

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 2788)
      • HopToDesk.exe (PID: 1608)

    • Reads the software policy settings

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 2860)
      • HopToDesk.exe (PID: 2788)
      • HopToDesk.exe (PID: 1608)

    • Reads the machine GUID from the registry

      • HopToDesk.exe (PID: 2160)
      • HopToDesk.exe (PID: 1484)
      • HopToDesk.exe (PID: 2860)
      • HopToDesk.exe (PID: 2788)
      • HopToDesk.exe (PID: 1608)

    • Creates files in the program directory

      • cmd.exe (PID: 752)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 4028)
      • cscript.exe (PID: 2952)
      • cscript.exe (PID: 3300)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:24 19:05:04+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 7585792
InitializedDataSize: 24576
UninitializedDataSize: 12148736
EntryPoint: 0x12d2130
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.41.5.0
ProductVersionNumber: 1.41.5.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
LegalCopyright: Copyright © 2024 Begonia Holdings. Copyright © 2023 Purslane, Inc.
FileDescription: HopToDesk
FileVersion: 1.41.5
ProductVersion: 1.41.5
ProductName: HopToDesk
CompanyName: Begonia Holdings
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
77
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start hoptodesk.exe netsh.exe no specs hoptodesk.exe netsh.exe no specs cmd.exe no specs taskkill.exe no specs hoptodesk-update.exe netsh.exe no specs hoptodesk-update.exe no specs netsh.exe no specs taskkill.exe no specs hoptodesk.exe netsh.exe no specs cmd.exe no specs taskkill.exe no specs hoptodesk.exe netsh.exe no specs cmd.exe chcp.com no specs sc.exe no specs sc.exe no specs taskkill.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs reg.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs sc.exe no specs sc.exe no specs hoptodesk.exe no specs sc.exe no specs sc.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs netsh.exe no specs findstr.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs hoptodesk.exe no specs hoptodesk.exe reg.exe no specs cmd.exe no specs taskkill.exe no specs hoptodesk.exe wmpnscfg.exe no specs hoptodesk.exe

Process information

PID
CMD
Path
Indicators
Parent process
116taskkill /F /IM RuntimeBroker_hoptodesk.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
120reg add HKEY_CLASSES_ROOT\hoptodesk /f /v "URL Protocol" /t REG_SZ /d ""C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
480"netsh" advfirewall firewall show rule name= HopToDesk verboseC:\Windows\System32\netsh.exe—HopToDesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
568"C:\Users\admin\AppData\Local\Temp\HopToDesk-update.exe" --fwC:\Users\admin\AppData\Local\Temp\HopToDesk-update.exe—HopToDesk-update.exe
User:
admin
Company:
Begonia Holdings
Integrity Level:
HIGH
Description:
HopToDesk
Exit code:
0
Version:
1.41.6
Modules
Images
c:\users\admin\appdata\local\temp\hoptodesk-update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
696reg add HKEY_CLASSES_ROOT\hoptodesk\shell\open\command /f /ve /t REG_SZ /d "\"C:\Program Files\HopToDesk\HopToDesk.exe\" \"--connect\" \"%1\""C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
752"C:\Windows\System32\cmd.exe" /C C:\Users\admin\AppData\Local\Temp\HopToDesk_install.batC:\Windows\System32\cmd.exe
HopToDesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
784taskkill /F /IM RuntimeBroker_hoptodesk.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
864"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="HopToDesk" dir=in action=allow program="C:\Users\admin\AppData\Local\Temp\HopToDesk.exe" enable=yesC:\Windows\System32\netsh.exe—HopToDesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
896sc stop HopToDeskC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
956findstr /c:"HopToDesk Service" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\apphelp.dll
Total events
42 589
Read events
41 946
Write events
624
Delete events
19

Modification events

(PID) Process:(2160) HopToDesk.exeKey:HKEY_CLASSES_ROOT\HopToDesk
Operation:writeName:URL Protocol
Value:
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-101
Value:
Provides DHCP based enforcement for NAP
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-103
Value:
1.0
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-102
Value:
Microsoft Corporation
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-1
Value:
IPsec Relying Party
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-2
Value:
Provides IPsec based enforcement for Network Access Protection
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-4
Value:
1.0
(PID) Process:(3652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-3
Value:
Microsoft Corporation
Executable files
9
Suspicious files
9
Text files
37
Unknown types
1

Dropped files

PID
Process
Filename
Type
2160HopToDesk.exeC:\Users\admin\AppData\Local\Temp\sciter.dllexecutable
MD5:FC2311CA280C197F5ED16DEF6D464B6B
SHA256:285F3E6A051A7C61845CD7E4D2120781B6BDF411239F70A85C65B38A52D38F28
2160HopToDesk.exeC:\Users\admin\AppData\Roaming\HopToDesk\config\UpdatePath.tomltext
MD5:5C06736373F1C19F9F83C3D034A0FE51
SHA256:0BAAD169B8006BE9C254778C4E9523E6905BEA5A6D735A9082118110736A65A1
2160HopToDesk.exeC:\Users\admin\AppData\Roaming\HopToDesk\config\HopToDesk2.2160_ThreadId(15)_1709639481532875000text
MD5:F48304D019B418DA9B0593EBB565BE91
SHA256:A681222E24E490642EB0997AE1E983A050F02BB5A82D9374446E8D2CE4AF7535
2160HopToDesk.exeC:\Users\admin\AppData\Roaming\HopToDesk\config\HopToDesk.2160_ThreadId(15)_1709639481532875000text
MD5:8A5CF4FA4D0DA258D9F54B09F491DB32
SHA256:C48F4AA21FF0AAACB5B02F524D46C29BF3C7CF9A5B059A6A6492FCD7C5F4CD0E
2160HopToDesk.exeC:\Users\admin\AppData\Roaming\HopToDesk\config\HopToDesk2.tomltext
MD5:A6BECBA0352AB368313402F9CF42ED09
SHA256:26059F8DD9026AC1ECF174D0C79467BE90E1681CDCBE7AEBBFEC35D639864205
2160HopToDesk.exeC:\Users\admin\AppData\Roaming\HopToDesk\config\HopToDesk.2160_ThreadId(18)_1709639477704750000text
MD5:D5889065B82B305B96FB175F5CE6F1A3
SHA256:0EFC0AF21884B9CFF61540A710E2E8258DF94DBA6C2B59A82C6DEAFEDC78ED0A
2160HopToDesk.exeC:\Users\admin\AppData\Local\Temp\HopToDesk-update.exeexecutable
MD5:CA307565D7DA1327AD8BA77A5ABBAE13
SHA256:C8F8F48DC64AA1FDB1EFEDB64901E96DA5723B752D58C75BE981D7EC7EDD35B5
2592HopToDesk-update.exeC:\Users\admin\AppData\Local\Temp\HopToDesk.exeexecutable
MD5:CA307565D7DA1327AD8BA77A5ABBAE13
SHA256:C8F8F48DC64AA1FDB1EFEDB64901E96DA5723B752D58C75BE981D7EC7EDD35B5
3140HopToDesk.exeC:\Users\admin\AppData\Local\Temp\HopToDesk_mk_shortcut.vbsbinary
MD5:E49AE77F558CC588FF323B67BE1CF5DB
SHA256:C02E3EF559C4BF49D5931DB77978277BC03B5A528B43BCFDBDE7B36D5BBBF91C
2592HopToDesk-update.exeC:\Users\admin\AppData\Roaming\HopToDesk\log\update\HopToDesk-update_rCURRENT.logtext
MD5:19B087A751147A30D209ADB5D0786D1E
SHA256:47F2B6797B40977E7309E6362944710BDF83427844C7EFF8E1AE93DC219582E2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
61
DNS requests
5
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2160
HopToDesk.exe
GET
101
45.77.249.125:80
http://signal.hoptodesk.com:80/?user=167286068
unknown
—
—
unknown
1484
HopToDesk.exe
GET
101
45.77.249.125:80
http://signal.hoptodesk.com:80/?user=167286068
unknown
—
—
unknown
2860
HopToDesk.exe
GET
101
45.77.249.125:80
http://signal.hoptodesk.com:80/?user=167286068
unknown
—
—
unknown
1608
HopToDesk.exe
GET
101
45.77.249.125:80
http://signal.hoptodesk.com:80/?user=1709639604
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2160
HopToDesk.exe
188.114.97.3:443
api.hoptodesk.com
CLOUDFLARENET
NL
unknown
2160
HopToDesk.exe
81.181.108.236:3478
—
M247 Ltd
GB
unknown
2160
HopToDesk.exe
23.165.104.217:3478
turn.hoptodesk.com
—
—
unknown
2160
HopToDesk.exe
81.181.108.49:3478
—
M247 Ltd
GB
unknown
2160
HopToDesk.exe
107.174.93.216:3478
—
AS-COLOCROSSING
US
unknown
2160
HopToDesk.exe
139.99.170.75:3478
—
OVH SAS
AU
unknown
2160
HopToDesk.exe
23.165.104.217:443
turn.hoptodesk.com
—
—
unknown

DNS requests

Domain
IP
Reputation
api.hoptodesk.com
  • 188.114.97.3
  • 188.114.96.3
unknown
turn.hoptodesk.com
  • 23.165.104.217
unknown
signal.hoptodesk.com
  • 45.77.249.125
unknown
www.hoptodesk.com
  • 188.114.97.3
  • 188.114.96.3
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2160
HopToDesk.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Websocket update request to external network
1484
HopToDesk.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Websocket update request to external network
2860
HopToDesk.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Websocket update request to external network
1608
HopToDesk.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Websocket update request to external network
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HopToDesk.exe