Overview

overview

8

Static

static

5

Virtual Desktop.zip

windows10-2004-x64

8

Virtual Desktop.zip

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    599s
  • max time network
    387s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 04:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Virtual Desktop.zip
  • Size 552.4MB
  • Sample260819-e1rdpsdm9v
  • SHA256 dcfd992e54c6af0b0128460997539e166a5087c517c65b31a42c22cbece5b91a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 27 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • SmartAssembly .NET packer 3 IoCs

    Detects SmartAssembly .NET packer.

  • Drops file in Program Files directory 41 IoCs
  • Drops file in Windows directory 53 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Virtual Desktop.zip"
    1⤵
      PID:3864
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5600
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap9257:88:7zEvent31496
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:5924
      • C:\Users\Admin\Desktop\Virtual Desktop\Virtual Desktop.exe
        "C:\Users\Admin\Desktop\Virtual Desktop\Virtual Desktop.exe"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Setup.exe
          "C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Setup.exe" en-US
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Windows\System32\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /qn /i "C:\Users\Admin\Desktop\Virtual Desktop\Prerequisites\SpeechPlatformRuntime.msi" MSIRESTARTMANAGERCONTROL=Disable
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5068
          • C:\Windows\System32\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /qn /i "C:\Users\Admin\Desktop\Virtual Desktop\Prerequisites\MSSpeech_TTS_en-US_Helen.msi" MSIRESTARTMANAGERCONTROL=Disable
            3⤵
              PID:5168
            • C:\Windows\System32\msiexec.exe
              "C:\Windows\System32\msiexec.exe" /qn /i "C:\Users\Admin\Desktop\Virtual Desktop\Prerequisites\MSSpeech_SR_en-US_TELE.msi" MSIRESTARTMANAGERCONTROL=Disable
              3⤵
                PID:1804
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" delete VirtualDesktop.Service.exe
                3⤵
                • Launches sc.exe
                PID:4716
              • C:\Windows\System32\msiexec.exe
                "C:\Windows\System32\msiexec.exe" /qn /i "C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Service.msi" MSIRESTARTMANAGERCONTROL=Disable
                3⤵
                  PID:4172
                • C:\Windows\System32\msiexec.exe
                  "C:\Windows\System32\msiexec.exe" /qn /X {C6D1B2CF-D4BA-4301-B39F-F5FDDDCA9310}
                  3⤵
                  • Enumerates connected drives
                  PID:5204
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" delete VirtualDesktop.Service.exe
                  3⤵
                  • Launches sc.exe
                  PID:4180
                • C:\Windows\System32\msiexec.exe
                  "C:\Windows\System32\msiexec.exe" /qn /i "C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Service.msi" MSIRESTARTMANAGERCONTROL=Disable
                  3⤵
                    PID:3544
                  • C:\Windows\System32\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Engine.Media.dll"
                    3⤵
                    • Loads dropped DLL
                    • Modifies registry class
                    PID:4472
                  • C:\Windows\System32\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Engine.MilkDrop.dll"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1708
                    • C:\Windows\SysWOW64\regsvr32.exe
                      /s "C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Engine.MilkDrop.dll"
                      4⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:5976
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Enumerates connected drives
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3760
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding DCB6AE167671CCBA99AAD580F5550A57
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2084
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 65B47C7A74D3D5ED1C66594762930942
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5308
                • C:\Windows\Installer\MSIFF5.tmp
                  "C:\Windows\Installer\MSIFF5.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Users\Admin\AppData\Local\Temp\uninstallservice.bat" VirtualDesktop.Service.exe
                  2⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5288
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\uninstallservice.bat" VirtualDesktop.Service.exe"
                    3⤵
                    • Executes a command shell one-liner
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1524
                    • C:\Windows\SysWOW64\sc.exe
                      sc stop VirtualDesktop.Service.exe
                      4⤵
                      • Launches sc.exe
                      • System Location Discovery: System Language Discovery
                      PID:2124
                    • C:\Windows\SysWOW64\sc.exe
                      sc delete VirtualDesktop.Service.exe
                      4⤵
                      • Launches sc.exe
                      • System Location Discovery: System Language Discovery
                      PID:5692
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 97046AD2AF844B582156B168B546160E E Global\MSI0000
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1404
              • C:\Program Files\Virtual Desktop\VirtualDesktop.Service.exe
                "C:\Program Files\Virtual Desktop\VirtualDesktop.Service.exe"
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5828
                • C:\Program Files\Virtual Desktop\VirtualDesktop.Server.exe
                  "C:\Program Files\Virtual Desktop\VirtualDesktop.Server.exe"
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5584
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /4
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:5128
              • C:\Windows\system32\AUDIODG.EXE
                C:\Windows\system32\AUDIODG.EXE 0x450 0xf4
                1⤵
                  PID:5404
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                  1⤵
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of WriteProcessMemory
                  PID:2528
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bb754de6-e049-7348-8c8c-3af91f950fe3}\vdvad.inf" "9" "46dd69753" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\users\admin\desktop\virtual desktop\audiodriver\x64"
                    2⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:1692
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca1198852b16:VDVAD_WaveExtensible:1.6.1.0:*vdvad," "46dd69753" "0000000000000160"
                    2⤵
                    • Drops file in Drivers directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    PID:5808

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      Windows Command Shell

                      1
                      T1059.003

                      System Services

                      1
                      T1569

                      Service Execution

                      1
                      T1569.002

                      Persistence

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Privilege Escalation

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Defense Evasion

                      Impair Defenses

                      1
                      T1562

                      Credential Access

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      4
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Service Stop

                      1
                      T1489

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e5cc222.rbs
                      • Path C:\Config.Msi\e5cc222.rbs
                      • Size 90KB
                      • SHA256 960a03cce96753ca77466a1c905373ac293844c02b9084f764549a3e1493d8d7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5cc227.rbs
                      • Path C:\Config.Msi\e5cc227.rbs
                      • Size 12KB
                      • SHA256 dfac0ff377586db00d78d3a738e5c7cd6ff44f5a786172c5bcbaa31d95ff8140
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5cc22c.rbs
                      • Path C:\Config.Msi\e5cc22c.rbs
                      • Size 21KB
                      • SHA256 ea2829ca58a99a92070dbac0b9d1cc8c6d225b1c5225f63a8190615324e0f09d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5cc231.rbs
                      • Path C:\Config.Msi\e5cc231.rbs
                      • Size 328KB
                      • SHA256 5b5fb3f562f41ab86aa925afbb2f9da5e6defd6cf9bcc8a34f12d783d133cfe5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5cc235.rbs
                      • Path C:\Config.Msi\e5cc235.rbs
                      • Size 1.2MB
                      • SHA256 d77a4c0150eacd7255bf76980c056c7499289444d5811fe6d15aa0dda60417fb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5cc236.rbf
                      • Path C:\Config.Msi\e5cc236.rbf
                      • Size 26KB
                      • SHA256 c8ce81ef62b91a8dfe12e203c24a7efbc081478be9cd0e04f8ac29517de09c0e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5cc239.rbf
                      • Path C:\Config.Msi\e5cc239.rbf
                      • Size 2KB
                      • SHA256 0a7476441b01da9b76959cf3a1ee35cd1d250b74a54651ec6235e995d5164f8a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e5cc23a.rbf
                      • Path C:\Config.Msi\e5cc23a.rbf
                      • Size 199KB
                      • SHA256 f1efd501d060a4786d860b11b77bdcba6bb1b8358d7bdd1faa917fa1f3ea7f8b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VirtualDesktop.Server.exe
                      • Path C:\Program Files\Virtual Desktop\VirtualDesktop.Server.exe
                      • Size 5.3MB
                      • SHA256 5826cf457895b1c804ea16a2593f19623a95143a4e4afe690aa5dacbde54722d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VirtualDesktop.Service.exe
                      • Path C:\Program Files\Virtual Desktop\VirtualDesktop.Service.exe
                      • Size 10.9MB
                      • SHA256 6ea4b61afdeb65efc7274cf73acf33b80294dd87750e9aa431f6219d1083674a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
                      • Size 337B
                      • SHA256 0f06895c2bc74c004d7af136c6ec308da58b468c83f8f583a15a87cf1dd2b0b4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      3EC49180A59F0C351C30F112AD97CFA5_2BBBC5B869045D7902A4725D84BC0C08
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_2BBBC5B869045D7902A4725D84BC0C08
                      • Size 338B
                      • SHA256 01b117202effe64b4e327b831482cf7fbef5ed3dc55519e7cad77d8883bbca46
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
                      • Size 404B
                      • SHA256 0fc0898e4eaf0992b92888128a17a24de62a2429c0b81cd00164c84274822a04
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      3EC49180A59F0C351C30F112AD97CFA5_2BBBC5B869045D7902A4725D84BC0C08
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_2BBBC5B869045D7902A4725D84BC0C08
                      • Size 408B
                      • SHA256 9fdba1517c5cf45e6ebb777d32e39fa89bfb88ffd94b30582b7a60179b0e3c07
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      uninstallservice.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\uninstallservice.bat
                      • Size 24B
                      • SHA256 74a036991f5a8de7bf6c5b582b682e8509b4bda698bea84a6630b573c70a1171
                      • MD5 SHA1 SHA512
                      Submit Download

                      SET4365.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\{bb754de6-e049-7348-8c8c-3af91f950fe3}\SET4365.tmp
                      • Size 11KB
                      • SHA256 6f9d282de3a5455d875b91b1a8ae41be9459d2580440d2a91f63aa4dbb2af3f0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SET4376.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\{bb754de6-e049-7348-8c8c-3af91f950fe3}\SET4376.tmp
                      • Size 43KB
                      • SHA256 c2fa5c2c0085d48850e8549ec105d81b9fa47393e89fb8873b7275f180401eaa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vdvad.inf
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\AudioDriver\x64\vdvad.inf
                      • Size 4KB
                      • SHA256 55c2bc0f7c0e281f0ec438da712c0c0aaab853a46942fece45431b0d8eab4137
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Dark Nebula.vde
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Environments\Dark Nebula.vde
                      • Size 13.9MB
                      • SHA256 363c93582c3a067c6e352b4da85a67ecd9e00742348837eafa327d8eee5dd33f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Deep Space.vde
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Environments\Deep Space.vde
                      • Size 13.7MB
                      • SHA256 f6408b6a75403f0a983cdc7968f680196b6dfb43de51d7a5eacdacf3c8cffeea
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Home Theater.vde
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Environments\Home Theater.vde
                      • Size 23.3MB
                      • SHA256 15882f54692838a589f84adf3f21d852967d0708868bf3b3bd7d91dc62fa7182
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.Speech.dll
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Microsoft.Speech.dll
                      • Size 670KB
                      • SHA256 83cac210f42053cc62a0f7ab37f11227617e5615de1a780620476b42e325edec
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSSpeech_SR_en-US_TELE.msi
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Prerequisites\MSSpeech_SR_en-US_TELE.msi
                      • Size 22.4MB
                      • SHA256 854db2d4cf44dd94d1f6e62659f3c08d695ef13f7c2d599d9825b0305fb54227
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSSpeech_TTS_en-US_Helen.msi
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Prerequisites\MSSpeech_TTS_en-US_Helen.msi
                      • Size 16.5MB
                      • SHA256 b8f2f9995bb64faf9b1da855a22053e05cf3350bc4f4b54e940b79f80b0f2a41
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSSpeech_TTS_ja-JP_Haruka.msi
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Prerequisites\MSSpeech_TTS_ja-JP_Haruka.msi
                      • Size 9.8MB
                      • SHA256 0df9e574050588030debc66135b2a5aafb89468f4c34cebc2f732b7ee217de0f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SpeechPlatformRuntime.msi
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Prerequisites\SpeechPlatformRuntime.msi
                      • Size 2.6MB
                      • SHA256 9c0a1d096e80f2ae77d5fc00b5d1a43b665c28ec6196911de3dce6d74c115137
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Virtual Desktop.exe
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Virtual Desktop.exe
                      • Size 12.8MB
                      • SHA256 d91624ee4835d06d1d8ab60768e2ffe2c5a8ebc544f75fea80107af0b4e6348c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Virtual Desktop.exe.config
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Virtual Desktop.exe.config
                      • Size 4KB
                      • SHA256 00dc104dd4f06207fa443764022f16dd9f09638c4007d75c4b2445d0d63da693
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VirtualDesktop.Service.msi
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Service.msi
                      • Size 9.1MB
                      • SHA256 4542393e5a8d5d50db19d523d7dfa1e3093686a806303c738d567323f1955a34
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VirtualDesktop.Setup.exe
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\VirtualDesktop.Setup.exe
                      • Size 3.8MB
                      • SHA256 2caa1092d3071e7264366df64b696634100008fb3b5718c55f4fc78cdefcae2b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Xceed.Wpf.Toolkit.dll
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\Xceed.Wpf.Toolkit.dll
                      • Size 1.0MB
                      • SHA256 401178d414f50252c36fdd7c32dbcb49b80be9e27eb79d81ddcf62ad6a44e237
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      steam_api64.dll
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\steam_api64.dll
                      • Size 282KB
                      • SHA256 f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      steam_appid.txt
                      • Path C:\Users\Admin\Desktop\Virtual Desktop\steam_appid.txt
                      • Size 6B
                      • SHA256 5fffee9939196c22e323344aed457dcb81727aaf2bea9542968288762b325c87
                      • MD5 SHA1 SHA512
                      Submit Download

                      MSIF1EC.tmp
                      • Path C:\Windows\Installer\MSIF1EC.tmp
                      • Size 904KB
                      • SHA256 d6b89fd5a95071e7b144d8bedcb09b694e9cd14bfbfafb782b17cf8413eac6da
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSIF7DD.tmp
                      • Path C:\Windows\Installer\MSIF7DD.tmp
                      • Size 319KB
                      • SHA256 2dbed94e7193db800e16e0016e5f15c7fc140368a8838cf24ca27f2e049b98dc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSIF985.tmp
                      • Path C:\Windows\Installer\MSIF985.tmp
                      • Size 868KB
                      • SHA256 78035b1d13620a8d68c96a3da5ead38963054fe26aa85e07f820db4a680b0404
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSIFF5.tmp
                      • Path C:\Windows\Installer\MSIFF5.tmp
                      • Size 414KB
                      • SHA256 2dcdff816e10d19293ad43cdf055f04d59a9ab1bf959ff6294f64e86e2d748de
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/4160-1218-0x000001CA20370000-0x000001CA20738000-memory.dmp
                      Download

                      memory/4388-1199-0x000002881E230000-0x000002881EF00000-memory.dmp
                      Download

                      memory/4388-1200-0x000002881F2B0000-0x000002881F2CA000-memory.dmp
                      Download

                      memory/4388-1202-0x0000028820E90000-0x0000028820F3A000-memory.dmp
                      Download

                      memory/4388-1203-0x000002883B530000-0x000002883BB48000-memory.dmp
                      Download

                      memory/4388-1205-0x000002883B110000-0x000002883B220000-memory.dmp
                      Download

                      memory/4388-1215-0x000002883B420000-0x000002883B442000-memory.dmp
                      Download

                      memory/4388-1438-0x000002883BCF0000-0x000002883BCF8000-memory.dmp
                      Download

                      memory/4388-1434-0x000002883BCD0000-0x000002883BCD8000-memory.dmp
                      Download

                      memory/4388-1430-0x000002883B520000-0x000002883B528000-memory.dmp
                      Download

                      memory/4388-1416-0x000002883BE40000-0x000002883BF4A000-memory.dmp
                      Download

                      memory/4388-1431-0x000002883BC10000-0x000002883BC18000-memory.dmp
                      Download

                      memory/4388-1432-0x000002883BD70000-0x000002883BDA8000-memory.dmp
                      Download

                      memory/4388-1433-0x000002883BC20000-0x000002883BC2E000-memory.dmp
                      Download

                      memory/4388-1429-0x000002883BD30000-0x000002883BD70000-memory.dmp
                      Download

                      memory/4388-1428-0x000002883BBF0000-0x000002883BC0C000-memory.dmp
                      Download

                      memory/5128-1413-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1409-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1404-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1403-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1414-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1415-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1412-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1411-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1405-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5128-1410-0x00000238CCA90000-0x00000238CCA91000-memory.dmp
                      Download

                      memory/5584-1420-0x000001FD98BD0000-0x000001FD9911A000-memory.dmp
                      Download

                      memory/5584-1435-0x000001FD99720000-0x000001FD99728000-memory.dmp
                      Download

                      memory/5584-1436-0x000001FD99730000-0x000001FD99738000-memory.dmp
                      Download

                      memory/5584-1422-0x000001FD994C0000-0x000001FD994CA000-memory.dmp
                      Download

                      memory/5584-1425-0x000001FD994E0000-0x000001FD994E8000-memory.dmp
                      Download

                      memory/5828-1352-0x00000235F9070000-0x00000235F90AC000-memory.dmp
                      Download

                      memory/5828-1342-0x00000235F7C40000-0x00000235F8734000-memory.dmp
                      Download

                      memory/5828-1351-0x00000235F9010000-0x00000235F9022000-memory.dmp
                      Download