Analysis
- user interaction
yes - max time kernel
138s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/09/2026, 09:39
Static task
static1
Behavioral task
behavioral1
Sample
Patcher.cmd
Resource
win11-20260513-en
windows11-21h2-x64
33 signatures
150 seconds
General
- Target Patcher.cmd
- Size 5KB
- Sample260907-lm5gqstdrd
- SHA256 a98b76b70c62b2115e18b852972f3db99e8e79935dbeecf0e32932075733d9bb
- MD5 fd37a2180c83064d0a161333efcb029d
- SHA1 e76768d1dc89311623b66ce852433bbcfde802eb
- SHA512 d8c84499e04804189e298d57b99d5fae8b7e824d8af8f2da71430e63df91d90ed041a493c12ef8fcca086033e265045552bf9d8d36561c132fe3e88bb6ea9d3d
- SSDEEP 48:4Kg5+5K5g/5pfwRpM1toWApTHKYHKdMAyjpdZ0ttvyRF8A/7A4NUjNzZ6G8+FN2L:4lFnlUl8w8mRq0LDblM3+L8VhWE
- TLSH T16FB1762591C68A9C537355B2D2F52784713681D27F90629821BB88A7B6D9103A33FDE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 11 5684 curl.exe 18 1168 curl.exe - Drops file in Drivers directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\vmnetuserif.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SETEB7.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SETEB7.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SET164A.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET165B.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\vmnetbridge.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET1709.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\hcmon.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET164A.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\vmnet.sys MsiExec.exe File created C:\Windows\system32\DRIVERS\SET165B.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET16F8.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SET16F8.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SET1709.tmp MsiExec.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools msiexec.exe - Looks for VMWare services registry key. 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMware msiexec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMware msiexec.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMware msiexec.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMware msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMware MsiExec.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMware MsiExec.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 15 IoCs
pid Process 4120 idman643build10.exe 3604 IDM1.tmp 4036 VMwareInstaller.exe 1412 vcredist_x64.exe 4244 vcredist_x64.exe 3284 VC_redist.x64.exe 1464 VC_redist.x64.exe 788 VC_redist.x64.exe 3112 VC_redist.x64.exe 852 VC_redist.x64.exe 3128 vmware-tray.exe 1504 vmware-authd.exe 2000 vmware-autostart.exe 4344 vmware-usbarbitrator64.exe 4276 vmnat.exe - Loads dropped DLL 64 IoCs
pid Process 4244 vcredist_x64.exe 5364 VC_redist.x64.exe 3112 VC_redist.x64.exe 820 MsiExec.exe 820 MsiExec.exe 5300 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 5300 MsiExec.exe 5300 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 3156 MsiExec.exe 820 MsiExec.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 3128 vmware-tray.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 4056 MsiExec.exe 1504 vmware-authd.exe 1504 vmware-authd.exe 1504 vmware-authd.exe 1504 vmware-authd.exe 1504 vmware-authd.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vmware-tray.exe = "\"C:\\Program Files\\VMware\\VMware Workstation\\vmware-tray.exe\"" msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 11 raw.githubusercontent.com 1 raw.githubusercontent.com 2 raw.githubusercontent.com 9 raw.githubusercontent.com - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: VMwareInstaller.exe File opened (read-only) \??\H: VMwareInstaller.exe File opened (read-only) \??\J: VMwareInstaller.exe File opened (read-only) \??\V: VMwareInstaller.exe File opened (read-only) \??\X: VMwareInstaller.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: VMwareInstaller.exe File opened (read-only) \??\M: VMwareInstaller.exe File opened (read-only) \??\N: VMwareInstaller.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: VMwareInstaller.exe File opened (read-only) \??\P: VMwareInstaller.exe File opened (read-only) \??\T: VMwareInstaller.exe File opened (read-only) \??\U: VMwareInstaller.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: VMwareInstaller.exe File opened (read-only) \??\K: VMwareInstaller.exe File opened (read-only) \??\S: VMwareInstaller.exe File opened (read-only) \??\Y: VMwareInstaller.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: VMwareInstaller.exe File opened (read-only) \??\R: VMwareInstaller.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: VMwareInstaller.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: VMwareInstaller.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: VMwareInstaller.exe File opened (read-only) \??\W: VMwareInstaller.exe File opened (read-only) \??\Z: VMwareInstaller.exe File opened (read-only) \??\S: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_bc519c177a90877a\c_netservice.PNF MsiExec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\perfh00A.dat MsiExec.exe File created C:\Windows\system32\perfc011.dat MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_72f156a5ee3f59e8\netrass.PNF MsiExec.exe File opened for modification C:\Windows\system32\SET1649.tmp MsiExec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e726d719-ec80-7749-9ada-157c23824e07}\vmusb.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_0525128a3d54207e\netnwifi.PNF MsiExec.exe File created C:\Windows\system32\DRVSTORE\netuserif_0EA53CCA9B63BE687310154DB5F8CCB106847450\vmnetuserif.cat MsiExec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\SET1474.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\vmnetbridge.cat DrvInst.exe File created C:\Windows\system32\perfc00A.dat MsiExec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MsiExec.exe File created C:\Windows\system32\vnetlib.dll MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_8074ac14f1ab2957\netpacer.PNF MsiExec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{e726d719-ec80-7749-9ada-157c23824e07}\SETD23.tmp DrvInst.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\system32\DRVSTORE\hcmon_CFDFE770B24985C34CBB82FD13BA00B1136C614E\hcmon.sys MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_d34968d7b3e6da21\ndiscap.PNF MsiExec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\SET1474.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netbridge.inf_amd64_1c40c369eff72dc1\vmnetbridge.sys DrvInst.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\perfc009.dat MsiExec.exe File created C:\Windows\system32\DRVSTORE\hcmon_CFDFE770B24985C34CBB82FD13BA00B1136C614E\hcmon.inf MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\SET1475.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\vmnetbridge.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\SET1477.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\vmnet.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e726d719-ec80-7749-9ada-157c23824e07}\vmusb.cat DrvInst.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File created C:\Windows\system32\perfh007.dat MsiExec.exe File created C:\Windows\System32\vmsrchTemp.txt MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vmusb.inf_amd64_e4985be9ea2d2d2d\vmusb.inf DrvInst.exe File opened for modification C:\Windows\system32\vmnetbridge.dll MsiExec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\SET1487.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_882899f2b1006416\netvwififlt.PNF MsiExec.exe File created C:\Windows\system32\DRVSTORE\netuserif_0EA53CCA9B63BE687310154DB5F8CCB106847450\netuserif.inf MsiExec.exe File created C:\Windows\system32\DRVSTORE\netuserif_0EA53CCA9B63BE687310154DB5F8CCB106847450\vmnet.sys MsiExec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VMware\VMware Workstation\x64\vmware-vmx-stats.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmPerfmon.ini msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\icudt60.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\VMnetDHCP.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\x64\vmware-vmx.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmwarestring.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\Resources\pvscsi_Windows8.flp msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmware-vdiskmanager.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw22-config-option.xml msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw4-config-option.xml msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\en\stask.vmsg msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8\vmciver.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\x64\icudt44l.dat msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\googleurl.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\vim-types.dll msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8\vmci.inf msiexec.exe File created C:\Program Files\VMware\VMware Workstation\x64\PXE-VMXNET.ROM msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmappcfg.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmnetuserif.cat msiexec.exe File created C:\Program Files\VMware\VMware Workstation\EULA.fr.rtf msiexec.exe File created C:\Program Files\VMware\VMware Workstation\ico\generic.ico msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmware.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\en\auth.vmsg msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw3-config-option.xml msiexec.exe File created C:\Program Files\VMware\VMware Workstation\x64\PXE-VMXNET3.ROM msiexec.exe File created C:\Program Files\VMware\VMware Workstation\ico\snapshot.ico msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmware-kvm.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw13-config-option.xml msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw8-config-option.xml msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmci\sockets\include\vmci_sockets.h msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmci\sockets\Win8\vsockver.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmclientcore.dll msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8\vmusbver.dll msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmci\sockets\Win8\vsock.sys msiexec.exe File created C:\Program Files\VMware\VMware Workstation\libcds.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\Resources\shared.lnk msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\en\evc.vmsg msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw10-config-option.xml msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw14-config-option.xml msiexec.exe File created C:\Program Files\VMware\VMware Workstation\messages\fr\vmui-fr.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\x64\mksSandbox-stats.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\vmomi.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\x64\vmware-vmx-debug.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\ovftool_open_source_licenses.txt msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmci\sockets\Win8\vsocklib_x64.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\Resources\storePwd.ini msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmappsdk.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\icudt44l.dat msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmx86\Win8\vmx86.sys msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\hcmon\Win7\hcmon.inf msiexec.exe File created C:\Program Files\VMware\VMware Workstation\x64\VGA.ROM msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmnetadapter.cat msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vix.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\en\cluster.vmsg msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\env\en\perf.vmsg msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\vmware.eula msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmauthd.dll msiexec.exe File opened for modification C:\Program Files\VMware\VMware Workstation\vmwarebase.dll msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8\vmusb.inf msiexec.exe File created C:\Program Files\Common Files\VMware\Drivers\vmci\device\vmciver.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\7za.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\vmware-tray.exe msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\icuuc60.dll msiexec.exe File created C:\Program Files\VMware\VMware Workstation\OVFTool\libcurl.dll msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\inf\VMware\vmPerfmon.h MsiExec.exe File created C:\Windows\INF\oem3.PNF MsiExec.exe File opened for modification C:\Windows\Installer\MSIE6A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEF15.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8C7.tmp msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIE00B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95F0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE686.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEEC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF1BA.tmp msiexec.exe File created C:\Windows\Installer\{86B6E794-CF20-4939-A2B4-1CD53C370315}\_generic.ico msiexec.exe File opened for modification C:\Windows\Installer\{86B6E794-CF20-4939-A2B4-1CD53C370315}\_generic.ico msiexec.exe File opened for modification C:\Windows\inf\VMware\vmPerfmon.ini MsiExec.exe File opened for modification C:\Windows\Installer\e598c90.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF6ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B6.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem4.PNF MsiExec.exe File created C:\Windows\SystemTemp\~DF0D53E1DCAB0C31B6.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI633.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI917.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF0C14F307AAC187A.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{560D2DA4-096E-4868-B22A-DA6418FDE6FB} msiexec.exe File created C:\Windows\Installer\e598c8f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1428.tmp msiexec.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\Installer\e598c67.msi msiexec.exe File created C:\Windows\SystemTemp\~DF1B62F36AEFA0CCD7.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF1EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3C1.tmp msiexec.exe File created C:\Windows\INF\oem0.PNF MsiExec.exe File created C:\Windows\INF\oem1.PNF MsiExec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\MSIE97.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9022.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE451.tmp msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\SystemTemp\~DFEE24577EF2883A87.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF011.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI906.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE96.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF179FED5F5A6023D5.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{5904914B-9FC8-44C2-AE48-5C7F30A603EC} msiexec.exe File opened for modification C:\Windows\Installer\MSIEF45.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF17B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF8B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\e598c67.msi msiexec.exe File created C:\Windows\SystemTemp\~DFE8CFDD0CE0806870.TMP msiexec.exe File opened for modification C:\Windows\Installer\e598c7a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDFAC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE50E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI848.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF07.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF5E2D673FD096D8B2.TMP msiexec.exe File created C:\Windows\Installer\e598c79.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI941A.tmp msiexec.exe File created C:\Windows\inf\VMware\vmPerfmon.h MsiExec.exe File created C:\Windows\SystemTemp\~DFEA4BF89DF5DA3C59.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6056 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idman643build10.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDM1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe - Checks SCSI registry key(s) 3 TTPs 59 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 MsiExec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b7671573c6f2ce060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b76715730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900b7671573000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ab7671573000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db7671573000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 MsiExec.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Delays execution with timeout.exe 11 IoCs
pid Process 5668 timeout.exe 5792 timeout.exe 5228 timeout.exe 3844 timeout.exe 4540 timeout.exe 5188 timeout.exe 1588 timeout.exe 1048 timeout.exe 1900 timeout.exe 5596 timeout.exe 4888 timeout.exe - Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 228 net.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BC1F4B6F-13AB-4239-8C79-D6DCADC52BAA}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DFC76A6B-4873-458C-AB00-40B1FC028001} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DFC76A6B-4873-458C-AB00-40B1FC028001}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{420F0000-71EB-4757-B979-418F039FC1F9} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{420F0000-71EB-4757-B979-418F039FC1F9}\Compatibility Flags = "1024" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BC1F4B6F-13AB-4239-8C79-D6DCADC52BAA} msiexec.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\DeskTop MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" DrvInst.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\VMware.Snapshot\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\VC_Runtime_Minimum msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.VirtualDisk\DefaultIcon\ = "C:\\Program Files\\VMware\\VMware Workstation\\ico\\vd.ico,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16A76DDB-46C2-4AB4-9A74-755B80DDEB4E}\1.0\ = "VMware net 1.0 Type Library" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16A76DDB-46C2-4AB4-9A74-755B80DDEB4E}\1.0\0 MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\PackageCode = "5E78E5602FA7A974088E3902313D8AF2" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\B41940958CF92C44EA84C5F7036A30CE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9} VC_redist.x64.exe Key created \REGISTRY\MACHINE\Software\Classes\VMware.VMTeamMember\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.vmsn\VMware.Snapshot msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vmrc\shell\open\command\ = "\"C:\\Program Files\\VMware\\VMware Workstation\\vmware.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.Document\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vmtm\OpenWithList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VMware.VirtualDisk msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VMware.SuspendState msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3d09c1ca-2bcc-40b7-b9bb-3f3ec143a87b}\InProcServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vm\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VMware.Document\shell\Open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vmsd\VMware.SnapshotMetadata\ShellNew msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ovf\ = "VMware.OVFPackage" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{560D2DA4-096E-4868-B22A-DA6418FDE6FB}v14.40.33816\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.OVAPackage msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.TeamConfiguration\DefaultIcon\ = "C:\\Program Files\\VMware\\VMware Workstation\\ico\\generic.ico,0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vmss msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33816" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\PackageName = "vc_runtimeAdditional_x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.OVFPackage\shell\Open\ = "Open with VMware Workstation" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.TeamConfiguration\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ova\OpenWithList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\Provider msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\vmrc\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.VMTeamMember\ = "VMware Team Member" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Version = "14.40.33816.0" VC_redist.x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.Document\shell\Open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VMware.Document\shell\Open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.VMBios\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.VMPolicy\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.SnapshotMetadata\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.TeamConfiguration\shell\Open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{5904914B-9FC8-44C2-AE48-5C7F30A603EC}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VMware.OVFPackage\shell\Open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.vmss\VMware.SuspendState msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vmdk\ = "VMware.VirtualDisk" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.Document\DefaultIcon\ = "C:\\Program Files\\VMware\\VMware Workstation\\ico\\config.ico,0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ovf msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ovf msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.vmpl msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.vmx\VMware.Document msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ovf\VMware.OVFPackage\ShellNew msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3d09c1ca-2bcc-40b7-b9bb-3f3ec143a87b}\InProcServer32\ = "C:\\Windows\\System32\\vmnetbridge.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vmrc\DefaultIcon\ = "\"C:\\Program Files\\VMware\\VMware Workstation\\vmware.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VMware.VMBios\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VMware.OVFPackage msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VMware.SnapshotMetadata\shell\Open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{77169412-f642-45e7-b533-0c6f48de12f9}" VC_redist.x64.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3984 msiexec.exe 3984 msiexec.exe 3984 msiexec.exe 3984 msiexec.exe 3984 msiexec.exe 3984 msiexec.exe 3984 msiexec.exe 3984 msiexec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 820 MsiExec.exe 4344 vmware-usbarbitrator64.exe 4344 vmware-usbarbitrator64.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 5612 vssvc.exe Token: SeRestorePrivilege 5612 vssvc.exe Token: SeAuditPrivilege 5612 vssvc.exe Token: SeShutdownPrivilege 3284 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 3284 VC_redist.x64.exe Token: SeSecurityPrivilege 3984 msiexec.exe Token: SeCreateTokenPrivilege 3284 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 3284 VC_redist.x64.exe Token: SeLockMemoryPrivilege 3284 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 3284 VC_redist.x64.exe Token: SeMachineAccountPrivilege 3284 VC_redist.x64.exe Token: SeTcbPrivilege 3284 VC_redist.x64.exe Token: SeSecurityPrivilege 3284 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 3284 VC_redist.x64.exe Token: SeLoadDriverPrivilege 3284 VC_redist.x64.exe Token: SeSystemProfilePrivilege 3284 VC_redist.x64.exe Token: SeSystemtimePrivilege 3284 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 3284 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 3284 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 3284 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 3284 VC_redist.x64.exe Token: SeBackupPrivilege 3284 VC_redist.x64.exe Token: SeRestorePrivilege 3284 VC_redist.x64.exe Token: SeShutdownPrivilege 3284 VC_redist.x64.exe Token: SeDebugPrivilege 3284 VC_redist.x64.exe Token: SeAuditPrivilege 3284 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 3284 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 3284 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 3284 VC_redist.x64.exe Token: SeUndockPrivilege 3284 VC_redist.x64.exe Token: SeSyncAgentPrivilege 3284 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 3284 VC_redist.x64.exe Token: SeManageVolumePrivilege 3284 VC_redist.x64.exe Token: SeImpersonatePrivilege 3284 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 3284 VC_redist.x64.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeBackupPrivilege 3004 srtasks.exe Token: SeRestorePrivilege 3004 srtasks.exe Token: SeSecurityPrivilege 3004 srtasks.exe Token: SeTakeOwnershipPrivilege 3004 srtasks.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3128 vmware-tray.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3128 vmware-tray.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 6056 wrote to memory of 2344 6056 cmd.exe 81 PID 6056 wrote to memory of 3516 6056 cmd.exe 82 PID 6056 wrote to memory of 8 6056 cmd.exe 83 PID 6056 wrote to memory of 1028 6056 cmd.exe 84 PID 6056 wrote to memory of 5668 6056 cmd.exe 85 PID 6056 wrote to memory of 4604 6056 cmd.exe 86 PID 6056 wrote to memory of 5792 6056 cmd.exe 87 PID 6056 wrote to memory of 5684 6056 cmd.exe 88 PID 6056 wrote to memory of 1048 6056 cmd.exe 89 PID 6056 wrote to memory of 4120 6056 cmd.exe 90 PID 4120 wrote to memory of 3604 4120 idman643build10.exe 91 PID 6056 wrote to memory of 5228 6056 cmd.exe 92 PID 6056 wrote to memory of 1168 6056 cmd.exe 93 PID 6056 wrote to memory of 1900 6056 cmd.exe 94 PID 6056 wrote to memory of 4036 6056 cmd.exe 95 PID 4036 wrote to memory of 1412 4036 VMwareInstaller.exe 96 PID 1412 wrote to memory of 4244 1412 vcredist_x64.exe 97 PID 4244 wrote to memory of 3284 4244 vcredist_x64.exe 98 PID 1464 wrote to memory of 788 1464 VC_redist.x64.exe 108 PID 788 wrote to memory of 3112 788 VC_redist.x64.exe 109 PID 3284 wrote to memory of 972 3284 VC_redist.x64.exe 110 PID 972 wrote to memory of 5364 972 VC_redist.x64.exe 111 PID 5364 wrote to memory of 5436 5364 VC_redist.x64.exe 112 PID 3112 wrote to memory of 852 3112 VC_redist.x64.exe 113 PID 3984 wrote to memory of 820 3984 msiexec.exe 115 PID 3984 wrote to memory of 5300 3984 msiexec.exe 117 PID 3984 wrote to memory of 4056 3984 msiexec.exe 118 PID 3984 wrote to memory of 3156 3984 msiexec.exe 119 PID 5712 wrote to memory of 5584 5712 svchost.exe 128 PID 5712 wrote to memory of 5888 5712 svchost.exe 133 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Patcher.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\system32\schtasks.exeschtasks /delete /tn "Activate-Windows-And-Office-Monthly" /f2⤵PID:2344
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn "Wipe-Recycle-Bin-And-Trim-Monthly" /f2⤵PID:3516
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn "Reset-IDM-Trial-Monthly" /f2⤵PID:8
-
-
C:\Windows\system32\curl.execurl -L -o "C:\Users\Admin/iso/darwinPre15.iso" "https://raw.githubusercontent.com/ExtremePlanes616/Windows-To-Go-And-VMware-Patcher/refs/heads/main/darwinPre15.iso2⤵PID:1028
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5668
-
-
C:\Windows\system32\curl.execurl -L -o "C:\Users\Admin/iso/darwin.iso" "https://raw.githubusercontent.com/ExtremePlanes616/Windows-To-Go-And-VMware-Patcher/refs/heads/main/darwin.iso2⤵PID:4604
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5792
-
-
C:\Windows\system32\curl.execurl -L -o "C:\Users\Admin\AppData\Local\Temp\/idman643build10.exe" "https://raw.githubusercontent.com/ExtremePlanes616/Windows-To-Go-And-VMware-Patcher/refs/heads/main/idman643build10.exe"2⤵
- Downloads MZ/PE file
PID:5684
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1048
-
-
C:\Users\Admin\AppData\Local\Temp\idman643build10.exeC:\Users\Admin\AppData\Local\Temp\/idman643build10.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 52⤵
- Delays execution with timeout.exe
PID:5228
-
-
C:\Windows\system32\curl.execurl -L -o "C:\Users\Admin\AppData\Local\Temp\/VMwareInstaller.exe" "https://github.com/201853910/VMwareWorkstation/releases/download/26H1/VMware-Workstation-Full-26H1-25388281.exe"2⤵
- Downloads MZ/PE file
PID:1168
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1900
-
-
C:\Users\Admin\AppData\Local\Temp\VMwareInstaller.exeC:\Users\Admin\AppData\Local\Temp\/VMwareInstaller.exe /s /v"/qn EULAS_AGREED=1 REBOOT=ReallySuppress DATACOLLECTION=0"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{95BD3712-DF47-40AD-88C0-1DE55BA6B312}~setup\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{95BD3712-DF47-40AD-88C0-1DE55BA6B312}~setup\vcredist_x64.exe" /Q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\Temp\{1206950F-4A8F-4328-9AE4-78A51D79F647}\.cr\vcredist_x64.exe"C:\Windows\Temp\{1206950F-4A8F-4328-9AE4-78A51D79F647}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{95BD3712-DF47-40AD-88C0-1DE55BA6B312}~setup\vcredist_x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /Q /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\Temp\{210BA98D-8C3D-4BD5-9FA4-6941BBB19D55}\.be\VC_redist.x64.exe"C:\Windows\Temp\{210BA98D-8C3D-4BD5-9FA4-6941BBB19D55}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9DB1F877-CE92-4E84-9883-2E8ADF1EC9C8} {606583D1-4AF8-48E7-B35E-3CACA39E4629} 42445⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=560 -burn.embedded BurnPipe.{B3BE5D65-94C0-46A0-A85B-D754FDD53510} {728C75E6-463B-4769-962E-D841AE79B6CB} 32846⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=560 -burn.embedded BurnPipe.{B3BE5D65-94C0-46A0-A85B-D754FDD53510} {728C75E6-463B-4769-962E-D841AE79B6CB} 32847⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F17C2CA0-B7E7-48CC-91F6-2126F2A91015} {FF5FB7A1-5A8F-434B-B00C-D22BCB61D93C} 53648⤵
- System Location Discovery: System Language Discovery
PID:5436
-
-
-
-
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3844
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\USBXHCI" /v Start /t REG_DWORD /d 0 /f2⤵PID:4268
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5596
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\uaspstor" /v Start /t REG_DWORD /d 0 /f2⤵PID:3008
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4540
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 0 /f2⤵PID:3964
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5188
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\stornvme" /v Start /t REG_DWORD /d 0 /f2⤵PID:6096
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4888
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control" /v PortableOperatingSystem /t REG_DWORD /d 1 /f2⤵PID:5920
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1588
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5612
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding AD39F75BE89EE4DE9B78AA1BA00DC80F2⤵
- Looks for VMWare services registry key.
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:820 -
C:\Windows\System32\net.exenet start VMAuthdService3⤵PID:2544
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start VMAuthdService4⤵PID:4824
-
-
-
C:\Windows\System32\net.exenet start vmware-view-usbd3⤵
- Discovers systems in the same network
PID:228 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start vmware-view-usbd4⤵PID:1216
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 87042D3C299E953846A725B95AD45D012⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5300
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 60CFEC2EAA46D39DEEDDC397942ADCA2 E Global\MSI00002⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4056
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2844B1BE73468B1B46475EC6E8CBF644 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3156
-
-
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260907104140.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:788 -
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260907104140.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2D14CE9A-83FC-4959-91F4-248279DB3D55} {24F0F09A-B482-487E-9A0D-5BB6962F5E95} 31124⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:852
-
-
-
-
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3128
-
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe"C:\Program Files\VMware\VMware Workstation\vmware-authd.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504
-
C:\Program Files\VMware\VMware Workstation\vmware-autostart.exe"C:\Program Files\VMware\VMware Workstation\vmware-autostart.exe"1⤵
- Executes dropped EXE
PID:2000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8\vmusb.inf" "9" "454492f13" "0000000000000150" "WinSta0\Default" "0000000000000154" "208" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5584
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\VMware\VMware Workstation\netbridge.inf" "9" "43e921417" "0000000000000164" "WinSta0\Default" "00000000000000BC" "208" "C:\Program Files\VMware\VMware Workstation"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5888
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\VMware\VMware Workstation\netadapter.inf" "9" "424b22b1f" "00000000000000BC" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files\VMware\VMware Workstation"2⤵PID:5404
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\VMWARE\0000" "C:\Windows\INF\oem5.inf" "oem5.inf:fc9f1aa2477c2bb3:VMnetAdapter1.Install:25.0.0.1:*vmnetadapter1," "4cbdd083b" "000000000000017C" "6a85"2⤵PID:2544
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\VMWARE\0001" "C:\Windows\INF\oem5.inf" "oem5.inf:fc9f1aa2df34f6ba:VMnetAdapter8.Install:25.0.0.1:*vmnetadapter8," "47eb20b4f" "00000000000000BC" "6a85"2⤵PID:5488
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8\vmci.inf" "9" "4d941d7e3" "0000000000000174" "WinSta0\Default" "0000000000000188" "208" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8"2⤵PID:2256
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\VMWVMCIHOSTDEV\0000" "C:\Windows\INF\oem6.inf" "oem6.inf:3c66b0ea390d9e8f:vmci.install.x64:9.8.30.0:root\vmwvmcihostdev," "42936a687" "000000000000018C" "6a85"2⤵PID:5384
-
-
C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
C:\Windows\system32\vmnat.exeC:\Windows\system32\vmnat.exe1⤵
- Executes dropped EXE
PID:4276
-
C:\Windows\system32\vmnetdhcp.exeC:\Windows\system32\vmnetdhcp.exe1⤵PID:4064
-
\??\c:\windows\system32\NetCfgNotifyObjectHost.exec:\windows\system32\NetCfgNotifyObjectHost.exe {0DCBA19F-5337-439B-932A-02E53A8AAA74} 5481⤵PID:3956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:3872
-
\??\c:\windows\system32\NetCfgNotifyObjectHost.exec:\windows\system32\NetCfgNotifyObjectHost.exe {374DD16C-82E1-4194-B617-58C80802A637} 7721⤵PID:3040
-
\??\c:\windows\system32\NetCfgNotifyObjectHost.exec:\windows\system32\NetCfgNotifyObjectHost.exe {17378EFC-48BD-4BB1-8C00-9BD945540359} 4921⤵PID:5808
-
\??\c:\windows\system32\NetCfgNotifyObjectHost.exec:\windows\system32\NetCfgNotifyObjectHost.exe {29594EEB-6564-49DC-92F6-50EBB5577296} 5761⤵PID:4344
-
C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"1⤵PID:5156
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e598c6c.rbs
- Size 19KB
- SHA256 44edeaef657b2481383e24c6bcd80d2895a61234063e3d7e2742e6f346db0d14
- MD5 6a792edbe306f7efde387c60cbe2160f
- SHA1 1ee61ead7da4bdd70d8b553e17cf6462a2207bda
- SHA512 3d09a03269c91d80dcd1389af9e7d646f8f0c9df2451a04b30ef9b5537b7d6e81c439d5133ebaf68515e083c5e610ea5ebe4d85237acdebc5f43348e67c1e14f
- SSDEEP 192:opRV1kR115dXcFUADIc1f+W+y4+ogPpD7:opRV6R1TeC81f/cWD7
- TLSH T1DD92FC427684C9D2D8766B30CD671B653B76DBD5A350838B50DC90308F93BCA2F9DA8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e598c78.rbs
- Size 19KB
- SHA256 3fde3bf41efc2a74dba371c27294f2e4d9cd3521bcdd13977e7aeabd3555b546
- MD5 a015bc021f7bc301652127ce0798ef1e
- SHA1 03850cbce7f6794b27d725ba950995775abb3062
- SHA512 b701e3c7c8c7d18cedc5d6cbbe25d614b978dacaff00ba9d6d3e571c59dc3a188e5a255df191b1829dbd4cc05ad0981bc2618e9881687530ef2494ca490a33ac
- SSDEEP 192:ocXsiX1XMcXMEXMdXMHXMNXM6XM+YXMXXMJXMyXMnXMMXMPXM7XMhXcXlX2YXV6V:o7Xv28mpaMSxcHUQpjmRmjL
- TLSH T12C92FC02AA44C6D3D8A62F30DD571F2A3775D3EA9760935B01DDD1308F837C66E8D68A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e598c7f.rbs
- Size 21KB
- SHA256 a6b387ad2971258b6c62e8b06bc541ae8dc9c83c451b856a24f02377aefee7b1
- MD5 9ab3fe04e854e08f369adbeb1dc4ea1c
- SHA1 8924a3d2ad66b00a5056810b4a91cbb920883319
- SHA512 46cf8c98222b0ac0559bcce1bdf93196d1520212ab7ca6ee2dbc74544953f30be0cd37cb7dd2a9485fd888abd4672a03938dc6b62dd3cc6a5c1fdcf15faa6273
- SSDEEP 384:oUR3GR0nAKxNAUhUC7xJjrMNYPzIbSfGm+ts0jsrgZ7kP:oI2sAKhkm9
- TLSH T194A20C03768099E3C86227B1DD671BA93B73D6D99750434B10ACD1388F633C72E5AA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e598c8e.rbs
- Size 21KB
- SHA256 c0d70551011b8094d3241c2eac271472741153d40b39baf5c50921371ee5ff8b
- MD5 301e7b49598228fc356b1532a385d6f0
- SHA1 8b556393f7f89671524f63385146ad7fcbe82f4a
- SHA512 4ad37e91d1be09370a94d5e72b710eec645617a007a5575d89d41396a14ae7335043718fb4066e49a849a8e9926e40cfb4758dd62559e6953965c12fdc29f206
- SSDEEP 384:rUrQoNFcB1np12gju4aD92salckU72eC6Ab/9LqLJoV4Nn5:rUrQoNFcB1np12gSLD9AbletoVUn5
- TLSH T11DA2FF01AA44D593D8A62B70CD5747A537B6D3D9D7A1838B12CDC2304F933C71FAEA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e598c93.rbs
- Size 16.5MB
- SHA256 bf2bed4838c7139ffef9444f6565a93b694d598ff6bf5206897fa8fcbe11def7
- MD5 7b413cf08935c1a5349e1f9e9dd31007
- SHA1 6a26c5aa4b3e5783d91c3cbb76ccd38435abff2f
- SHA512 27c65cdcb96e1f7c7d7fc6f6a88f308e520ec01358e7f9be9704adcd3d6c044a32fe9b3e73915720cf8bb29eb7d7877235d3b898d2b66e4549695ba2053b21f6
- SSDEEP 196608:S5vBJlszpYkSRZkSR25vBJlszpRkSRa5vBJlszpu5vBJlszpR:SWzpONWWzplaWzpOWzpR
- TLSH T160078C46B6AD40A5D8B6E13DC917460BE7B27C11433087CF02A45A6FAF3F7E14A3A725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw9-config-option.xml
- Size 865KB
- SHA256 1aac0a50b13dfee95f3c26dda367b92068254dc523236bf99400718c71987013
- MD5 6e742f048bd8635589553f456ac00968
- SHA1 9e0acf712c2e7a81a4f5f66d1e8fccb82e189b47
- SHA512 540fcdb173f7f8c50ebfc3faaeb2df4d1411b64a8607c827374da11e2b2cf574d853a7a2d484f4258321bcc6ccbc851afaa7f8d33b8c21ddabcca492b3da02cd
- SSDEEP 6144:ENvNHNlNPNTNCNfN5NvNuN4NuNeNvNcNVNvNcNtNNNwNFNUNjNONwNrNhN0N9N5W:x
- TLSH T14315CE3854FAB55414F65086EF001D8EED2A11D78688A28E30DF1BD74FB6EC294DB26F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VMware\VMware Workstation\vmware.exe
- Size 2.1MB
- SHA256 47ebf04b0d1cb8273794ec9e6d77a85e978d4c12f4f31024b4f41f3a842721ae
- MD5 819f8e0b4b7c5b444b2bebb19004d646
- SHA1 1e639d4d1d283c5c2046b97fc1af58eaa3f0ccd9
- SHA512 f72a88d7a23f0c1fb6c06a623236b96dbc60da4baaab51170086ab3e55723c357a92cae5f91bd2f67144943cb3502748bee9f69e14f5e97e1003e04f6a120a47
- SSDEEP 49152:SwxjwzTA2WJoon4PD+4eMb2/siTmc/HLP+ST+:AQJAcj2
- TLSH T140A53AD6AE6C41E1C27DC2BDC16FC926E57334A047714AC7A9164E2A6F1F6F28E3C910
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VMware\VMware Workstation\vmwarebase.dll
- Size 7.5MB
- SHA256 f0bea99a43516a5e2b0573ea76e00e11a39b637486530949c134b5b91b95454b
- MD5 7b49dc90f3afb488bdf5f0aa439ace18
- SHA1 861f911d296cdea0e18bb4006ce8c86e4458a57d
- SHA512 29f7e5b8db99aeb4bcd34effd3ea96a5d8cd8aa44d4a48f33f0792b003eb510d86f043866163b35be5ded7fc329f10584ca4e2e59dca3029f54fc71d8fdc2be3
- SSDEEP 196608:/a/BGRO8aa5y1RqSmKMBw1VUQ0UwoJ3yTg+m/wPoE+U+iYzEnodP4CuuRbpxNrk+:i/kRO8aa5y1RqSmKMBw1VUywoJ3yTg+u
- TLSH T1F7868D56A3A51069C2A7C279C6474223EFF1B85113709BDB44A1C66D2F3B7E6A33FB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VMware\VMware Workstation\x64\icudt44l.dat
- Size 9.2MB
- SHA256 7e1fc96fcc98cb8f0cb44cfa94b40549a40bd0f9968c3c1141631aa0af95a1fe
- MD5 58cccfc4824ce98be253981d1087740e
- SHA1 69ff1822448fc25f56298890eeea62e974f44da9
- SHA512 eff1ca414672758fa1bcfc3ff2d69bcf0bdbb4bb8e94442c1e9108d5b11203b355409de9af3f6ce943a693e7198329afebde2b0862959fd48ac674c341e49429
- SSDEEP 196608:C+nBa+8oim+nba+8oitKn+nt1a+8oiMqMEjX8C:l8JD8JN8JMqLjl
- TLSH T16FA6E716DEFAC949FDF39A30B9F6A152B567FD076D34CC495110230B786E5A089A0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation Pro.lnk
- Size 1KB
- SHA256 4783dd7b733e86e8470b7353cbbda7cd8d3308c657a0b7d7cbdd542c990cebdd
- MD5 085e7a3a69ab68cd58b0c342dee19166
- SHA1 80e768f823353e9d1c2ea69f34b5aa9fb7a89854
- SHA512 6bea956178da469cd6ae6ba38658497f9f87ce9ed219623b03ca817f5cf4e7517183ad1cee346b8832bd821773c10608991368bf0e0ebbbcd936444feef9e095
- TLSH T18421C9012BEF0761F1FB1A356EA26235437BBC05EA7AD72D41C4918C29BA20465FCF93
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation Pro.lnk~RFe5a0570.TMP
- Size 1KB
- SHA256 c2f16840845450648f97cf90e7d9aa74444838104734cb0796e6da872fb33b02
- MD5 accab458c5e7acc3462a977f108e1322
- SHA1 b136066921a9f1b974a8366925042bb462f60288
- SHA512 d4270a020ec808414b7663ca37e8bebfb59484e901699af2d214a33803a57f2b61fc4cddff950854a1489905555359a684f596db6a12b6a1b1c140952ec63635
- TLSH T16C21BD052BDB0771F1FB1A356EA26334477BBC04DA7ADB2D40C4958829B920565F8F93
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\state.rsm
- Size 1KB
- SHA256 bb3c5b70a3d798cba337e2d0a1ef3b8de3a8ba034644c3b1e7116913529d92f8
- MD5 a991c1caa7053588395ae805fe1efeab
- SHA1 52d7aed4bc3ee2f5131a8505440ffa8cbbbd008f
- SHA512 48ad51fcfc2b02e3a6ccffbf0c9ea1a22abdc33daf6ab26a459b41132dd76ad1fd316b74c7d8ab3018d24179634aae8dda704bba7ee9eceb1e83e18737fc03a5
- TLSH T1FD21EC645FFD1026F3BBE6706BF50525797DB82319118C3E0482224A4F32D419998F6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
- Size 1KB
- SHA256 87651ff247f3aa5be64d8470aeba7d6c2208e7a710f638868ab13166bc1d5469
- MD5 ad65ed072f3e6c68ee0bed2e7f0034aa
- SHA1 7f1ae6aeaeadca99b66def439d0300be02c9efa0
- SHA512 6e1d69339b2dfbf8727905ccedac1ae7ab27b38d47f05a178307c676f2b7b79ae0732da8a994100c46d6fe137a7cc71776597660a8de0e0995e54aeb16df0818
- TLSH T190112007051477639A496E31ED8ADC279EF2A38681D1E817C30089822962EC82FC80FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
- Size 727B
- SHA256 5cf1ddfc0ea9a6a8bbd7677fbb0433943ad677897b1540ae35bb06105971992b
- MD5 a849394ac2669c63b4bb7138d0ed660a
- SHA1 e4fd0453994bb1881729ddc255770f1a3c40de22
- SHA512 b654f3a509efbdb9b2134159253454f2fad16f925f0092bd91cdb4acbed4863e5aba0536f6e363ea800d1d809b4820380b65072c1ba728975ff75718bb2e82f5
- TLSH T1800188737535696859561F0A4DD4C6757D0B52A130DEB07F947F00CAF3EA7E27101131
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 c9d9f96d5a4a01d9f2355757c867fc294d19e973bf546f36d5db9d9d911718fb
- MD5 7385601cedf672ac3aa73e98b57e62e1
- SHA1 1a4e4e3da02fb6fe6c11b2f57b0ad7a0a501d54c
- SHA512 2e8ce29849fad82f90c8ae57f0ce1e4751cef82c778f504e381e420756a8be95a23ff78adaca4e6ac5a5e54b01c7fc6329884d161ef5b1e276dc3b6878b20ea9
- TLSH T1CB01654A1DB89A41B940188B8F5CB9F8307BF87D2C9B07CB14D71CDF1158B99C003815
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
- Size 252B
- SHA256 138b5d83ac3c72aee0e7dafbd519ed72b54862e13f103e4346e4b0887d65c6ed
- MD5 046ce08eb6a02a70dcd0d4c22129d4dc
- SHA1 d62d3af4c0de3b3e63c940f9795f8a9a6152aa95
- SHA512 d8401f0eabbfe24df096523aa319283bba92f50dbf49614a0080f13578c30cd516271b2153048b79c9dc1e0eeb8e1d2b8aa54cf75a6268a3199eac5bb11bbc3a
- TLSH T126D0C920A7F94311F166597B9FA18182EB24BA2AD8479B190BB2494F183AF914831B4A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
- Size 408B
- SHA256 51a1d337069a3408fc4bd63bc431073cca9f3b8d6efc68fc42dabb28572bc991
- MD5 52663cc680bfa6125c2d211aced0eaf4
- SHA1 78d7f3f7db1c6b6c263033895047e3142309977f
- SHA512 397c2d0ea29a29ac187e697ea917f512c1e1c66d8cfed2489bfbe57a1de08439ff93c32744d59a6247397c06c5a9830140b7e93027ac3dc0cad6fc9b880b373e
- TLSH T161E0C03431FC4109F4E0E43803F69D1248D9F28B054286B90A90670AB514B00DCF5130
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 7a7b6b73e887db86968759cf53f5569e1d027239798a502ce2f4e170a0adee10
- MD5 6ca03ea5db573ffa7b05d9a111df3213
- SHA1 88c9f3e4cfdcc2dc0df50087de4fbedd1294c94c
- SHA512 1d589db42a0c0e8cfee3e3975f7a52e47d4f691b0ec73869901bfb307a25f985c4eeb8acb32869697b6bd9889ddf6c5ad1186e100789dce09d4ede5d2f3021c2
- TLSH T1EFE0C62C22EBA94EF090CC3546FAE0764D8DF30A140087B91AC1430CBB0BF406E20EF4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
- Size 163KB
- SHA256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
- MD5 3334432be5087a844002849fe340c9fc
- SHA1 29b5af4c994b3d0725fecb687dd5a4b28c58ae7d
- SHA512 413deeff8340b992e83d7774a6ab3706587a5fa68aed703ecbdd906b6f4effee0d69acfe82d2bb97ddb9d245847ded41d108b6c44f7117e8414a4184e7ef7435
- SSDEEP 3072:1ZyDE5GQIB/xlMyLClgQmQW1t77ou+HHVnApsTdqYCL:Dr5GQIBp6R01tsnVnApuI
- TLSH T184F3F60573E88516F6B60B70FE748AB1993AFC70DD21948FA394BE0F7970A41D928727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260907104140.log
- Size 19KB
- SHA256 90b0b76c46280f927fd4f8df9721c7ccee59ac6d04c857d432195372c9f519a4
- MD5 1c29d450251bf62384e530760fafa248
- SHA1 d4e5aaff9a1782314a6c7d7a3e6701b1544cb7ab
- SHA512 870feb875a8d0b4f628cd579ae992fef4ae3c213e246fd73d0dd90ab44ca15f65a8d617e2e339618edecd7f4cc7de66e24b8fd5d63d71d4695c8e79ba75c6648
- SSDEEP 192:tleg5DYjnH1z151e1u191D1A1CFMS41Lo+dtXTjNjHXKXvXyDf8uKrI72IOXcub7:tleg5DmbFMS415lheEN72IOXtbjd/t
- TLSH T1C99243027AA8F1323884A6BAE5694F949E16B76C2FC045F477360F58021FC5FEF6B584
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260907104140_000_vcRuntimeMinimum_x64.log
- Size 2KB
- SHA256 ee616b14f8f78ea3af54c4998f6fbbf1fdde02cd3b7ae104ba6e975977915a35
- MD5 ef628e768a21a366f28acdf194fbdaa7
- SHA1 5978ff6b8c7b3330f82c0cfe4758468d76f16f52
- SHA512 98424ad60f4fd783cae7c669fce5e8aec7083788944ac1d274d472c62a29c5d75aa18e03381fab6836f507432b897fa63522b7532d0d0c33375ab2f46d2dad54
- TLSH T15D410B541AD90857B2B657579FF3C0219B33FCD268349B4C2389821A42ABD05ADBC7AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260907104140_001_vcRuntimeAdditional_x64.log
- Size 2KB
- SHA256 264cbca363f5ff138da0e1c2188b7d6951969f28c655a23de028388957f6c0f5
- MD5 a12f5d99219a9175bf60092fd2ecc545
- SHA1 f3422a27ba9b44a09b2bb13f493a7d7e71fb72a0
- SHA512 c64960bf74828ecd130ad01bff5cee45877b9973fd9181013fa73886d7287e490c7f88a00a4e82d0310dba18335041cf27d8854835b59fb94e6ee6e9923349df
- TLSH T1BD41D4551AEC0846B2F75747AFF3C0629A33FDD169388B4C2345831A067BD04987DBAE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\idman643build10.exe
- Size 12.0MB
- SHA256 a79c0e275750bd9b15f83f1b2d71f4a09eed11a9d903e534448b322db2ed392b
- MD5 f3b070d8ac98453d84a52a27d4c1342c
- SHA1 4da7c0210028205cc0b81325ba2f110a308860db
- SHA512 421cba8692bbee15a382a22eb1d9f5397a43965e1df7b9674d43f2d69fc89f4f86807958fb2efeba83537874597b6065a1dbb1177627fda4612b0eb14ded8204
- SSDEEP 196608:BDb5p8Wr++VnAWNJN+TD6AJqQWJNey3UtUzRwFehhJrCcfQs+Vn9OZqtSZ0FkD21:B5f+CxNJNCdSexYDhHCpn4Z4fkKpwE
- TLSH T141C633C7A19698EFE9281979CC709AF589197D42CD0813477BA93DFE3AF42C3681443B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vminst.log
- Size 14KB
- SHA256 068bdd57b34bc36e5b39eabcdad7f3be58db18db8727d3466d430226df5a7a41
- MD5 6bb8c7f100f30c3e9ce17bac72defec3
- SHA1 b9bd22ba8b044d8475738a489d2a88e060ad65a0
- SHA512 8e47c952cfbd81808bee2f50e5351c98245cc0ed2c9dd19e3afd9bf3dd43a4c2d4afbcb3ddb6f2486d9845dd3af2ac465095825d175a9307119eee5b8e3d49b0
- SSDEEP 384:YWocQtQFp202HLFlr6KTbrOZVvg1XpQ9DM:YWocM3I6iW
- TLSH T13F629D15262155B36FAE8E5DFA4D378C8813706AF78473A8BFB50D0D4A27419AB3B307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vminst.log
- Size 24KB
- SHA256 6d5ea9103bb8d90c0137baeb8db60572e80c7f10c8e573989338be7e4bf0a75d
- MD5 fc97f5a383928a3299b7ca18d57680fe
- SHA1 e51c50350da61bda7f31f102c3f7e6554ff567d0
- SHA512 cbbe367569f88072a44f8452c1e51842439d49b06dda39a0ce4fac79ffcb70a9716afcf9e837d681aa3bb5dbce11813dbf31e4ba9f25649bcf9a867d22266f34
- SSDEEP 384:YWocQtQFp202HLFlr6KTbrOZVvg1XpQ9DW:YWocM3I6i4
- TLSH T1A6B2DE2C163109A76FDECA19F95C3B4D891261A7F788A7A4BFBC1C094527419DE3F20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vmmsi.log
- Size 3KB
- SHA256 ba209be1304bd3fb229549cdb3e82b2bba87aa80232a193a2381d7717988c3d9
- MD5 63a1a0190e861b047c8e5b39c2e76486
- SHA1 e5d9727390aa69912acebab61639e9b00394b624
- SHA512 0aef74428429cf57d0b709c629ef2950faf374813eee1ed1225aa5c829bc9966b76faea42e623750c8026776ecfa956c75791dcc0dbd62e04a26b941d501e5cf
- TLSH T1CD61DA555ED90C46F2B35B47AEB3C0120B73FDD65D34DB4D2388831A46AB809E8BC76A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vmmsi.log_20260907_104239.log
- Size 968KB
- SHA256 869b4a269e9a13b384b34b21d2657fcba8c0e06360a57ef09abdc1d1575e8aa3
- MD5 01a5d31fdd6acfd84af4d73a9debdc0b
- SHA1 a4a01c6b98de839296269c536b357713d1981f17
- SHA512 ac8b5b105bacdee35f8bcaa5a19f9ddbee6582aad5f71f8de2cc622b62f47ce0ebe2a518dca6796bf3446330ce94f407d11a95e79a32522b7a19bc9e2ed50334
- SSDEEP 3072:MRmsjFIhyijKa10K+YEjPzXJI6s54/AiBkEx+aII73vUKZPDK735HrNJufR2vORL:ZJjhLPq9N
- TLSH T13225591AAFF80116B2F39F47DEF344125536BD616C38E84D6181434E06B2D05F9AABAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{86B6E794-CF20-4939-A2B4-1CD53C370315}{95BD3712-DF47-40AD-88C0-1DE55BA6B312}~setup\vcredist_x64.exe
- Size 24.3MB
- SHA256 814e9da5ec5e5d6a8fa701999d1fc3baddf7f3adc528e202590e9b1cb73e4a11
- MD5 689d09bce45c75db883db7e78b6f4e9b
- SHA1 ba92a00f0f55dcae85c1bbd098efe606bd080b3c
- SHA512 4db5078fdd9eb9ce00a1b6195a67c779a1d3c719de0fbd4729adbdac2d8ca442cf4e0a31aa40d213f29617ec073f1a7e42570dcc2f931eb9534c45f1ec6de253
- SSDEEP 786432:moKpx5hYBug51MMlQi7PZdJXiq1+N76JupzS:Upx56Bu61FZPZdxQcUzS
- TLSH T1B9473332E418406BEBB234779DAAE5312E7CA62C231149E6D3C8ED4D6B7919313FF611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\VMware Workstation Pro.lnk
- Size 1KB
- SHA256 cc50a124fa93d581ece88eecd8571ed806570a732f1cfb8fcfbde0da556748ba
- MD5 a9dee4ee988fa6b98ccfa2007f5c34e1
- SHA1 5bc3b0c6bae3695e25420a0b6996a0d842432eec
- SHA512 4a7f552eb94ba6f6df801de18c6fe6ed96ce045275d398db5e2d388a951f1badb6d665ccdf6061fd81749e3d77c6c6b089eaf5d35fd1e290c0bd31428b73b69a
- TLSH T1E621EB012BEF0672F0FB1A356DA26325437ABC05DA2AD72D41C4918C2DB620465FCF93
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\VMware Workstation Pro.lnk~RFe5a05ce.TMP
- Size 1KB
- SHA256 3f1643c3362ae931b110104a85daa4e0cdeb648baa24e1871ecef2b922ef133d
- MD5 f9ed5e214009aac8e278f8454ef1dab6
- SHA1 925b6390c8b224fcb82ee31541c9f037a7cf0e2a
- SHA512 47b7a2227694526ccfb508002bbe22c6deb94755843603720781e832959d834ecb1a93344c73f7f1ea16a05ac2a9c4472049606fc8f7b11f3ab9f8f6a63b68b1
- TLSH T17C21BD012BDB0672F1FB1A356DA26324477AB804DA2AD72D40C4A18829B620565F8F93
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\INF\oem0.PNF
- Size 5KB
- SHA256 d5f3b537a198f0d41aa34d98ac2d536132ce24408a46257a22099019e0b313c7
- MD5 9605b4361998fa45abe726aa081971fd
- SHA1 4de2aeabf8d51a7a69b6cdeda8fc52dd0f11ff27
- SHA512 bba4f559fae7a4144b2afff95a490bd17b02bf19362a5501c53f5b2e16e924153574ebed2edb1a29b6748563b81cce434ccd5603bb4d47aaef20c84567dddb45
- SSDEEP 96:fWG/Yfb9NdSu3HS5PjLIcU808l9t6aXDRH1fsn7enFWhkq:OXtSuXqPjLIP808l9gaTYn7OEt
- TLSH T15CC1354573E94F15F0BA9E706DF466E26836BC425E12DE4F2264730D1C32E94DBB0B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\oem1.PNF
- Size 5KB
- SHA256 4e401b9c6ef717c59f415c98bc9b39c714e65c27f08ac4d2be6c2c97f2dfbdce
- MD5 089e3f99f7962ce7a36d60944c359373
- SHA1 e394cd3f225ec50723b2957bd1166db25235cbfb
- SHA512 9c8e510b7c0621e3c4562a490929f635c3b0cdb778c69177b392b42ecd2a8e837e0c59952c90e953b419b7bed5f60cf4a72d21b28b15243f12bd693ccb18cb7e
- SSDEEP 96:hDi0PEnkt/m6PYN7aUd9h6vXDRy1TCY3ekSDr7:hWa//gmu90vTUCY3WH7
- TLSH T1D1C1475677E98F11F1F68E716EF4A6E65872BC125D11CB4F7114330D0C72E90AAB0B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\oem2.PNF
- Size 6KB
- SHA256 7a63ea24c01e5198e569fc6101d7477aaf21e38d00ea7b7a558dd828dba1ed99
- MD5 f1bca5be8155526a5ac68f47cdf266e0
- SHA1 6553215edffa7648a70d774777ade2095f0788d2
- SHA512 07d268c0c2bdb54eb39381c206ee405656159484fbd41d55040b099fcef529a8f3525b70f76f77f32edadf7e3b38165af43001886c752261ed95a2673f934c0c
- SSDEEP 96:b4rgQFfpA0WXW76bNzX141fQ1OVZUuQSCUJ:6fxkb6ZUK/
- TLSH T130D13745B3F88B15F1BA9B306DB512E65472BC519D12C61F3160334E0D72F949AB0B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\oem3.PNF
- Size 7KB
- SHA256 f40f925db543002aa61b9da329254bb42b6fb8682490547af346816dfb350e40
- MD5 29d5219d9218c8cea507725549c69d26
- SHA1 c68911a0c94b2073811fdbda23353766fb26f2bd
- SHA512 c157e87f593daf5c699a38469c89a2024b28ec143b9168b2ba68bad88cf659125dfb015b7edac134f24d1a6f52a485ec7e413586b7928486d944a263dd8637a8
- SSDEEP 96:xWdqkD0+8i4iC6vJ0mc6Mi2AnvW0JyQrWC0SW6s1Pxw4ccm:w4iCsHPMivdB79cm
- TLSH T183F1294573D88B09F5B68E74ACF462E55466BCC1DC11CB4F2574770E2872B80EBB1B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\oem4.PNF
- Size 10KB
- SHA256 ec5bf22d054ccec8210f37a4d0bb00c0099ed5c203760ce5663c72cd547e9e32
- MD5 4eb74bcd67b1bf688596712ce620858c
- SHA1 a248842f8263cb931c6c165ee377c10fbac76b84
- SHA512 b43c5c829ccd4332755db023c9183de70f8a6fa5d16e3da8f1777b1450ea1f2620049b9bb565c7af668f15a6f4444a7bc7a7a066723797ce11c3a47ccc8c839d
- SSDEEP 96:n0uBKkpFKXL5S4Y8Va3ZAw0xZGDleJ161Ah6OQO2krWzmRXE0kr/cCsSxofqYbSz:lKL5Sf93ZqrileSA0TOERoNOXEGxCK
- TLSH T182226755B7E88B18F5F34E709DF961E50865BC969C55DB4F21A0330D2872A90CAF0B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI3B92.tmp
- Size 977KB
- SHA256 5ce1c83786eaecb0030f809c776de34b1fe802db00157bfa543c2f8dee1f1f8b
- MD5 f8f06fd1595f08880c73e3e762a65b64
- SHA1 c7d4207bbafbf2e4b64ce74846535be91fed6de6
- SHA512 06b5014f1e1b13a90eb70b10e4032e2f22efdd2f36a94275e6115d48e47f392bc311caa263391eb0e65d9d495667c55b77f515235429406e31ca76508a59b45f
- SSDEEP 24576:c/0HaiU1JdStRplQdEt9SQxs1brpjF2OJIEBhF2nKCL:c/0H1U1JdStXSdERiBFoEBhF2nKCL
- TLSH T147257C26BBE901B9E0BB923889674606E771FC06077096DF03A0A66D3F37BD15739B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIDFAC.tmp
- Size 3.3MB
- SHA256 8b4e7ed62c9b3d4806b6c6c76f6c6fe276e32075c65556d3104ce0b155040fad
- MD5 1970080189609f09a0bb42e44962787c
- SHA1 818f6a3f6a64de0e6cad5a5a52a60aa1bb502b22
- SHA512 674bee8efa0f46e6e6348b29df5bd964b2c58baa1ddbf11955a3d158fea9a38abadffa02011136a039ea95eba075e12e38fce282795072d8faabfa2681af4767
- SSDEEP 49152:OlCt9egZ/6YxIWnvD8LaHIc+stEugtoHmfonkXk2H7PCOnLyqbHXsPYXixXoas7j:b6ApvBJeP7uqbHcgXzpF
- TLSH T106F57C4AB6AD40A5D8A6E13DC517460BF7B278104331D7CF01A44A6FAF3F7E18A3A725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE00B.tmp
- Size 2.9MB
- SHA256 c06d5df2ce5a5b246fe7eca9b20feaa16bc3af4ddbdf0d512f6899bdc5fc2f10
- MD5 8594598cba9e553c2fbaa57d728b5839
- SHA1 666cada13854e09af8d67806ce19e8dc5f85830c
- SHA512 c037026adc55267dbb2140b6c5c354ff4c1dba6cd5c0502ebf71ddd52948da0c3499be0f7ab5931a21db8c29bef3a5720c05c9155e9f30ebc725771164920bf7
- SSDEEP 49152:5+9HjZmEkPWy2lJvlD90DtTFh49WqnJv0opdWLG5YXT1z0HsoAtuT:5+9lmnEHpvYXTJ0R
- TLSH T14AD55A4AA6BE4095D5A6D03D862B4A0FD7F1BC120371C3CF1164DA6E5F3BBD20A3A365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE451.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE6A6.tmp
- Size 648KB
- SHA256 d380a8cb5c5c318213378a51e6e64fb78d049493c2456efc1e4d5debcc2ab55e
- MD5 3688fb25eef0eb15694989379f4fe5a3
- SHA1 cb7ad4cb37a464dc1b13ab66dd86f13aa0b11484
- SHA512 3b6881344dd1c4016dadd22dc2e5b43a44ab5bf234b2b9d8418b763be9ab91b16a678dee17c71cc46b666e316d2887b729b47e46829645c9b05c4392dc541738
- SSDEEP 12288:Xh6v58voKhwwTNHkLwiq7Tp1Qj0tpmfDRz32A+AfEU:Xsh8vjhwwTNkwiW9xtpmfDN38Af5
- TLSH T16CE48C56F6E100B9E4AB813989934712F7727C550760ABDF13E0A27A5F3BBD1173AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIEF45.tmp
- Size 1012KB
- SHA256 280ecde7ad57f23e214d5a2c7f692f6d6ff4a3054a57dad7cd50392cafcf00ee
- MD5 d8a58d9ae8e2a4106548a6e2b675f7ea
- SHA1 1b0dc03ba8016c6ae04273336f2918b94f7e4ba3
- SHA512 68a29b6b5a52133434599c2ec03a4b4bcf76d537454f319a7aee0a29c75d98d7faba67e7fd27d99fa2fae3f2ab3466002aac58ccfde93641add09c2355ef0a78
- SSDEEP 12288:vfNLyMbS+HmEvXuB4Al3xeEGRKKaV2NxMUpMOueSP82E5:v02RHmEXs4AzeEGRKKaSMUpMOaPl
- TLSH T1EC257C17ABD901BAE4BB9239CD674A01E772BC46077097DF02E0626D2E37FD44A39712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF011.tmp
- Size 149KB
- SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
- MD5 8eabeadadc6d03c9807787af28381b65
- SHA1 b5015709fb98a8a849a0440c54c07c394e89bc59
- SHA512 18ddec2d28640108faf5a4b9878cc0e6224fdc6ee26bd9fcfc2c972d0ea82a21468181c6fcc3413a99e2a9bc070e71d41c998528a324eee93ee1b59351b6f037
- SSDEEP 3072:CJdLyE16iOLin7Q4RZUKnnH1uhC7vu/2nrZ/yqMPu:CJdLT1jXZ/H1dRxt
- TLSH T171E3AE01B1D08072DABF193A5434DA725F3FB9209F508ADB53988A7D9E702C09E76B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DRVSTORE\hcmon_CFDFE770B24985C34CBB82FD13BA00B1136C614E\hcmon.sys
- Size 70KB
- SHA256 9dec53e8712a81eb8f40d8d21136ff4b2548e771455fdb04e1a489b9e125be4f
- MD5 4bd413100171400786d276d7ab1745b4
- SHA1 8a491e0b08d1668db83cb1dcebb1ef4d598f586f
- SHA512 70455fef7442c37f5bc4a70e97efaa693ea23d126fdb286757b67a11332f56cd4a7e673b1735b3dbf5bbc3243f6fe91dd6420e4643563012d59d663023b5c47a
- SSDEEP 1536:14SQqoPIj47yOX/F/CSuyo/eUA0cKyJoFYthhfyQyLz9i:qSQhfXFKvAuF2Tlspi
- TLSH T13D638E53A6A815EEE1A3C478C2759123EBB2F8462311E7DF42B0C6181F537E1EE39356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DRVSTORE\netuserif_0EA53CCA9B63BE687310154DB5F8CCB106847450\vmnetuserif.sys
- Size 30KB
- SHA256 628d6ef2035717f8d4405c0b07df3e26b93be6ad3ee7785e93600b2fdbd6a109
- MD5 47b4f5c9b20dc2b898b0450f13316529
- SHA1 eb7a71ef706c84e8152d2a67b88dba4373a5ded3
- SHA512 d9c08847192eb80cf498efa0855e2269ef00985a285dcf34e79d176075cbd67d98ca84d6fc373e5737afbef74051c3ff1645406a2ce8a01339b64b60a000469a
- SSDEEP 384:e2XTBrxHzp6cM6cCbF6TKEkyeHhCa56lGrI6LTQ5vATz/zATk+3iT+CiHiZFRofI:/rYsQTtSCah9EI4m+CiOof7N9zY
- TLSH T19DD25B82E27810CBF6A68E7542E5D213ED74BA931711CADF42E0C1750FA3BC4EA34759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DRVSTORE\vmx86_DE638A59BE84BE5B59302F447D5BD6034D20B52F\vmx86.sys
- Size 98KB
- SHA256 a5834d6075e9d93f3a3f58da9ca48d910100ebe7acdee6b23b0b8fed11cfebb8
- MD5 2fcca24c1e3c8a7cef3fe0065a85aeee
- SHA1 a0df87a8e1e7af6663c048af03422de146749b8c
- SHA512 5aa12dc49532048afa9aab08144acd4d9cce8ec905824172fe2834a334131782e38f05e3478677714a27ade917b543428b669f0c8a8e1e40e429847c078a91dd
- SSDEEP 1536:V/H3ffZQq01DPgLWrBQraXrcJ6AjiY59kTVPGBEqf5jNX8tAOakcJgzd:V/H3ffZQq0175dA+Y59EPGxotrakBR
- TLSH T1D4A36C8637A818B9E5B6E23DCA589677E5F1F452132AD7CF1290C2A41F273D05E3E381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DRVSTORE\vsock_690F8C6B0EAFCFF466BBDFAE97E2B783CA5F408D\vsock.sys
- Size 89KB
- SHA256 372c11a3541fc543279faa0cb842b04b0c76545770531f7cc5ff2f051bae5c46
- MD5 043c338b99e4877a1938397ae7236e38
- SHA1 3181d84312febc3cd4f461f668bbf701303a8be0
- SHA512 39815c615c3356faf61715bb96d0b6b09646ba71f8c1279ad0c9ad05ce18d45f28c8e8daec93d5ea0d1820371d4ca08d4e9c8bd7b837983ee9bc21e56583476f
- SSDEEP 1536:BKM7gD0AnUfcHFVcxmNwaBULYDcw/Nc0z4nE:0IgkWcq/BJDcsNfv
- TLSH T145936C9A61A414F5E0B6D178C6D68517E7F1B8422B2687CF06B0C6BA1F37BD05E3D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DRVSTORE\vsock_690F8C6B0EAFCFF466BBDFAE97E2B783CA5F408D\vsocklib_x64.dll
- Size 31KB
- SHA256 e72fe264ad42ea6546f4815fdd12dc53e3382966fc463d0aa83ca51700820233
- MD5 d7418393aa7c417a398052db2302b650
- SHA1 e52810e145619516dc03f6acc81e8518c0bc417c
- SHA512 0effabacd0a876fbe2c3c99831de5264a1cf7e059ad3468624885ec42fb45e396440d79b8f6112896c10477290dcc6a4f6aa5a6d0ee1612c97c7fc168438f1dd
- SSDEEP 384:RMJomRJAdJz4V4eZDhjJCX+nPsW68DLh2hBeLcoxFRkP3U0R9zW0wRlP:+R44We5lnPzLCkYcx49zCT
- TLSH T175E25B96E66501CAD8A7A4B087B69D97B835B7521F0816DF22F0C1181F73BC1AF3E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DRVSTORE\vsock_690F8C6B0EAFCFF466BBDFAE97E2B783CA5F408D\vsocklib_x86.dll
- Size 27KB
- SHA256 fe5bdcadafbf2bf8ff6b4fd31865981dbba80496c48aabd954b1d005361e2d10
- MD5 4f831648e4094df9ccb6dde41def02e4
- SHA1 624ad741a75ed529d0da1225bc19143ceda94eca
- SHA512 0bd4097a56a277f8b79f9884a42b85e3df34ee3812c5f2fd2466ad00ef4b900b77bad94b093d318a0ed61e1f309663c2aecf4f42453437cbeba957da263b0d1a
- SSDEEP 384:IN01+WAUtHgZQWBVUcjlhA+sZge1noxFRmYlORR9z0ZevX:AURgZFhHk31cNK9zmevX
- TLSH T14CC26C91A71062C3EA6504B426B8D99B6DBCBF611F1081D373D9EA001F167D3FB3495E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{5eeada8a-9b73-7943-a3b8-c441165899e5}\netadapter.inf
- Size 23KB
- SHA256 9eaab742e85b31e311d2b50ed3c8f2de252d0ea700a3c4d7ab4f0c33e32378db
- MD5 9d4982f743e11cc434f531d76fd72a2f
- SHA1 aae92a008646ab1bfd128b0a07ef60f65dbb4fd9
- SHA512 5c2031e1e482d8be8547f40fded397466c5f289cc0be99fa8fc414de9d69fdc1e3857e77d64a47c3200a5aa38e62888e5b57d6aaca6f8b12409b79a5169ab004
- SSDEEP 384:dRNmquHAH9IeE+Q+0u4EsJ8sE0MskEp72hMvKVgjstypHGfDotWGfDotGFum3MmX:ex8ULg48U4gcEQIMNAW4q4+gqQT
- TLSH T1E4B2AA3B5C669EF12003D2ECD6C758B6C4DB2160105C1DE332DEC9AC6B8BA1E5B7C996
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{5eeada8a-9b73-7943-a3b8-c441165899e5}\vmnetadapter.cat
- Size 12KB
- SHA256 612701059a78733cc93d2cbadbd378179c011adb2b454e78b1d10789f5e0d39c
- MD5 f5bf23fd5b9c14b09996e83827e5e3f1
- SHA1 2854b2e4d3eb334546c7ed793a1726e4e0bc0f66
- SHA512 e62edbcbcdedb4a3f1bed167ac742a32dcb84ffe6d6b2169592a2b205b50898853494541cd8a234508081de0886792ef67dec7c9ead322bec23467dc4800005f
- SSDEEP 192:Kz5+oQORsAvyGr9IvYW7/lyKFFWQFdruuMAAUYX01k9z3ABSfjkemA:etNViZFRvruuMgYR9z4bo
- TLSH T1CA52E8F26ADD54C1B57359B002F8E097287D7BDB2C10816C729BFB6C1D62385EB1816E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{5eeada8a-9b73-7943-a3b8-c441165899e5}\vmnetadapter.sys
- Size 30KB
- SHA256 900dab67810607208d37c7ef441d607d11d294650183475af50158faecec7cce
- MD5 1ae6fe02020202835b80cf68fcbc67f4
- SHA1 b7e37eecfe58c8507301b77abaa4f9522201c648
- SHA512 cd1979cd9d0b2b5a22c58d9035df244ff15091eb8c7bce827fec2332336fd44efef800f443f5b04c888d98f3b60c1fdeaa9ec10fbb581e0723954ff55d173cc1
- SSDEEP 384:Qz9+Zw3s5nBqStq2xeNkIfYQnKCC275TWDDCna758EiZFRHoR9zUyd:CQw3s5nBPq28NnfYQEF758NH09zN
- TLSH T159E27E91A2AD51C6F5A75A3841B18E13BE38B6824750DEDF8290C1780FD7BC1EE3476E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{9b66d1c2-0383-8048-9668-7fe4f1ac5e64}\vmci.cat
- Size 11KB
- SHA256 234645d9fe70f1a87331c6e5fca35c2bcc0b69e2264402ec50a038361ccbc414
- MD5 5a81607f0a1d3edac0609373551d6323
- SHA1 165b01fc1d34d1917b7e989f65d09d444f10e68b
- SHA512 76362d31317b31b26952ed9191df9ce7d03884f4e85c976863ef849c3f0470d091b145ede91e1739c781281f1175629bc81f66b198f7c0fc0ddb37c8b8d4508d
- SSDEEP 192:4/w6jSwlb2EJCKFEThLxyKR/2FWQF8nSv6dlX01k9z3AIfHtjOTF:496eFROnS+R9zpNsF
- TLSH T1E73209E68A6C41C3FDA7A87083E4E593BC3977CB5C40556911EAF75809A23C8F71806E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{9b66d1c2-0383-8048-9668-7fe4f1ac5e64}\vmci.inf
- Size 3KB
- SHA256 372fd5abfd070581d5c2310614e28ccb49deefeeacf31a4b7f7b249b3e15f498
- MD5 ffd8beb17eed32d9b75f37e5de639422
- SHA1 7b84b9dc87fe3c1bc7c294439d3f33cc055ad122
- SHA512 b4dc7c146b5a523962038caed0aaf10beddd7c1353f51ad465d5288fd3d45d227ed5feed6fdefe381b133feb5a61861718c2d0255e090e61d5929721e54c217a
- TLSH T131714F0C9D6709346783E2917E837C83E6B03589C1A1180476DE6B664B87B6CDB2E27F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\Temp\{9b66d1c2-0383-8048-9668-7fe4f1ac5e64}\vmci.sys
- Size 104KB
- SHA256 e9a45bddb38925ded64b874644f58a6e8e87a10614ed7a34b9bdcce6bd3d46c6
- MD5 5b2f4b17924a5bd97ef2b7ffec16059e
- SHA1 19ff3e6b7b988e2a14018b9b8705be99172d6a1c
- SHA512 27a97f692aed14c3d5a91e981992aabcf64fb3c7f4db63200557c6794e1a89bc61fce23dae32282e0f4258759c76ca88f4141c7332c6e8848c634b6436f6d0ad
- SSDEEP 3072:x5qlcwpme8LdvxsNTQwl2sZEgpRDA3Yd5k:x5GcyYJvxGdPZDDA3D
- TLSH T116A36D6632A521B9E5B692B8C7A2C157E7B1F4521B2287DF0370C1AD0F27BE06D3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\netbridge.inf
- Size 4KB
- SHA256 95dcb91170cc1d9a1cc0b738a9846ac3e481c1b0ad66a2da2ce418de667b9f63
- MD5 17e8a021d33259e2efbbaf02a5f6aca5
- SHA1 32e01b3c3b9230c02f2e91cabb85023ee31a54de
- SHA512 481f787c7c5967d327b47c1ba3ca4c6b890e299e60f66393cf7d0c75f5b20cdd9a826848539698a5c246222c0805c0bfe9450a8a9cd770356b495f503111da9d
- SSDEEP 48:/vBxDVQNZIEfRttAFt/RgmRBr7S4jHaJbKEdtqXvfNlsiW/+E2vHBJEuIDhFrS6Y:XBxDVQNZI8qRXDHMEKughSZmusR4
- TLSH T17291FE662D6198333290D1B6EB012C42D6DF158DC2141F88F5EF8C96BB86D1E722CAA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\vmnet.sys
- Size 31KB
- SHA256 a1f6caecb25bdd17963f9ef836030263c0ecc69e9d4c3eb8bfed971882824941
- MD5 06f3be64b67f81680711369684512b22
- SHA1 758ce0075836977c0011fa9ea11429f9f1d7529e
- SHA512 c59171961c6fc99629db55d80c8f21d3917692178ce0ab89284d6dc96d4f2516312f3fcfab3e6fef07785e2764f9734b1d51d21b8d5733bcf4eaab2fa1a76de6
- SSDEEP 768:yOS3mtvlUM7pyizn3PepvzO6tmQegE9zlN:q3ilUGAvtRePzz
- TLSH T11EE27CD49798209AF6A64438C272D847FE74B5530B11CBDF42D0D2B82FA33C59B7972A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\vmnetbridge.cat
- Size 13KB
- SHA256 52079a92078e2d636f35545b87bf12e761280ad9a1a0108d5a800edff629c192
- MD5 b5fbae38750bd410f8cd20b4c1579e4c
- SHA1 310085c445357fbd48e65fba087490b8ca3b9b23
- SHA512 3c82d6b229e1ba5ecef03ebe44aea99ea280d3cb56c36b0fafc280c07115b1407a29371fa22493006f0778f22503c9e44eea4992780eb978fc35a089bd8010aa
- SSDEEP 192:3KSxudQO1mRyGr9IvYW7/lyKFFWQFdGrFIfgtUX01k9z3A7WlxP7:9ViZFRvLtR9zPb7
- TLSH T1F252D7E26A9D54C2F96358B402F8E05768BC7BDF5C10C02D72ABF7684DA23C5EB1416E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\vmnetbridge.dll
- Size 79KB
- SHA256 ba0d213d9ed8b8c067b5fa29d4666a07bbea6022ccf3430bc295c3df74a1e73a
- MD5 d57dfb2ee32edd53bbc695aece47a08d
- SHA1 13697463e705fe4cbb84721cc40dfca99cf5cf4d
- SHA512 c31f11e60cbfea99f0e822d10f7ea259b8fc9fefa59a16b86fde5f11650220fac4761d5d33067fafdcdae4662344b60cd656587e98bb4959e15b756a55ca200c
- SSDEEP 1536:pstuv3v8Ir5aCjQk0YH+m8ufTJnvbli/BhCxUKT4UQ+JcyzIHz:pstuv3/r5ayQErfS6UKT4UDcykHz
- TLSH T190835B93B79C80C6D06AA13589638B86F5B6F8504F1297CF73A0A32E1F777C5AA35710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ad6c9406-0d1e-4540-8170-d65628c0da56}\vmnetbridge.sys
- Size 52KB
- SHA256 483c378a7d9f006e6d9ad7755642dade3c86d6345ce4ee64993ea94d45afbfcd
- MD5 73a72fd175ffc492e73e93a66d8fe504
- SHA1 c0dae4dd5d0c0d6dbd75e7e711a231ff7ca8a6d8
- SHA512 c63fc7d1a1c9b0bc1fcfe5e740c3920947ce160e8573fb46ef3da676a421aea7f74bf81ee346107217cc517b35750bb594e875a1ead85ba5ced7915dd5d5c775
- SSDEEP 768:cKxvubPUZlhx/IZ6Uc5YYKgKZd89d+vv0Dy+ZOPaq7N9zI6:cK0bPn6Z5RdySy+Uamvzb
- TLSH T1E0338EA2D3A810D6E4BB9178C3724957D6767C4613228ADF03A1C5AE1F377C1E63C38A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{e726d719-ec80-7749-9ada-157c23824e07}\vmusb.cat
- Size 11KB
- SHA256 dc3b3af515a8e22f5c7a64e3a5c7cc50df8ff01289df24aa8e35680120a72544
- MD5 cf1f39b8ea17ca0c2dfeb6b2067e3002
- SHA1 3b2c0d38ade301c26b449c73353661a2a5f27e7e
- SHA512 22fe4eed014524f93eb44c5fdf4b110468bdbca60d1d70d72e78a06a01ac92e0b99ccf5abd63a1dfc8974e25ea788ed67b9f48e6d9504f0e358a17b2a43a8c36
- SSDEEP 192:5WnyhJCYE/VhLxyKR/2FWQF8Z/FqX01k9z3AG2/a:hWeFROaR9zDsa
- TLSH T168321AA58A3C50C3F8E79C6053E8E4D77C3D67C75840A47A12E7F7A40A923C9EB2952D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{e726d719-ec80-7749-9ada-157c23824e07}\vmusb.inf
- Size 3KB
- SHA256 204093aa1a7d5fd0781f96c5105f67bfb951d2051df6d3cb64b6696f3a6bd96f
- MD5 b72be2e85a0a17011af13f3135a943e9
- SHA1 967b66fb2b82f6c4aa0c49acbb90d20feccad41d
- SHA512 b1810b1f85b2bac4c7bf11bc4b43139221cba05e37e17f60f96f041fbd43fd88d18ac47adc0e708fed6520027f43aa2361e2137296740894cc24098ccedad433
- TLSH T1038110010D53AD396873C4D72B0719C7E715621610B99A4CB1EEBD9BEF9CA1D022D8BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\Temp\{e726d719-ec80-7749-9ada-157c23824e07}\vmusb.sys
- Size 56KB
- SHA256 ce75c6048626facdf41c456454ad04949325dc335cf662c1cfa92a453f602d67
- MD5 1239bbd6d1e65472146bea98a987d1e5
- SHA1 5ad276270dfe080719df9c7b66192ec2c61204a1
- SHA512 1ab15e0f4ec6cc71eac6ced3b9630b84487d543ddbeca77d69323b658f491dffdd17e0c95babd7298179bda4fbce8435344a7eb2f2dea63c7ae554653648266b
- SSDEEP 1536:neLhQBqYNnDb7WvIymQfKYPkG6KbE4RezS:NBqw374IymQfKYPH6KbEHe
- TLSH T1D8437D8663E954D6E0B79574C2A18557EBF2B0A21720D7DF06E0D1B81F233E0EA39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 104KB
- SHA256 9de856505cf030097f9e567cd3c8f257add8a954be8ae6476ade25708de6a69a
- MD5 486d6b1af8089c5c8a4bd1c77b2e2f59
- SHA1 cfafaa55f95ec7d0cc62282583c77755630035f4
- SHA512 e3501af80eeac77450f8ac498d0ac6693b4dc20e331f2dafb3eeef8a9a3f5e5b168f62b2e81f241c9da12aa06a72abba5b5616acbe4698b4446e6a2915de362e
- SSDEEP 1536:bDp8QrCNhw0C7kBS/Urc8EbStUgUkuePOmmKYDk0Q4MbjrXYpZoHOl0HCHfhjyZl:bp0WA
- TLSH T17BA3564490E8865DC5F50962229EEE70C57E75CF770B0FA570BC6308DAC2B147FBA4AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{1206950F-4A8F-4328-9AE4-78A51D79F647}\.cr\vcredist_x64.exe
- Size 670KB
- SHA256 1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e
- MD5 261f741c93973d184d4fccf833f0c075
- SHA1 cb7846fc45cc545b3ac6ab0aa3425461e219b196
- SHA512 90ca6a11c6bbd5f97d1ed146da5279bf40330bf9020b40eb816ede0d914ed4d769e9c48cb8c839924700dec818d4f818f89e6d6afbc7091e2a2809ebe099da81
- SSDEEP 12288:Z3mgqnIZuYfCYqFet4CovkM7pu1nEMSgKZLrfDDIcbMZ3MyGb:Z3WnIZuMCxezot7ohEDfDBMZ8yM
- TLSH T120E49D32A5614033F7F10573B928A6303E7CE3282B51C8A9D7D4AD1D7EB4892A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{210BA98D-8C3D-4BD5-9FA4-6941BBB19D55}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{210BA98D-8C3D-4BD5-9FA4-6941BBB19D55}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{210BA98D-8C3D-4BD5-9FA4-6941BBB19D55}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 5.4MB
- SHA256 8265bab100e281ddd366a9a435aee439bb87a1fe848fbfce0881449c4f08e485
- MD5 92f06ebd6d7dd8fc4373a257ba81e19e
- SHA1 479f3a9fa2d3fed500088812f9201197adf01e17
- SHA512 76eb034b06f05a0dcbe62843d791a28959c9354c5e290b90a4320451ba0d5081432f2f6581fb16aedde1fbdc7a60b85c0d7f13907ab7d5e563c57dd2aa6fb9ea
- SSDEEP 98304:aaaTUerJ34CXBLnYanuGjC1L9qjYBV0fVXi1sduXPPLg92OlPZ/GU0Zfxda5cg:zrKtZnYanuGjCB9qj1f2sdZ1GUcY5cg
- TLSH T1D846335CC618D3D6647AB117D57A83860DF429EF66231E84DE731F96838E24BB3A380D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{210BA98D-8C3D-4BD5-9FA4-6941BBB19D55}\cab5046A8AB272BF37297BB7928664C9503
- Size 967KB
- SHA256 78cd0d63fb93470f11a300d79c5bafe4554142035126068710d6583fc23d49fa
- MD5 3ec3d0ebf9e94535ab326fb3ed1ebefd
- SHA1 5331e4062617df4cfe8dd1fed67a39e1778c3e86
- SHA512 c3f4899d2bf3079485c5c47c8a910023b654e0ae4821ced54b995df5626692551e12fecdc65551d56d9a99f8e5dcdb6176011afe97dc45a734c192834ed0485a
- SSDEEP 24576:Ai3yPptQc8pzIXCH9T6hJuAsx4lYNMEY8iSoujlz8V6ZiUc:AiI8pzIXCHR6ru/xqE9iqJ8kip
- TLSH T1162533818C7D724FF250195E6B82EA7A042F6EA7DC57607662F660C614C27ACB13C4FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{210BA98D-8C3D-4BD5-9FA4-6941BBB19D55}\vcRuntimeAdditional_x64
- Size 208KB
- SHA256 a4b5cd38dbac2d9588bb15d6b02b24a05c340c2c0a10d1ac86037e6dd14262c5
- MD5 c41d1aa655205cb772e3aeb0de9c14df
- SHA1 a3d95bdfa9c9552536adb589f66ccf28dfeabb1c
- SHA512 dd5b8f32021bcff98f2a96582d4cfc28571bef870ca3b1d6f7e58d6d4e18f12eb91063f2524094beb699396814109e39f87183e9935742b9579bae75f5f32f52
- SSDEEP 3072:C9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT9g:slaZeKFxCnBheIdlux
- TLSH T1E524AF12B5808033DAFE1A351178DBA15F3D7E608F544A9B2364B6AD1E717C08F3A9B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{210BA98D-8C3D-4BD5-9FA4-6941BBB19D55}\vcRuntimeMinimum_x64
- Size 208KB
- SHA256 59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22
- MD5 cbb2aeab99bcc3085738c1c41fdf3225
- SHA1 9462fcbb04046d68df7250f5124e79c269f771b2
- SHA512 aec8238b7d7a4727b1f3fdcd5d3c6064bf72af6da5d8ef6542fe5fd97b8e24b7d15540426fae029a628d7e160f9fb31fc482edccc416d970f93656ecad0fd5e7
- SSDEEP 3072:S9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTYBp:claZeKFxCnBheIdluO
- TLSH T1B824AE12B5808033DAFE1A350578DB615F3D7E608E54899B6364B6AD1E707C0CF3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{67F86D48-CC10-4A2F-9A3C-A4AAB26111B0}\.ba\license.rtf
- Size 9KB
- SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
- MD5 04b33f0a9081c10e85d0e495a1294f83
- SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
- SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
- SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
- TLSH T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{67F86D48-CC10-4A2F-9A3C-A4AAB26111B0}\.ba\thm.wxl
- Size 2KB
- SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
- MD5 fbfcbc4dacc566a3c426f43ce10907b6
- SHA1 63c45f9a771161740e100faf710f30eed017d723
- SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
- TLSH T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{67F86D48-CC10-4A2F-9A3C-A4AAB26111B0}\.ba\thm.xml
- Size 8KB
- SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
- MD5 f62729c6d2540015e072514226c121c7
- SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
- SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
- SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
- TLSH T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{67F86D48-CC10-4A2F-9A3C-A4AAB26111B0}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- TLSH T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
- MD5 SHA1 SHA512 SSDEEP TLSH