Overview

overview

8

Static

static

5

PCRemoteRe..._1.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

7z.dll

windows11-ltsc_2024-x64

1

MVCameraDriver.dll

windows11-ltsc_2024-x64

1

MonectMediaCenter.exe

windows11-ltsc_2024-x64

1

MonectRunt...ck.exe

windows11-ltsc_2024-x64

8

MonectServer.exe

windows11-ltsc_2024-x64

1

MonectServ...ce.exe

windows11-ltsc_2024-x64

1

PCRemoteReceiver.exe

windows11-ltsc_2024-x64

8

PCRemoteRe...UI.exe

windows11-ltsc_2024-x64

6

Packages/v...64.exe

windows11-ltsc_2024-x64

4

SDL2.dll

windows11-ltsc_2024-x64

1

SDL2_image.dll

windows11-ltsc_2024-x64

1

TouchInput.dll

windows11-ltsc_2024-x64

1

avcodec-59.dll

windows11-ltsc_2024-x64

1

avformat-59.dll

windows11-ltsc_2024-x64

1

avutil-57.dll

windows11-ltsc_2024-x64

1

channel.dll

windows11-ltsc_2024-x64

1

driver/ViG...us.sys

windows11-ltsc_2024-x64

3

driver/ViG...09.dll

windows11-ltsc_2024-x64

1

driver/leg...us.sys

windows11-ltsc_2024-x64

3

driver/leg...09.dll

windows11-ltsc_2024-x64

1

driver/leg...09.dll

windows11-ltsc_2024-x64

1

driver/leg...df.sys

windows11-ltsc_2024-x64

3

driver/leg...oy.sys

windows11-ltsc_2024-x64

3

driver/usb...64.exe

windows11-ltsc_2024-x64

1

driver/usb...dd.dll

windows11-ltsc_2024-x64

1

driver/vJo...09.dll

windows11-ltsc_2024-x64

1

driver/vJo...df.sys

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    99s
  • max time network
    103s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 04:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PCRemoteReceiverSetup_7_8_1.exe
  • Size 67.8MB
  • Sample260731-ewdbaace47
  • SHA256 30b0299ab64ab5ca9e8319fd305921d84edfc2c53b0477297f5f3a21c509b599
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 52 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiverSetup_7_8_1.exe
    "C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiverSetup_7_8_1.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM PCRemoteReceiver.exe /F /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4932
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM MonectServerService.exe /F /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2968
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM MonectMediaCenter.exe /F /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1404
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM MonectRuntimeCheck.exe /F /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4740
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM MonectServer.exe /F /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1180
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM driververifyx64.exe /F /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3020
    • C:\Program Files\PC Remote Receiver\Packages\vc_redist.x64.exe
      "C:\Program Files\PC Remote Receiver\Packages\vc_redist.x64.exe" /install /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3164
      • C:\Windows\Temp\{F0923488-AB67-4B2E-BBCF-46C00FD63612}\.cr\vc_redist.x64.exe
        "C:\Windows\Temp\{F0923488-AB67-4B2E-BBCF-46C00FD63612}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\PC Remote Receiver\Packages\vc_redist.x64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=696 /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4488
    • C:\Program Files\PC Remote Receiver\PCRemoteReceiver.exe
      "C:\Program Files\PC Remote Receiver\PCRemoteReceiver.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Program Files\PC Remote Receiver\MonectRuntimeCheck.exe
        "C:\Program Files\PC Remote Receiver\MonectRuntimeCheck.exe"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Program Files\PC Remote Receiver\driververifyx64.exe
          "C:\Program Files\PC Remote Receiver\driververifyx64.exe"
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2928
        • C:\Windows\System32\netsh.exe
          advfirewall firewall add rule name="MonectServerService" dir=in action=allow program="C:\Program Files\PC Remote Receiver\MonectServerService.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2092
        • C:\Windows\System32\netsh.exe
          advfirewall firewall add rule name="PCRemoteReceiver" dir=in action=allow program="C:\Program Files\PC Remote Receiver\PCRemoteReceiver.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:5180
        • C:\Windows\System32\netsh.exe
          advfirewall firewall add rule name="MonectMediaCenter" dir=in action=allow program="C:\Program Files\PC Remote Receiver\MonectMediaCenter.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4704
      • C:\Program Files\PC Remote Receiver\PCRemoteReceiverUI.exe
        "C:\Program Files\PC Remote Receiver\PCRemoteReceiverUI.exe"
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4232
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4232.5124.9239584607864485711 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:2584
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView /prefetch:4 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcbf0e5fd8,0x7ffcbf0e5fe4,0x7ffcbf0e5ff0
            5⤵
              PID:5804
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,9030509140040197951,11541851824670241589,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
              5⤵
                PID:3696
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1776,i,9030509140040197951,11541851824670241589,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
                5⤵
                  PID:3408
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1776,i,9030509140040197951,11541851824670241589,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
                  5⤵
                    PID:5828
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3316 --field-trial-handle=1776,i,9030509140040197951,11541851824670241589,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94 /prefetch:1
                    5⤵
                      PID:5584
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bdbb1250-20b2-a542-8845-657128d3d473}\vjoy.inf" "9" "49e52482b" "000000000000017C" "WinSta0\Default" "000000000000018C" "208" "c:\program files\pc remote receiver\driver\vjoy"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:2508
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\System32\DriverStore\FileRepository\vjoy.inf_amd64_958aef712eba5057\vjoy.inf" "oem1.inf:b2fe4818a00a2e82:vjoy.Inst.Win7:12.53.21.621:root\vid_1234&pid_bead&rev_0219," "49e52482b" "000000000000017C" "7587"
              1⤵
              • Drops file in Drivers directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:4356
            • C:\Windows\system32\AUDIODG.EXE
              C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E4
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4572
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d734562e-83ad-554f-a12f-69afc8fb0565}\vigembus.inf" "9" "429a86e87" "000000000000018C" "WinSta0\Default" "000000000000016C" "208" "c:\program files\pc remote receiver\driver\vigem"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:204
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_dc012c700833063e\vigembus.inf" "oem2.inf:c14ce88408607219:ViGEmBus_Device:1.16.112.0:nefarius\vigembus\gen1," "429a86e87" "000000000000018C" "7587"
              1⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:5464
            • C:\Program Files\PC Remote Receiver\MonectServerService.exe
              "C:\Program Files\PC Remote Receiver\MonectServerService.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:5964
              • C:\Program Files\PC Remote Receiver\driververifyx64.exe
                -disable
                2⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:3152
              • C:\Program Files\PC Remote Receiver\MonectServer.exe
                "C:\Program Files\PC Remote Receiver\MonectServer.exe"
                2⤵
                • Executes dropped EXE
                PID:2680

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  2
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Netsh Helper DLL

                  1
                  T1546.007

                  Privilege Escalation

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  2
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Netsh Helper DLL

                  1
                  T1546.007

                  Defense Evasion

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify System Firewall

                  1
                  T1562.004

                  Credential Access

                  Discovery

                  Network Share Discovery

                  1
                  T1135

                  Peripheral Device Discovery

                  1
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  4
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Network Configuration Discovery

                  1
                  T1016

                  Internet Connection Discovery

                  1
                  T1016.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  MVCameraDriver.dll
                  • Path C:\Program Files\PC Remote Receiver\MVCameraDriver.dll
                  • Size 123KB
                  • SHA256 23f8e0f4fe011eedffc8106e307665c528c5cf6fabf5e9cb5c4ca6114c8c6896
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MonectRuntimeCheck.exe
                  • Path C:\Program Files\PC Remote Receiver\MonectRuntimeCheck.exe
                  • Size 122KB
                  • SHA256 84d0135bdd7b3e51d79ba0a799145bc9be78b4870e8b48d38722e45f6fc2af34
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MonectServer.exe
                  • Path C:\Program Files\PC Remote Receiver\MonectServer.exe
                  • Size 159KB
                  • SHA256 ad8050604ac9222b179dae314127db229cd08a240fab9e1b62f32cf8bc644653
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MonectServerService.exe
                  • Path C:\Program Files\PC Remote Receiver\MonectServerService.exe
                  • Size 2.7MB
                  • SHA256 4ad47150551ce94811c480fbb3ab9c088084624498897bd61cd399f98ad59bfd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PCRemoteReceiver.exe
                  • Path C:\Program Files\PC Remote Receiver\PCRemoteReceiver.exe
                  • Size 7.3MB
                  • SHA256 0f9df02f001812ebf67e383c50a59a5b853c39992ff55b9a230006f358642501
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PCRemoteReceiverUI.exe
                  • Path C:\Program Files\PC Remote Receiver\PCRemoteReceiverUI.exe
                  • Size 17.2MB
                  • SHA256 454a5aaf8535e7fd0ff3de4dd4c1b30f057597c64e56112964bebf5c06a1c744
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vc_redist.x64.exe
                  • Path C:\Program Files\PC Remote Receiver\Packages\vc_redist.x64.exe
                  • Size 14.3MB
                  • SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SDL2.dll
                  • Path C:\Program Files\PC Remote Receiver\SDL2.dll
                  • Size 2.2MB
                  • SHA256 81c70b7bfa5690b0ff20c15caa499f615a82cf5b49d278da89265eb836036465
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SDL2_image.dll
                  • Path C:\Program Files\PC Remote Receiver\SDL2_image.dll
                  • Size 122KB
                  • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  avutil-57.dll
                  • Path C:\Program Files\PC Remote Receiver\avutil-57.dll
                  • Size 940KB
                  • SHA256 cb86f74c46b1771d9ce5aba2fd83796b60c0d2a3f1f9ba7ed9cc111f0b25b0a1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  channel.dll
                  • Path C:\Program Files\PC Remote Receiver\channel.dll
                  • Size 3.5MB
                  • SHA256 eabcd6679a72f19e8f8f4a3518a9e1e20b1ea69cc78bf878734514cbb6aee09b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ViGEmBus.inf
                  • Path C:\Program Files\PC Remote Receiver\driver\ViGEm\ViGEmBus.inf
                  • Size 2KB
                  • SHA256 63774d6149f036c0d9faf98b062fea6b97debed559a9522099e46b54fe58da40
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vjoy.inf
                  • Path C:\Program Files\PC Remote Receiver\driver\vJoy\vjoy.inf
                  • Size 10KB
                  • SHA256 33fe32886a8bf72769c3e4991265546c3d1cca9247dbb661f23f7f82362226a4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  driververifyx64.exe
                  • Path C:\Program Files\PC Remote Receiver\driververifyx64.exe
                  • Size 157KB
                  • SHA256 147e27f46540b799ab600cbf30c0c0016cbe586922b53b92c3bf954d91d22ee7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  install.dll
                  • Path C:\Program Files\PC Remote Receiver\install.dll
                  • Size 31KB
                  • SHA256 969d851b53f685d34fd4429451dddb0c6e116a9ec145c8a7774c3c4acabab899
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en_us.lg
                  • Path C:\Program Files\PC Remote Receiver\lang\en_us.lg
                  • Size 12KB
                  • SHA256 db923c6b728fcbf6d7e6bdb3906bcbd2b0e169d188f1da8f953bd3a0ff1e9e89
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  swresample-4.dll
                  • Path C:\Program Files\PC Remote Receiver\swresample-4.dll
                  • Size 423KB
                  • SHA256 339114e12aaf6c5c4d5f17605eac4665ec570ff5de189adada800c177b238932
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  swscale-6.dll
                  • Path C:\Program Files\PC Remote Receiver\swscale-6.dll
                  • Size 589KB
                  • SHA256 b2c3ee9cdc0e5292040bcd3336390e77ae8b467d65faa80f7e68625a619b32de
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  InstallOptions.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg5E3.tmp\InstallOptions.dll
                  • Size 15KB
                  • SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LangDLL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg5E3.tmp\LangDLL.dll
                  • Size 5KB
                  • SHA256 131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg5E3.tmp\System.dll
                  • Size 12KB
                  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ioSpecial.ini
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg5E3.tmp\ioSpecial.ini
                  • Size 1KB
                  • SHA256 affc1b65e91c30bc3945c048300bd0bfbd2c6ad137d9eeeed8d6fdc4bdd1476e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ioSpecial.ini
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg5E3.tmp\ioSpecial.ini
                  • Size 1KB
                  • SHA256 1ab3507fd102f9d986cc72415a9bb29e1fcd89dded1579386559fd6206e8100a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ioSpecial.ini
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg5E3.tmp\ioSpecial.ini
                  • Size 1KB
                  • SHA256 a9d7669fd7010a122242e0a3668432e8266b6696bbbfebfdd4d96ed8668fc9b1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 2aa47b9de117ea03743d6d9a230011402d0e360c0c8de36d35c0dcdb059dd61a
                  • MD5 SHA1 SHA512
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 5935e8230022a179fde2bb939867b937e7c73a7b5ed9e9a78b7d96e7bac29d2b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  throttle_store.dat
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Crashpad\throttle_store.dat
                  • Size 20B
                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                  • MD5 SHA1 SHA512
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                  • Size 72B
                  • SHA256 52ced2e060e7f0810307f75c91e17e9a5d510cf6eafd9cbb22133c0fa2c4e32f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index~RFe5a155e.TMP
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a155e.TMP
                  • Size 48B
                  • SHA256 dc2328312f61aca07fcacf8e0cd74663ba58a9f68410161b6ba9e6bd1b6b8e61
                  • MD5 SHA1 SHA512
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Extension Rules\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Site Characteristics Database\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  c1571282-c93b-47e7-8fd1-a5836da110a0.tmp
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\c1571282-c93b-47e7-8fd1-a5836da110a0.tmp
                  • Size 6KB
                  • SHA256 2851e7f1e88659c4a71268c0fac71fc33d6a4a976f2e4dec1612fa14c826faac
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\GraphiteDawnCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\GraphiteDawnCache\data_1
                  • Size 264KB
                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\GraphiteDawnCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\GraphiteDawnCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Local State
                  • Size 15KB
                  • SHA256 4359beb5f5eb4b1d4c1f4c8bf372e0f5eefe2e771ee249d270d68f7dbc4cc5a1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Local State
                  • Size 1KB
                  • SHA256 783d8fb38a3e56826aac974ee69dbf0ebb2fa369f4cc75d4d4bfe53cdcce1037
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Local State
                  • Size 2KB
                  • SHA256 b2587b461459550db1d31e8a786efce718e9522dd12e68290001599a02205e07
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Local State
                  • Size 3KB
                  • SHA256 1eb498fc843e34c59973d9abdb03f03f958711aeefeee850436ca7fb484632cb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  dberr.txt
                  • Path C:\Windows\System32\CatRoot2\dberr.txt
                  • Size 64KB
                  • SHA256 5116802e45dba53d13abfa1d898b9a7f1b7854b0ae031ad49ce7492b3da7fc96
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vigembus.inf_amd64_dc012c700833063e.ini
                  • Path C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_dc012c700833063e.ini
                  • Size 554B
                  • SHA256 33fce0360e56b37d909eab0ae5ab542c288d32b7c28c9c6a6679006f26703885
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vjoy.inf_amd64_958aef712eba5057.ini
                  • Path C:\Windows\System32\DriverStore\FileRepository\vjoy.inf_amd64_958aef712eba5057.ini
                  • Size 645B
                  • SHA256 73bbcb7f25e685753e49c4118fc339945de7975d6c2a14fc8988aee28e444365
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  logo.png
                  • Path C:\Windows\Temp\{8D20D53F-49C0-4019-8DA6-A3C1A5D6574C}\.ba\logo.png
                  • Size 1KB
                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  wixstdba.dll
                  • Path C:\Windows\Temp\{8D20D53F-49C0-4019-8DA6-A3C1A5D6574C}\.ba\wixstdba.dll
                  • Size 191KB
                  • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vc_redist.x64.exe
                  • Path C:\Windows\Temp\{F0923488-AB67-4B2E-BBCF-46C00FD63612}\.cr\vc_redist.x64.exe
                  • Size 632KB
                  • SHA256 82c3e3423e48bafcdd726624eb7fd3e00674e50e4b6acdcac408fe8fae43b022
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ViGEmBus.sys
                  • Path \??\c:\PROGRA~1\PCREMO~1\driver\vigem\x64\ViGEmBus.sys
                  • Size 67KB
                  • SHA256 1a1e57cb0dd7ca08d96bbb1b6ce667e3273702c13a7ecf86839b7642ef8255e0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WdfCoInstaller01009.dll
                  • Path \??\c:\PROGRA~1\PCREMO~1\driver\vigem\x64\WdfCoInstaller01009.dll
                  • Size 1.7MB
                  • SHA256 1a7627c11aecf24e8e0c9a519498e8456f0457bd89f0ffe649bd8fb53a194f89
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WdfCoInstaller01009.dll
                  • Path \??\c:\PROGRA~1\PCREMO~1\driver\vjoy\WdfCoInstaller01009.dll
                  • Size 1.7MB
                  • SHA256 44812fe5fe3b848d7d592278382c7c0370eba3115a9bd7f8db22efb89d1ed2b3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hidkmdf.sys
                  • Path \??\c:\PROGRA~1\PCREMO~1\driver\vjoy\hidkmdf.sys
                  • Size 26KB
                  • SHA256 8668f69c256baff9422ac9b3ab77448c21b5043547920591148b152cb3afb0d2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vjoy.sys
                  • Path \??\c:\PROGRA~1\PCREMO~1\driver\vjoy\vjoy.sys
                  • Size 65KB
                  • SHA256 297f9c12df8bd91640439c0bf7fe1ee391bbd01d330f5e1604a29c4669977774
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ViGEmBus.cat
                  • Path \??\c:\program files\pc remote receiver\driver\vigem\ViGEmBus.cat
                  • Size 9KB
                  • SHA256 5b03a642a52d5ee895931c8fad98b2a67f20331c313aec42aa96d76c9c3ff928
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vJoy.cat
                  • Path \??\c:\program files\pc remote receiver\driver\vjoy\vJoy.cat
                  • Size 11KB
                  • SHA256 784ea14d897c88be331d5c129d254a3a09add3d47066ad2879adecef3f00c97d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/2888-384-0x000000006A880000-0x000000006A8A7000-memory.dmp
                  Download

                  memory/2888-385-0x00000180400F0000-0x0000018044FF9000-memory.dmp
                  Download

                  memory/2888-380-0x00007FFCC5720000-0x00007FFCC5923000-memory.dmp
                  Download

                  memory/2888-382-0x00007FFCD0780000-0x00007FFCD0828000-memory.dmp
                  Download

                  memory/2888-381-0x00007FFCD0CC0000-0x00007FFCD0D63000-memory.dmp
                  Download

                  memory/2888-383-0x00007FFCC54F0000-0x00007FFCC5720000-memory.dmp
                  Download

                  memory/3696-461-0x00007FFCE7230000-0x00007FFCE7231000-memory.dmp
                  Download

                  memory/3696-644-0x00000185E6600000-0x00000185E6799000-memory.dmp
                  Download

                  memory/5584-487-0x00007FFCE7230000-0x00007FFCE7231000-memory.dmp
                  Download

                  memory/5964-388-0x00007FFCC05E0000-0x00007FFCC54E9000-memory.dmp
                  Download

                  memory/5964-387-0x00007FFCD0CC0000-0x00007FFCD0D63000-memory.dmp
                  Download

                  memory/5964-386-0x00007FFCC5720000-0x00007FFCC5923000-memory.dmp
                  Download

                  memory/5964-389-0x00007FFCD0780000-0x00007FFCD0828000-memory.dmp
                  Download