Overview

overview

9

Static

static

1

2026-08-07...r_.exe

windows10-2004-x64

9

2026-08-07...r_.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
  • Size 74.3MB
  • Sample260807-2bk7qaac85
  • SHA256 1f979dd7eee4ca7112057e511d804eecc5e9ae6e51876e72ddec881de424d1c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Detects executables packed with SmartAssembly 5 IoCs
  • Drops file in Drivers directory 10 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 61 IoCs
  • SmartAssembly .NET packer 1 IoCs

    Detects SmartAssembly .NET packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 9 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 51 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe"
    1⤵
    • Enumerates connected drives
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe" /i "C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Streamer.Setup.msi" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Desktop Streamer" APPDIR="C:\Program Files\Virtual Desktop Streamer" SECONDSEQUENCE="1" CLIENTPROCESSID="1184" AI_MORE_CMD_LINE=1
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      PID:2540
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4380
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7F9BC11AF211184B01CF249E07F02F73 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8F76.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi8F63.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr8F64.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr8F65.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5776
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssB6B5.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiB6A3.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrB6A4.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrB6A5.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5972
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A5B6CB20D8EFD605E8303D2553EB77F3
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5584
      • C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-07_66455c7b3cd88a17683f54ffe2ab18ee_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_.exe" /groupsextract:114; /out:"C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer\prerequisites" /callbackid:5584
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3212
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 284A4F34587F1345DDAC329D75FD3A08 E Global\MSI0000
      2⤵
      • Drops file in Windows directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss234B.ps1" -propFile "C:\Windows\SystemTemp\msi2348.txt" -scriptFile "C:\Windows\SystemTemp\scr2349.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr234A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:4132
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss2804.ps1" -propFile "C:\Windows\SystemTemp\msi2801.txt" -scriptFile "C:\Windows\SystemTemp\scr2802.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr2803.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:5436
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss3DC3.ps1" -propFile "C:\Windows\SystemTemp\msi3DB0.txt" -scriptFile "C:\Windows\SystemTemp\scr3DB1.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr3DB2.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2892
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss4DC6.ps1" -propFile "C:\Windows\SystemTemp\msi4DB3.txt" -scriptFile "C:\Windows\SystemTemp\scr4DB4.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr4DB5.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2692
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss57FC.ps1" -propFile "C:\Windows\SystemTemp\msi57EA.txt" -scriptFile "C:\Windows\SystemTemp\scr57EB.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr57EC.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3248
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss65EC.ps1" -propFile "C:\Windows\SystemTemp\msi65D9.txt" -scriptFile "C:\Windows\SystemTemp\scr65DA.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr65DB.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
        3⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:1168
    • C:\Program Files\Virtual Desktop Streamer\Updater.exe
      "C:\Program Files\Virtual Desktop Streamer\Updater.exe" /configservice -name "Updater"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3440
    • C:\Windows\Installer\MSI6C3C.tmp
      "C:\Windows\Installer\MSI6C3C.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe
        "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3176
        • C:\Windows\System32\sc.exe
          "C:\Windows\System32\sc.exe" delete VirtualDesktop.Service.exe
          4⤵
          • Launches sc.exe
          PID:2816
        • C:\Windows\System32\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /qn /i "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Service.msi" MSIRESTARTMANAGERCONTROL=Disable
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:4196
        • C:\Windows\System32\sc.exe
          "C:\Windows\System32\sc.exe" delete VirtualDesktop.Service.exe
          4⤵
          • Launches sc.exe
          PID:5820
        • C:\Windows\System32\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /qn /i "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Service.msi" MSIRESTARTMANAGERCONTROL=Disable
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:4832
    • C:\Windows\Installer\MSI10F0.tmp
      "C:\Windows\Installer\MSI10F0.tmp" 1735 {31A7EAC4-99AC-41B8-8C39-1F54DD9CF036}5IC:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer\prerequisites\VirtualDesktop.Service.msibwbBi-=l1184Chainer
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4836
  • C:\Program Files\Virtual Desktop Streamer\Updater.exe
    "C:\Program Files\Virtual Desktop Streamer\Updater.exe" /runservice
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4256
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3504
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3813d265-4a38-0142-b166-90e76e32c675}\vdvad.inf" "9" "46dd69753" "00000000000000DC" "WinSta0\Default" "00000000000000E0" "208" "c:\program files\virtual desktop streamer\audiodriver\x64"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3364
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\vdvad.inf_amd64_da9d1878467edc43\vdvad.inf" "oem1.inf:ed86ca1198852b16:VDVAD_WaveExtensible:1.6.1.0:*vdvad," "46dd69753" "00000000000000DC" "9e9d"
      1⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:6020
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3e4b6ab6-9409-1848-aea0-dfde1ce45efc}\vdvge.inf" "9" "498525ae7" "00000000000000DC" "WinSta0\Default" "00000000000000E0" "208" "c:\program files\virtual desktop streamer\gamepaddriver\x64"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:6016
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\vdvge.inf_amd64_7e2f7ed91dabd43b\vdvge.inf" "oem2.inf:c14ce884140e1b91:vdvge_Device:1.0.2.0:root\vdvge," "498525ae7" "000000000000019C" "9e9d"
      1⤵
      • Drops file in Drivers directory
      • Checks SCSI registry key(s)
      PID:2348
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{88918944-a923-de4a-85b9-c6cec3de2a21}\vdvmd.inf" "9" "4b44dc1bf" "00000000000000DC" "WinSta0\Default" "000000000000019C" "208" "c:\program files\virtual desktop streamer\monitordriver\x64"
      1⤵
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5744
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\System32\DriverStore\FileRepository\vdvmd.inf_amd64_c74624328284bb1d\vdvmd.inf" "oem3.inf:c14ce8840c48fa1f:MyDevice_Install:13.50.53.699:root\vdvmd," "4b44dc1bf" "00000000000001A4" "9e9d"
      1⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:5828
    • C:\Program Files\Virtual Desktop\VirtualDesktop.Service.exe
      "C:\Program Files\Virtual Desktop\VirtualDesktop.Service.exe"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:4728
    • C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Streamer.exe
      "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Streamer.exe"
      1⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3960
      • C:\Program Files\Virtual Desktop Streamer\Updater.exe
        "C:\Program Files\Virtual Desktop Streamer\Updater.exe" /justcheck -critical
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5476
      • C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe
        "C:\Program Files\Virtual Desktop Streamer\VirtualDesktop.Setup.exe"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        PID:4852
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\System32\DriverStore\FileRepository\vdvmd.inf_amd64_c74624328284bb1d\vdvmd.inf" "oem3.inf:c14ce8840c48fa1f:MyDevice_Install:13.50.53.699:root\vdvmd," "4b44dc1bf" "00000000000000E0" "9e9d"
      1⤵
      • Drops file in Drivers directory
      • Checks SCSI registry key(s)
      PID:2360

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59fc59.rbs
          • Path C:\Config.Msi\e59fc59.rbs
          • Size 910KB
          • SHA256 8dbdc5771ed8bf19a3d8c7122c97d1680662eab3f534a31cd419db90063b71f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59fc5e.rbs
          • Path C:\Config.Msi\e59fc5e.rbs
          • Size 329KB
          • SHA256 04c340f552beec5bd0e121cfa8738f9c0e2e25e20bd90e30a717394208f2915b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pico_neo3_leftcontroller.png
          • Path C:\Program Files\Virtual Desktop Streamer\OpenVRDriver\resources\rendermodels\oculus_quest2_controller_left\pico_neo3_leftcontroller.png
          • Size 89KB
          • SHA256 5eb85fbd79c51e1160640ad20f4700558debcd8b79618cd20561b06e787cd2a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          616AD1AB067CFD351D6C0EF6F3E12F40
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
          • Size 1KB
          • SHA256 9d9e8ad7b7e2bebe98dee283adb6496263f945acb2db3f3af94b1b8b1228f195
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8EC9B1D0ABBD7F98B401D425828828CE_CDB31A67E2F7BEE9EBCC3799C6ED485F
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CDB31A67E2F7BEE9EBCC3799C6ED485F
          • Size 727B
          • SHA256 04c38b58a03772c7954cab86c8ae856f7fd57beb41f8874bc476abef82498787
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 727B
          • SHA256 db1d5f399aac10e28e8c58ab6e8a9f1876422832b762d6231faa4f663e92885e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          616AD1AB067CFD351D6C0EF6F3E12F40
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
          • Size 252B
          • SHA256 9dfd009527f843a1e60aa9e2f76b86c9e7a31faaa0a912ae44c2f75c244e42ee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8EC9B1D0ABBD7F98B401D425828828CE_CDB31A67E2F7BEE9EBCC3799C6ED485F
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_CDB31A67E2F7BEE9EBCC3799C6ED485F
          • Size 408B
          • SHA256 ab362ab5b61f6dfbdcaa5efb216638e7e732d130f737240846ec36f9669f47c1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 412B
          • SHA256 bd52723f12a02f1223f0832c37964b1042e0cccbb1bd7a8c30c92b3f51c5587a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BannerBitmap.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1184\BannerBitmap.jpg
          • Size 13KB
          • SHA256 723a598c2dc3636da059b91e4e4cc8899744ab0e4fd25d127a5b2bd779b4f1ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DialogBitmap.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1184\DialogBitmap.jpg
          • Size 37KB
          • SHA256 f5dc338bd11eaf7e0e21a722f37b107e26590d915536ae9f8d5e15ce85de5933
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI7C1D.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7C1D.LOG
          • Size 150KB
          • SHA256 eb7ea6044b1a93854254f5948b31ea83a7e4574dca5b40b122e86455755ba7f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI7C1D.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7C1D.LOG
          • Size 211KB
          • SHA256 52aa87ae0ab9cf9aabf1826c7125c012a20977eef774a0ef0a8054bbebf03179
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI7FE7.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7FE7.tmp
          • Size 904KB
          • SHA256 d6b89fd5a95071e7b144d8bedcb09b694e9cd14bfbfafb782b17cf8413eac6da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI82A9.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI82A9.tmp
          • Size 1.1MB
          • SHA256 403869ed494bcbc3e535b492f2ebfad95748049e203ff7c31ac1afb38d8909ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI83B4.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI83B4.tmp
          • Size 877KB
          • SHA256 107fd7ee1eaf17c27b4ed25990acace2cb51f8d39f4dfc8ef5a3df03d02e1d34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI8D91.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI8D91.tmp
          • Size 758KB
          • SHA256 8029e9d62de81689ae1081a918ea8534af1d02e3c56b49a74fedbaeeb2321a74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pss8F76.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\pss8F76.ps1
          • Size 36KB
          • SHA256 8a48daf5bcb5646aedf34754e49ab64db84910a1b81afbe64ab61442f8d96908
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          scr8F64.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\scr8F64.ps1
          • Size 31KB
          • SHA256 a12f6a3fba6844b009c10054563bd5a61342e518e128a762b7ecd67d2629df47
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          upd773A.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\upd773A.tmp
          • Size 526B
          • SHA256 15e735624bca76c3868fb878a414c3573f2c28d5e6d1ec5415de3b0716e17504
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CSCore.txt
          • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\Licenses\CSCore.txt
          • Size 2KB
          • SHA256 a0ddbd80b651f9e209b0a1a906f8e4f349a156133890b419773db62f3b675b97
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VirtualDesktop.Service.msi
          • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Service.msi
          • Size 7.4MB
          • SHA256 1454f9172a28682f8818e833189860100383cf94603c4b3b2a6af628b78704f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VirtualDesktop.Setup.exe
          • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Setup.exe
          • Size 4.6MB
          • SHA256 3beef51bd53e691941bd154cc9756aaa85616aea6f4724851528f035d1ce9552
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VirtualDesktop.Streamer.Setup.msi
          • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Streamer.Setup.msi
          • Size 8.3MB
          • SHA256 5252145d011a3385bb0132eeec8c3d8347f32730a0f5941d93d3b53e419963b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VirtualDesktop.Streamer.exe
          • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\VirtualDesktop.Streamer.exe
          • Size 21.6MB
          • SHA256 5add9376b645184500b22336d526230156ef0d7385321b650d36798e5072c080
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Xceed.Wpf.Toolkit.dll
          • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\Xceed.Wpf.Toolkit.dll
          • Size 1.0MB
          • SHA256 401178d414f50252c36fdd7c32dbcb49b80be9e27eb79d81ddcf62ad6a44e237
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libVirtualDesktopNet.dll
          • Path C:\Users\Admin\AppData\Roaming\Virtual Desktop, Inc\Virtual Desktop Streamer 1.34.19\install\D9CF036\libVirtualDesktopNet.dll
          • Size 134KB
          • SHA256 5b792fc8b420fdd5ac77d8a85f5ea327b20042cb2ae9a6d699b8e64789338963
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI1EFF.tmp
          • Path C:\Windows\Installer\MSI1EFF.tmp
          • Size 408KB
          • SHA256 d385762123b06fe6857f83dab4f0e958abe0eeb9fb9a9de50d819cc015766ecf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIB332.tmp
          • Path C:\Windows\Installer\MSIB332.tmp
          • Size 429KB
          • SHA256 e1646b16cb541d54da0d904df2497acee0f91a1c6027c3220fe4401d9e1f2fff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vdvad.inf_amd64_da9d1878467edc43.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\vdvad.inf_amd64_da9d1878467edc43.ini
          • Size 408B
          • SHA256 4d0dd2c671762124a4044a8c4378bb43f15aa3387913690e69d4a8dd9c34ab6b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vdvge.inf_amd64_7e2f7ed91dabd43b.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\vdvge.inf_amd64_7e2f7ed91dabd43b.ini
          • Size 408B
          • SHA256 9fd259c96f82a1ba54ab54438f70d1b6e20ebcee1558d439e21d79dbd29f6eaf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vdvmd.inf_amd64_c74624328284bb1d.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\vdvmd.inf_amd64_c74624328284bb1d.ini
          • Size 408B
          • SHA256 318479982813db77ca0b2d9ffeed8ecde7a311d34ec5c0ba915e16525641799d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_m3opcnap.a0d.ps1
          • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_m3opcnap.a0d.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pss4DC6.ps1
          • Path C:\Windows\SystemTemp\pss4DC6.ps1
          • Size 36KB
          • SHA256 7ce13ce5e7f83ee5062d808db590365f5f8b1509b6c5faa170e60b3dc383afc7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2892-547-0x0000016DC4330000-0x0000016DC434E000-memory.dmp
          Download

          memory/2892-549-0x0000016DC4370000-0x0000016DC438A000-memory.dmp
          Download

          memory/2892-548-0x0000016DC4310000-0x0000016DC431E000-memory.dmp
          Download

          memory/3176-594-0x0000013070F50000-0x00000130713E0000-memory.dmp
          Download

          memory/3960-761-0x0000020BF10D0000-0x0000020BF10D8000-memory.dmp
          Download

          memory/3960-760-0x0000020BF1E40000-0x0000020BF1E80000-memory.dmp
          Download

          memory/3960-759-0x0000020BF10C0000-0x0000020BF10C8000-memory.dmp
          Download

          memory/3960-757-0x0000020BF0BF0000-0x0000020BF0C40000-memory.dmp
          Download

          memory/3960-710-0x0000020BECD10000-0x0000020BECD18000-memory.dmp
          Download

          memory/3960-708-0x0000020BEB2F0000-0x0000020BEC87E000-memory.dmp
          Download

          memory/3960-762-0x0000020BF10E0000-0x0000020BF10E8000-memory.dmp
          Download

          memory/3960-763-0x0000020BF2390000-0x0000020BF23CE000-memory.dmp
          Download

          memory/3960-764-0x0000020BF10F0000-0x0000020BF10FE000-memory.dmp
          Download

          memory/4728-654-0x000001CA1D240000-0x000001CA1D7D6000-memory.dmp
          Download

          memory/4728-667-0x000001CA1E1F0000-0x000001CA1E22C000-memory.dmp
          Download

          memory/4728-666-0x000001CA1E190000-0x000001CA1E1A2000-memory.dmp
          Download

          memory/5436-367-0x0000000007FC0000-0x000000000857A000-memory.dmp
          Download

          memory/5436-363-0x0000000007380000-0x00000000079FC000-memory.dmp
          Download

          memory/5436-353-0x00000000023F0000-0x0000000002426000-memory.dmp
          Download

          memory/5436-354-0x0000000004F70000-0x00000000055BA000-memory.dmp
          Download

          memory/5436-355-0x0000000004F40000-0x0000000004F62000-memory.dmp
          Download

          memory/5436-360-0x00000000057F0000-0x0000000005B4B000-memory.dmp
          Download

          memory/5436-361-0x0000000005C10000-0x0000000005C2E000-memory.dmp
          Download

          memory/5436-362-0x0000000005C50000-0x0000000005C9C000-memory.dmp
          Download

          memory/5436-356-0x0000000005660000-0x00000000056C6000-memory.dmp
          Download

          memory/5436-357-0x00000000056D0000-0x0000000005736000-memory.dmp
          Download

          memory/5436-366-0x0000000006C30000-0x0000000006C52000-memory.dmp
          Download

          memory/5436-365-0x0000000006F00000-0x0000000006F96000-memory.dmp
          Download

          memory/5436-364-0x0000000006180000-0x000000000619A000-memory.dmp
          Download

          memory/5776-115-0x000001EC74FF0000-0x000001EC74FFA000-memory.dmp
          Download

          memory/5776-108-0x000001EC74F20000-0x000001EC74F42000-memory.dmp
          Download

          memory/5776-113-0x000001EC74FD0000-0x000001EC74FEE000-memory.dmp
          Download

          memory/5776-114-0x000001EC75240000-0x000001EC752F2000-memory.dmp
          Download