Overview

overview

9

Static

static

1

2026-08-07...r_.exe

windows10-2004-x64

9

2026-08-07...r_.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/08/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
  • Size 74.3MB
  • Sample260807-2bk7qaac85
  • SHA256 1f979dd7eee4ca7112057e511d804eecc5e9ae6e51876e72ddec881de424d1c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables packed with SmartAssembly 5 IoCs
  • Drops file in Drivers directory 10 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 58 IoCs
  • SmartAssembly .NET packer 1 IoCs

    Detects SmartAssembly .NET packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 9 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 51 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe"
    1⤵
    • Enumerates connected drives
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe" /i "C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Streamer.Setup.msi" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Desktop Streamer" APPDIR="C:\Program Files\Virtual Desktop Streamer" SECONDSEQUENCE="1" CLIENTPROCESSID="3444" AI_MORE_CMD_LINE=1
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      PID:432
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A01D10CFD47BC35CFA59E0F6B40576EC C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssDEC2.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiDEAF.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrDEB0.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrDEB1.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3588
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssB2A1.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiB29E.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrB29F.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrB2A0.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:452
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 14AB4C3327F7513B8315718BC63FF567
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe" /groupsextract:114; /out:"C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer\prerequisites" /callbackid:3408
        3⤵
        • System Location Discovery: System Language Discovery
        PID:652
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 59E54A42AF5A0D60C031A78948E13A2B E Global\MSI0000
      2⤵
      • Drops file in Windows directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss2E2D.ps1" -propFile "C:\Windows\SystemTemp\msi2E2A.txt" -scriptFile "C:\Windows\SystemTemp\scr2E2B.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr2E2C.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:4228
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss32E6.ps1" -propFile "C:\Windows\SystemTemp\msi32E3.txt" -scriptFile "C:\Windows\SystemTemp\scr32E4.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr32E5.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3776
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss46C1.ps1" -propFile "C:\Windows\SystemTemp\msi46BE.txt" -scriptFile "C:\Windows\SystemTemp\scr46BF.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr46C0.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:1224
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss524F.ps1" -propFile "C:\Windows\SystemTemp\msi524C.txt" -scriptFile "C:\Windows\SystemTemp\scr524D.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr524E.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3940
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss5AC0.ps1" -propFile "C:\Windows\SystemTemp\msi5ABD.txt" -scriptFile "C:\Windows\SystemTemp\scr5ABE.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr5ABF.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2136
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss6852.ps1" -propFile "C:\Windows\SystemTemp\msi683F.txt" -scriptFile "C:\Windows\SystemTemp\scr6840.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr6841.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3300
    • C:\Program Files\Virtual Desktop Streamer\Updater.exe
      "C:\Program Files\Virtual Desktop Streamer\Updater.exe" /configservice -name "Updater"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4708
    • C:\Windows\Installer\MSI6E06.tmp
      "C:\Windows\Installer\MSI6E06.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3144
      • C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe
        "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe"
        3⤵
        • Checks computer location settings
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4108
        • C:\Windows\System32\sc.exe
          "C:\Windows\System32\sc.exe" delete VirtualDesktop.Service.exe
          4⤵
          • Launches sc.exe
          PID:4220
        • C:\Windows\System32\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /qn /i "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Service.msi" MSIRESTARTMANAGERCONTROL=Disable
          4⤵
            PID:1104
          • C:\Windows\System32\sc.exe
            "C:\Windows\System32\sc.exe" delete VirtualDesktop.Service.exe
            4⤵
            • Launches sc.exe
            PID:972
          • C:\Windows\System32\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /qn /i "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Service.msi" MSIRESTARTMANAGERCONTROL=Disable
            4⤵
              PID:4520
        • C:\Windows\Installer\MSI1C7E.tmp
          "C:\Windows\Installer\MSI1C7E.tmp" 1733 {31A7EAC4-99AC-41B8-8C39-1F54DD9CF036}5IC:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer\prerequisites\VirtualDesktop.Service.msibwbBi-=l3444Chainer
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1328
      • C:\Program Files\Virtual Desktop Streamer\Updater.exe
        "C:\Program Files\Virtual Desktop Streamer\Updater.exe" /runservice
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3872
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{72e9d6e9-7422-dc47-8045-3a74491c7a07}\vdvad.inf" "9" "46dd69753" "0000000000000138" "WinSta0\Default" "0000000000000140" "208" "c:\program files\virtual desktop streamer\audiodriver\x64"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:1676
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca1198852b16:VDVAD_WaveExtensible:1.6.1.0:*vdvad," "46dd69753" "0000000000000138"
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:1400
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3596493e-0b7a-ab4d-9f3e-f7c0c393112f}\vdvge.inf" "9" "498525ae7" "00000000000000E8" "WinSta0\Default" "0000000000000178" "208" "c:\program files\virtual desktop streamer\gamepaddriver\x64"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4904
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c14ce884140e1b91:vdvge_Device:1.0.2.0:root\vdvge," "498525ae7" "0000000000000174"
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:2768
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{78fabd14-5156-604e-bb96-afbaf72dcf13}\vdvmd.inf" "9" "4b44dc1bf" "0000000000000174" "WinSta0\Default" "0000000000000180" "208" "c:\program files\virtual desktop streamer\monitordriver\x64"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4456
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem5.inf" "oem5.inf:c14ce8840c48fa1f:MyDevice_Install:13.50.53.699:root\vdvmd," "4b44dc1bf" "0000000000000194"
          2⤵
          • Drops file in Drivers directory
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:3724
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem5.inf" "oem5.inf:c14ce8840c48fa1f:MyDevice_Install:13.50.53.699:root\vdvmd," "4b44dc1bf" "0000000000000180"
          2⤵
          • Drops file in Drivers directory
          • Checks SCSI registry key(s)
          PID:1160
      • C:\Program Files\Virtual Desktop\VirtualDesktop.Service.exe
        "C:\Program Files\Virtual Desktop\VirtualDesktop.Service.exe"
        1⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2820
      • C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Streamer.exe
        "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Streamer.exe"
        1⤵
        • Checks computer location settings
        • Drops file in System32 directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:320
        • C:\Program Files\Virtual Desktop Streamer\Updater.exe
          "C:\Program Files\Virtual Desktop Streamer\Updater.exe" /justcheck -critical
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3632
        • C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe
          "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe"
          2⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          PID:1464

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e590af4.rbs
            • Path C:\Config.Msi\e590af4.rbs
            • Size 909KB
            • SHA256 278e78ea295e2747ab94567c7a43632c95ca5ad551d77a9fa6e2d0a89f3c01f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e590af9.rbs
            • Path C:\Config.Msi\e590af9.rbs
            • Size 329KB
            • SHA256 39983c19bf406f1192769c4e65c2855d1da197659d066759f2328157ee48658f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pico_neo3_leftcontroller.png
            • Path C:\Program Files\Virtual Desktop Streamer\OpenVRDriver\resources\rendermodels\oculus_quest2_controller_left\pico_neo3_leftcontroller.png
            • Size 89KB
            • SHA256 5eb85fbd79c51e1160640ad20f4700558debcd8b79618cd20561b06e787cd2a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Updater.ini
            • Path C:\Program Files\Virtual Desktop Streamer\Updater.ini
            • Size 229B
            • SHA256 935acb1c78fd07b0dd111f17ed5c404c021d0250c0f1e3b72ffdc14c383576ad
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Updater.ini
            • Path C:\Program Files\Virtual Desktop Streamer\Updater.ini
            • Size 316B
            • SHA256 160bebd5fd63e1e8431c152212b6cc4dc1af201ee0dd3529cce2a72e7d869385
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
            • Size 471B
            • SHA256 81865d0c7df6370bfa0c53908b27b8bd1cdaea30c20f767cefd73b6b5376ddb8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8EC9B1D0ABBD7F98B401D425828828CE_CDB31A67E2F7BEE9EBCC3799C6ED485F
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CDB31A67E2F7BEE9EBCC3799C6ED485F
            • Size 727B
            • SHA256 04c38b58a03772c7954cab86c8ae856f7fd57beb41f8874bc476abef82498787
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Size 727B
            • SHA256 db1d5f399aac10e28e8c58ab6e8a9f1876422832b762d6231faa4f663e92885e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
            • Size 400B
            • SHA256 729e15f2940d0379a30b719820f8dc7bda47bd371e354eb2075ac7a07d2f1ac3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8EC9B1D0ABBD7F98B401D425828828CE_CDB31A67E2F7BEE9EBCC3799C6ED485F
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_CDB31A67E2F7BEE9EBCC3799C6ED485F
            • Size 408B
            • SHA256 6a3357162cdf7938c0b159137daec44184f42500e54c5324b04246b1f2b2d6df
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Size 412B
            • SHA256 6a1e23902c5029762a6eb32a3a227edee27fd30d2814604b96587624fff17c73
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            BannerBitmap.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3444\BannerBitmap.jpg
            • Size 13KB
            • SHA256 723a598c2dc3636da059b91e4e4cc8899744ab0e4fd25d127a5b2bd779b4f1ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DialogBitmap.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3444\DialogBitmap.jpg
            • Size 37KB
            • SHA256 f5dc338bd11eaf7e0e21a722f37b107e26590d915536ae9f8d5e15ce85de5933
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSICFCF.LOG
            • Path C:\Users\Admin\AppData\Local\Temp\MSICFCF.LOG
            • Size 146KB
            • SHA256 6ec2806ac38e8ed8ff5a9b3b12f7e26282a6009786c2bb3229df4441d43cabfa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSICFCF.LOG
            • Path C:\Users\Admin\AppData\Local\Temp\MSICFCF.LOG
            • Size 207KB
            • SHA256 ca71cfdd49382c8a93d3126d4b5e16e548661dd67d43084e50ae2da1388acf9b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSID465.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSID465.tmp
            • Size 904KB
            • SHA256 d6b89fd5a95071e7b144d8bedcb09b694e9cd14bfbfafb782b17cf8413eac6da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSID5FE.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSID5FE.tmp
            • Size 1.1MB
            • SHA256 403869ed494bcbc3e535b492f2ebfad95748049e203ff7c31ac1afb38d8909ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSID6F9.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSID6F9.tmp
            • Size 877KB
            • SHA256 107fd7ee1eaf17c27b4ed25990acace2cb51f8d39f4dfc8ef5a3df03d02e1d34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIDDE8.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSIDDE8.tmp
            • Size 758KB
            • SHA256 8029e9d62de81689ae1081a918ea8534af1d02e3c56b49a74fedbaeeb2321a74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_aufzyja1.1o0.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aufzyja1.1o0.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            pssDEC2.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\pssDEC2.ps1
            • Size 36KB
            • SHA256 8a48daf5bcb5646aedf34754e49ab64db84910a1b81afbe64ab61442f8d96908
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            scrDEB0.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\scrDEB0.ps1
            • Size 31KB
            • SHA256 a12f6a3fba6844b009c10054563bd5a61342e518e128a762b7ecd67d2629df47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            shi98B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\shi98B.tmp
            • Size 4.8MB
            • SHA256 047e2df9ccf0ce298508ee7f0db0abcb2ff9cff9916b6e8a1fbd806b7a9d064b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            shiD84C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\shiD84C.tmp
            • Size 444KB
            • SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            shiD86C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\shiD86C.tmp
            • Size 76KB
            • SHA256 47267b3ddec6deeb0b018afbde2b99d17350329a52f0ae49f66b5edc5fcc4366
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            shiD88E.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\shiD88E.tmp
            • Size 948KB
            • SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            upd77DB.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\upd77DB.tmp
            • Size 526B
            • SHA256 15e735624bca76c3868fb878a414c3573f2c28d5e6d1ec5415de3b0716e17504
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SET918C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\{3596493e-0b7a-ab4d-9f3e-f7c0c393112f}\SET918C.tmp
            • Size 1KB
            • SHA256 b3a178d9d172875ec4daee8ef6ed39b2bbb5178869f27b1fde99b35c0eab3a70
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vdvge.cat
            • Path C:\Users\Admin\AppData\Local\Temp\{3596493e-0b7a-ab4d-9f3e-f7c0c393112f}\vdvge.cat
            • Size 11KB
            • SHA256 ddaad106500286f7a5b3f69a3dfbeb89160f861dfb0a4a45bc16c0065b886b87
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vdvge.sys
            • Path C:\Users\Admin\AppData\Local\Temp\{3596493e-0b7a-ab4d-9f3e-f7c0c393112f}\vdvge.sys
            • Size 74KB
            • SHA256 7eb92d9e144c074045346c7d4f4f8415322e7d8a98034409040f553b475d9784
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vdvad.cat
            • Path C:\Users\Admin\AppData\Local\Temp\{72e9d6e9-7422-dc47-8045-3a74491c7a07}\vdvad.cat
            • Size 11KB
            • SHA256 6f9d282de3a5455d875b91b1a8ae41be9459d2580440d2a91f63aa4dbb2af3f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vdvad.inf
            • Path C:\Users\Admin\AppData\Local\Temp\{72e9d6e9-7422-dc47-8045-3a74491c7a07}\vdvad.inf
            • Size 4KB
            • SHA256 55c2bc0f7c0e281f0ec438da712c0c0aaab853a46942fece45431b0d8eab4137
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vdvad.sys
            • Path C:\Users\Admin\AppData\Local\Temp\{72e9d6e9-7422-dc47-8045-3a74491c7a07}\vdvad.sys
            • Size 43KB
            • SHA256 c2fa5c2c0085d48850e8549ec105d81b9fa47393e89fb8873b7275f180401eaa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vdvmd.cat
            • Path C:\Users\Admin\AppData\Local\Temp\{78fabd14-5156-604e-bb96-afbaf72dcf13}\vdvmd.cat
            • Size 11KB
            • SHA256 5543f7468e3460340ae8dbe7d84dc252d0a55d0122d35995484a70eb571cb94a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vdvmd.dll
            • Path C:\Users\Admin\AppData\Local\Temp\{78fabd14-5156-604e-bb96-afbaf72dcf13}\vdvmd.dll
            • Size 73KB
            • SHA256 46f3043d24552d537ec1eef489771ed7504482f5bfc18bf3fc921cdc42340c80
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vdvmd.inf
            • Path C:\Users\Admin\AppData\Local\Temp\{78fabd14-5156-604e-bb96-afbaf72dcf13}\vdvmd.inf
            • Size 3KB
            • SHA256 22f514641457d1bdbff8ab9d908d432b663c30361b626fa7d68df306f56f4f6e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CSCore.txt
            • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\Licenses\CSCore.txt
            • Size 2KB
            • SHA256 a0ddbd80b651f9e209b0a1a906f8e4f349a156133890b419773db62f3b675b97
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            VirtualDesktop.Service.msi
            • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Service.msi
            • Size 7.4MB
            • SHA256 1454f9172a28682f8818e833189860100383cf94603c4b3b2a6af628b78704f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VirtualDesktop.Setup.exe
            • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Setup.exe
            • Size 4.6MB
            • SHA256 3beef51bd53e691941bd154cc9756aaa85616aea6f4724851528f035d1ce9552
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VirtualDesktop.Streamer.Setup.msi
            • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Streamer.Setup.msi
            • Size 8.3MB
            • SHA256 5252145d011a3385bb0132eeec8c3d8347f32730a0f5941d93d3b53e419963b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VirtualDesktop.Streamer.exe
            • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Streamer.exe
            • Size 21.6MB
            • SHA256 5add9376b645184500b22336d526230156ef0d7385321b650d36798e5072c080
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Xceed.Wpf.Toolkit.dll
            • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\Xceed.Wpf.Toolkit.dll
            • Size 1.0MB
            • SHA256 401178d414f50252c36fdd7c32dbcb49b80be9e27eb79d81ddcf62ad6a44e237
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libVirtualDesktopNet.dll
            • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\libVirtualDesktopNet.dll
            • Size 134KB
            • SHA256 5b792fc8b420fdd5ac77d8a85f5ea327b20042cb2ae9a6d699b8e64789338963
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI2BA6.tmp
            • Path C:\Windows\Installer\MSI2BA6.tmp
            • Size 408KB
            • SHA256 d385762123b06fe6857f83dab4f0e958abe0eeb9fb9a9de50d819cc015766ecf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIB0E5.tmp
            • Path C:\Windows\Installer\MSIB0E5.tmp
            • Size 429KB
            • SHA256 e1646b16cb541d54da0d904df2497acee0f91a1c6027c3220fe4401d9e1f2fff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pss524F.ps1
            • Path C:\Windows\SystemTemp\pss524F.ps1
            • Size 36KB
            • SHA256 7ce13ce5e7f83ee5062d808db590365f5f8b1509b6c5faa170e60b3dc383afc7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/320-995-0x000002ED33EE0000-0x000002ED33F30000-memory.dmp
            Download

            memory/320-998-0x000002ED354D0000-0x000002ED35510000-memory.dmp
            Download

            memory/320-947-0x000002ED17230000-0x000002ED187BE000-memory.dmp
            Download

            memory/320-948-0x000002ED1A340000-0x000002ED1A348000-memory.dmp
            Download

            memory/320-1004-0x000002ED32E00000-0x000002ED32F1F000-memory.dmp
            Download

            memory/320-1002-0x000002ED354A0000-0x000002ED354AE000-memory.dmp
            Download

            memory/320-999-0x000002ED346A0000-0x000002ED346A8000-memory.dmp
            Download

            memory/320-1000-0x000002ED35490000-0x000002ED35498000-memory.dmp
            Download

            memory/320-1001-0x000002ED35550000-0x000002ED35588000-memory.dmp
            Download

            memory/320-997-0x000002ED34460000-0x000002ED34468000-memory.dmp
            Download

            memory/1224-629-0x00000209D73D0000-0x00000209D73EA000-memory.dmp
            Download

            memory/1224-628-0x00000209D7370000-0x00000209D737E000-memory.dmp
            Download

            memory/2820-886-0x00000162CBD20000-0x00000162CC2B6000-memory.dmp
            Download

            memory/2820-903-0x00000162CCCF0000-0x00000162CCD2C000-memory.dmp
            Download

            memory/2820-900-0x00000162CCB70000-0x00000162CCB82000-memory.dmp
            Download

            memory/3300-680-0x000002123FCA0000-0x000002123FEBC000-memory.dmp
            Download

            memory/3588-164-0x000001EC21C40000-0x000001EC21C62000-memory.dmp
            Download

            memory/3776-427-0x0000000005290000-0x00000000052B2000-memory.dmp
            Download

            memory/3776-435-0x0000000005C40000-0x0000000005F94000-memory.dmp
            Download

            memory/3776-444-0x0000000008230000-0x00000000087D4000-memory.dmp
            Download

            memory/3776-425-0x0000000004CA0000-0x0000000004CD6000-memory.dmp
            Download

            memory/3776-429-0x0000000005BD0000-0x0000000005C36000-memory.dmp
            Download

            memory/3776-443-0x0000000006830000-0x0000000006852000-memory.dmp
            Download

            memory/3776-428-0x0000000005B60000-0x0000000005BC6000-memory.dmp
            Download

            memory/3776-426-0x0000000005340000-0x0000000005968000-memory.dmp
            Download

            memory/3776-438-0x0000000006150000-0x000000000616E000-memory.dmp
            Download

            memory/3776-439-0x0000000006170000-0x00000000061BC000-memory.dmp
            Download

            memory/3776-441-0x0000000006790000-0x00000000067AA000-memory.dmp
            Download

            memory/3776-440-0x0000000007BB0000-0x000000000822A000-memory.dmp
            Download

            memory/3776-442-0x0000000007430000-0x00000000074C6000-memory.dmp
            Download

            memory/3940-648-0x00000153FB150000-0x00000153FB36C000-memory.dmp
            Download

            memory/4108-685-0x00000189EBA30000-0x00000189EBEC0000-memory.dmp
            Download

            memory/4228-420-0x0000019AF2000000-0x0000019AF221C000-memory.dmp
            Download