Analysis
- geolocation tags
- user interaction
yes - max time kernel
74s - max time network
255s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 17:15
Errors
General
- Target vmware-workstation-player-16.1.1-installer_QtQuU-1.exe
- Size 5.2MB
- Sample260709-vsvddset9j
- SHA256 959e6e2f8410af379a9772a77d186420b33f288e28b11676bc08a6f4119265b2
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 42 IoCs
- Modifies registry class 48 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of FindShellTrayWindow 59 IoCs
- Suspicious use of SendNotifyMessage 45 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmware-workstation-player-16.1.1-installer_QtQuU-1.exe"C:\Users\Admin\AppData\Local\Temp\vmware-workstation-player-16.1.1-installer_QtQuU-1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9XLSZTA0I2.tmp\vmware-workstation-player-16.1.1-installer_QtQuU-1.tmp"C:\Users\Admin\AppData\Local\Temp\is-9XLSZTA0I2.tmp\vmware-workstation-player-16.1.1-installer_QtQuU-1.tmp" /SL5="$5020C,4171849,960512,C:\Users\Admin\AppData\Local\Temp\vmware-workstation-player-16.1.1-installer_QtQuU-1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1HOW9KFJNV.tmp\component0_extract\saBSI.exe"C:\Users\Admin\AppData\Local\Temp\is-1HOW9KFJNV.tmp\component0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US InstallID=GnjW1demeOQFPm6gUkCePrYz2Rbhl2iGeT2PwHsERToH2NIFU0BUntdlolXysz9bdJuGqOh1WXKpTWe60zV3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91088 PaidDistribution=true InstallID=GnjW1demeOQFPm6gUkCePrYz2Rbhl2iGeT2PwHsERToH2NIFU0BUntdlolXysz9bdJuGqOh1WXKpTWe60zV saBsiVersion=4.1.1.865 CountryCode=US /no_self_update4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\McAfee\Temp3425451214\installer.exe"C:\Program Files\McAfee\Temp3425451214\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-1HOW9KFJNV.tmp\component1.exe"C:\Users\Admin\AppData\Local\Temp\is-1HOW9KFJNV.tmp\component1.exe" /s3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS45957B99\UnifiedStub-installer.exe.\UnifiedStub-installer.exe /s4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:105⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\Downloads\vmware-workstation-player-16.1.1-installer.exe"C:\Users\Admin\Downloads\vmware-workstation-player-16.1.1-installer.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\{132A1BC6-DA72-43E2-87F3-6B19F89F78F3}~setup\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\{132A1BC6-DA72-43E2-87F3-6B19F89F78F3}~setup\vcredist_x86.exe" /Q /norestart4⤵
-
C:\Windows\Temp\{8EC1C104-6063-4004-BCC8-A50CDE4F2ADC}\.cr\vcredist_x86.exe"C:\Windows\Temp\{8EC1C104-6063-4004-BCC8-A50CDE4F2ADC}\.cr\vcredist_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{132A1BC6-DA72-43E2-87F3-6B19F89F78F3}~setup\vcredist_x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /Q /norestart5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\{132A1BC6-DA72-43E2-87F3-6B19F89F78F3}~setup\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\{132A1BC6-DA72-43E2-87F3-6B19F89F78F3}~setup\vcredist_x64.exe" /Q /norestart4⤵
-
C:\Windows\Temp\{32EB543A-2FA8-42CC-83D0-4D6F60858661}\.cr\vcredist_x64.exe"C:\Windows\Temp\{32EB543A-2FA8-42CC-83D0-4D6F60858661}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{132A1BC6-DA72-43E2-87F3-6B19F89F78F3}~setup\vcredist_x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /Q /norestart5⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 9283⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 9283⤵
- Program crash
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:101⤵
- Executes dropped EXE
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\McAfee\WebAdvisor\updater.exe"C:\Program Files\McAfee\WebAdvisor\updater.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"3⤵
-
-
-
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1552 -ip 15521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1552 -ip 15521⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E5617ED6A2C3B4245B96963564400322 C2⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 87EA076F552F34ED777C6E163B6ADBE6 C2⤵
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E1F9C5A4C536D715ECCF2FF8C7BB5D682⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 3400F4502E4D7B05ED8A7B15F3D264F12⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A05F8331B7E0D3C21B76C67FC7863AAA E Global\MSI00002⤵
-
C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe"C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe" -- uninstall usb3⤵
-
-
C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe"C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe" -- install vmusb Win83⤵
-
-
C:\Program Files (x86)\Common Files\VMware\USB\vnetlib64.exe"C:\Program Files (x86)\Common Files\VMware\USB\vnetlib64.exe" -- install hcmoninf 5;Win73⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet03⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet13⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet23⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet33⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet43⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet53⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet63⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet73⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet83⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet93⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet103⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet113⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet123⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet133⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet143⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet153⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet163⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet173⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet183⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- remove adapter vmnet193⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- uninstall bridge3⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- uninstall userif 5;None3⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- install bridge3⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- install userif 5;None3⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- add adapter vmnet13⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- add adapter vmnet83⤵
-
-
C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe"C:\Program Files (x86)\VMware\VMware Player\vnetlib64.exe" -- install vmx86inf 5;Win83⤵
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 199EC2BE1D055E43F9791123455AC249 E Global\MSI00002⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8\vmusb.inf" "9" "454492f13" "0000000000000194" "WinSta0\Default" "0000000000000198" "208" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8"1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\VMware\VMware Player\netbridge.inf" "9" "4f3176507" "0000000000000164" "WinSta0\Default" "0000000000000184" "208" "C:\Program Files (x86)\VMware\VMware Player"1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\VMware\VMware Player\netadapter.inf" "9" "4a5017fd3" "0000000000000184" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files (x86)\VMware\VMware Player"1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\VMWARE\0000" "C:\Windows\System32\DriverStore\FileRepository\netadapter.inf_amd64_8e12d1edcc9e768d\netadapter.inf" "oem3.inf:fc9f1aa2477c2bb3:VMnetAdapter1.Install:14.0.0.5:*vmnetadapter1," "4cbdd083b" "0000000000000184" "aaab"1⤵
-
\??\c:\windows\system32\NetCfgNotifyObjectHost.exec:\windows\system32\NetCfgNotifyObjectHost.exe {6A062A28-0C56-4480-8CA9-200B871D87FB} 5721⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
-
\??\c:\windows\system32\NetCfgNotifyObjectHost.exec:\windows\system32\NetCfgNotifyObjectHost.exe {D65F2C58-FAB4-491B-A452-DB205E08607B} 6601⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\VMWARE\0001" "C:\Windows\System32\DriverStore\FileRepository\netadapter.inf_amd64_8e12d1edcc9e768d\netadapter.inf" "oem3.inf:fc9f1aa2df34f6ba:VMnetAdapter8.Install:14.0.0.5:*vmnetadapter8," "47eb20b4f" "0000000000000118" "aaab"1⤵
-
\??\c:\windows\system32\NetCfgNotifyObjectHost.exec:\windows\system32\NetCfgNotifyObjectHost.exe {B381E030-FE45-44EA-8AD3-F00253443A4D} 7281⤵
-
\??\c:\windows\system32\NetCfgNotifyObjectHost.exec:\windows\system32\NetCfgNotifyObjectHost.exe {82804F4E-28D7-49EF-84A5-CE40B9CB4D4B} 8921⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8\vmci.inf" "9" "4d941d7e3" "0000000000000184" "WinSta0\Default" "0000000000000188" "208" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8"1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\VMWVMCIHOSTDEV\0000" "C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_5e38a278d114b813\vmci.inf" "oem4.inf:9c00c72d390d9e8f:vmci.install.x64:9.8.16.0:root\vmwvmcihostdev," "42936a687" "0000000000000184" "aaab"1⤵
-
C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39e0855 /state1:0x41c64e6d1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
e5bc476.rbs
ovftool-hw9-config-option.xml
vmplayer.exe
vmwarebase.dll
icudt44l.dat
analyticsmanager.cab
analyticstelemetry.cab
browserhost.cab
browserplugin.cab
ds_invoker.cab
installer.exe
l10n.cab
logicmodule.cab
logicscripts.cab
mfw-mwb.cab
mfw-nps.cab
mfw-webadvisor.cab
mfw.cab
resourcedll.cab
servicehost.cab
settingmanager.cab
taskmanager.cab
uihost.cab
uimanager.cab
uninstaller.cab
updater.cab
webadvisor.cab
wssdep.cab
AnalyticsManager.dll
dataConfig.cab
Resource.dll
ServiceHost.exe
TaskManager.dll
AnalyticsEventsConfig.luc
AnalyticsTelemetryHandler.luc
class.luc
dkjson.luc
logger.luc
settingmanager.dll
wssdep.dll
InstallerLib.dll
mc.dll
rsEngine.Core.dll
EPP.exe
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
installer.exe
saBSI.exe
VMware Workstation 16 Player.lnk
VMware Workstation 16 Player.lnk~RFe5c12f3.TMP
config.ini
vmnetdhcp.conf
prep_Activatable Class_Hermes_perf.cache
rsServiceController.DLL
rsTime.DLL
Reason.PAC.DLL
rsDatabase.DLL
rsLogger.DLL
Newtonsoft.Json.DLL
Microsoft.Win32.TaskScheduler.dll
Newtonsoft.Json.dll
Reason.PAC.dll
UnifiedStub-installer.exe
rsLogger.dll
rsStubLib.dll
rsSyncSvc.exe
uninstall-epp.exe
Reason.ArchiveUtility-x64.dll
MSI5803.tmp
DIFXAPI.dll
RAV_Cross.png
WebAdvisor.png
component0.zip
saBSI.exe
component1.exe
mainlogo.png
yes.png
vmware-workstation-player-16.1.1-installer_QtQuU-1.tmp
mwa13A8.tmp
mwaE015.tmp
vminst.log
VMware Workstation 16 Player.lnk
VMware Workstation 16 Player.lnk~RFe5c12d4.TMP
oem1.PNF
MSI113D.tmp
MSI1B65.tmp
MSIF68F.tmp
netadapter.inf_amd64_8e12d1edcc9e768d.ini
netbridge.inf_amd64_9204dc61a7dee6f3.ini
vmci.inf_amd64_5e38a278d114b813.ini
dberr.txt
vminst.log
wixstdba.dll
logo.png
memory/1416-244-0x0000019132C60000-0x0000019132D14000-memory.dmp
memory/1416-2302-0x0000019132BA0000-0x0000019132BF0000-memory.dmp
memory/1416-4157-0x0000019133570000-0x00000191335A2000-memory.dmp
memory/1416-246-0x0000019119E40000-0x0000019119E62000-memory.dmp
memory/1416-388-0x00000191327C0000-0x0000019132818000-memory.dmp
memory/1416-4167-0x0000019133570000-0x000001913359E000-memory.dmp
memory/1416-2353-0x0000019132BF0000-0x0000019132C4C000-memory.dmp
memory/1416-253-0x0000019119E80000-0x0000019119EB0000-memory.dmp
memory/1416-241-0x00000191187B0000-0x00000191187E2000-memory.dmp
memory/1416-4177-0x0000019133570000-0x00000191335A0000-memory.dmp
memory/1416-238-0x0000019132860000-0x00000191328F4000-memory.dmp
memory/1416-4187-0x0000019133710000-0x0000019133742000-memory.dmp
memory/1416-4197-0x0000019132A40000-0x0000019132A48000-memory.dmp
memory/1416-4143-0x0000019133770000-0x0000019133824000-memory.dmp
memory/1416-236-0x0000019117FF0000-0x000001911817A000-memory.dmp
memory/1416-4204-0x0000019132A70000-0x0000019132A78000-memory.dmp
memory/1552-28-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-20-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-38-0x0000000000FC0000-0x0000000001413000-memory.dmp
memory/1552-39-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-37-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-35-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-34-0x0000000000FC0000-0x0000000001413000-memory.dmp
memory/1552-33-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-32-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-6-0x0000000001560000-0x0000000001561000-memory.dmp
memory/1552-27-0x0000000001560000-0x0000000001561000-memory.dmp
memory/1552-204-0x0000000003100000-0x0000000003240000-memory.dmp
memory/1552-25-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-345-0x0000000000FC0000-0x0000000001413000-memory.dmp
memory/1552-19-0x0000000006540000-0x0000000006680000-memory.dmp
memory/1552-4141-0x0000000006540000-0x0000000006680000-memory.dmp
memory/2376-26-0x00000000004D0000-0x00000000005C9000-memory.dmp
memory/2376-1-0x00000000004D0000-0x00000000005C9000-memory.dmp
memory/3656-248-0x000001E6001E0000-0x000001E6002E0000-memory.dmp
memory/3656-262-0x000001E6039F0000-0x000001E603A10000-memory.dmp
memory/3656-295-0x000001E614690000-0x000001E6146B0000-memory.dmp
memory/3656-263-0x000001E613E50000-0x000001E613F50000-memory.dmp
memory/3656-272-0x000001E603C50000-0x000001E603C70000-memory.dmp
memory/4388-722-0x00007FF705EE0000-0x00007FF705EF0000-memory.dmp
memory/4388-578-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-579-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-580-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-581-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-583-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-586-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-588-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-589-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-592-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-625-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-594-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-762-0x00007FF705EE0000-0x00007FF705EF0000-memory.dmp
memory/4388-596-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-760-0x00007FF705EE0000-0x00007FF705EF0000-memory.dmp
memory/4388-598-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-757-0x00007FF705EE0000-0x00007FF705EF0000-memory.dmp
memory/4388-600-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-601-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-755-0x00007FF705EE0000-0x00007FF705EF0000-memory.dmp
memory/4388-754-0x00007FF705EE0000-0x00007FF705EF0000-memory.dmp
memory/4388-753-0x00007FF6E6D30000-0x00007FF6E6D40000-memory.dmp
memory/4388-738-0x00007FF705EE0000-0x00007FF705EF0000-memory.dmp
memory/4388-607-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-668-0x00007FF6E2BC0000-0x00007FF6E2BD0000-memory.dmp
memory/4388-714-0x00007FF6CF800000-0x00007FF6CF810000-memory.dmp
memory/4388-712-0x00007FF6CF800000-0x00007FF6CF810000-memory.dmp
memory/4388-612-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-706-0x00007FF6CF800000-0x00007FF6CF810000-memory.dmp
memory/4388-614-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-615-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-616-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-617-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-618-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-693-0x00007FF6CF800000-0x00007FF6CF810000-memory.dmp
memory/4388-619-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-686-0x00007FF6CF2B0000-0x00007FF6CF2C0000-memory.dmp
memory/4388-676-0x00007FF6E2BC0000-0x00007FF6E2BD0000-memory.dmp
memory/4388-620-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-621-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-622-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-623-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-624-0x00007FF6BAF30000-0x00007FF6BAF40000-memory.dmp
memory/4388-626-0x00007FF6BC080000-0x00007FF6BC090000-memory.dmp
memory/4388-637-0x00007FF6E2BC0000-0x00007FF6E2BD0000-memory.dmp
memory/4388-653-0x00007FF6E2BC0000-0x00007FF6E2BD0000-memory.dmp
memory/4388-655-0x00007FF6E2BC0000-0x00007FF6E2BD0000-memory.dmp
memory/4388-657-0x00007FF6E2BC0000-0x00007FF6E2BD0000-memory.dmp
memory/4388-660-0x00007FF6E2BC0000-0x00007FF6E2BD0000-memory.dmp
memory/4388-661-0x00007FF6E2BC0000-0x00007FF6E2BD0000-memory.dmp