Overview

overview

8

Static

static

1

VMware-pla...71.exe

windows7-x64

1

VMware-pla...71.exe

windows10-2004-x64

Resubmissions

13/06/2024, 11:12

240613-nbbrdsweje8

13/06/2024, 10:58

240613-m2wc2szdnp6

Analysis

  • max time kernel
    116s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    13/06/2024, 11:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    VMware-player-full-17.5.2-23775571.exe
  • Size 586.7MB
  • Sample240613-nbbrdsweje
  • SHA256 398d115723b6a85e925148915aeb19a73dde9e195dd0f4ebb3137543076f9089
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionpersistence

Malware Config

Signatures

  • Drops file in Drivers directory 27 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare drivers on disk 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare services registry key. 1 TTPs 12 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VMware-player-full-17.5.2-23775571.exe
    "C:\Users\Admin\AppData\Local\Temp\VMware-player-full-17.5.2-23775571.exe"
    1⤵
    • Looks for VMWare Tools registry key
    • Enumerates connected drives
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:996
    • C:\Users\Admin\AppData\Local\Temp\{66F9F0FA-1733-4091-B1DE-86F6238DF317}~setup\vcredist_x86.exe
      "C:\Users\Admin\AppData\Local\Temp\{66F9F0FA-1733-4091-B1DE-86F6238DF317}~setup\vcredist_x86.exe" /Q /norestart
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Windows\Temp\{7A0A6966-9867-458C-8BCA-CB151239C76D}\.cr\vcredist_x86.exe
        "C:\Windows\Temp\{7A0A6966-9867-458C-8BCA-CB151239C76D}\.cr\vcredist_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{66F9F0FA-1733-4091-B1DE-86F6238DF317}~setup\vcredist_x86.exe" -burn.filehandle.attached=552 -burn.filehandle.self=516 /Q /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1716
        • C:\Windows\Temp\{F9F172EC-04E1-45C9-ACFB-A5A362DD2E58}\.be\VC_redist.x86.exe
          "C:\Windows\Temp\{F9F172EC-04E1-45C9-ACFB-A5A362DD2E58}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{F1C40CAE-7482-45BE-B48F-4D2610C968FD} {B94F0B01-B046-4D60-BCAC-89AC0193F4B5} 1716
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1436
          • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=1092 -burn.embedded BurnPipe.{84E0AD85-D2B1-4CC8-99DC-24D9555E9FEB} {5823954A-D028-401C-8991-C83380C5D76D} 1436
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1048
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=1092 -burn.embedded BurnPipe.{84E0AD85-D2B1-4CC8-99DC-24D9555E9FEB} {5823954A-D028-401C-8991-C83380C5D76D} 1436
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3008
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{31F4766F-2803-4572-AA6F-CA3C6AAC46EB} {B1D5450B-9224-471D-A857-8A35B683A895} 3008
                7⤵
                  PID:4524
      • C:\Users\Admin\AppData\Local\Temp\{66F9F0FA-1733-4091-B1DE-86F6238DF317}~setup\vcredist_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\{66F9F0FA-1733-4091-B1DE-86F6238DF317}~setup\vcredist_x64.exe" /Q /norestart
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3740
        • C:\Windows\Temp\{C2853DE6-5D68-4774-8BD0-73F6A4DB84DD}\.cr\vcredist_x64.exe
          "C:\Windows\Temp\{C2853DE6-5D68-4774-8BD0-73F6A4DB84DD}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{66F9F0FA-1733-4091-B1DE-86F6238DF317}~setup\vcredist_x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /Q /norestart
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4164
          • C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{407E2F86-25FB-4B60-B8B9-CEFCB85438B4} {CB24D4C1-F46E-48FB-B284-B353D432B2C1} 4164
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1432
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{258CB742-CD4D-432B-B8C3-6474E70E6244} {E991EEF3-373B-4794-9905-417A333B16DD} 1432
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4204
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{258CB742-CD4D-432B-B8C3-6474E70E6244} {E991EEF3-373B-4794-9905-417A333B16DD} 1432
                6⤵
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:4084
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B2C71D45-F876-4F47-B7BF-D9A35952CDE0} {5581AA2F-FC23-4923-817F-BF4DDB6149D2} 4084
                  7⤵
                  • Modifies registry class
                  PID:3236
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4560
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:3240
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Looks for VMWare services registry key.
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:228
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding D09AACB2C905907E07632599CA966C7C C
          2⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:972
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding 1D3148C7AB475361CB4672F16EA8A4F5 C
          2⤵
          • Loads dropped DLL
          PID:2460
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 9D737F0707444C23465592BA4534F604
          2⤵
          • Looks for VMWare services registry key.
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Loads dropped DLL
          • Modifies registry class
          PID:4296
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding 50648536D3E5D4D7BFDF93250FC2FE03
          2⤵
          • Loads dropped DLL
          PID:2036
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 8746872959CBF6B4E5A5349EDD36427C E Global\MSI0000
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Loads dropped DLL
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4244
          • C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe
            "C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe" -- uninstall usb
            3⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            PID:1796
          • C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe
            "C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe" -- install vmusb Win8
            3⤵
            • Executes dropped EXE
            PID:4200
          • C:\Program Files (x86)\Common Files\VMware\USB\vnetlib64.exe
            "C:\Program Files (x86)\Common Files\VMware\USB\vnetlib64.exe" -- install hcmoninf 5;Win7
            3⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            PID:1156
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet0
            3⤵
            • Executes dropped EXE
            PID:4252
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet1
            3⤵
            • Executes dropped EXE
            PID:3980
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet2
            3⤵
            • Executes dropped EXE
            PID:2880
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet3
            3⤵
            • Executes dropped EXE
            PID:4496
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet4
            3⤵
            • Executes dropped EXE
            PID:1464
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet5
            3⤵
            • Executes dropped EXE
            PID:2056
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet6
            3⤵
            • Executes dropped EXE
            PID:3236
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet7
            3⤵
            • Executes dropped EXE
            PID:2848
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet8
            3⤵
            • Executes dropped EXE
            PID:2492
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet9
            3⤵
            • Executes dropped EXE
            PID:1132
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet10
            3⤵
            • Executes dropped EXE
            PID:2276
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet11
            3⤵
            • Executes dropped EXE
            PID:3060
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet12
            3⤵
            • Executes dropped EXE
            PID:4732
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet13
            3⤵
            • Executes dropped EXE
            PID:4460
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet14
            3⤵
            • Executes dropped EXE
            PID:4164
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet15
            3⤵
            • Executes dropped EXE
            PID:2728
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet16
            3⤵
            • Executes dropped EXE
            PID:4792
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet17
            3⤵
            • Executes dropped EXE
            PID:1368
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet18
            3⤵
            • Executes dropped EXE
            PID:2272
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet19
            3⤵
            • Executes dropped EXE
            PID:368
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- uninstall bridge
            3⤵
            • Executes dropped EXE
            PID:4852
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- uninstall userif 5;None
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2364
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- install bridge
            3⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Checks SCSI registry key(s)
            • Modifies registry class
            PID:3864
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- install userif 5;None
            3⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            PID:2032
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- add adapter vmnet1
            3⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:2364
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- add adapter vmnet8
            3⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:4124
          • C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe
            "C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- install vmx86inf 5;Win8
            3⤵
            • Drops file in Drivers directory
            • Looks for VMWare services registry key.
            • Drops file in System32 directory
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            PID:2756
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding 0266C74469E7F5FBE64E104BAABCDD24 E Global\MSI0000
          2⤵
          • Drops file in Drivers directory
          • Looks for VMWare services registry key.
          • Sets service image path in registry
          • Drops file in System32 directory
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious behavior: LoadsDriver
          PID:3544
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:4196
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8\vmusb.inf" "9" "454492f13" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4956
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files (x86)\VMware\VMware Player\netbridge.inf" "9" "4f3176507" "0000000000000158" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files (x86)\VMware\VMware Player"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:1200
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files (x86)\VMware\VMware Player\netadapter.inf" "9" "4a5017fd3" "0000000000000184" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\VMware\VMware Player"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:3664
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\VMWARE\0000" "C:\Windows\INF\oem5.inf" "oem5.inf:fc9f1aa2477c2bb3:VMnetAdapter1.Install:14.0.0.8:*vmnetadapter1," "4cbdd083b" "0000000000000184"
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:2396
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\VMWARE\0001" "C:\Windows\INF\oem5.inf" "oem5.inf:fc9f1aa2df34f6ba:VMnetAdapter8.Install:14.0.0.8:*vmnetadapter8," "47eb20b4f" "0000000000000140"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2632
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8\vmci.inf" "9" "4d941d7e3" "0000000000000164" "WinSta0\Default" "0000000000000174" "208" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:3312
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\VMWVMCIHOSTDEV\0000" "C:\Windows\INF\oem6.inf" "oem6.inf:9c00c72d390d9e8f:vmci.install.x64:9.8.18.0:root\vmwvmcihostdev," "42936a687" "0000000000000180"
          2⤵
          • Drops file in Drivers directory
          • Looks for VMWare drivers on disk
          • Looks for VMWare services registry key.
          • Checks SCSI registry key(s)
          PID:4040
      • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
        c:\windows\system32\NetCfgNotifyObjectHost.exe {895D820F-3D5D-401F-8C2F-76F53FCD8499} 536
        1⤵
          PID:4292
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
          1⤵
            PID:2244
          • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
            c:\windows\system32\NetCfgNotifyObjectHost.exe {36F5BECE-F6E7-4652-916A-DD09A6BC9A4C} 412
            1⤵
              PID:216
            • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
              c:\windows\system32\NetCfgNotifyObjectHost.exe {E07BDA60-1FE4-44B4-9D63-BE35F7C83BC4} 540
              1⤵
                PID:1656
              • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
                c:\windows\system32\NetCfgNotifyObjectHost.exe {DE01EFAD-6969-4A4F-B18F-E58ABB2BC1CA} 1000
                1⤵
                  PID:1400
                • C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
                  "C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4960
                • C:\Windows\system32\LogonUI.exe
                  "LogonUI.exe" /flags:0x4 /state0:0xa3919055 /state1:0x41c64e6d
                  1⤵
                  • Modifies data under HKEY_USERS
                  • Suspicious use of SetWindowsHookEx
                  PID:2756

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e57e17c.rbs
                      • Path C:\Config.Msi\e57e17c.rbs
                      • Size 16KB
                      • SHA256 575fdac342ea04ef83bf067c2735e27611f0b8cda604db3d7bebcedb4efd8b73
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      e57e181.rbs
                      • Path C:\Config.Msi\e57e181.rbs
                      • Size 18KB
                      • SHA256 ad0cb8a918cf0647102a301a7b2ff753fc82b0c870d8cb9363e92881aced39e7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      e57e18e.rbs
                      • Path C:\Config.Msi\e57e18e.rbs
                      • Size 20KB
                      • SHA256 e51b1981c8bff2c57fbb81e9f1408626e114d8b2e5832d9b464197a04c0c0f72
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      e57e19d.rbs
                      • Path C:\Config.Msi\e57e19d.rbs
                      • Size 19KB
                      • SHA256 190d13c975478b7fe246e0e939434967677983d41f1a91f906dac3b0b6d79859
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      e57e1a4.rbs
                      • Path C:\Config.Msi\e57e1a4.rbs
                      • Size 19KB
                      • SHA256 9a61a643c3b420a5b65c15aa768abe8f83f89c65e88030a192c4ce6b08d9a94b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      e57e1b0.rbs
                      • Path C:\Config.Msi\e57e1b0.rbs
                      • Size 19KB
                      • SHA256 5b43795088a3059e42aa3bacd8b58db6d385c3899a1d2107309d1be3eddec13c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      e57e1b7.rbs
                      • Path C:\Config.Msi\e57e1b7.rbs
                      • Size 21KB
                      • SHA256 226ccaf007c205207af05d786632b6a5e3ab804f9313e0ea12eb674f91e89197
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      e57e1c6.rbs
                      • Path C:\Config.Msi\e57e1c6.rbs
                      • Size 21KB
                      • SHA256 95d0f2e66efaadeadd8faab55e4079ee785a8013e62f53df67c90afd20c011a9
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      e57e1c9.rbs
                      • Path C:\Config.Msi\e57e1c9.rbs
                      • Size 13.0MB
                      • SHA256 26201fd020067105799bbc86bdcccc079e1bea2b7950eb238256343dad9bc60e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      ovftool-hw9-config-option.xml
                      • Path C:\Program Files (x86)\VMware\VMware Player\OVFTool\env\ovftool-hw9-config-option.xml
                      • Size 861KB
                      • SHA256 6a846f6e1e5112a3efd76dc23d97b9c36abb7bf62f9bc202c1f840a3f8dc182e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmplayer.exe
                      • Path C:\Program Files (x86)\VMware\VMware Player\vmplayer.exe
                      • Size 1.8MB
                      • SHA256 bf480d9a362caf6a7de4e51bc441d2df30c9ffcfedd6ec1ee0a40344c20b591d
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmwarebase.dll
                      • Path C:\Program Files (x86)\VMware\VMware Player\vmwarebase.dll
                      • Size 6.7MB
                      • SHA256 4bbd232ebbf2bdd929c667bce4476317fd6eaacf328dfb24a18e11994e1bc11d
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      icudt44l.dat
                      • Path C:\Program Files (x86)\VMware\VMware Player\x64\icudt44l.dat
                      • Size 9.2MB
                      • SHA256 7e1fc96fcc98cb8f0cb44cfa94b40549a40bd0f9968c3c1141631aa0af95a1fe
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      VMware Workstation 17 Player.lnk
                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation 17 Player.lnk
                      • Size 1KB
                      • SHA256 89e4a7dce08dd7c3cf6327875b6f315296a3901438bd9d7985491e36bcea2433
                      • MD5 SHA1 SHA512
                      Submit Download

                      VMware Workstation 17 Player.lnk~RFe58f5e4.TMP
                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation 17 Player.lnk~RFe58f5e4.TMP
                      • Size 1KB
                      • SHA256 034cb84701b6246c507eb23be1470cd841db554f2db3700440b084b7538894b2
                      • MD5 SHA1 SHA512
                      Submit Download

                      state.rsm
                      • Path C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\state.rsm
                      • Size 1KB
                      • SHA256 bff811015d3b9b9d09a5787b794018d2e86ca5dcb67eee82e28258ad4ff006e6
                      • MD5 SHA1 SHA512
                      Submit Download

                      vmnetdhcp.conf
                      • Path C:\ProgramData\VMware\vmnetdhcp.conf
                      • Size 1KB
                      • SHA256 c2f94516504b4706487bd1a1d79d4d70064ec5f9253166bb4f9f937c34479c5e
                      • MD5 SHA1 SHA512
                      Submit Download

                      8EC9B1D0ABBD7F98B401D425828828CE_6F3E5404F7D7AD127F27AE9C72CFEBEA
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6F3E5404F7D7AD127F27AE9C72CFEBEA
                      • Size 727B
                      • SHA256 c074b5488ab362f376898f93577510943a39095c113f17d32c06a4bb3867ef3b
                      • MD5 SHA1 SHA512
                      Submit Download

                      8EC9B1D0ABBD7F98B401D425828828CE_6F3E5404F7D7AD127F27AE9C72CFEBEA
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6F3E5404F7D7AD127F27AE9C72CFEBEA
                      • Size 408B
                      • SHA256 f1311d1423fb840a731e35c6da9eb7798b6953937538ee5256110d34afd0d625
                      • MD5 SHA1 SHA512
                      Submit Download

                      DIFXAPI.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\FQCDBA5.tmp.dir\DIFXAPI.dll
                      • Size 386KB
                      • SHA256 57afba202253a7736e7296ca9ad606b9640ad6f5e9c231ee291f511dd469c783
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MSI2D06.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI2D06.tmp
                      • Size 2.6MB
                      • SHA256 5da4d187effdb2b88ec677b4f7620fd3be9ca0959dd5c37a641d18f19f908d58
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MSI41F7.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI41F7.tmp
                      • Size 2.9MB
                      • SHA256 8a421e5813d2afa810727cb54000e5bb5edac793310c4a90ab5146d56911b445
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      dd_vcredist_amd64_20240613111828_000_vcRuntimeMinimum_x64.log
                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240613111828_000_vcRuntimeMinimum_x64.log
                      • Size 2KB
                      • SHA256 fb25a999e820ab21201ec024c1e76584e5d6b3969ba3016c59e71b083a02748e
                      • MD5 SHA1 SHA512
                      Submit Download

                      dd_vcredist_amd64_20240613111828_001_vcRuntimeAdditional_x64.log
                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240613111828_001_vcRuntimeAdditional_x64.log
                      • Size 2KB
                      • SHA256 5791430a1f1699b655c54c27771c88b62434111531fe5b5c2699a7ebb4db518d
                      • MD5 SHA1 SHA512
                      Submit Download

                      dd_vcredist_x86_20240613111813_000_vcRuntimeMinimum_x86.log
                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240613111813_000_vcRuntimeMinimum_x86.log
                      • Size 2KB
                      • SHA256 6caa87b8912d4df9e8b19394e701df5e21c6a025f5755eaadf5569f4f50b45a9
                      • MD5 SHA1 SHA512
                      Submit Download

                      dd_vcredist_x86_20240613111813_001_vcRuntimeAdditional_x86.log
                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240613111813_001_vcRuntimeAdditional_x86.log
                      • Size 2KB
                      • SHA256 2a1c30929a3bb02a88a8118e18ede1ac8df814d88f8cb39c05d0051f2a3858a9
                      • MD5 SHA1 SHA512
                      Submit Download

                      vminst.log
                      • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                      • Size 34KB
                      • SHA256 2ebd5a51eef63903e85f9627d19114028f1a3f57a82edfdc1733650e477d9867
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vminst.log
                      • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                      • Size 39KB
                      • SHA256 d041c35c03b4de3958d21a3f8a58a0b6bf058860fd6de63547e79988faaf15b4
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vminst.log
                      • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                      • Size 40KB
                      • SHA256 38ed05be27209d5e9c6fba6cef2ccaa0e3137a41740a273bbe0201e965b1d8dd
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vminst.log
                      • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                      • Size 40KB
                      • SHA256 cc22bc4f9d2434e282c9e9347419308dc08bc1ae2d414ab9c427aa64ee5eff69
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vminst.log
                      • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                      • Size 42KB
                      • SHA256 774b124c108636f734a391d56b5528af5d3557c3166abb9753213bbafbfd79fe
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmmsi.log
                      • Path C:\Users\Admin\AppData\Local\Temp\vmmsi.log
                      • Size 183KB
                      • SHA256 710c3e470be732e3579c94ce6a4a1bd3bfa4e39f4ed3ca528673443cea0f79cd
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmmsi.log_20240613_111958.log
                      • Path C:\Users\Admin\AppData\Local\Temp\vmmsi.log_20240613_111958.log
                      • Size 1.5MB
                      • SHA256 efe41dad93d8fa34e5faf5ccdaca39c48ad0480cd996749d420c32c6002c2434
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vcredist_x64.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\{66F9F0FA-1733-4091-B1DE-86F6238DF317}~setup\vcredist_x64.exe
                      • Size 24.2MB
                      • SHA256 917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vcredist_x86.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\{66F9F0FA-1733-4091-B1DE-86F6238DF317}~setup\vcredist_x86.exe
                      • Size 13.2MB
                      • SHA256 5365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      VMware Workstation 17 Player.lnk
                      • Path C:\Users\Public\Desktop\VMware Workstation 17 Player.lnk
                      • Size 1KB
                      • SHA256 b9361f06d5107d8936f19eb31400a1be2395c4f2d77e4594f081d6a6bb3c94c7
                      • MD5 SHA1 SHA512
                      Submit Download

                      VMware Workstation 17 Player.lnk~RFe58f5b5.TMP
                      • Path C:\Users\Public\Desktop\VMware Workstation 17 Player.lnk~RFe58f5b5.TMP
                      • Size 1KB
                      • SHA256 834474b62f84e4aa7332c89affa5ac2d7345f0cb16030f8d6d64025b3caaa937
                      • MD5 SHA1 SHA512
                      Submit Download

                      oem3.PNF
                      • Path C:\Windows\INF\oem3.PNF
                      • Size 7KB
                      • SHA256 b30aac666884de0c66c69d08312047104ec151e02eab4e1577aeba698d9255a8
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MSIDB25.tmp
                      • Path C:\Windows\Installer\MSIDB25.tmp
                      • Size 518KB
                      • SHA256 6081f9d9040dd70c74c1f5ae51db1320ba3b3e9e6a5cdfda22a6f5e72ef38d4a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MSIDB45.tmp
                      • Path C:\Windows\Installer\MSIDB45.tmp
                      • Size 1.6MB
                      • SHA256 fe793fc1b303f85837fc6a990caed01289c02e24f3ca497566108198fe6af5de
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MSIDC40.tmp
                      • Path C:\Windows\Installer\MSIDC40.tmp
                      • Size 118KB
                      • SHA256 bf93de4755822425f3fd3928b52d2a6e6c91ab069213aaaa95695ed3e17e72e9
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      hcmon.sys
                      • Path C:\Windows\System32\DRVSTORE\hcmon_AE2641AF84DF5670FA8422233CEAC89B307A0500\hcmon.sys
                      • Size 70KB
                      • SHA256 94938835f53b968665eda2a7a082788dac0a13ee486e3186387c0ff7ececfe8a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmnetuserif.sys
                      • Path C:\Windows\System32\DRVSTORE\netuserif_58711DA5F5777EBD18942543251CD2F96A4E1EE5\vmnetuserif.sys
                      • Size 29KB
                      • SHA256 26b2cd990adeb32ef7e4c00c0e447c64c9a7811de2f398d6a227ccf26e33da72
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vnetinst.dll
                      • Path C:\Windows\System32\DRVSTORE\netuserif_58711DA5F5777EBD18942543251CD2F96A4E1EE5\vnetinst.dll
                      • Size 115KB
                      • SHA256 11e605295b184468b69d444edf35707567615d16fe5b9ba924edcb76527f9002
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmx86.sys
                      • Path C:\Windows\System32\DRVSTORE\vmx86_0EB6D425AF13AF7EF7CCBE7DA93B4388751906C3\vmx86.sys
                      • Size 98KB
                      • SHA256 e8de7c03018755a37a2993b2688c5258b46919b15c5e55a85590d8ae3abf1eb3
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vsock.sys
                      • Path C:\Windows\System32\DRVSTORE\vsock_91D4AA923191C17024EC2122FC89C72E5812E906\vsock.sys
                      • Size 86KB
                      • SHA256 dfdb2166d3010a1e7ccfdc38f0b1524fdc4b79b17b06093b7f9820b637d28343
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vsocklib_x64.dll
                      • Path C:\Windows\System32\DRVSTORE\vsock_91D4AA923191C17024EC2122FC89C72E5812E906\vsocklib_x64.dll
                      • Size 30KB
                      • SHA256 952603279b8851c3739d562247f3f0a373b5fd0eb5a9c3baf1e6b1e608ebc6c8
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vsocklib_x86.dll
                      • Path C:\Windows\System32\DRVSTORE\vsock_91D4AA923191C17024EC2122FC89C72E5812E906\vsocklib_x86.dll
                      • Size 25KB
                      • SHA256 af1df28834936aef92e142c14b1439ca64d070840b2c07b87351174ec0f71d8a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      netadapter.inf
                      • Path C:\Windows\System32\DriverStore\Temp\{665f872c-44e7-f347-ab2d-1ed42b5dbfa5}\netadapter.inf
                      • Size 28KB
                      • SHA256 8d3180911c7397eda186969813dd6aa6447b2e247d1dddf8cf15c82f8c187c7b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmnetadapter.cat
                      • Path C:\Windows\System32\DriverStore\Temp\{665f872c-44e7-f347-ab2d-1ed42b5dbfa5}\vmnetadapter.cat
                      • Size 13KB
                      • SHA256 2fed201cfaabf39aa9d32531759ffb01b93e890ab28137983ac0a0f1b76cf4f6
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmnetadapter.sys
                      • Path C:\Windows\System32\DriverStore\Temp\{665f872c-44e7-f347-ab2d-1ed42b5dbfa5}\vmnetadapter.sys
                      • Size 30KB
                      • SHA256 a75125186847fb0e6d4cd755ccd68431df3a64c8786125b6110589054f9c2389
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      netbridge.inf
                      • Path C:\Windows\System32\DriverStore\Temp\{6bb5a10b-036e-1944-986f-74bc7f447d73}\netbridge.inf
                      • Size 4KB
                      • SHA256 a3bbff5810e7d94a7490e06d5b420f734ec02f4fce66274930e024761e01049b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmnet.sys
                      • Path C:\Windows\System32\DriverStore\Temp\{6bb5a10b-036e-1944-986f-74bc7f447d73}\vmnet.sys
                      • Size 30KB
                      • SHA256 7e3af2553ce93dca2a7b2c42e1c839573ba37e393e9e7a5e200dcc2df4f7fda7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmnetbridge.cat
                      • Path C:\Windows\System32\DriverStore\Temp\{6bb5a10b-036e-1944-986f-74bc7f447d73}\vmnetbridge.cat
                      • Size 12KB
                      • SHA256 a58b885df4777c61b577af7569eaa5ac0202ea50f55fe141e9be0ffc77743a50
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmnetbridge.dll
                      • Path C:\Windows\System32\DriverStore\Temp\{6bb5a10b-036e-1944-986f-74bc7f447d73}\vmnetbridge.dll
                      • Size 79KB
                      • SHA256 0e8d73db78847ff2956c471c009088c1754640a06f877e9dea061bf9b6c287fd
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmnetbridge.sys
                      • Path C:\Windows\System32\DriverStore\Temp\{6bb5a10b-036e-1944-986f-74bc7f447d73}\vmnetbridge.sys
                      • Size 52KB
                      • SHA256 9237ac240f3bef26001bc33a670245d368b727fc43e031b6a48fbf698fdc1def
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmusb.cat
                      • Path C:\Windows\System32\DriverStore\Temp\{776a2e3f-0bb3-cc46-9160-edfb6f4383d3}\vmusb.cat
                      • Size 11KB
                      • SHA256 ea696506747d3ab4a9c8b8d486b4a886ba4cba7b65eceb1d89c6ce54be6c9c20
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmusb.inf
                      • Path C:\Windows\System32\DriverStore\Temp\{776a2e3f-0bb3-cc46-9160-edfb6f4383d3}\vmusb.inf
                      • Size 3KB
                      • SHA256 9cbf08670ee83cb7956473072d7d51a709da49522a1109ea582425d86d88d8f4
                      • MD5 SHA1 SHA512
                      Submit Download

                      vmusb.sys
                      • Path C:\Windows\System32\DriverStore\Temp\{776a2e3f-0bb3-cc46-9160-edfb6f4383d3}\vmusb.sys
                      • Size 66KB
                      • SHA256 965c2e680140329f56f253f9a5bce8745a9664fc56aedb58bdb57e126b0aa1c5
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmci.cat
                      • Path C:\Windows\System32\DriverStore\Temp\{82b4147c-728d-1f4d-89a9-b45fe86e6c2a}\vmci.cat
                      • Size 11KB
                      • SHA256 b69004749d69e2d826a4341d2ac409711fb984fe2ebb4afa2b3dbc03368493cd
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vmci.inf
                      • Path C:\Windows\System32\DriverStore\Temp\{82b4147c-728d-1f4d-89a9-b45fe86e6c2a}\vmci.inf
                      • Size 3KB
                      • SHA256 1e71d0b7aa6a8835986a2d603c7218e792886fec4ea889f13200cf0fdc78a73b
                      • MD5 SHA1 SHA512
                      Submit Download

                      vmci.sys
                      • Path C:\Windows\System32\DriverStore\Temp\{82b4147c-728d-1f4d-89a9-b45fe86e6c2a}\vmci.sys
                      • Size 102KB
                      • SHA256 91e68a9891339a8db757c9eceb65371db83822fa56305d61330e50194dc97131
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      dberr.txt
                      • Path C:\Windows\System32\catroot2\dberr.txt
                      • Size 19KB
                      • SHA256 277af09a90715bd9e2c035493958de0c6fc4dbe18255bb134166b9f4d569c12e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vminst.log
                      • Path C:\Windows\Temp\vminst.log
                      • Size 14KB
                      • SHA256 af27324b6080eb89ca293ce0c04b4b5d94505f6771269fea2d9922192ce89930
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      license.rtf
                      • Path C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\.ba\1031\license.rtf
                      • Size 12KB
                      • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\.ba\1031\thm.wxl
                      • Size 3KB
                      • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
                      • MD5 SHA1 SHA512
                      Submit Download

                      thm.xml
                      • Path C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\.ba\thm.xml
                      • Size 8KB
                      • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      cab2C04DDC374BD96EB5C8EB8208F2C7C92
                      • Path C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                      • Size 5.4MB
                      • SHA256 2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      cab5046A8AB272BF37297BB7928664C9503
                      • Path C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\cab5046A8AB272BF37297BB7928664C9503
                      • Size 935KB
                      • SHA256 b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vcRuntimeAdditional_x64
                      • Path C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\vcRuntimeAdditional_x64
                      • Size 188KB
                      • SHA256 1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vcRuntimeMinimum_x64
                      • Path C:\Windows\Temp\{0D17A213-BB0C-46CE-8AAC-903B449BFB06}\vcRuntimeMinimum_x64
                      • Size 188KB
                      • SHA256 ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vcredist_x86.exe
                      • Path C:\Windows\Temp\{7A0A6966-9867-458C-8BCA-CB151239C76D}\.cr\vcredist_x86.exe
                      • Size 634KB
                      • SHA256 e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vcredist_x64.exe
                      • Path C:\Windows\Temp\{C2853DE6-5D68-4774-8BD0-73F6A4DB84DD}\.cr\vcredist_x64.exe
                      • Size 635KB
                      • SHA256 9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      logo.png
                      • Path C:\Windows\Temp\{F9F172EC-04E1-45C9-ACFB-A5A362DD2E58}\.ba\logo.png
                      • Size 1KB
                      • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                      • MD5 SHA1 SHA512
                      Submit Download

                      wixstdba.dll
                      • Path C:\Windows\Temp\{F9F172EC-04E1-45C9-ACFB-A5A362DD2E58}\.ba\wixstdba.dll
                      • Size 191KB
                      • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      cab54A5CABBE7274D8A22EB58060AAB7623
                      • Path C:\Windows\Temp\{F9F172EC-04E1-45C9-ACFB-A5A362DD2E58}\cab54A5CABBE7274D8A22EB58060AAB7623
                      • Size 800KB
                      • SHA256 7be2d324f0cb063be8335982096f17ed4f08a7592130e04459ae818824016589
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      cabB3E1576D1FEFBB979E13B1A5379E0B16
                      • Path C:\Windows\Temp\{F9F172EC-04E1-45C9-ACFB-A5A362DD2E58}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                      • Size 4.9MB
                      • SHA256 e38280421473e79ebaaa8398d86974fc7100cc8ec1c3273fb9bfe4f672c918a6
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vcRuntimeAdditional_x86
                      • Path C:\Windows\Temp\{F9F172EC-04E1-45C9-ACFB-A5A362DD2E58}\vcRuntimeAdditional_x86
                      • Size 180KB
                      • SHA256 ff8884498c3174b7d2bd35bd1a43d75d3538dca2c0821ca5876fa45eb2c8a47f
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      vcRuntimeMinimum_x86
                      • Path C:\Windows\Temp\{F9F172EC-04E1-45C9-ACFB-A5A362DD2E58}\vcRuntimeMinimum_x86
                      • Size 180KB
                      • SHA256 c78bc45113d0270c2154930761c3b74db714987a16c0fbe5e7a05fa3a853d0c8
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      memory/1048-241-0x0000000000060000-0x00000000000D7000-memory.dmp
                      Download

                      memory/3008-240-0x0000000000060000-0x00000000000D7000-memory.dmp
                      Download

                      memory/3236-482-0x0000000000510000-0x0000000000587000-memory.dmp
                      Download

                      memory/4084-519-0x0000000000510000-0x0000000000587000-memory.dmp
                      Download

                      memory/4204-520-0x0000000000510000-0x0000000000587000-memory.dmp
                      Download

                      memory/4524-203-0x0000000000060000-0x00000000000D7000-memory.dmp
                      Download