Overview

overview

8

Static

static

5

PCRemoteRe..._1.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

7z.dll

windows11-ltsc_2024-x64

1

MVCameraDriver.dll

windows11-ltsc_2024-x64

1

MonectMediaCenter.exe

windows11-ltsc_2024-x64

1

MonectRunt...ck.exe

windows11-ltsc_2024-x64

8

MonectServer.exe

windows11-ltsc_2024-x64

1

MonectServ...ce.exe

windows11-ltsc_2024-x64

1

PCRemoteReceiver.exe

windows11-ltsc_2024-x64

8

PCRemoteRe...UI.exe

windows11-ltsc_2024-x64

6

Packages/v...64.exe

windows11-ltsc_2024-x64

4

SDL2.dll

windows11-ltsc_2024-x64

1

SDL2_image.dll

windows11-ltsc_2024-x64

1

TouchInput.dll

windows11-ltsc_2024-x64

1

avcodec-59.dll

windows11-ltsc_2024-x64

1

avformat-59.dll

windows11-ltsc_2024-x64

1

avutil-57.dll

windows11-ltsc_2024-x64

1

channel.dll

windows11-ltsc_2024-x64

1

driver/ViG...us.sys

windows11-ltsc_2024-x64

3

driver/ViG...09.dll

windows11-ltsc_2024-x64

1

driver/leg...us.sys

windows11-ltsc_2024-x64

3

driver/leg...09.dll

windows11-ltsc_2024-x64

1

driver/leg...09.dll

windows11-ltsc_2024-x64

1

driver/leg...df.sys

windows11-ltsc_2024-x64

3

driver/leg...oy.sys

windows11-ltsc_2024-x64

3

driver/usb...64.exe

windows11-ltsc_2024-x64

1

driver/usb...dd.dll

windows11-ltsc_2024-x64

1

driver/vJo...09.dll

windows11-ltsc_2024-x64

1

driver/vJo...df.sys

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 04:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PCRemoteReceiver.exe
  • Size 7.3MB
  • Sample260731-ewdbaace47
  • SHA256 0f9df02f001812ebf67e383c50a59a5b853c39992ff55b9a230006f358642501
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 52 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiver.exe
    "C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiver.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Users\Admin\AppData\Local\Temp\MonectRuntimeCheck.exe
      "C:\Users\Admin\AppData\Local\Temp\MonectRuntimeCheck.exe"
      2⤵
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe
        "C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:5088
      • C:\Windows\System32\netsh.exe
        advfirewall firewall add rule name="MonectServerService" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2956
      • C:\Windows\System32\netsh.exe
        advfirewall firewall add rule name="PCRemoteReceiver" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiver.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2188
      • C:\Windows\System32\netsh.exe
        advfirewall firewall add rule name="MonectMediaCenter" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MonectMediaCenter.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:5916
    • C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiverUI.exe
      "C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiverUI.exe"
      2⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1436.6044.13191875837966123406 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:3140
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView /prefetch:4 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7fff454e5fd8,0x7fff454e5fe4,0x7fff454e5ff0
          4⤵
            PID:792
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,8504484288603972782,8160773241887351827,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
            4⤵
              PID:4296
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2116 --field-trial-handle=1856,i,8504484288603972782,8160773241887351827,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
              4⤵
                PID:5396
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2444 --field-trial-handle=1856,i,8504484288603972782,8160773241887351827,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
                4⤵
                  PID:4132
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3508 --field-trial-handle=1856,i,8504484288603972782,8160773241887351827,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94 /prefetch:1
                  4⤵
                    PID:1080
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4524 --field-trial-handle=1856,i,8504484288603972782,8160773241887351827,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
                    4⤵
                      PID:5580
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=1856,i,8504484288603972782,8160773241887351827,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
                      4⤵
                        PID:3200
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4660 --field-trial-handle=1856,i,8504484288603972782,8160773241887351827,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
                        4⤵
                          PID:2808
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView" --webview-exe-name=PCRemoteReceiverUI.exe --webview-exe-version=0.5.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4568 --field-trial-handle=1856,i,8504484288603972782,8160773241887351827,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd5a8b303eaacce08a9ee34622d7739336a85e94
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3924
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b94770e9-d2da-da45-aa9f-160a4020e62d}\vjoy.inf" "9" "49e52482b" "00000000000000E8" "WinSta0\Default" "0000000000000170" "208" "c:\users\admin\appdata\local\temp\driver\vjoy"
                    1⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:4320
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\System32\DriverStore\FileRepository\vjoy.inf_amd64_958aef712eba5057\vjoy.inf" "oem1.inf:b2fe4818a00a2e82:vjoy.Inst.Win7:12.53.21.621:root\vid_1234&pid_bead&rev_0219," "49e52482b" "00000000000000E8" "f637"
                    1⤵
                    • Drops file in Drivers directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2584
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004D8
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5844
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{54a21558-9d5c-c34b-9fb3-b4a379ab4536}\vigembus.inf" "9" "429a86e87" "0000000000000198" "WinSta0\Default" "000000000000019C" "208" "c:\users\admin\appdata\local\temp\driver\vigem"
                    1⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:5576
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_dc012c700833063e\vigembus.inf" "oem2.inf:c14ce88408607219:ViGEmBus_Device:1.16.112.0:nefarius\vigembus\gen1," "429a86e87" "0000000000000198" "f637"
                    1⤵
                    • Drops file in Drivers directory
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4628
                  • C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe
                    C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe
                    1⤵
                    • Modifies data under HKEY_USERS
                    • Suspicious use of WriteProcessMemory
                    PID:2140
                    • C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe
                      -disable
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Suspicious use of AdjustPrivilegeToken
                      PID:900
                    • C:\Users\Admin\AppData\Local\Temp\MonectServer.exe
                      "C:\Users\Admin\AppData\Local\Temp\MonectServer.exe"
                      2⤵
                        PID:3844

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Persistence

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Event Triggered Execution

                          2
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Netsh Helper DLL

                          1
                          T1546.007

                          Privilege Escalation

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Event Triggered Execution

                          2
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Netsh Helper DLL

                          1
                          T1546.007

                          Defense Evasion

                          Impair Defenses

                          1
                          T1562

                          Disable or Modify System Firewall

                          1
                          T1562.004

                          Credential Access

                          Discovery

                          Network Share Discovery

                          1
                          T1135

                          Peripheral Device Discovery

                          1
                          T1120

                          Query Registry

                          2
                          T1012

                          System Information Discovery

                          3
                          T1082

                          System Network Configuration Discovery

                          1
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          settings.dat
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Crashpad\settings.dat
                          • Size 280B
                          • SHA256 c2eec5dc1d8e300d6f32bc36ac074f6d6d9b46514b52533cdb3607d4788ec095
                          • MD5 SHA1 SHA512
                          Submit Download

                          settings.dat
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Crashpad\settings.dat
                          • Size 280B
                          • SHA256 a746eeaa1f16c142dcfcc60c241ca5a1870d9cc537efa3c4a077293b95f7d33d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          throttle_store.dat
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Crashpad\throttle_store.dat
                          • Size 20B
                          • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                          • MD5 SHA1 SHA512
                          Submit Download

                          the-real-index
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                          • Size 72B
                          • SHA256 1a96452d499711c64ce39e4d10a873737a8c70012367905bb195de226c1b71fc
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          the-real-index~RFe5a2f00.TMP
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a2f00.TMP
                          • Size 48B
                          • SHA256 88030a718b7256815d46f6c06b9978dbaa74f9347e5693045335155b6bd9aac4
                          • MD5 SHA1 SHA512
                          Submit Download

                          Network Persistent State
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Network\Network Persistent State
                          • Size 111B
                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Network Persistent State~RFe5b05b9.TMP
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Network\Network Persistent State~RFe5b05b9.TMP
                          • Size 59B
                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          SCT Auditing Pending Reports
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\Network\SCT Auditing Pending Reports
                          • Size 2B
                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                          • MD5 SHA1 SHA512
                          Submit Download

                          c50f7296-888e-4abb-b7a8-1cfd0b0f1f49.tmp
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\c50f7296-888e-4abb-b7a8-1cfd0b0f1f49.tmp
                          • Size 6KB
                          • SHA256 6c0e2ec6da5f7c6306552fd6b3227ca334fae7a0a6af424fe290db398c3b46fe
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          CURRENT
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\shared_proto_db\metadata\CURRENT
                          • Size 16B
                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                          • MD5 SHA1 SHA512
                          Submit Download

                          MANIFEST-000001
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                          • Size 41B
                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                          • MD5 SHA1 SHA512
                          Submit Download

                          data_0
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\GraphiteDawnCache\data_0
                          • Size 8KB
                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          data_1
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\GraphiteDawnCache\data_1
                          • Size 264KB
                          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          data_2
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\GraphiteDawnCache\data_2
                          • Size 8KB
                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          data_3
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\GraphiteDawnCache\data_3
                          • Size 8KB
                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Local State
                          • Size 15KB
                          • SHA256 40e216d942ffadaf876b290d8e8bc3fd6b9c4720b288dd0017c26e8eaf9bc770
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Local State
                          • Size 2KB
                          • SHA256 c06131321825dfbe03e3c9714e53bbfef03f4afe444098c4331865effb4f3e07
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Local State
                          • Size 3KB
                          • SHA256 f4fd3ae793f5a2b6cc9545400a3db63bc59097c7c0eb412ff44266bdccf3fde8
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Local State~RFe59dcd9.TMP
                          • Path C:\Users\Admin\AppData\Local\com.monect.receiver\EBWebView\Local State~RFe59dcd9.TMP
                          • Size 1KB
                          • SHA256 c1d3bb3423c975bf10d67a1be63336d9f7a0760347c01207e4ae6cf00a7e22d3
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dberr.txt
                          • Path C:\Windows\System32\CatRoot2\dberr.txt
                          • Size 64KB
                          • SHA256 b15555db85e3fef121d702a7fb30d1c4651338d9cd26768478945f3f4b0a3517
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vigembus.inf_amd64_dc012c700833063e.ini
                          • Path C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_dc012c700833063e.ini
                          • Size 554B
                          • SHA256 8a3ed801d1d8211e470c0270ee719465371a3d07615aded0fb1514cd84c02068
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          vjoy.inf_amd64_958aef712eba5057.ini
                          • Path C:\Windows\System32\DriverStore\FileRepository\vjoy.inf_amd64_958aef712eba5057.ini
                          • Size 645B
                          • SHA256 dcbd3c785be57ddbb03a7db35aeb490119d7ebf4e4afba78449a123e4e4a965e
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/1080-160-0x00007FFF6D820000-0x00007FFF6D821000-memory.dmp
                          Download

                          memory/2140-31-0x00007FFF46DA0000-0x00007FFF4BCA9000-memory.dmp
                          Download

                          memory/2140-34-0x00007FFF62570000-0x00007FFF62618000-memory.dmp
                          Download

                          memory/2140-32-0x00007FFF5E1E0000-0x00007FFF5E3E3000-memory.dmp
                          Download

                          memory/2140-33-0x00007FFF62480000-0x00007FFF62523000-memory.dmp
                          Download

                          memory/3924-513-0x00000267A5EF0000-0x00000267A5EF1000-memory.dmp
                          Download

                          memory/3924-520-0x00000267A5EF0000-0x00000267A5EF1000-memory.dmp
                          Download

                          memory/3924-524-0x00000267A5EF0000-0x00000267A5EF1000-memory.dmp
                          Download

                          memory/3924-519-0x00000267A5EF0000-0x00000267A5EF1000-memory.dmp
                          Download

                          memory/3924-522-0x00000267A5EF0000-0x00000267A5EF1000-memory.dmp
                          Download

                          memory/3924-523-0x00000267A5EF0000-0x00000267A5EF1000-memory.dmp
                          Download

                          memory/3924-521-0x00000267A5EF0000-0x00000267A5EF1000-memory.dmp
                          Download

                          memory/3924-515-0x00000267A5EF0000-0x00000267A5EF1000-memory.dmp
                          Download

                          memory/4296-123-0x00007FFF6D820000-0x00007FFF6D821000-memory.dmp
                          Download

                          memory/4296-266-0x000001D500DF0000-0x000001D500E1F000-memory.dmp
                          Download

                          memory/4884-28-0x000000006A880000-0x000000006A8A7000-memory.dmp
                          Download

                          memory/4884-30-0x0000022419BF0000-0x000002241EAF9000-memory.dmp
                          Download

                          memory/4884-26-0x00007FFF62570000-0x00007FFF62618000-memory.dmp
                          Download

                          memory/4884-25-0x00007FFF5E1E0000-0x00007FFF5E3E3000-memory.dmp
                          Download

                          memory/4884-29-0x00007FFF62480000-0x00007FFF62523000-memory.dmp
                          Download

                          memory/4884-27-0x00007FFF50230000-0x00007FFF50460000-memory.dmp
                          Download

                          memory/5580-350-0x00007FFF6D4F0000-0x00007FFF6D4F1000-memory.dmp
                          Download

                          memory/5580-349-0x00007FFF6DA90000-0x00007FFF6DA91000-memory.dmp
                          Download