Overview

overview

8

Static

static

1

VMware-Wor...81.exe

windows10-2004-x64

8

VMware-Wor...81.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VMware-Workstation-Full-26H1-25388281.exe
  • Size 274.3MB
  • Sample260701-rxt2msgs2j
  • SHA256 a0ef9087607d9cad20b08139e73e41242e044ad5bd8cee141d3bad314586737f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Drops file in Drivers directory 25 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 11 IoCs
    defense_evasion
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VMware-Workstation-Full-26H1-25388281.exe
    "C:\Users\Admin\AppData\Local\Temp\VMware-Workstation-Full-26H1-25388281.exe"
    1⤵
    • Looks for VMWare Tools registry key
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{B2DDF747-6C42-4B21-B03E-76AC251EC8D2}~setup\vcredist_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{B2DDF747-6C42-4B21-B03E-76AC251EC8D2}~setup\vcredist_x64.exe" /Q /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Windows\Temp\{6C4CDF2E-B8EC-450A-AA03-78E28F162F70}\.cr\vcredist_x64.exe
        "C:\Windows\Temp\{6C4CDF2E-B8EC-450A-AA03-78E28F162F70}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{B2DDF747-6C42-4B21-B03E-76AC251EC8D2}~setup\vcredist_x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /Q /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5440
        • C:\Windows\Temp\{62B1E64F-7C99-4B20-8E2F-C5C3046257A8}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{62B1E64F-7C99-4B20-8E2F-C5C3046257A8}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C44F8717-985F-4151-9EAA-5BA9E9F08F98} {448A58FF-9D9A-44F7-BF75-31B2EF387D02} 5440
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2364
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3944
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4452
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Looks for VMWare services registry key.
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding DC496E3E0249A69372536B2D7EF1DDA0 C
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3960
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A3046DEECF35824A8D6047D27DDADFCF C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:296
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 890AB079257A51512C3A36370F6A392E
        2⤵
        • Looks for VMWare services registry key.
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5456
        • C:\Windows\System32\net.exe
          net start VMAuthdService
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 start VMAuthdService
            4⤵
              PID:2428
          • C:\Windows\System32\net.exe
            net start vmware-view-usbd
            3⤵
            • Discovers systems in the same network
            • Suspicious use of WriteProcessMemory
            PID:4556
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start vmware-view-usbd
              4⤵
                PID:1784
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding AC780CE92A12EE99C39B6BB41FF405D0
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:548
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding 1783A6CC6D584116EF52C6AA7E220CF5 E Global\MSI0000
            2⤵
            • Drops file in Drivers directory
            • Looks for VMWare services registry key.
            • Sets service image path in registry
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Loads dropped DLL
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: LoadsDriver
            • Suspicious use of SetWindowsHookEx
            PID:3780
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 97492ECA4DF1D411A6DEC50DB80D6379 E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1772
        • C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /burn.runonce
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3044
          • C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260701153624.log"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6116
            • C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260701153624.log"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5528
              • C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{558398DB-5D04-4962-B5A6-AA4F6DF9C619} {E7A2D63C-893B-4C7B-9323-014D7054B843} 5528
                4⤵
                • Adds Run key to start application
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5472
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{96CE235E-2392-4536-A282-3D5ABBA10521} {64575687-8E3E-43E8-B57E-E80AFA639DB8} 5472
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4812
                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{96CE235E-2392-4536-A282-3D5ABBA10521} {64575687-8E3E-43E8-B57E-E80AFA639DB8} 5472
                    6⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1084
                    • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1966B826-6B39-40BC-8A9A-9A2A1FD3234A} {DB67035C-FEB3-43E2-BC42-038F4D0F05FB} 1084
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:5420
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:3076
          • C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
            "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3368
          • C:\Program Files\VMware\VMware Workstation\vmware-autostart.exe
            "C:\Program Files\VMware\VMware Workstation\vmware-autostart.exe"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4512
          • C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
            "C:\Program Files\VMware\VMware Workstation\vmware-authd.exe"
            1⤵
            • Executes dropped EXE
            PID:3016
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8\vmusb.inf" "9" "454492f13" "000000000000017C" "WinSta0\Default" "000000000000018C" "208" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8"
            1⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:2752
          • C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
            "C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4976
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "1" "C:\Program Files\VMware\VMware Workstation\netbridge.inf" "9" "43e921417" "0000000000000190" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\VMware\VMware Workstation"
            1⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:3004
          • C:\Windows\system32\vmnat.exe
            C:\Windows\system32\vmnat.exe
            1⤵
            • Executes dropped EXE
            PID:4512
          • C:\Windows\system32\vmnetdhcp.exe
            C:\Windows\system32\vmnetdhcp.exe
            1⤵
            • Executes dropped EXE
            PID:5744
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "1" "C:\Program Files\VMware\VMware Workstation\netadapter.inf" "9" "424b22b1f" "000000000000017C" "WinSta0\Default" "000000000000018C" "208" "C:\Program Files\VMware\VMware Workstation"
            1⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:2652
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "2" "211" "ROOT\VMWARE\0000" "C:\Windows\System32\DriverStore\FileRepository\netadapter.inf_amd64_c1c4a664a4282894\netadapter.inf" "oem3.inf:fc9f1aa2477c2bb3:VMnetAdapter1.Install:25.0.0.1:*vmnetadapter1," "4cbdd083b" "0000000000000178" "ff8"
            1⤵
            • Drops file in Drivers directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            PID:244
          • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
            c:\windows\system32\NetCfgNotifyObjectHost.exe {7A606795-A400-4F6E-BC31-0A2A0B767A7B} 572
            1⤵
              PID:4800
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
              1⤵
                PID:2548
              • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
                c:\windows\system32\NetCfgNotifyObjectHost.exe {3E72E3E3-BF0D-45CB-A527-76ABC26E650F} 652
                1⤵
                  PID:5784
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\VMWARE\0001" "C:\Windows\System32\DriverStore\FileRepository\netadapter.inf_amd64_c1c4a664a4282894\netadapter.inf" "oem3.inf:fc9f1aa2df34f6ba:VMnetAdapter8.Install:25.0.0.1:*vmnetadapter8," "47eb20b4f" "0000000000000168" "ff8"
                  1⤵
                  • Drops file in Drivers directory
                  PID:1564
                • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
                  c:\windows\system32\NetCfgNotifyObjectHost.exe {552378CF-E8BC-4F5F-8DB6-D34473C825F7} 600
                  1⤵
                    PID:3160
                  • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
                    c:\windows\system32\NetCfgNotifyObjectHost.exe {0208EF01-AA15-4661-827A-DF404C4358E6} 752
                    1⤵
                      PID:1768
                    • C:\Windows\system32\DrvInst.exe
                      DrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8\vmci.inf" "9" "4d941d7e3" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8"
                      1⤵
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Modifies data under HKEY_USERS
                      PID:5132
                    • C:\Windows\system32\DrvInst.exe
                      DrvInst.exe "2" "211" "ROOT\VMWVMCIHOSTDEV\0000" "C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_faf39406c404b481\vmci.inf" "oem4.inf:3c66b0ea390d9e8f:vmci.install.x64:9.8.30.0:root\vmwvmcihostdev," "42936a687" "000000000000017C" "ff8"
                      1⤵
                      • Drops file in Drivers directory
                      • Looks for VMWare drivers on disk
                      • Looks for VMWare services registry key.
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      PID:5756
                    • C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
                      "C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4576

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Persistence

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Event Triggered Execution

                          1
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Event Triggered Execution

                          1
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Defense Evasion

                          Modify Registry

                          3
                          T1112

                          Virtualization/Sandbox Evasion

                          3
                          T1497

                          Credential Access

                          Discovery

                          File and Directory Discovery

                          1
                          T1083

                          Network Share Discovery

                          1
                          T1135

                          Peripheral Device Discovery

                          2
                          T1120

                          Query Registry

                          4
                          T1012

                          Remote System Discovery

                          1
                          T1018

                          System Information Discovery

                          3
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Virtualization/Sandbox Evasion

                          3
                          T1497

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          e598db5.rbs
                          • Path C:\Config.Msi\e598db5.rbs
                          • Size 19KB
                          • SHA256 aef4aaac94c16dbd2d63dfd10ba1e8649166df3db22df7fd2abd97bf794e06fa
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e598dc1.rbs
                          • Path C:\Config.Msi\e598dc1.rbs
                          • Size 19KB
                          • SHA256 0cdf6fe0ba61a21dc85428c4174a57437e32c512f4e9c27036896ef853f91842
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e598dc8.rbs
                          • Path C:\Config.Msi\e598dc8.rbs
                          • Size 21KB
                          • SHA256 2c2201a94611697ecf8354e7a946276e243fbce8a4fad1ba69dddf848120ad17
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e598dd7.rbs
                          • Path C:\Config.Msi\e598dd7.rbs
                          • Size 21KB
                          • SHA256 e48f02882c104b0877e363a0191909ba08ba139d65e56ff2a2ab79854457a0cf
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e598dda.rbs
                          • Path C:\Config.Msi\e598dda.rbs
                          • Size 16.5MB
                          • SHA256 62bb134e9d9e441519adaab9267acf0b515feec929745430b5186ee54fb358a8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ovftool-hw9-config-option.xml
                          • Path C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw9-config-option.xml
                          • Size 865KB
                          • SHA256 1aac0a50b13dfee95f3c26dda367b92068254dc523236bf99400718c71987013
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vmware.exe
                          • Path C:\Program Files\VMware\VMware Workstation\vmware.exe
                          • Size 2.1MB
                          • SHA256 47ebf04b0d1cb8273794ec9e6d77a85e978d4c12f4f31024b4f41f3a842721ae
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vmwarebase.dll
                          • Path C:\Program Files\VMware\VMware Workstation\vmwarebase.dll
                          • Size 7.5MB
                          • SHA256 f0bea99a43516a5e2b0573ea76e00e11a39b637486530949c134b5b91b95454b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          icudt44l.dat
                          • Path C:\Program Files\VMware\VMware Workstation\x64\icudt44l.dat
                          • Size 9.2MB
                          • SHA256 7e1fc96fcc98cb8f0cb44cfa94b40549a40bd0f9968c3c1141631aa0af95a1fe
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VMware Workstation Pro.lnk
                          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation Pro.lnk
                          • Size 1KB
                          • SHA256 7e935f8cdbe0616fcebe6b511bd7314c286f64268922d43ea21b66784c5686fc
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          VMware Workstation Pro.lnk
                          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation Pro.lnk
                          • Size 1KB
                          • SHA256 7353995815c59ac24558b4935ec985346106cdeff2df4fdd66d914cb145410bc
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          state.rsm
                          • Path C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\state.rsm
                          • Size 1KB
                          • SHA256 f39fb0c8f1aa46b128abfc83f974bedb8b437f64bfcdf416d7c6b9adc38cf6de
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                          • Size 471B
                          • SHA256 6294d27eaad40cb327b2a467d13e55095d53540b5c5b2c240c427a5bc9e8ed07
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
                          • Size 727B
                          • SHA256 0ee5b534d981b8e7e4b3bcd9f1cf52b965f5d645a707b4445375dcd6624c8fef
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                          • Size 727B
                          • SHA256 c49e3320fffa30b60c928e85f45584fc8e1a86e0d0c2e11fdc4419ad70cdde3b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                          • Size 400B
                          • SHA256 244b8103a4b9b4bbfcc41e436e10b9c61d78c4871c2118ef9549ac5369e0b550
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
                          • Size 408B
                          • SHA256 ecda836e8fd66bf0233ed6f6251fe1ce550f2d2509d8444ca16933ca62aa15d6
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                          • Size 412B
                          • SHA256 0ec6ad7431dd07e9b78485f2f1507202a7d54278c4cc6536c48817ed97f831b5
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          MSI49BF.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\MSI49BF.tmp
                          • Size 2.9MB
                          • SHA256 c06d5df2ce5a5b246fe7eca9b20feaa16bc3af4ddbdf0d512f6899bdc5fc2f10
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSIDD08.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\MSIDD08.tmp
                          • Size 3.3MB
                          • SHA256 8b4e7ed62c9b3d4806b6c6c76f6c6fe276e32075c65556d3104ce0b155040fad
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSIE0B3.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\MSIE0B3.tmp
                          • Size 234KB
                          • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          dd_vcredist_amd64_20260701153624_000_vcRuntimeMinimum_x64.log
                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260701153624_000_vcRuntimeMinimum_x64.log
                          • Size 3KB
                          • SHA256 fd9e9156a7c81038e87b3d82088049dab2a876c596e1fbb3ac4beddf5c689761
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dd_vcredist_amd64_20260701153624_001_vcRuntimeAdditional_x64.log
                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260701153624_001_vcRuntimeAdditional_x64.log
                          • Size 2KB
                          • SHA256 4337205f3f5bef429601b802e9077726de5ed34a7a525d4b5fe28380614f13c9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          vminst.log
                          • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                          • Size 30KB
                          • SHA256 1aff90bb8b6d0de192efb96d9dd348951f461ebbce3eb429a373d950dd267a28
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vminst.log
                          • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                          • Size 37KB
                          • SHA256 bf177df1ef9698d8fc14eeb5f5abbec9a2a7e54873901e87f48131ee555a26af
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vminst.log
                          • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                          • Size 37KB
                          • SHA256 c382cf063980ebfeca3d10602b636a8aa061294239c5adbcb797250219db855d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vmmsi.log
                          • Path C:\Users\Admin\AppData\Local\Temp\vmmsi.log
                          • Size 188KB
                          • SHA256 f5d8f270aa7fb3521d512b9cb7273353a7966dff3a1482f6d15ba614a5af0487
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vcredist_x64.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{B2DDF747-6C42-4B21-B03E-76AC251EC8D2}~setup\vcredist_x64.exe
                          • Size 24.3MB
                          • SHA256 814e9da5ec5e5d6a8fa701999d1fc3baddf7f3adc528e202590e9b1cb73e4a11
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VMware Workstation Pro.lnk
                          • Path C:\Users\Public\Desktop\VMware Workstation Pro.lnk
                          • Size 1KB
                          • SHA256 5d3c9815ffc74868d5e737d6d79da9f3ecbfac3b9296d301db5899d035661e7b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          VMware Workstation Pro.lnk~RFe5a9e74.TMP
                          • Path C:\Users\Public\Desktop\VMware Workstation Pro.lnk~RFe5a9e74.TMP
                          • Size 1KB
                          • SHA256 2dc372752cbfb40b7cf0c2c9b4f585d098146e6c7c26101a84f71bb33de26961
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          oem0.PNF
                          • Path C:\Windows\INF\oem0.PNF
                          • Size 6KB
                          • SHA256 a56a9f16f845ddceeda4b16f4f37af5c5c0558f0e5164a9348836e24b16d6b38
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          oem1.PNF
                          • Path C:\Windows\INF\oem1.PNF
                          • Size 7KB
                          • SHA256 7171181c552f72e65b8e77757bb8b672247fbaf1e83eb5eb349c6b0a63cfb4c0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          oem2.PNF
                          • Path C:\Windows\INF\oem2.PNF
                          • Size 10KB
                          • SHA256 ee093c36f69307418c368477014f1f58fbf3b3dd3b27ee53f669d52c34db407f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSI7362.tmp
                          • Path C:\Windows\Installer\MSI7362.tmp
                          • Size 648KB
                          • SHA256 d380a8cb5c5c318213378a51e6e64fb78d049493c2456efc1e4d5debcc2ab55e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSI7BB3.tmp
                          • Path C:\Windows\Installer\MSI7BB3.tmp
                          • Size 1012KB
                          • SHA256 280ecde7ad57f23e214d5a2c7f692f6d6ff4a3054a57dad7cd50392cafcf00ee
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          MSI7CDD.tmp
                          • Path C:\Windows\Installer\MSI7CDD.tmp
                          • Size 149KB
                          • SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          netadapter.inf_amd64_c1c4a664a4282894.ini
                          • Path C:\Windows\System32\DriverStore\FileRepository\netadapter.inf_amd64_c1c4a664a4282894.ini
                          • Size 544B
                          • SHA256 27ca578732a7216d9f38784d0c6311182811c960f2e5c92b4ad54c4807c0fb13
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          netbridge.inf_amd64_1c40c369eff72dc1.ini
                          • Path C:\Windows\System32\DriverStore\FileRepository\netbridge.inf_amd64_1c40c369eff72dc1.ini
                          • Size 656B
                          • SHA256 174346fbcb96c7f813464764af921a693ef890a59e7a42c23b29b43cea5a0536
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          vmci.inf_amd64_faf39406c404b481.ini
                          • Path C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_faf39406c404b481.ini
                          • Size 405B
                          • SHA256 71c419c9d12fcb29f03ba73f90ac563229c17050fda50f9e491548eba049f8a8
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          vmusb.inf_amd64_e4985be9ea2d2d2d.ini
                          • Path C:\Windows\System32\DriverStore\FileRepository\vmusb.inf_amd64_e4985be9ea2d2d2d.ini
                          • Size 408B
                          • SHA256 e4f72f56c7860a766c3f2fd0468ba70504b4e3be50f25f58bb2d2070af1b9847
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dberr.txt
                          • Path C:\Windows\System32\catroot2\dberr.txt
                          • Size 75KB
                          • SHA256 d95d537d0f5f573b43a13ee2e73e9a03476cb08c5b1b42f5dbb6134dcb74f3ef
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          license.rtf
                          • Path C:\Windows\Temp\{4AAD567A-5C0B-42D7-9067-5287B70F5D26}\.ba\license.rtf
                          • Size 9KB
                          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          thm.wxl
                          • Path C:\Windows\Temp\{4AAD567A-5C0B-42D7-9067-5287B70F5D26}\.ba\thm.wxl
                          • Size 2KB
                          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          thm.xml
                          • Path C:\Windows\Temp\{4AAD567A-5C0B-42D7-9067-5287B70F5D26}\.ba\thm.xml
                          • Size 8KB
                          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          wixstdba.dll
                          • Path C:\Windows\Temp\{4AAD567A-5C0B-42D7-9067-5287B70F5D26}\.ba\wixstdba.dll
                          • Size 191KB
                          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          logo.png
                          • Path C:\Windows\Temp\{62B1E64F-7C99-4B20-8E2F-C5C3046257A8}\.ba\logo.png
                          • Size 1KB
                          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          wixstdba.dll
                          • Path C:\Windows\Temp\{62B1E64F-7C99-4B20-8E2F-C5C3046257A8}\.ba\wixstdba.dll
                          • Size 215KB
                          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cab2C04DDC374BD96EB5C8EB8208F2C7C92
                          • Path C:\Windows\Temp\{62B1E64F-7C99-4B20-8E2F-C5C3046257A8}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                          • Size 5.4MB
                          • SHA256 8265bab100e281ddd366a9a435aee439bb87a1fe848fbfce0881449c4f08e485
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cab5046A8AB272BF37297BB7928664C9503
                          • Path C:\Windows\Temp\{62B1E64F-7C99-4B20-8E2F-C5C3046257A8}\cab5046A8AB272BF37297BB7928664C9503
                          • Size 967KB
                          • SHA256 78cd0d63fb93470f11a300d79c5bafe4554142035126068710d6583fc23d49fa
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vcRuntimeAdditional_x64
                          • Path C:\Windows\Temp\{62B1E64F-7C99-4B20-8E2F-C5C3046257A8}\vcRuntimeAdditional_x64
                          • Size 208KB
                          • SHA256 a4b5cd38dbac2d9588bb15d6b02b24a05c340c2c0a10d1ac86037e6dd14262c5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vcRuntimeMinimum_x64
                          • Path C:\Windows\Temp\{62B1E64F-7C99-4B20-8E2F-C5C3046257A8}\vcRuntimeMinimum_x64
                          • Size 208KB
                          • SHA256 59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vcredist_x64.exe
                          • Path C:\Windows\Temp\{6C4CDF2E-B8EC-450A-AA03-78E28F162F70}\.cr\vcredist_x64.exe
                          • Size 670KB
                          • SHA256 1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/1084-232-0x0000000000A00000-0x0000000000A77000-memory.dmp
                          Download

                          memory/3000-241-0x0000017A2F260000-0x0000017A2FC04000-memory.dmp
                          Download

                          memory/3000-329-0x0000017A2F260000-0x0000017A2FC04000-memory.dmp
                          Download

                          memory/4812-233-0x0000000000A00000-0x0000000000A77000-memory.dmp
                          Download

                          memory/5420-230-0x0000000000A00000-0x0000000000A77000-memory.dmp
                          Download