a0ef9087607d9cad20b08139e73e41242e044ad5bd8cee141d3bad314586737f

Analysis

user interaction
yes
max time kernel
91s
max time network
208s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VMware-Workstation-Full-26H1-25388281.exe
Size 274.3MB
Sample260705-ve4d5sd16z
SHA256 a0ef9087607d9cad20b08139e73e41242e044ad5bd8cee141d3bad314586737f
MD5 83f9b6cc7cf0e74ad3b15ccca27860af
SHA1 0c892b81cc3519b5159e186c6215b379e5a425ab
SHA512 606b27d2de4573d5dc4fa94f64370336b10274634d299f1281f6900fb8b68084ea5527dbbccce17cf5a308e379a8b82d89ba3123f13e6029e9d099c8efe038f3
SSDEEP 6291456:d4X2Ud9mEA0S1SPDVx1g+GJbcqH3DolFjKkcKPxkq/6I6J7My:d+91ikLVxqbbcqH3DolFjKkJ6I6J7My
TLSH
T1DAD82316A69900A9F0A6D239C9778517EBB17C05033186DF12E4B69F2F3BFD44B3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	VMware-Workstation-Full-26H1-25388281.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\I:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\Q:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\X:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\T:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\D:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\M:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\W:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\A:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\L:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\N:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\K:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\O:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\Z:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\P:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\R:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\S:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\U:	VMware-Workstation-Full-26H1-25388281.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 51 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VMware\InstallerCache\{86B6E794-CF20-4939-A2B4-1CD53C370315}.msi	VMware-Workstation-Full-26H1-25388281.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF90D66C36ECE12DEF.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a163c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2907.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a1652.msi	msiexec.exe
File created	C:\Windows\Installer\e5a1629.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a1629.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9D2035B1154AC5BE.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a163b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a163c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF442BD0F489198E2A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B3B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{560D2DA4-096E-4868-B22A-DA6418FDE6FB}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAAD2CCB1BE131BB2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1BD7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBAB219DB4A5980FE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF487BF4D3E34187E9.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a1651.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8B502C925BB0A7FA.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a1652.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A6F.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5904914B-9FC8-44C2-AE48-5C7F30A603EC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3403A09DBA6C3EE0.TMP	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
4612	vcredist_x64.exe
4352	vcredist_x64.exe
1340	VC_redist.x64.exe

Loads dropped DLL 8 IoCs

pid	Process
4352	vcredist_x64.exe
4092	VC_redist.x64.exe
1304	MsiExec.exe
2016	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611f050cfb2bdaef0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801611f050c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101611f050c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3611f050c00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6611f050c00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
872	net.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Version = "14.40.33816.0"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33816"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33816"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\PackageCode = "EF1C5BBCEEFD25C458AFD3A70929F953"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\4AD2D065E69086842BA2AD4681DF6EBF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33816"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33816"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{EEB10322-20EC-431E-98B9-9A180C54BA4F}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B41940958CF92C44EA84C5F7036A30CE\VC_Runtime_Additional	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Version = "237536280"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.40.33816"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Version = "237536280"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{560D2DA4-096E-4868-B22A-DA6418FDE6FB}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{560D2DA4-096E-4868-B22A-DA6418FDE6FB}v14.40.33816\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5252	explorer.exe
5252	explorer.exe
1412	msiexec.exe
1412	msiexec.exe
1412	msiexec.exe
1412	msiexec.exe
1412	msiexec.exe
1412	msiexec.exe
1412	msiexec.exe
1412	msiexec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5252	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeBackupPrivilege	248	vssvc.exe
Token: SeRestorePrivilege	248	vssvc.exe
Token: SeAuditPrivilege	248	vssvc.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	5252	explorer.exe
Token: SeCreatePagefilePrivilege	5252	explorer.exe
Token: SeShutdownPrivilege	1340	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	1340	VC_redist.x64.exe
Token: SeSecurityPrivilege	1412	msiexec.exe
Token: SeCreateTokenPrivilege	1340	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	1340	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	1340	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	1340	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	1340	VC_redist.x64.exe
Token: SeTcbPrivilege	1340	VC_redist.x64.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2000	sihost.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5408	VMware-Workstation-Full-26H1-25388281.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe
5252	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1512	StartMenuExperienceHost.exe
5720	SearchHost.exe
5252	explorer.exe
1412	msiexec.exe
1304	MsiExec.exe
2016	MsiExec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 5252	2000	sihost.exe	91
PID 5408 wrote to memory of 4612	5408	VMware-Workstation-Full-26H1-25388281.exe	98
PID 4612 wrote to memory of 4352	4612	vcredist_x64.exe	99
PID 4352 wrote to memory of 1340	4352	vcredist_x64.exe	100
PID 1340 wrote to memory of 1528	1340	VC_redist.x64.exe	110
PID 1528 wrote to memory of 4092	1528	VC_redist.x64.exe	111
PID 4092 wrote to memory of 1288	4092	VC_redist.x64.exe	112
PID 1412 wrote to memory of 1304	1412	msiexec.exe	113
PID 1412 wrote to memory of 2016	1412	msiexec.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VMware-Workstation-Full-26H1-25388281.exe
"C:\Users\Admin\AppData\Local\Temp\VMware-Workstation-Full-26H1-25388281.exe"
1⤵
- Looks for VMWare Tools registry key
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{B9F9B043-A4B3-4739-B47F-5DAA41C6BB2A}~setup\vcredist_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{B9F9B043-A4B3-4739-B47F-5DAA41C6BB2A}~setup\vcredist_x64.exe" /Q /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\Temp\{9D9E2CA7-0D39-446D-822E-E53066FD057A}\.cr\vcredist_x64.exe
    "C:\Windows\Temp\{9D9E2CA7-0D39-446D-822E-E53066FD057A}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{B9F9B043-A4B3-4739-B47F-5DAA41C6BB2A}~setup\vcredist_x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /Q /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\Temp\{0957ECC1-3B2E-48AC-86A3-4546EBF7513B}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{0957ECC1-3B2E-48AC-86A3-4546EBF7513B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0E5A0085-C3F1-49F3-B8F3-CAFFF5EBA41A} {54792285-273A-4FDB-A69F-2DEF6A6F8FC5} 4352
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1116 -burn.embedded BurnPipe.{C5EA20AE-9562-41E6-8695-BC05285E3F8E} {C12BD84F-B63B-4FFB-93FB-A99511366913} 1340
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=592 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1116 -burn.embedded BurnPipe.{C5EA20AE-9562-41E6-8695-BC05285E3F8E} {C12BD84F-B63B-4FFB-93FB-A99511366913} 1340
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{16647C3E-9002-45D1-A5D0-9907C866EA0E} {AB7C0A4B-32C2-41FA-B171-4C695595AE10} 4092
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1288

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5252
- - C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe" /name Microsoft.DeviceManager
    3⤵
    PID:3300
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
      4⤵
      PID:5116
- - C:\Program Files\VMware\VMware Workstation\vmware.exe
    "C:\Program Files\VMware\VMware Workstation\vmware.exe"
    3⤵
    PID:1388
- - C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    3⤵
    PID:6512
- C:\Windows\System32\ShellHost.exe
  "C:\Windows\System32\ShellHost.exe"
  2⤵
  PID:5052
- C:\Windows\System32\ShellHost.exe
  "C:\Windows\System32\ShellHost.exe"
  2⤵
  PID:632
- C:\Windows\System32\ShellHost.exe
  "C:\Windows\System32\ShellHost.exe"
  2⤵
  PID:5860

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E2BBBC8813472635559AA5B1982B57AD C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C95E8F50EDC1FC1D075CA78988B26DFC C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2016
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7B3ECDC22236985CF9659AB008293383
  2⤵
  PID:5920
- - C:\Windows\System32\net.exe
    net start VMAuthdService
    3⤵
    PID:796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start VMAuthdService
      4⤵
      PID:1748
- - C:\Windows\System32\net.exe
    net start vmware-view-usbd
    3⤵
    - Discovers systems in the same network
    PID:872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start vmware-view-usbd
      4⤵
      PID:852
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7BC89DA1CB27C94C7260758EBBEB17F5
  2⤵
  PID:4136
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C71B89D1C8FBAD6466E33D6FE5079C54 E Global\MSI0000
  2⤵
  PID:2920
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9B842E03D493C35201796BD4DB6F9F7F E Global\MSI0000
  2⤵
  PID:5768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4636

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F0
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:5000

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8\vmusb.inf" "9" "454492f13" "00000000000000E8" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8"
1⤵
PID:1764

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\VMware\VMware Workstation\netbridge.inf" "9" "43e921417" "0000000000000190" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\VMware\VMware Workstation"
1⤵
PID:2800

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4596

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\VMware\VMware Workstation\netadapter.inf" "9" "424b22b1f" "00000000000000E4" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\VMware\VMware Workstation"
1⤵
PID:2436

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\VMWARE\0000" "C:\Windows\System32\DriverStore\FileRepository\netadapter.inf_amd64_c1c4a664a4282894\netadapter.inf" "oem3.inf:fc9f1aa2477c2bb3:VMnetAdapter1.Install:25.0.0.1:*vmnetadapter1," "4cbdd083b" "00000000000000E4" "7899"
1⤵
PID:5160

\??\c:\windows\system32\NetCfgNotifyObjectHost.exe
c:\windows\system32\NetCfgNotifyObjectHost.exe {5A0F0AD1-1F76-456D-852A-44E62BADC5F6} 604
1⤵
PID:5844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:1212

\??\c:\windows\system32\NetCfgNotifyObjectHost.exe
c:\windows\system32\NetCfgNotifyObjectHost.exe {D0DE0D81-9AE9-4D1F-A849-37888671D162} 620
1⤵
PID:1580

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\VMWARE\0001" "C:\Windows\System32\DriverStore\FileRepository\netadapter.inf_amd64_c1c4a664a4282894\netadapter.inf" "oem3.inf:fc9f1aa2df34f6ba:VMnetAdapter8.Install:25.0.0.1:*vmnetadapter8," "47eb20b4f" "000000000000018C" "7899"
1⤵
PID:3708

\??\c:\windows\system32\NetCfgNotifyObjectHost.exe
c:\windows\system32\NetCfgNotifyObjectHost.exe {ED2DB798-9021-4D31-A134-52EC06BC99F5} 712
1⤵
PID:1364

\??\c:\windows\system32\NetCfgNotifyObjectHost.exe
c:\windows\system32\NetCfgNotifyObjectHost.exe {D7EC1FC7-0695-48D3-B9DE-5587AF73AE36} 896
1⤵
PID:3596

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8\vmci.inf" "9" "4d941d7e3" "0000000000000190" "WinSta0\Default" "0000000000000188" "208" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8"
1⤵
PID:1248

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\VMWVMCIHOSTDEV\0000" "C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_faf39406c404b481\vmci.inf" "oem4.inf:3c66b0ea390d9e8f:vmci.install.x64:9.8.30.0:root\vmwvmcihostdev," "42936a687" "0000000000000190" "7899"
1⤵
PID:5052

C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
"C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"
1⤵
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a162e.rbs

Path C:\Config.Msi\e5a162e.rbs
Size 19KB
SHA256 beee5ed8e2a4d5760e47cd7a2b17c49bb2c4815ef51e9a7776bda2db353c6976
MD5 8f4b3a2337b8c6cb77c0e31e0a4d1248
SHA1 53de2af2cf3b9ed3addba75e7e91419a8d96ba75
SHA512 483f4a968d0c635f339e3255b7a7e85da4d0b5c01f25dfc563f70f4c61b56953b090ea4e46044dce04758328e8299b350e012d1c7c33477a35654dd77b6b55b0
SSDEEP 192:3BR21kRo15dXcFUADIc1f+W+y4+ogPB39EJc7:3BR26RoTeC81f/cK39EJc7
TLSH
T1D792FC426680C9E3D8766B30CE631B653B76DBD5A390438B40DC90348F93BCA2F9D69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a163a.rbs

Path C:\Config.Msi\e5a163a.rbs
Size 19KB
SHA256 2676b6bcf7a8801c11953a059ab8362db9502e913ce2a2136ab813b353169e41
MD5 7be453baa7cfb3c11845dfac01699f48
SHA1 3488cfa6da86ea358c91b08a94372efc77a4cd77
SHA512 06b0cc30113cd9c771a5bbc14b1a95df57b3b7bce50b4bf717cdc163f7791a9a4f600c175f22af226c58c37edcf1eaaeefff50d76d5804addcfe9885f83ef6eb
SSDEEP 192:3cXsiX1XMcXMEXMdXMHXMNXM6XM+YXMXXMJXMyXMnXMMXMPXM7XMhXcXlX2YXV6a:37Xv28mpaMSxcHUQpAqRqjL
TLSH
T1E0920C02AA40C6D3D8A62F30DD571F2A3776D3EA9760935B01DDD1348F837C66E8D68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a1641.rbs

Path C:\Config.Msi\e5a1641.rbs
Size 21KB
SHA256 8de7a70fc8eaf9c73ecd7d41a92b02d69a1805a0e75a14a52c7177d21795e6fb
MD5 36dab28ebeb558ddbd9c9a669bca41e6
SHA1 6992b7523d06186ee249a24eacafc77654e54ea8
SHA512 302787d52b1b1bc48bc8e5efe7c84577680fe442b13d9cd4673a913d25a5e1f42378c6b597f3d58e96f0d55a180c65538b1199648dabe734fa377ee641b90d2f
SSDEEP 384:V7RTGRBnAKxNAUhUC7xJjrMNYPzIbSfmayd0sVGbIFDkP:VVatAKhkmp
TLSH
T179A20F03768099E3C8A227B1DD671BA53F73D7D99350434B10ACD1388F633C72E5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a1650.rbs

Path C:\Config.Msi\e5a1650.rbs
Size 21KB
SHA256 2f623e5546016e42639ca9daf43b57ff90d3a90683bb9116d672e0a15cffa6e4
MD5 fbf8b987ffff172cf6d5343c0b1c20fb
SHA1 808dc1b693bcaf46e5dbd3875d83f7d4589404d0
SHA512 5c02f44e01d03d400fbd15edc333fea51ab2bd01870097ce491dcc8d38612166748f84fa798ce942f66359a97ff590054759f9d8dc0f30ddb8ab8e238c9967ab
SSDEEP 384:VUrQoNFcB1np12gju4aD92salckU72eC6Ab/H3q3JoV4Nn5:VUrQoNFcB1np12gSLD9Abf6ZoVUn5
TLSH
T1A3A21F01AA44D593D8A62B30CD9747A537B6D3D9D7A1838B12CDC2304F933C71FAEA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a1653.rbs

Path C:\Config.Msi\e5a1653.rbs
Size 16.5MB
SHA256 408ef055be4d5fe9aed0be5b1b190763c3c26c58eb08be4166539063e75a05f4
MD5 d604dc29647ab724742651b994b27c01
SHA1 b70b91cd5fd24402d886b3d0a80f475fc4afd253
SHA512 48d590364913069d6e9814a154043194ba15aac78a375401ae8d10d13b67bdaf12077d6951005b6908aa209bd1a5109e816fb325d2fbfcd480ca288f1f9314b9
SSDEEP 196608:a5vBJlszpYkSRvkSRC5vBJlszpRkSR85vBJlszpu5vBJlszpR:aWzpOLiWzplwWzpOWzpR
TLSH
T1E9078C46B6AD40A5D8B6E13DC917460BE7B27C11433087CF02A45A6FAF3F7E14A3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovftool-hw9-config-option.xml

Path C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw9-config-option.xml
Size 865KB
SHA256 1aac0a50b13dfee95f3c26dda367b92068254dc523236bf99400718c71987013
MD5 6e742f048bd8635589553f456ac00968
SHA1 9e0acf712c2e7a81a4f5f66d1e8fccb82e189b47
SHA512 540fcdb173f7f8c50ebfc3faaeb2df4d1411b64a8607c827374da11e2b2cf574d853a7a2d484f4258321bcc6ccbc851afaa7f8d33b8c21ddabcca492b3da02cd
SSDEEP 6144:ENvNHNlNPNTNCNfN5NvNuN4NuNeNvNcNVNvNcNtNNNwNFNUNjNONwNrNhN0N9N5W:x
TLSH
T14315CE3854FAB55414F65086EF001D8EED2A11D78688A28E30DF1BD74FB6EC294DB26F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmware.exe

Path C:\Program Files\VMware\VMware Workstation\vmware.exe
Size 2.1MB
SHA256 47ebf04b0d1cb8273794ec9e6d77a85e978d4c12f4f31024b4f41f3a842721ae
MD5 819f8e0b4b7c5b444b2bebb19004d646
SHA1 1e639d4d1d283c5c2046b97fc1af58eaa3f0ccd9
SHA512 f72a88d7a23f0c1fb6c06a623236b96dbc60da4baaab51170086ab3e55723c357a92cae5f91bd2f67144943cb3502748bee9f69e14f5e97e1003e04f6a120a47
SSDEEP 49152:SwxjwzTA2WJoon4PD+4eMb2/siTmc/HLP+ST+:AQJAcj2
TLSH
T140A53AD6AE6C41E1C27DC2BDC16FC926E57334A047714AC7A9164E2A6F1F6F28E3C910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmwarebase.dll

Path C:\Program Files\VMware\VMware Workstation\vmwarebase.dll
Size 7.5MB
SHA256 f0bea99a43516a5e2b0573ea76e00e11a39b637486530949c134b5b91b95454b
MD5 7b49dc90f3afb488bdf5f0aa439ace18
SHA1 861f911d296cdea0e18bb4006ce8c86e4458a57d
SHA512 29f7e5b8db99aeb4bcd34effd3ea96a5d8cd8aa44d4a48f33f0792b003eb510d86f043866163b35be5ded7fc329f10584ca4e2e59dca3029f54fc71d8fdc2be3
SSDEEP 196608:/a/BGRO8aa5y1RqSmKMBw1VUQ0UwoJ3yTg+m/wPoE+U+iYzEnodP4CuuRbpxNrk+:i/kRO8aa5y1RqSmKMBw1VUywoJ3yTg+u
TLSH
T1F7868D56A3A51069C2A7C279C6474223EFF1B85113709BDB44A1C66D2F3B7E6A33FB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudt44l.dat

Path C:\Program Files\VMware\VMware Workstation\x64\icudt44l.dat
Size 9.2MB
SHA256 7e1fc96fcc98cb8f0cb44cfa94b40549a40bd0f9968c3c1141631aa0af95a1fe
MD5 58cccfc4824ce98be253981d1087740e
SHA1 69ff1822448fc25f56298890eeea62e974f44da9
SHA512 eff1ca414672758fa1bcfc3ff2d69bcf0bdbb4bb8e94442c1e9108d5b11203b355409de9af3f6ce943a693e7198329afebde2b0862959fd48ac674c341e49429
SSDEEP 196608:C+nBa+8oim+nba+8oitKn+nt1a+8oiMqMEjX8C:l8JD8JN8JMqLjl
TLSH
T16FA6E716DEFAC949FDF39A30B9F6A152B567FD076D34CC495110230B786E5A089A0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VMware Workstation Pro.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation Pro.lnk
Size 1KB
SHA256 c20fcb585c639f8c32a0d2d257dd01f531010e6cd61267ed5326ba85e69d8fb2
MD5 70f6157af67afa76999e057ed1f14156
SHA1 4f379c1711b37debfcef286d41795ee0ead53f41
SHA512 cb74fda98653959448eac33ed67bcb42f8f4d0c9430811d9f63c94728f32003e932f1c6bc3843ebc8cb4c06f6a5b2f0dbaf705712f90237a321823773faf0a3f
TLSH
T14021AD0037DA1711F2FF1B356A62263A433AFC55D629DB2D02C5858C2ABA1447498F57
MD5 SHA1 SHA512 TLSH

Submit Download

VMware Workstation Pro.lnk~RFe5aee88.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation Pro.lnk~RFe5aee88.TMP
Size 1KB
SHA256 bfe4232853d37f587efd93d516eadbe4f24c49a70aca4bf4c8979cbecd9d8d21
MD5 90f2bd5d149862d3c8fa4e6f446e9f86
SHA1 8623cb6037bc73a88265ae3a34f957a1fd61781f
SHA512 bca395f98a242442d3312f8fe6d062d691fae3d548ed1c7cf1144b3b81690ee6183e8a8af0df0bb0ef851569a54283352e0c9ba8a38c9e1c1e8bdf0f79bb14cd
TLSH
T11021CE0023D61715F2FF6B356A622629433AFC54DA28DB2D01C2854C2AFB1547498F67
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\ProgramData\VMware\VMware Workstation\config.ini
Size 122B
SHA256 0733dc2b79d0e0e08def5527faad68f1768586ad4c6ab239d4d571fb62d0cf5b
MD5 c44c906e2ac7a302c51cc98e90fad6aa
SHA1 a94de860e4e8f9d10415c2ce576e2c1664268f9b
SHA512 58502a70a478138660b078cc231405d83f0ea8118391396b6d40d80f3ec6685c71d2e34d77228e60069db73f47fb03f6efc191cdd3bd487f9a1b6fad83f68f5b
TLSH
T196B09282A206B37AEB600AFA9022456196A614A44D5D66A89582210C89A986509DA633
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 016da5af33ed0c89afe61dcbc0c96283a1284512c3f7095d63093917fe39c69e
MD5 e97f55982ab7be1b328e2b414c40cc80
SHA1 74eb393c074fb359099bd11e105deb16cf31d57b
SHA512 15fdc6b9476edbceeb601b128df417ce75fcb2f20b0d83c2e8a1f1b887ad34df55996ec8d36317d805f5b55116df95becd07356afb293b81bea5ac8f1046a897
TLSH
T172F0DCFB90ABA043390B9C9C2FF68AB62079418E24D7427A21386AC0934B0F9561B406
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
Size 727B
SHA256 4320655ce1947de69510b5788fba0f2a5d7f788a98ade88027db1e1eb927453f
MD5 08126137bb45f588cbe5cb33b14c27e9
SHA1 18e80d2cf32d7f27190c53df41e58c7b04aa358c
SHA512 3552ff847313c186b17ba79a1aabdc5600c2fed10e272dd43d2df8e0abaf7a0bd360c01d9c97afaef79fdcc451d9f82ae64f749db11deea99b8670005fc77cdb
TLSH
T15501440B58095E40297694385B2987F5352D87B539CE841F32FE52E8E5483A3C3785E5
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 6c763e720f5cb77044eeabb5c55a774dd33b41361a7094a7242576c775c39b8b
MD5 2425779b83b139057a63a8d431a95906
SHA1 e5b422e5879b8f573269b854fa3c40aa820d9162
SHA512 e40b1fa4fa72ed566d7c14eec1723961d9d8e6625d1fbb4fcee27264a4df210576dfe48b04ace9f857b36c0e18f8b069e817c35f8dd77bc35847e0625d7fb48f
TLSH
T1E90194DA70B46CC1B8015C23D5FCF48D321AE2D80DC14EFAA1AE0586E9DD7FAAC02C48
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 ada55a3c530788352cb994e0c293ea27ddd9873aaeb3b05d5f13d44e0213c028
MD5 e2e7095d4ed4f17ef346ce5020510b25
SHA1 1a47c37c49fa59358cddea0f578f3f76f972441f
SHA512 741aea5210a8834c28a2b73aa6df9dc170fcfeedea944dd498724c852094e45f52234d36e2150cdd7dded721ec2cff3ed91aa59635e77d7347f11923bb3faca1
TLSH
T161E0202417FE502EF2A4977403D5D1DE9F35F1136C54527E0D82155D5D19D045C92D30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
Size 408B
SHA256 5506451f7773d524ab178b4fd2763a33226255870822484df4515dce29576daa
MD5 f25b65b17a79b07d048fd891ad81e19c
SHA1 5940323fa9819a299ed2a78b53e67552049ba36c
SHA512 e4a4e1d7f7ff0b6f7d570db267fa3a17c7e953bb27fdf1075632a38512d5de6a5226045d6c2806d84b1123e7541787195775c581968398e84cb96231056f5917
TLSH
T1A1E0C03862FE4189F2F0EC3403F55865054DF24E044382A80D805B07EA10A404CF5530
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 9fc99a47fe1b0de96f72dab6377eaa0281914b5fb16c04d3a92e47ca43e811ac
MD5 81373f1691ee30b9ecf8b758791bde96
SHA1 85183617bbd1c0f54983e5dfcac42b37702483ba
SHA512 39a110a1e72309a5efdabd12c21c0ef99380df8b059034c0c5cc875af51c15ec4251a04b7eba9fb875a497e8db131bf1694f2e3429e5749f5ed4f3f58a7bef8f
TLSH
T18AE0682C21BB755FF050C87042F6A57A1E49E211148482B80ED04308A70AF005C11DB4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

MSI69E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI69E7.tmp
Size 3.3MB
SHA256 8b4e7ed62c9b3d4806b6c6c76f6c6fe276e32075c65556d3104ce0b155040fad
MD5 1970080189609f09a0bb42e44962787c
SHA1 818f6a3f6a64de0e6cad5a5a52a60aa1bb502b22
SHA512 674bee8efa0f46e6e6348b29df5bd964b2c58baa1ddbf11955a3d158fea9a38abadffa02011136a039ea95eba075e12e38fce282795072d8faabfa2681af4767
SSDEEP 49152:OlCt9egZ/6YxIWnvD8LaHIc+stEugtoHmfonkXk2H7PCOnLyqbHXsPYXixXoas7j:b6ApvBJeP7uqbHcgXzpF
TLSH
T106F57C4AB6AD40A5D8A6E13DC517460BF7B278104331D7CF01A44A6FAF3F7E18A3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6BAD.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6BAD.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7C78.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7C78.tmp
Size 2.9MB
SHA256 c06d5df2ce5a5b246fe7eca9b20feaa16bc3af4ddbdf0d512f6899bdc5fc2f10
MD5 8594598cba9e553c2fbaa57d728b5839
SHA1 666cada13854e09af8d67806ce19e8dc5f85830c
SHA512 c037026adc55267dbb2140b6c5c354ff4c1dba6cd5c0502ebf71ddd52948da0c3499be0f7ab5931a21db8c29bef3a5720c05c9155e9f30ebc725771164920bf7
SSDEEP 49152:5+9HjZmEkPWy2lJvlD90DtTFh49WqnJv0opdWLG5YXT1z0HsoAtuT:5+9lmnEHpvYXTJ0R
TLSH
T14AD55A4AA6BE4095D5A6D03D862B4A0FD7F1BC120371C3CF1164DA6E5F3BBD20A3A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260705175649_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260705175649_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 71878268ba7b7d7b0b4c41bf045ec6ad1cd143a1660c280e1065eb4791117806
MD5 6e3b6280a2882fec364e7ac4f9ba4ded
SHA1 e1b78e5a37858b660458f71306462c291d145c80
SHA512 112e11c1ac621d1d6d17dc367a9e4b574a635f4467548187948b4accab6ea6265106308c639aaa042ff1a561f6fde899206fa3a41134f64c9b13c460a7162ec6
TLSH
T1684115751AE90A09F1BB6647ABF3C0134E33FCDAA834CF0C1345831A026BD055AA876E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260705175649_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260705175649_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 403c474d8968300a10bfaaaae225c3f6fc7846d0aa942f96239503d3ba3381be
MD5 99c1074bf88bfceb2c4fd1c7b3adc9e5
SHA1 4fc52f20219dac20b0c9acc757c476d65277a510
SHA512 afa8116229ee8a0eb28ffab92302fde3e528778cca3be9a01e750741770bd85fecf7da73b7fb71d88d9b33b56660304f96dbf64eec527fb7df309a99e04009d2
TLSH
T1C24119751BD90809B1B66B47AFF3C0624A73FCDA6434DF0C12458219066BD055AE87AE
MD5 SHA1 SHA512 TLSH

Submit Download

vminst.log

Path C:\Users\Admin\AppData\Local\Temp\vminst.log
Size 30KB
SHA256 20a1268e1c5e3871ed2eba57f8cb1fa43e488f51eab3d986f2f4b5e09dcc2d6f
MD5 68d1736c2c053bf4b5888853eac32e70
SHA1 1fc254af28e68ebb7b8492b7232f2829b5ff3bab
SHA512 5776347dd45eae379435e8a2fb5112272b4e75159bfd85d18560ebdc791ffc02aad385249846a2f0170e7085ec5fa15d97243d22b6fa5e3723b9a825f130e263
SSDEEP 384:yeJB4TjYBXk2d26QX4q/MUUbCAsf598J21+yXh8s:yeJJBVQIq/TMCAsf598J21+w9
TLSH
T1ACE220155B212862BB9E8D9EF25CB748C217A135B3CE2358BFA50509C713619DB3B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vminst.log

Path C:\Users\Admin\AppData\Local\Temp\vminst.log
Size 37KB
SHA256 055e693e33e7f3eca3e481fd8358e156e3aa779a7435ba91d9157d1afaa748d1
MD5 1f603149928bf5e2217f79408068ceaa
SHA1 47b2a66c0e8ec299349103f717b00fa37ae4831c
SHA512 6cee51a10b51748f6333697c24b23933803ce994b0d665765640727e13de40ad0b39d28ce51a48cb05de358417a1ffd470c014d6a1f7600be1344cecd353df24
SSDEEP 384:yeJB4TjYBXk2d26QX4q/MUUbCAsf598J21+yXh8S:yeJJBVQIq/TMCAsf598J21+wp
TLSH
T14B035E154B212856BB9E8E9EF15CB74CC217A136B38E13587FA50509C723A25DB3B38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vminst.log

Path C:\Users\Admin\AppData\Local\Temp\vminst.log
Size 37KB
SHA256 46e5a4951f04f749bb7b145ecf60c8d885c1accb2a08fd57dee230824fd73438
MD5 b163684bf56270e5c5dcf56829c4d8ae
SHA1 61bb72f591c4cc45ab57cd638f22707613bd1b8d
SHA512 17243659d373916a1f3f007d851a60e53f424049bee69709e6bcc0765dd34bd8afdb42f1e4445ae9bfcf051dd3df55ea93dd19b413908d9e30a13b9b01ee471b
SSDEEP 384:yeJB4TjYBXk2d26QX4q/MUUbCAsf598J21+yXh8J:yeJJBVQIq/TMCAsf598J21+wM
TLSH
T10E036F154B2128567B9E8E9EF15CB74CC217A136B38E13587FA50509C723A29DB3B38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vminst.log

Path C:\Users\Admin\AppData\Local\Temp\vminst.log
Size 43KB
SHA256 094b9b0f86aecd9092f068dd8dcf1c7c96fd2142c58ebf14a47318356a4fe58f
MD5 b16b9a56f4f47cc46f4bb9be61f22543
SHA1 0251e618d444788cbad5a4bb357f38f8f431979d
SHA512 9c84d4c50c143e9a2b3b57a7141070a8e8df3edadcebc7a78bcc2d23daa38af5d206512f67b02d1d2e3193a11d1f1302e80ec2841120f480056b8b5a8aa0e2e1
SSDEEP 384:yeJB4TjYBXk2d26QX4q/MUUbCAsf598J21+yXh835:yeJJBVQIq/TMCAsf598J21+wS5
TLSH
T170138E154B2128567B9E8E9EF15CB74CC217A136B38E13687FA90509C713A25D73B38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmmsi.log

Path C:\Users\Admin\AppData\Local\Temp\vmmsi.log
Size 190KB
SHA256 d26f35bc7eb9f70aa5c92f326dc016ba3b56d378a5b94d4332ecfeaf027c17b1
MD5 1a288e77d68654757de69d5ea0dec66e
SHA1 6c7ad21910cd53680a8ff563e9c1ba11e5aed826
SHA512 df45c20355b971aa53d82b836265751faff5202854927cd9ae1fbed42cf77904318d03c4fe791c2315618d7a24bbcb65d465da1b95cc2100fe724faeeb617ea3
SSDEEP 1536:S1/X4Asx6Ugi7+Fn9NdlHPbWQHk87JsP3+SMVpoSuJjNpbsB/vqYRs7+9NWArShy:YSMVmSHgeiWGOTn5v
TLSH
T18E1430356FF8014AB37BA987AFF345369632F9B56930CD1D2182824901B2D04BD6D7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{B9F9B043-A4B3-4739-B47F-5DAA41C6BB2A}~setup\vcredist_x64.exe
Size 24.3MB
SHA256 814e9da5ec5e5d6a8fa701999d1fc3baddf7f3adc528e202590e9b1cb73e4a11
MD5 689d09bce45c75db883db7e78b6f4e9b
SHA1 ba92a00f0f55dcae85c1bbd098efe606bd080b3c
SHA512 4db5078fdd9eb9ce00a1b6195a67c779a1d3c719de0fbd4729adbdac2d8ca442cf4e0a31aa40d213f29617ec073f1a7e42570dcc2f931eb9534c45f1ec6de253
SSDEEP 786432:moKpx5hYBug51MMlQi7PZdJXiq1+N76JupzS:Upx56Bu61FZPZdxQcUzS
TLSH
T1B9473332E418406BEBB234779DAAE5312E7CA62C231149E6D3C8ED4D6B7919313FF611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VMware Workstation Pro.lnk~RFe5aeea7.TMP

Path C:\Users\Public\Desktop\VMware Workstation Pro.lnk~RFe5aeea7.TMP
Size 1KB
SHA256 1c6743589eb23069916b8a69e8d91e999a8712faad511660e5d2801ea07f506b
MD5 35e802aae0ae00ee6152541f4ac4e473
SHA1 7e05e6b71cd1469eaf110c9f178463f6b574f7af
SHA512 ac3c9c88d640f998ee8ab553b723825bc0f321044813bbb07b2fbb5e1f5d2084410693d5927283e5b2518d83966ff8e35fd7f31e8e9686670d9d0bbde765f43b
TLSH
T14721ED0033DA0611F2FF6B396A722629433AF854CB19DB2D02C6854C2AF71547898F67
MD5 SHA1 SHA512 TLSH

Submit Download

~Mware Workstation Pro.tmp

Path C:\Users\Public\Desktop\~Mware Workstation Pro.tmp
Size 1KB
SHA256 3678bccdb24240628cd23d09982e4f8b201e8dd987ca2901556a6b656e9301c7
MD5 41a4f16c263c2922689a7ffcd5613040
SHA1 76a9a79f15c3e565fe23301ac215c1ac504dd686
SHA512 d29f078959c9bc6a71ebdd913eb6ec42172fd882ee7a04cb49c75ed9d8c63622a2b69ee71588b81a5e504573917df0d3f4dc53652d17c1d603bf954ea9b86604
TLSH
T12121FC0033DA0611F2FF1B3A6A622229433AF859DA19DB2D02C6814C2AF70807498F67
MD5 SHA1 SHA512 TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 6KB
SHA256 0f768c935cabb01f9169f9810231f27df5980842da2848e4ca862fa28c58e006
MD5 0c3ff4954a0844a8afb6fa18b030df08
SHA1 2962969748897aab247dfeacdb3db2c73df0ea52
SHA512 3be4408357e6aa90d99d2d6765ef508aa03f33f3582263e956f8035da6fdae02465a06533d944a6dcfc69c88ebb7c75e20d3b7367591e570ba5737e401e8d3dc
SSDEEP 96:v4rgQdYLXIGX2tY6DE3G1a1U188ZUuQSCUJ:CY8rDJZUK/
TLSH
T162D14546B3F88B15F1FA9B306DB511E65476BC51AC12C61F7260338E0972F949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem1.PNF

Path C:\Windows\INF\oem1.PNF
Size 7KB
SHA256 f4ffc57ad4d911d7753f8b69a0b7cec184a35ed7edcfc14ab2b8c96620a03e02
MD5 d44db904f93f0b60eb528bb0b405d6f3
SHA1 e3159970deb9b68faa86636de3e86d1cd8273535
SHA512 a50e14a9f739f26819db315638a6ba7f3485b624c8e1cf753d918d7ea6c8003322493c2043c7f1d18f47e90aaca2626ffc9177328ed043e8c3f03d395270a31c
SSDEEP 96:LWdqkD0+844iVKvJTAMi2CoW0WAVCiSqt6i1AKww4ccm:o4iV8UMix/K9cm
TLSH
T1A2F11645B3D88B09F5B68E745CF462E55466BCC1DC11CB4F2574770E2872B80EBB1B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem2.PNF

Path C:\Windows\INF\oem2.PNF
Size 10KB
SHA256 4a18c16b46e919eb0bafab8e5bdbc70370e8e7e9e417c5e9ea9512191aa33de5
MD5 0fbb8226671fa69207f79b9b80b752c7
SHA1 ce6101098b54efcc522857ed6e1b63eb60869674
SHA512 bf76cf42275b8d67b9b3204562406940d6b1e7f805bd103317e664004b5964b2c82d5a8063b818cfe2616b0477a0d393bccedf430df9b67de099c39e00fe6f68
SSDEEP 96:O0uBKkpFKXLFS4Y8VaIZA8xpGDnO1yxAh6cj12xrPzmRu/3kY2CNSrPKGgqYbSXj:8KLFSf9IZZ7invA0cj1qmPKFOXEGxCK
TLSH
T192226755B7E88B18F6F30E709DF961E50864BC969C55DB4F21A0330D2872A90DBF0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICCFC.tmp

Path C:\Windows\Installer\MSICCFC.tmp
Size 648KB
SHA256 d380a8cb5c5c318213378a51e6e64fb78d049493c2456efc1e4d5debcc2ab55e
MD5 3688fb25eef0eb15694989379f4fe5a3
SHA1 cb7ad4cb37a464dc1b13ab66dd86f13aa0b11484
SHA512 3b6881344dd1c4016dadd22dc2e5b43a44ab5bf234b2b9d8418b763be9ab91b16a678dee17c71cc46b666e316d2887b729b47e46829645c9b05c4392dc541738
SSDEEP 12288:Xh6v58voKhwwTNHkLwiq7Tp1Qj0tpmfDRz32A+AfEU:Xsh8vjhwwTNkwiW9xtpmfDN38Af5
TLSH
T16CE48C56F6E100B9E4AB813989934712F7727C550760ABDF13E0A27A5F3BBD1173AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID33A.tmp

Path C:\Windows\Installer\MSID33A.tmp
Size 1012KB
SHA256 280ecde7ad57f23e214d5a2c7f692f6d6ff4a3054a57dad7cd50392cafcf00ee
MD5 d8a58d9ae8e2a4106548a6e2b675f7ea
SHA1 1b0dc03ba8016c6ae04273336f2918b94f7e4ba3
SHA512 68a29b6b5a52133434599c2ec03a4b4bcf76d537454f319a7aee0a29c75d98d7faba67e7fd27d99fa2fae3f2ab3466002aac58ccfde93641add09c2355ef0a78
SSDEEP 12288:vfNLyMbS+HmEvXuB4Al3xeEGRKKaV2NxMUpMOueSP82E5:v02RHmEXs4AzeEGRKKaSMUpMOaPl
TLSH
T1EC257C17ABD901BAE4BB9239CD674A01E772BC46077097DF02E0626D2E37FD44A39712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID3E7.tmp

Path C:\Windows\Installer\MSID3E7.tmp
Size 149KB
SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
MD5 8eabeadadc6d03c9807787af28381b65
SHA1 b5015709fb98a8a849a0440c54c07c394e89bc59
SHA512 18ddec2d28640108faf5a4b9878cc0e6224fdc6ee26bd9fcfc2c972d0ea82a21468181c6fcc3413a99e2a9bc070e71d41c998528a324eee93ee1b59351b6f037
SSDEEP 3072:CJdLyE16iOLin7Q4RZUKnnH1uhC7vu/2nrZ/yqMPu:CJdLT1jXZ/H1dRxt
TLSH
T171E3AE01B1D08072DABF193A5434DA725F3FB9209F508ADB53988A7D9E702C09E76B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDB40.tmp

Path C:\Windows\Installer\MSIDB40.tmp
Size 977KB
SHA256 5ce1c83786eaecb0030f809c776de34b1fe802db00157bfa543c2f8dee1f1f8b
MD5 f8f06fd1595f08880c73e3e762a65b64
SHA1 c7d4207bbafbf2e4b64ce74846535be91fed6de6
SHA512 06b5014f1e1b13a90eb70b10e4032e2f22efdd2f36a94275e6115d48e47f392bc311caa263391eb0e65d9d495667c55b77f515235429406e31ca76508a59b45f
SSDEEP 24576:c/0HaiU1JdStRplQdEt9SQxs1brpjF2OJIEBhF2nKCL:c/0H1U1JdStXSdERiBFoEBhF2nKCL
TLSH
T147257C26BBE901B9E0BB923889674606E771FC06077096DF03A0A66D3F37BD15739B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netadapter.inf_amd64_c1c4a664a4282894.ini

Path C:\Windows\System32\DriverStore\FileRepository\netadapter.inf_amd64_c1c4a664a4282894.ini
Size 544B
SHA256 27ca578732a7216d9f38784d0c6311182811c960f2e5c92b4ad54c4807c0fb13
MD5 31970ef2746774f0dc9bf99587aa6731
SHA1 534688aa91e0098bd48257d61dfb535837fc6e5b
SHA512 7b1c10a7db119bc64a1554045e8d7983f747c17ac8c5da46981fe3df37e85d6284f111d4bfebc9bddb01388316d174dd5e5c8dd299ac7f61f76edb63836b1642
TLSH
T18DF0900163FAC5EA5B171CC9C3D8AE72E6A67224769169433380C884CF8B83759D434B
MD5 SHA1 SHA512 TLSH

Submit Download

netbridge.inf_amd64_1c40c369eff72dc1.ini

Path C:\Windows\System32\DriverStore\FileRepository\netbridge.inf_amd64_1c40c369eff72dc1.ini
Size 656B
SHA256 174346fbcb96c7f813464764af921a693ef890a59e7a42c23b29b43cea5a0536
MD5 750e967e862f71e8263e0b652080b13f
SHA1 cbbcf6885f5d62f09fd8de6a27fc024359fde847
SHA512 ebed382f28825735956c72e9b2d438bfd5f246e560182d7f95cc2394b85748aa866ad0870f326f9ea4d6ae17ab75b6894c7ec4d78b26681266b082de75993cc6
TLSH
T164F0D60573F2C5ED0B265CA9C7986E37C295B329E2915B83B340C4909F8763B24D5307
MD5 SHA1 SHA512 TLSH

Submit Download

vmci.inf_amd64_faf39406c404b481.ini

Path C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_faf39406c404b481.ini
Size 405B
SHA256 71c419c9d12fcb29f03ba73f90ac563229c17050fda50f9e491548eba049f8a8
MD5 be379a3b23d6daa7261c4074937a6b8e
SHA1 6a699863055659170a37df1217dcaa6db7a30047
SHA512 06787072bf6dfa15108f8d78762432e9bd026fb09474bd18b12a4563efb8a7123a5ed0a5f7b59b867a044d9f0867ed7f0546434177b693be3c9411db41857ace
TLSH
T13BE0E56430F0C6D92340550B73185B249A2CF20F8C92280932A0E1185F5BC486D89222
MD5 SHA1 SHA512 TLSH

Submit Download

vmusb.inf_amd64_e4985be9ea2d2d2d.ini

Path C:\Windows\System32\DriverStore\FileRepository\vmusb.inf_amd64_e4985be9ea2d2d2d.ini
Size 408B
SHA256 e4f72f56c7860a766c3f2fd0468ba70504b4e3be50f25f58bb2d2070af1b9847
MD5 dbe3bdeac26c5e5023f75e3fa9fc01e2
SHA1 237abc65d6b2a3a1c7965427084ca3e9591a70b7
SHA512 fe062dfc6810d81cfb3cacf44f747ff1bf60410f46dc42fea1ba7911bb33524274b188947ce09c2fd98e380c00114d2dfe8499b2f6b138ad4a1c23f89971cb05
TLSH
T1A6E0922981F6E38D260057A39F5C3E35C885F006369B8C9132B8B1985F8AD169BA5653
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 79KB
SHA256 ae5c1931a3e8412d6976d0c7b4f2e477d785693d16695cc1b533a959e9aaf9bd
MD5 6bc675e0a34056488f4a06a4896d6e77
SHA1 af59ede09d2de0336063a5eeee7a6a906293a011
SHA512 f3a0fcbe235cb11bfac2a3d01a225c22f2c83a8a76fce475e6de1b7f05b82d3941ad75a3283a681d75c3b402bff0742399ac83db8d8296e1308ee90080f1bff0
SSDEEP 1536:tMTL9Te1dIPpbgux2dU1DVAHVDCfYG7FhPDOsscTc4szCfDg3gl2ovFFHggUrtXK:UitwxZ
TLSH
T165837005D2D88A9CC9F209737266EE75DD1F65C6730F4DA632DC63809DC2B012F7A86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{0957ECC1-3B2E-48AC-86A3-4546EBF7513B}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{0957ECC1-3B2E-48AC-86A3-4546EBF7513B}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{0957ECC1-3B2E-48AC-86A3-4546EBF7513B}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 8265bab100e281ddd366a9a435aee439bb87a1fe848fbfce0881449c4f08e485
MD5 92f06ebd6d7dd8fc4373a257ba81e19e
SHA1 479f3a9fa2d3fed500088812f9201197adf01e17
SHA512 76eb034b06f05a0dcbe62843d791a28959c9354c5e290b90a4320451ba0d5081432f2f6581fb16aedde1fbdc7a60b85c0d7f13907ab7d5e563c57dd2aa6fb9ea
SSDEEP 98304:aaaTUerJ34CXBLnYanuGjC1L9qjYBV0fVXi1sduXPPLg92OlPZ/GU0Zfxda5cg:zrKtZnYanuGjCB9qj1f2sdZ1GUcY5cg
TLSH
T1D846335CC618D3D6647AB117D57A83860DF429EF66231E84DE731F96838E24BB3A380D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{0957ECC1-3B2E-48AC-86A3-4546EBF7513B}\cab5046A8AB272BF37297BB7928664C9503
Size 967KB
SHA256 78cd0d63fb93470f11a300d79c5bafe4554142035126068710d6583fc23d49fa
MD5 3ec3d0ebf9e94535ab326fb3ed1ebefd
SHA1 5331e4062617df4cfe8dd1fed67a39e1778c3e86
SHA512 c3f4899d2bf3079485c5c47c8a910023b654e0ae4821ced54b995df5626692551e12fecdc65551d56d9a99f8e5dcdb6176011afe97dc45a734c192834ed0485a
SSDEEP 24576:Ai3yPptQc8pzIXCH9T6hJuAsx4lYNMEY8iSoujlz8V6ZiUc:AiI8pzIXCHR6ru/xqE9iqJ8kip
TLSH
T1162533818C7D724FF250195E6B82EA7A042F6EA7DC57607662F660C614C27ACB13C4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{0957ECC1-3B2E-48AC-86A3-4546EBF7513B}\vcRuntimeAdditional_x64
Size 208KB
SHA256 a4b5cd38dbac2d9588bb15d6b02b24a05c340c2c0a10d1ac86037e6dd14262c5
MD5 c41d1aa655205cb772e3aeb0de9c14df
SHA1 a3d95bdfa9c9552536adb589f66ccf28dfeabb1c
SHA512 dd5b8f32021bcff98f2a96582d4cfc28571bef870ca3b1d6f7e58d6d4e18f12eb91063f2524094beb699396814109e39f87183e9935742b9579bae75f5f32f52
SSDEEP 3072:C9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT9g:slaZeKFxCnBheIdlux
TLSH
T1E524AF12B5808033DAFE1A351178DBA15F3D7E608F544A9B2364B6AD1E717C08F3A9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{0957ECC1-3B2E-48AC-86A3-4546EBF7513B}\vcRuntimeMinimum_x64
Size 208KB
SHA256 59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22
MD5 cbb2aeab99bcc3085738c1c41fdf3225
SHA1 9462fcbb04046d68df7250f5124e79c269f771b2
SHA512 aec8238b7d7a4727b1f3fdcd5d3c6064bf72af6da5d8ef6542fe5fd97b8e24b7d15540426fae029a628d7e160f9fb31fc482edccc416d970f93656ecad0fd5e7
SSDEEP 3072:S9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTYBp:claZeKFxCnBheIdluO
TLSH
T1B824AE12B5808033DAFE1A350578DB615F3D7E608E54899B6364B6AD1E707C0CF3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\Windows\Temp\{9D9E2CA7-0D39-446D-822E-E53066FD057A}\.cr\vcredist_x64.exe
Size 670KB
SHA256 1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e
MD5 261f741c93973d184d4fccf833f0c075
SHA1 cb7846fc45cc545b3ac6ab0aa3425461e219b196
SHA512 90ca6a11c6bbd5f97d1ed146da5279bf40330bf9020b40eb816ede0d914ed4d769e9c48cb8c839924700dec818d4f818f89e6d6afbc7091e2a2809ebe099da81
SSDEEP 12288:Z3mgqnIZuYfCYqFet4CovkM7pu1nEMSgKZLrfDDIcbMZ3MyGb:Z3WnIZuMCxezot7ohEDfDBMZ8yM
TLSH
T120E49D32A5614033F7F10573B928A6303E7CE3282B51C8A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{B98067FA-9B75-4AFA-91B1-1DC8C3C9B0E3}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-375-0x00000000005A0000-0x0000000000617000-memory.dmp

Download

memory/1388-1224-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1271-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1237-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1246-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1250-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1245-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1251-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1249-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1247-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1236-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1213-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1214-0x00007FF6BD7A0000-0x00007FF6BD9B9000-memory.dmp

Download

memory/1388-1215-0x00007FFA492F0000-0x00007FFA49846000-memory.dmp

Download

memory/1388-1217-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1221-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1222-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1223-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1233-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1227-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1228-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1235-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1234-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1231-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1232-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1219-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1248-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1218-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1220-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1216-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1230-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1275-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1253-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1229-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1264-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1265-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1260-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1261-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1272-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1270-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1269-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1268-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1267-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1266-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1263-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1262-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1259-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1258-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1252-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1244-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1256-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1257-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1254-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1388-1255-0x00007FFA4A550000-0x00007FFA4B038000-memory.dmp

Download

memory/1396-968-0x0000013A6A8A0000-0x0000013A6A9E9000-memory.dmp

Download

memory/1528-378-0x00000000005A0000-0x0000000000617000-memory.dmp

Download

memory/4092-377-0x00000000005A0000-0x0000000000617000-memory.dmp

Download

memory/5720-33-0x0000015183E10000-0x0000015183E30000-memory.dmp

Download

memory/5720-3-0x00000151801E0000-0x00000151802E0000-memory.dmp

Download

memory/5720-18-0x0000015183A30000-0x0000015183A50000-memory.dmp

Download

memory/5720-47-0x00000151942B0000-0x00000151942D0000-memory.dmp

Download

memory/5720-1-0x00000151801E0000-0x00000151802E0000-memory.dmp

Download

memory/5720-2-0x00000151801E0000-0x00000151802E0000-memory.dmp

Download

memory/5720-19-0x0000015193F20000-0x0000015194020000-memory.dmp

Download