Overview

overview

8

Static

static

1

VMware-Wor...93.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    299s
  • max time network
    314s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/11/2026, 16:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VMware-Workstation-Full-26H1u1-25688693.exe
  • Size 267.6MB
  • Sample261104-t2t9baszev
  • SHA256 3d775c3c2153600eef4642f95d519a514ba7e861400bda2598352bff792db473
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebootkitdefense_evasiondiscoverypersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Drops file in Drivers directory 25 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 12 IoCs
    defense_evasion
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 58 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VMware-Workstation-Full-26H1u1-25688693.exe
    "C:\Users\Admin\AppData\Local\Temp\VMware-Workstation-Full-26H1u1-25688693.exe"
    1⤵
    • Looks for VMWare Tools registry key
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Users\Admin\AppData\Local\Temp\{BB9A6394-131E-4A86-84E9-EE897E0953ED}{E5DDE904-2929-4515-93DB-E940B7294E8F}~setup\vcredist_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\{BB9A6394-131E-4A86-84E9-EE897E0953ED}{E5DDE904-2929-4515-93DB-E940B7294E8F}~setup\vcredist_x64.exe" /Q /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Windows\Temp\{E32EE024-D58D-4646-A379-A5CBC6618090}\.cr\vcredist_x64.exe
        "C:\Windows\Temp\{E32EE024-D58D-4646-A379-A5CBC6618090}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{BB9A6394-131E-4A86-84E9-EE897E0953ED}{E5DDE904-2929-4515-93DB-E940B7294E8F}~setup\vcredist_x64.exe" -burn.filehandle.attached=768 -burn.filehandle.self=772 /Q /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\Temp\{357ED7EE-F89C-4290-9A26-74CF0DC422D5}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{357ED7EE-F89C-4290-9A26-74CF0DC422D5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5998B3D3-930F-4ACA-97DF-4CC31EAC39B6} {BFB751F0-8246-437A-A361-85F93FB41783} 3916
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1728
          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{D1B430F7-8249-4802-A56D-CB6FE2949502} {0312A799-4EB3-442B-A2E0-44F8F3AA9E2B} 1728
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5924
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1012 -burn.embedded BurnPipe.{D1B430F7-8249-4802-A56D-CB6FE2949502} {0312A799-4EB3-442B-A2E0-44F8F3AA9E2B} 1728
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6028
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BECB3CFF-431C-4BB2-BAE5-7B7B30121E25} {A6F217C4-0EAB-41CD-9E78-3E590B4AE9BE} 6028
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1760
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3732
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4092
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Looks for VMWare services registry key.
    • Adds Run key to start application
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 18D6D8702EB6F50A20471A8AA9C00AB5 C
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:5728
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 06032C8C557AA3F2A22D501D706DCB80 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4632
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 08F1A9D04DF9B6FCBB4372DF7F7C1A6D
      2⤵
      • Looks for VMWare services registry key.
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:732
      • C:\Windows\System32\net.exe
        net start VMAuthdService
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5680
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start VMAuthdService
          4⤵
            PID:4920
        • C:\Windows\System32\net.exe
          net start vmware-view-usbd
          3⤵
          • Discovers systems in the same network
          • Suspicious use of WriteProcessMemory
          PID:4916
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 start vmware-view-usbd
            4⤵
              PID:5764
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding B43CFCFADA0BECB788078086AB5BF550
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1108
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding D922467F0D112AC7F519B6A4A6BCDBFA E Global\MSI0000
          2⤵
          • Drops file in Drivers directory
          • Looks for VMWare services registry key.
          • Sets service image path in registry
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: LoadsDriver
          PID:5548
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding FD16B236B60FA35D6AF3469F0BA9B36D E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:5836
      • C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5432
        • C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261104163903.log"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5468
          • C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261104163903.log"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5416
            • C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F03AD696-6ACC-421E-8971-032B39D61705} {A3681BC5-5101-419A-830F-5B65AD984CEF} 5416
              4⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2268
      • C:\Program Files\VMware\VMware Workstation\vmware-autostart.exe
        "C:\Program Files\VMware\VMware Workstation\vmware-autostart.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:916
      • C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
        "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5164
      • C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
        "C:\Program Files\VMware\VMware Workstation\vmware-authd.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        PID:3500
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8\vmusb.inf" "9" "454492f13" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Common Files\VMware\Drivers\vmusb\Win8"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:5388
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files\VMware\VMware Workstation\netbridge.inf" "9" "43e921417" "0000000000000160" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files\VMware\VMware Workstation"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:804
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files\VMware\VMware Workstation\netadapter.inf" "9" "424b22b1f" "0000000000000170" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\VMware\VMware Workstation"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:2140
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\VMWARE\0000" "C:\Windows\INF\oem5.inf" "oem5.inf:fc9f1aa2477c2bb3:VMnetAdapter1.Install:26.5.0.1:*vmnetadapter1," "4cbdd083b" "000000000000010C" "cce8"
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:3776
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\VMWARE\0001" "C:\Windows\INF\oem5.inf" "oem5.inf:fc9f1aa2df34f6ba:VMnetAdapter8.Install:26.5.0.1:*vmnetadapter8," "47eb20b4f" "0000000000000180" "cce8"
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          PID:5040
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "1" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8\vmci.inf" "9" "4d941d7e3" "0000000000000154" "WinSta0\Default" "000000000000018C" "208" "C:\Program Files\Common Files\VMware\Drivers\vmci\device\Win8"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:660
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\VMWVMCIHOSTDEV\0000" "C:\Windows\INF\oem6.inf" "oem6.inf:3c66b0ea390d9e8f:vmci.install.x64:9.8.32.0:root\vmwvmcihostdev," "42936a687" "0000000000000184" "cce8"
          2⤵
          • Drops file in Drivers directory
          • Looks for VMWare drivers on disk
          • Looks for VMWare services registry key.
          • Checks SCSI registry key(s)
          PID:4656
      • C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
        "C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4620
      • C:\Windows\system32\vmnat.exe
        C:\Windows\system32\vmnat.exe
        1⤵
        • Executes dropped EXE
        PID:5392
      • C:\Windows\system32\vmnetdhcp.exe
        C:\Windows\system32\vmnetdhcp.exe
        1⤵
        • Executes dropped EXE
        PID:5656
      • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
        c:\windows\system32\NetCfgNotifyObjectHost.exe {A998B52E-0F26-4A6A-95CE-A1C864276F6E} 548
        1⤵
          PID:4796
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
          1⤵
            PID:2528
          • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
            c:\windows\system32\NetCfgNotifyObjectHost.exe {2CFDACB2-3E4B-4969-B3D9-E694DF702161} 684
            1⤵
              PID:4232
            • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
              c:\windows\system32\NetCfgNotifyObjectHost.exe {96FC9CA0-4D71-45EB-8022-1B882A810D3B} 616
              1⤵
                PID:6036
              • \??\c:\windows\system32\NetCfgNotifyObjectHost.exe
                c:\windows\system32\NetCfgNotifyObjectHost.exe {466ABDC6-170C-4154-B811-B703483E3B98} 664
                1⤵
                  PID:4008
                • C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
                  "C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4404
                • C:\Program Files\VMware\VMware Workstation\vmware.exe
                  "C:\Program Files\VMware\VMware Workstation\vmware.exe"
                  1⤵
                  • Enumerates connected drives
                  • Writes to the Master Boot Record (MBR)
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5344
                  • C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
                    "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2084
                • C:\Program Files\VMware\VMware Workstation\vmware.exe
                  "C:\Program Files\VMware\VMware Workstation\vmware.exe"
                  1⤵
                  • Enumerates connected drives
                  • Writes to the Master Boot Record (MBR)
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  PID:6116
                  • C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
                    "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:4008
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                  1⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:3684
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xb8,0x108,0x7ffd7b6dc728,0x7ffd7b6dc734,0x7ffd7b6dc740
                    2⤵
                      PID:1492
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,10054300349237958072,10155287643432537953,262144 --field-trial-handle=1956,i,2702082329366992388,7113487782003421403,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1944 /prefetch:2
                      2⤵
                        PID:492
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,4620949566305060860,4112397587396232573,524288 --field-trial-handle=1956,i,2702082329366992388,7113487782003421403,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:11
                        2⤵
                        • System Time Discovery
                        PID:2736
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,17697719439750488204,17364712098705119268,524288 --field-trial-handle=1956,i,2702082329366992388,7113487782003421403,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2372 /prefetch:13
                        2⤵
                          PID:5772
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,5787210528950251288,487026702530194967,2097152 --field-trial-handle=1956,i,2702082329366992388,7113487782003421403,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
                          2⤵
                            PID:5300
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,15627081050468423831,12593386768909396338,2097152 --field-trial-handle=1956,i,2702082329366992388,7113487782003421403,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:1
                            2⤵
                              PID:2084
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,6369764379642273653,2797578627620905082,2097152 --field-trial-handle=1956,i,2702082329366992388,7113487782003421403,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4528 /prefetch:1
                              2⤵
                                PID:5820
                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                              1⤵
                                PID:1616
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5564
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                                  2⤵
                                  • Checks processor information in registry
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:4620
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 1992 -initialChannelId {90222e79-ea44-40e8-a689-5a2041c1dba3} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                    3⤵
                                      PID:1680
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {c346b9b2-bbc0-479f-8783-3569ca619c23} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                      3⤵
                                        PID:4384
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27274 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {b8fd54b0-867f-4fce-9e33-086be360a0ab} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                        3⤵
                                        • Checks processor information in registry
                                        PID:1628
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27274 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {b189517d-3450-4d20-b2a4-77e8be65b435} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                        3⤵
                                          PID:404
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34773 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {93ddf774-647d-4658-b79f-c32010c541cc} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                          3⤵
                                          • Checks processor information in registry
                                          PID:5188
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3980 -prefsLen 35010 -prefMapHandle 3984 -prefMapSize 270279 -ipcHandle 4964 -initialChannelId {45e9151a-249c-4c36-81fa-b1c7766d39d2} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                          3⤵
                                          • Checks processor information in registry
                                          PID:6716
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2584 -prefsLen 32952 -prefMapHandle 5304 -prefMapSize 270279 -jsInitHandle 5140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {c3eec05f-6e40-4cc8-91ea-ada2abbbbe58} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                          3⤵
                                          • Checks processor information in registry
                                          PID:3780
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {b3509fe6-2627-46e2-9f0b-e73287414537} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                          3⤵
                                          • Checks processor information in registry
                                          PID:5684
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {bdcf9a21-1431-4bf9-b774-573ec09c91e4} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                          3⤵
                                          • Checks processor information in registry
                                          PID:2824
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6268 -prefsLen 36885 -prefMapHandle 6272 -prefMapSize 270279 -jsInitHandle 5960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5936 -initialChannelId {a69a7ecc-eb18-49fa-8087-6e46488a010e} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                                          3⤵
                                          • Checks processor information in registry
                                          PID:4628
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 36885 -prefMapHandle 5564 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6328 -initialChannelId {a92233c8-a098-4d47-8117-6a7e41b59e5f} -parentPid 4620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                                          3⤵
                                            PID:5904
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                        1⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4904
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                          2⤵
                                          • Checks processor information in registry
                                          PID:3356

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            2
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Event Triggered Execution

                                            1
                                            T1546

                                            Component Object Model Hijacking

                                            1
                                            T1546.015

                                            Pre-OS Boot

                                            1
                                            T1542

                                            Bootkit

                                            1
                                            T1542.003

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            2
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Event Triggered Execution

                                            1
                                            T1546

                                            Component Object Model Hijacking

                                            1
                                            T1546.015

                                            Defense Evasion

                                            Modify Registry

                                            3
                                            T1112

                                            Pre-OS Boot

                                            1
                                            T1542

                                            Bootkit

                                            1
                                            T1542.003

                                            Virtualization/Sandbox Evasion

                                            3
                                            T1497

                                            Credential Access

                                            Discovery

                                            Browser Information Discovery

                                            1
                                            T1217

                                            File and Directory Discovery

                                            1
                                            T1083

                                            Network Share Discovery

                                            1
                                            T1135

                                            Peripheral Device Discovery

                                            2
                                            T1120

                                            Query Registry

                                            7
                                            T1012

                                            Remote System Discovery

                                            1
                                            T1018

                                            System Information Discovery

                                            5
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            System Network Configuration Discovery

                                            1
                                            T1016

                                            System Time Discovery

                                            1
                                            T1124

                                            Virtualization/Sandbox Evasion

                                            3
                                            T1497

                                            Lateral Movement

                                            Collection

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            e5966d3.rbs
                                            • Path C:\Config.Msi\e5966d3.rbs
                                            • Size 19KB
                                            • SHA256 b0dade469f0ac928cc2c0c81be33afa303708ebc4fe58fdf8e81d6943a2bbb9a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            e5966df.rbs
                                            • Path C:\Config.Msi\e5966df.rbs
                                            • Size 19KB
                                            • SHA256 feb53dcb7fe27afbb1f1416965e499ae7eb6a759053ebc3bb06d76334bf824ae
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            e5966e6.rbs
                                            • Path C:\Config.Msi\e5966e6.rbs
                                            • Size 21KB
                                            • SHA256 ef2b4880e9e5c5915437306a9f782b60aa28c99662e250dcdb3a65ab9d9140fe
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            e5966f5.rbs
                                            • Path C:\Config.Msi\e5966f5.rbs
                                            • Size 21KB
                                            • SHA256 f3c85f02d86d405d3941d5d2dbb9834f5258b045617279a5b76acae40b4a6a03
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            e5966f8.rbs
                                            • Path C:\Config.Msi\e5966f8.rbs
                                            • Size 16.5MB
                                            • SHA256 a2fba93cce68baab0d6e2ea898b13ed63070d0b97957b90c9c839a7c013824a9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ovftool-hw13-config-option.xml
                                            • Path C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw13-config-option.xml
                                            • Size 1.2MB
                                            • SHA256 2769b816543eb0d9b5d812a05fd22109bc12a82094b074739d903e1f3c64a213
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ovftool-hw17-config-option.xml
                                            • Path C:\Program Files\VMware\VMware Workstation\OVFTool\env\ovftool-hw17-config-option.xml
                                            • Size 1.3MB
                                            • SHA256 765ef401dc02fa5d354e2119f0eec983f94aae601819abbd204ffb2f3748b385
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmware.exe
                                            • Path C:\Program Files\VMware\VMware Workstation\vmware.exe
                                            • Size 2.1MB
                                            • SHA256 500bf5837c4e3ff24050621144821c2b3fb55c28b58363202a182ca85facded9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmwarebase.dll
                                            • Path C:\Program Files\VMware\VMware Workstation\vmwarebase.dll
                                            • Size 7.5MB
                                            • SHA256 30db308591d9a096391837eae603339ef407441e3801b23f7ebc75a1c7849907
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            icudt44l.dat
                                            • Path C:\Program Files\VMware\VMware Workstation\x64\icudt44l.dat
                                            • Size 9.2MB
                                            • SHA256 7e1fc96fcc98cb8f0cb44cfa94b40549a40bd0f9968c3c1141631aa0af95a1fe
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            VMware Workstation Pro.lnk
                                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\VMware Workstation Pro.lnk
                                            • Size 1KB
                                            • SHA256 f0c631e2052efd1690f26c53e1198b91bf4cdec98785445d33cc88842187a9da
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            ~Mware Workstation Pro.tmp
                                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware\~Mware Workstation Pro.tmp
                                            • Size 1KB
                                            • SHA256 2e404c975a01bdcd47d31d8d655bfbb283e09dd534a48ab33366fa0e5e6d8c84
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            state.rsm
                                            • Path C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\state.rsm
                                            • Size 1KB
                                            • SHA256 109eeefa77cad7f90b12f46fdf8efba8e6e3df69ae7844000f089241410a3a31
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            usbarb.rules
                                            • Path C:\ProgramData\VMware\VMware USB Arbitration Service\usbarb.rules
                                            • Size 36B
                                            • SHA256 7e03889784162acc8da51b15b533d8ada4b0caeeb54c7dad5f1fe41abccf5cec
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            vmnetdhcp.conf.5548
                                            • Path C:\ProgramData\VMware\vmnetdhcp.conf.5548
                                            • Size 1KB
                                            • SHA256 e8fe34f998d03c92565b673e676a202a172faf77111e51ec12fd6d79706cd44f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                            • Size 471B
                                            • SHA256 1ed85069e21937edae7c58cdf85943e0bf9b2d4efffecef92bbaaf4285f56d6b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
                                            • Size 727B
                                            • SHA256 1baa99befa07b22f3ac5fef4e7b86c1f01de9d7a2ff36ab03c7e7e4b25587e85
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                            • Size 727B
                                            • SHA256 c12ab73cbb66aa2841e800dfc79d42feeb0af7b03c93483a3c49c17ce70f0fb2
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                            • Size 400B
                                            • SHA256 31a2b9a751983471485bba62044b69437c184515e7554b7d59a40c810f689be5
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_C3B8FE07C4B32D5A2F50BA04A173C36B
                                            • Size 408B
                                            • SHA256 dfe807d5b55b4d4f66b88b10a7332b380025be731c7a38ff70b3901d08ad911e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                            • Size 412B
                                            • SHA256 f7ac2a0668b5f335267eafa55fa2ba8580fecf5d034acbf83f72802aef9afc92
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            46dfb9aa-b087-425b-b58b-f1c2993026bb.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\46dfb9aa-b087-425b-b58b-f1c2993026bb.tmp
                                            • Size 130KB
                                            • SHA256 403721ca6c3ba0afde94b5785217521f8fc3b18bb7cc4a6cf02d1d8ed737c711
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            settings.dat
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                            • Size 40B
                                            • SHA256 5c33d81edb42b9bc60251921f9ff8379c84009189a411e2ab5f7e486385151ad
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            1c1febdc-234d-4b12-b5e4-0376c198cc16.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1c1febdc-234d-4b12-b5e4-0376c198cc16.tmp
                                            • Size 13KB
                                            • SHA256 183080ab87b58b695e03979ec4d826a874606e28a558a00578c46ede242e7bf3
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            302321d0-99a2-4587-ab88-00a84c765291.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\302321d0-99a2-4587-ab88-00a84c765291.tmp
                                            • Size 6B
                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            data_1
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                            • Size 264KB
                                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            b5751cd9-f088-41e6-bbe3-83779220ebdd.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b5751cd9-f088-41e6-bbe3-83779220ebdd.tmp
                                            • Size 2B
                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            c3949521-a1d3-426c-aa82-602b0f77eed1.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c3949521-a1d3-426c-aa82-602b0f77eed1.tmp
                                            • Size 1KB
                                            • SHA256 0b67a59bb23f510bc2466e34a52dbab2370ce239fe253b990ade843a2d745038
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            e2a74ec1-6bc6-4104-bc5a-1ec80419db0c.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e2a74ec1-6bc6-4104-bc5a-1ec80419db0c.tmp
                                            • Size 10KB
                                            • SHA256 a879b145d108417b477207bfb355b6ab6f90474626359bb9b5877ffff55dfcfd
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ed282818-0000-4da6-bacf-107f18d7fbbf.tmp
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ed282818-0000-4da6-bacf-107f18d7fbbf.tmp
                                            • Size 131KB
                                            • SHA256 35e9e07038f95e642d3790bf9eef4143bb72399ceb6612fbbe54337b2ddc64d4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            activity-stream.contile.json
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\activity-stream.contile.json
                                            • Size 4KB
                                            • SHA256 abf4817388f1766d4990e038380227aabe0fa4eefd87006e22fde80c73891f7e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            activity-stream.discovery_stream.json
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\activity-stream.discovery_stream.json
                                            • Size 75KB
                                            • SHA256 e46fa264c9a5d4c2f52091d07d798113a58b9b21c2606a362a9cb30d8587413a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            1327
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\cache2\doomed\1327
                                            • Size 257KB
                                            • SHA256 11ae31bd55e8adca72874df98bf705551cd2c5c0402457635dcb24255d847437
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            22686
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\cache2\doomed\22686
                                            • Size 52B
                                            • SHA256 739ab77983783b57ae3fd741a4e73712b8b746917a2c2f0c158372fcd823ffac
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            26794
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\cache2\doomed\26794
                                            • Size 7KB
                                            • SHA256 67a8da783a4304365f8763c529649ba7455ba9c6f6e2d6dfdd5658f8f824d03c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                                            • Size 16KB
                                            • SHA256 16ac063d226c59f842638660eefa8e8e68b66408d7d71f30868746ca787bb47b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            08B2F11DC2B96DD8A3BD8DA58CE657A4F145B477
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\cache2\entries\08B2F11DC2B96DD8A3BD8DA58CE657A4F145B477
                                            • Size 357KB
                                            • SHA256 c8afd52060a64967a004c38b3e489065ba5c205a3a5d71af97e01f0099de5636
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            webext.sc.lz4
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\startupCache\webext.sc.lz4
                                            • Size 105KB
                                            • SHA256 2e7f8c12843e7c7b20f586adaefdb6841507f2467ced7ea9440de1f040228bc3
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            webext.sc.lz4
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\startupCache\webext.sc.lz4
                                            • Size 105KB
                                            • SHA256 5820943218862b36d1b7ecba51079991d5e9c63b0ff2e8f16a73dd1830e828e4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            MSI9735.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\MSI9735.tmp
                                            • Size 3.3MB
                                            • SHA256 4011f6bd9c6c9b44097c7026703cf3ff5b045e061dfd56180fd7e199b4e7a477
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            MSI99E6.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\MSI99E6.tmp
                                            • Size 234KB
                                            • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            MSIBC25.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\MSIBC25.tmp
                                            • Size 2.9MB
                                            • SHA256 4f331e1b17657448c1812d72a8de025ab3ce6feb5a1b9213b929f6ab49d989ac
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            cdstmp_5344_0
                                            • Path C:\Users\Admin\AppData\Local\Temp\cdstmp_5344_0
                                            • Size 5KB
                                            • SHA256 aeab32aa20a5cead3964f3f1b2ba4321e49a7135f39034c725c36c416bd0e793
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            dd_vcredist_amd64_20261104163903.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261104163903.log
                                            • Size 19KB
                                            • SHA256 79b9544b4c36f11f8de6638be0de48d868e118526537235e00670379168d7fda
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            dd_vcredist_amd64_20261104163903_000_vcRuntimeMinimum_x64.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261104163903_000_vcRuntimeMinimum_x64.log
                                            • Size 2KB
                                            • SHA256 c7adfc289d90f2e29eb211baaf90c3a6abec74049c4beee4d3abbd89d9f4fc2d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            dd_vcredist_amd64_20261104163903_001_vcRuntimeAdditional_x64.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261104163903_001_vcRuntimeAdditional_x64.log
                                            • Size 2KB
                                            • SHA256 23d68028dc234dceaddeea8588cde7960e909624724db8b5f3d20939303f9eda
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            tmpaddon
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                            • Size 11KB
                                            • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            tmpaddon
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                            • Size 502KB
                                            • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            tmpaddon-1
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                            • Size 21.6MB
                                            • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vminst.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                                            • Size 29KB
                                            • SHA256 84664d14fed15cfa8d5115ff2531fc13f73ebefc55992d38626f697f32f24b7b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vminst.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                                            • Size 35KB
                                            • SHA256 969b0edeb92c47a14601b2ef78cb6da5504e0140bf467724154d38c910c07147
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vminst.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\vminst.log
                                            • Size 36KB
                                            • SHA256 b555d595d620b997722fa38f6b69e965572257957189be37d18ef52da8835bfc
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmmsi.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\vmmsi.log
                                            • Size 188KB
                                            • SHA256 dd203a2ffa96091589531b5bbcaf5760767409bae8166498df424ed744358d00
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmmsi.log_20261104_164014.log
                                            • Path C:\Users\Admin\AppData\Local\Temp\vmmsi.log_20261104_164014.log
                                            • Size 1.3MB
                                            • SHA256 9decc92c25f5444cdce3a5ec49933f6f0e9937b6d2dbbd24a83e0fad72488849
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vcredist_x64.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\{BB9A6394-131E-4A86-84E9-EE897E0953ED}{E5DDE904-2929-4515-93DB-E940B7294E8F}~setup\vcredist_x64.exe
                                            • Size 24.3MB
                                            • SHA256 814e9da5ec5e5d6a8fa701999d1fc3baddf7f3adc528e202590e9b1cb73e4a11
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            F1KKWD0FURU1J2YPVLOP.temp
                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F1KKWD0FURU1J2YPVLOP.temp
                                            • Size 1KB
                                            • SHA256 3b418f45ff0c66447eafd0c57e2af65c724b979397c1fbeec35b39e5376a7194
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            AlternateServices.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\AlternateServices.bin
                                            • Size 8KB
                                            • SHA256 9cdce8e41a6663e2620df883f9748b67ffd0ea1739c059c36bf679cf37556093
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            addonStartup.json.lz4
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\addonStartup.json.lz4
                                            • Size 5KB
                                            • SHA256 162af1c59af942339d97542fa181a3c2fe94dc7fc319610b3c870b13fe246f61
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            addonStartup.json.lz4
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\addonStartup.json.lz4
                                            • Size 5KB
                                            • SHA256 951acc6ee87c49d6d694c08a61ee0cd8fb7939939ce0b722978900e310fd43c0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            store.json.mozlz4
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\crashes\store.json.mozlz4
                                            • Size 66B
                                            • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            data.safe.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\db\data.safe.bin
                                            • Size 6KB
                                            • SHA256 d1a50a7a78df55794c7c304068a033985e8d03c2b8af0700c1745c761e6a2a90
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            data.safe.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\db\data.safe.tmp
                                            • Size 7KB
                                            • SHA256 e3933fb816e6c5ffa67fee3a07bd0458a91c33f35622fa3ec9162ce6d5defbaa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            data.safe.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\db\data.safe.tmp
                                            • Size 7KB
                                            • SHA256 ab41c42905cc5895db607a0aba152aae2b1a1ad4aea22f5f18cf359263495bf1
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            data.safe.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\db\data.safe.tmp
                                            • Size 7KB
                                            • SHA256 bcab229ed29db183529f91727df8619a532a769c400180ea86a978e4f4d1970f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            events
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\events\events
                                            • Size 1KB
                                            • SHA256 02f4806e944efe2ccdc705ba4fc7ce549c7fec1f393ba130ce173e1443293722
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            events
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\events\events
                                            • Size 2KB
                                            • SHA256 721360d3d30bca29f40c9482953442a8b60bdd0006807a096da6171f2310d3aa
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            events
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\events\events
                                            • Size 4KB
                                            • SHA256 d349df4f18b0d2b3e7d4f1829e60d056b7f21e586d0ceb235b31ff236ae7b27c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            143c71a4-0273-4a91-bbbb-6d8a5028f724
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\143c71a4-0273-4a91-bbbb-6d8a5028f724
                                            • Size 883B
                                            • SHA256 8ca757bfc0e58eb6216ba3f75f913f0b5d6e8303cd5613c65dabe5f18b3e15fd
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            2cb55932-d053-4e7c-b9dc-918c41e5dfa9
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\2cb55932-d053-4e7c-b9dc-918c41e5dfa9
                                            • Size 235B
                                            • SHA256 5af37153d87a75ea633e918786d4359ce5393d5e0760c2fe912c089d1c834daf
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            361fade0-901b-4c12-9309-c84ce2128333
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\361fade0-901b-4c12-9309-c84ce2128333
                                            • Size 16KB
                                            • SHA256 bbf4a4bcbb89467ec8c6da1b4946105763d645ed6bbc35a57d4c33c2262a34af
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            525cd653-e0aa-487f-94e4-7b9c2c2fe25d
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\525cd653-e0aa-487f-94e4-7b9c2c2fe25d
                                            • Size 2KB
                                            • SHA256 6ac7657a208d8a83a78badf3ceec05c4aa70b2fb0883da69cdd58ce54f420121
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            9e8b166d-df42-4434-830f-f568dccee5e0
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\9e8b166d-df42-4434-830f-f568dccee5e0
                                            • Size 886B
                                            • SHA256 bfba5ba88a0cfd85d200bf1d536d98b001edc97c32e7c95775e6aabd8fc9d1af
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            fa8c6138-a645-4143-9e86-adfca0669a1e
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\datareporting\glean\pending_pings\fa8c6138-a645-4143-9e86-adfca0669a1e
                                            • Size 235B
                                            • SHA256 78daab0a0d098ce008ba615d22af441a44b28d4e5267d566a3798cd6cf26a21f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            extension-preferences.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\extension-preferences.json
                                            • Size 942B
                                            • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            extensions.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\extensions.json
                                            • Size 14KB
                                            • SHA256 54b4d67fcd1e050da55d44c16d1bc0747cfbaf323d7986b8dd270a0e64517c50
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            gmpopenh264.dll
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                            • Size 1.1MB
                                            • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            gmpopenh264.info
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                            • Size 116B
                                            • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            LICENSE
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
                                            • Size 473B
                                            • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            manifest.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                            • Size 1002B
                                            • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            widevinecdm.dll
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                            • Size 21.6MB
                                            • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            widevinecdm.dll.sig
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
                                            • Size 1KB
                                            • SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            prefs-1.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\prefs-1.js
                                            • Size 7KB
                                            • SHA256 a2dc9933e3116ec07c9b08536cc197b8b9d5339f5edd93fb833444859481f532
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prefs-1.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\prefs-1.js
                                            • Size 6KB
                                            • SHA256 c6385ba357e885200250950dcce99e5dc8524be84d6b8ed2b9ad172535e53f31
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prefs-1.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\prefs-1.js
                                            • Size 6KB
                                            • SHA256 e93c80c9298a3a8711b6bb5431c1c38dfee2b02df181918b6fcc036279e518e2
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prefs-1.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\prefs-1.js
                                            • Size 7KB
                                            • SHA256 0797a199548fd769399911e3b3d55f4df954a4502358e6a02fcea07ec2066518
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prefs.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\prefs.js
                                            • Size 6KB
                                            • SHA256 a0d41f9fab2d3d65e7f89d43610c50ac2d024f89c0aa6ebfa8c8da546fd8e6f1
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            sessionCheckpoints.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\sessionCheckpoints.json
                                            • Size 53B
                                            • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            sessionCheckpoints.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\sessionCheckpoints.json
                                            • Size 90B
                                            • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            recovery.jsonlz4
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\sessionstore-backups\recovery.jsonlz4
                                            • Size 1KB
                                            • SHA256 550feeae26a86d734d80eb4740dbaddfd7e72b0cacead6d79d6f14042c741e46
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            recovery.jsonlz4
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\sessionstore-backups\recovery.jsonlz4
                                            • Size 5KB
                                            • SHA256 556cb609862adbe9a281dd6636d33716b3d433e13102b920b994048c05135b93
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            recovery.jsonlz4
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\sessionstore-backups\recovery.jsonlz4
                                            • Size 1KB
                                            • SHA256 bff1ed5372640fa8278df24d2194eba536279268e525367967c98c1cc659836d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 5.1MB
                                            • SHA256 fa9fbdd15e66e8696c3a274e14b56baba329e978878964065d67b4413afa0204
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.6MB
                                            • SHA256 abb302a682915da6b5364ce8bcaf2e0ea353398c8108c3f9d2c5430fb24da3b1
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 9bfbccf650c25ba4bb691f17616a16fab5c170a2efeb600bd34bc8b90752d51f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 a4ae808520eda9c6b07e4530c4aa72ecb2350b5879e5bd32dd02ac531b9d01a9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 6aabd1e70691cae1a1eeb1090412b78fbdb54647e97e40ac06f40c44dcd31041
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 55488869666ea7777133eb5312d592340960299c201638db35fd6dd21f823651
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 1ef8758176424723ec0e42011cd3f5c0c98bfd89003baaa24c80080417961e0c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 0353c25c0a606ac1a7d58957fef4dcf41b5a0fed64b37c150d51d3963e33fa03
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 6a87cc7bab907f78732bce2376a98dee72be2bd9e56b041ff13f94bf6154ff01
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 90e8be7a4496e292586431970a98f3f16898891dba79ce59e3d98e77d64c8745
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 d7f967753c1228d2ce2f62b97a2bd0900c6c97ec34e4b8e033c9e87a3533a705
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 7.7MB
                                            • SHA256 1cc7e71d8d0ab634335e1bc53d5b6e5dd264b9f972df43e98404c02efe0a70ff
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite-wal
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
                                            • Size 128KB
                                            • SHA256 89a6d35633c06b9a6bb81884eab3b116265418290660a6e86fc5cf95d391f4cd
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            targeting.snapshot.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\targeting.snapshot.json
                                            • Size 3KB
                                            • SHA256 a8c78b8f7fd3d0d7e6a95a9b9c45e5b8142e943929c6aceb417cbb9357941427
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            xulstore.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\xulstore.json
                                            • Size 169B
                                            • SHA256 2b1c75e5dca4787786234ff05034dab914ecf879087b2c59ae9fe4051d497bfe
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            xulstore.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zbi0yx4i.default-release\xulstore.json
                                            • Size 167B
                                            • SHA256 a261f6c4c1f49fbaac01d6d7437da1149f9b03588d54b2fd860fdfe969596115
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            preferences.ini
                                            • Path C:\Users\Admin\AppData\Roaming\VMware\preferences.ini
                                            • Size 155B
                                            • SHA256 ccf65ab9db29ca5879d81844f9c99e6254597dc3797c4f7a9ba14436b75fdd15
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            preferences.ini
                                            • Path C:\Users\Admin\AppData\Roaming\VMware\preferences.ini
                                            • Size 155B
                                            • SHA256 7ceb1eabb76517fd49729a5b051c0abb425b9fa4459042947de7daf8e31719dd
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            E01244.lck
                                            • Path C:\Users\Admin\AppData\Roaming\VMware\preferences.ini.lck\E01244.lck
                                            • Size 512B
                                            • SHA256 397d1d614829b41b2fc279aa0b179a8f3760dd488d4f35aec6f632ad1ff8053e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            E31903.lck
                                            • Path C:\Users\Admin\AppData\Roaming\VMware\preferences.ini.lck\E31903.lck
                                            • Size 512B
                                            • SHA256 bda816b24e772cb36b4c1d34255547a132abda19566a3fef79d58faf6b3475d6
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            E65069.lck
                                            • Path C:\Users\Admin\AppData\Roaming\VMware\preferences.ini.lck\E65069.lck
                                            • Size 512B
                                            • SHA256 9ecec6cc1729f547e65141c48fc61913aa7e36bb04aa1bb1bc771b328bbc7cd2
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            VMware Workstation Pro.lnk
                                            • Path C:\Users\Public\Desktop\VMware Workstation Pro.lnk
                                            • Size 1KB
                                            • SHA256 bb61266c7dbfbaab3d0e7475f86e45045909ef612898bc5d4198f412bb3b27ca
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            VMware Workstation Pro.lnk
                                            • Path C:\Users\Public\Desktop\VMware Workstation Pro.lnk
                                            • Size 1KB
                                            • SHA256 45b783d6182bf4599f2a8df472c282b7818f741246408344dc07d781038a9e94
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            vmPerfmon.ini
                                            • Path C:\Windows\INF\VMware\vmPerfmon.ini
                                            • Size 2KB
                                            • SHA256 9301c7072fe1d7b396bb1f33aef762b68f2d52472eaed56d2c93d2f7dc7787b1
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            oem0.PNF
                                            • Path C:\Windows\INF\oem0.PNF
                                            • Size 5KB
                                            • SHA256 c0cc8b72d1829f8721a36acfdde9dfcb5ddada39cf5c90b7db2a9c1357ddd0cc
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            oem1.PNF
                                            • Path C:\Windows\INF\oem1.PNF
                                            • Size 5KB
                                            • SHA256 f787487ccea3b18b8bf471aa7856ce0891ae12ae5d9ef65b6ede76256a79770a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            oem2.PNF
                                            • Path C:\Windows\INF\oem2.PNF
                                            • Size 6KB
                                            • SHA256 bf204bc6bba94616a8aab47baf2fdda7e849ac138486422907cec1d11935ca08
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            oem3.PNF
                                            • Path C:\Windows\INF\oem3.PNF
                                            • Size 7KB
                                            • SHA256 daf1cc08942d5cd48eb974c0ac13d51e1ccfa7d6803c9e8b97cc234ad44e13e0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            oem4.PNF
                                            • Path C:\Windows\INF\oem4.PNF
                                            • Size 10KB
                                            • SHA256 865fd3a8d124a698db774658e9b4c456d918aea6fd987ceda44d4422a3df043f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            MSI38E6.tmp
                                            • Path C:\Windows\Installer\MSI38E6.tmp
                                            • Size 977KB
                                            • SHA256 ba44a3036a3892549094b303dab37bd57e50f7faad0191990e343b234ba43dae
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            MSIE720.tmp
                                            • Path C:\Windows\Installer\MSIE720.tmp
                                            • Size 648KB
                                            • SHA256 aac9ca33c3beee6229ae3254469045e36df2c4a994b42572d539fe10a6b4b8d0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            MSIEF42.tmp
                                            • Path C:\Windows\Installer\MSIEF42.tmp
                                            • Size 1013KB
                                            • SHA256 b26e3fc83151669a72614f042a0bdbdf1b514ed9d8918224ce210f5f195141cb
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            MSIEF82.tmp
                                            • Path C:\Windows\Installer\MSIEF82.tmp
                                            • Size 149KB
                                            • SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            hcmon.sys
                                            • Path C:\Windows\System32\DRVSTORE\HCMON_~1\hcmon.sys
                                            • Size 70KB
                                            • SHA256 5e0c160b21e271874043c63efc7ff067b51c11e430a3c4bf85f0607efb29fca0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmnetuserif.sys
                                            • Path C:\Windows\System32\DRVSTORE\NETUSE~1\vmnetuserif.sys
                                            • Size 29KB
                                            • SHA256 43f969c7c6438cf8a8b0a8b06f29f6dbc2c59d4be103a50baed91933dfd59f6a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmx86.sys
                                            • Path C:\Windows\System32\DRVSTORE\VMX86_~1\vmx86.sys
                                            • Size 98KB
                                            • SHA256 5807367c6989603b63fff62bb928dc5f184695ab76c8fc8126a052f3dbf47826
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vsock.sys
                                            • Path C:\Windows\System32\DRVSTORE\VSOCK_~1\vsock.sys
                                            • Size 89KB
                                            • SHA256 372c11a3541fc543279faa0cb842b04b0c76545770531f7cc5ff2f051bae5c46
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vsocklib_x64.dll
                                            • Path C:\Windows\System32\DRVSTORE\VSOCK_~1\vsocklib_x64.dll
                                            • Size 31KB
                                            • SHA256 e72fe264ad42ea6546f4815fdd12dc53e3382966fc463d0aa83ca51700820233
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vsocklib_x86.dll
                                            • Path C:\Windows\System32\DRVSTORE\VSOCK_~1\vsocklib_x86.dll
                                            • Size 27KB
                                            • SHA256 fe5bdcadafbf2bf8ff6b4fd31865981dbba80496c48aabd954b1d005361e2d10
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmusb.cat
                                            • Path C:\Windows\System32\DriverStore\Temp\{888ff08a-4de3-914d-a8bd-4afc4e69d8d1}\vmusb.cat
                                            • Size 11KB
                                            • SHA256 20316912c0be9259aaffc8362d4a9b40d4996d5e35de13e15b701294f9ee52ce
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmusb.inf
                                            • Path C:\Windows\System32\DriverStore\Temp\{888ff08a-4de3-914d-a8bd-4afc4e69d8d1}\vmusb.inf
                                            • Size 3KB
                                            • SHA256 b6a80570d22ba873e64e41a3b2f80c875fd70b31ba9e4bcd2f3db36221817a77
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            vmusb.sys
                                            • Path C:\Windows\System32\DriverStore\Temp\{888ff08a-4de3-914d-a8bd-4afc4e69d8d1}\vmusb.sys
                                            • Size 56KB
                                            • SHA256 3d0e66053d3fbfee751c07cc44d0d4e0e93b7d1777a2d91335df8efb3325c65c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            netbridge.inf
                                            • Path C:\Windows\System32\DriverStore\Temp\{ab1e393e-8e39-3546-bf59-1649abbf4fa8}\netbridge.inf
                                            • Size 4KB
                                            • SHA256 7858e0aea04bbb269b0a97c2684311cddb821757b29335a252287fdd7f6269dc
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmnet.sys
                                            • Path C:\Windows\System32\DriverStore\Temp\{ab1e393e-8e39-3546-bf59-1649abbf4fa8}\vmnet.sys
                                            • Size 31KB
                                            • SHA256 3442d71670a89f09b0eacfa018ce69f3cb834403892e584928a538ce3d7c3679
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmnetbridge.cat
                                            • Path C:\Windows\System32\DriverStore\Temp\{ab1e393e-8e39-3546-bf59-1649abbf4fa8}\vmnetbridge.cat
                                            • Size 13KB
                                            • SHA256 a893b4b7badf2eac15fd880f7f8e67f5212bffc2a546542cfef70cfc18985139
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmnetbridge.dll
                                            • Path C:\Windows\System32\DriverStore\Temp\{ab1e393e-8e39-3546-bf59-1649abbf4fa8}\vmnetbridge.dll
                                            • Size 79KB
                                            • SHA256 158333019ff573c8f619570800d73951714a1499ed9f0f5b9702b03f8226e384
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmnetbridge.sys
                                            • Path C:\Windows\System32\DriverStore\Temp\{ab1e393e-8e39-3546-bf59-1649abbf4fa8}\vmnetbridge.sys
                                            • Size 52KB
                                            • SHA256 08a5bed3ab1c74cae2081986223d0919795f479640bceae6494ab318d86f572c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmci.cat
                                            • Path C:\Windows\System32\DriverStore\Temp\{bae48075-de99-5241-8ad2-5bc9dae5d12d}\vmci.cat
                                            • Size 11KB
                                            • SHA256 5ea342c8b5c6962948b0e20df2a38cd8d95086f9719146e44cf0d1feaacac4a7
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmci.inf
                                            • Path C:\Windows\System32\DriverStore\Temp\{bae48075-de99-5241-8ad2-5bc9dae5d12d}\vmci.inf
                                            • Size 3KB
                                            • SHA256 7a90d18990ecb9dc3ff994bd46b3c51e51c1dbd171c4a2f8a70e2dc64dba6e4d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            vmci.sys
                                            • Path C:\Windows\System32\DriverStore\Temp\{bae48075-de99-5241-8ad2-5bc9dae5d12d}\vmci.sys
                                            • Size 104KB
                                            • SHA256 99733eefdbc3fc87c9413f620c7172b855fb38bd3baec5cf340e2ecfa341967c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            netadapter.inf
                                            • Path C:\Windows\System32\DriverStore\Temp\{f673610e-df92-504b-9260-99433203095a}\netadapter.inf
                                            • Size 23KB
                                            • SHA256 95c3a414dba08e760674318081bed8ae6b95994f61501d084f790075601d2012
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmnetadapter.cat
                                            • Path C:\Windows\System32\DriverStore\Temp\{f673610e-df92-504b-9260-99433203095a}\vmnetadapter.cat
                                            • Size 13KB
                                            • SHA256 1424f2d5145bf8db92e1f204c939c9ca4b9ef8e3343fe3707e8f316d38133058
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vmnetadapter.sys
                                            • Path C:\Windows\System32\DriverStore\Temp\{f673610e-df92-504b-9260-99433203095a}\vmnetadapter.sys
                                            • Size 30KB
                                            • SHA256 93fdeb918727e88765e20a0c6ec529990121685cf21852bd11131bb076ecc49b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            PerfStringBackup.TMP
                                            • Path C:\Windows\System32\PerfStringBackup.TMP
                                            • Size 5.1MB
                                            • SHA256 3a46345a8aac1db0df70c278e1101be7c1e83d5871115115e958789ad9a7390a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            dberr.txt
                                            • Path C:\Windows\System32\catroot2\dberr.txt
                                            • Size 104KB
                                            • SHA256 d371b76e81ef9adbd2477bb4e69b4a909440184bbf03a41651b41238d18515bd
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vnetlib.dll
                                            • Path C:\Windows\System32\vnetlib.dll
                                            • Size 1.2MB
                                            • SHA256 782c2d24fac45228f5fd7adfbe1a5d462d1d7bdad3d00f736fffca2b7e372892
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vminst.log
                                            • Path C:\Windows\Temp\vminst.log
                                            • Size 22KB
                                            • SHA256 d2e22c215c0b6ed4cca84f7ed40baca458477b93d7b25c8601d50ec7621dee3a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            logo.png
                                            • Path C:\Windows\Temp\{357ED7EE-F89C-4290-9A26-74CF0DC422D5}\.ba\logo.png
                                            • Size 1KB
                                            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            wixstdba.dll
                                            • Path C:\Windows\Temp\{357ED7EE-F89C-4290-9A26-74CF0DC422D5}\.ba\wixstdba.dll
                                            • Size 215KB
                                            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                            • Path C:\Windows\Temp\{357ED7EE-F89C-4290-9A26-74CF0DC422D5}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                            • Size 5.4MB
                                            • SHA256 8265bab100e281ddd366a9a435aee439bb87a1fe848fbfce0881449c4f08e485
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            cab5046A8AB272BF37297BB7928664C9503
                                            • Path C:\Windows\Temp\{357ED7EE-F89C-4290-9A26-74CF0DC422D5}\cab5046A8AB272BF37297BB7928664C9503
                                            • Size 967KB
                                            • SHA256 78cd0d63fb93470f11a300d79c5bafe4554142035126068710d6583fc23d49fa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vcRuntimeAdditional_x64
                                            • Path C:\Windows\Temp\{357ED7EE-F89C-4290-9A26-74CF0DC422D5}\vcRuntimeAdditional_x64
                                            • Size 208KB
                                            • SHA256 a4b5cd38dbac2d9588bb15d6b02b24a05c340c2c0a10d1ac86037e6dd14262c5
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vcRuntimeMinimum_x64
                                            • Path C:\Windows\Temp\{357ED7EE-F89C-4290-9A26-74CF0DC422D5}\vcRuntimeMinimum_x64
                                            • Size 208KB
                                            • SHA256 59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            BootstrapperApplicationData.xml
                                            • Path C:\Windows\Temp\{9097AACC-935D-41AA-B0C4-146AAFD69862}\.ba\BootstrapperApplicationData.xml
                                            • Size 14KB
                                            • SHA256 d92e14b38b29a43fa64cc15e0e94ff2e703dd6b6ff487a3fa97a7657e609a4b7
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            license.rtf
                                            • Path C:\Windows\Temp\{934B4EB6-E2EB-4E94-B0DF-252C9E1F0A12}\.ba\license.rtf
                                            • Size 9KB
                                            • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            thm.wxl
                                            • Path C:\Windows\Temp\{934B4EB6-E2EB-4E94-B0DF-252C9E1F0A12}\.ba\thm.wxl
                                            • Size 2KB
                                            • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            thm.xml
                                            • Path C:\Windows\Temp\{934B4EB6-E2EB-4E94-B0DF-252C9E1F0A12}\.ba\thm.xml
                                            • Size 8KB
                                            • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wixstdba.dll
                                            • Path C:\Windows\Temp\{934B4EB6-E2EB-4E94-B0DF-252C9E1F0A12}\.ba\wixstdba.dll
                                            • Size 191KB
                                            • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            vcredist_x64.exe
                                            • Path C:\Windows\Temp\{E32EE024-D58D-4646-A379-A5CBC6618090}\.cr\vcredist_x64.exe
                                            • Size 670KB
                                            • SHA256 1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/1760-262-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                            Download

                                            memory/3500-792-0x000001F5D02E0000-0x000001F5D0426000-memory.dmp
                                            Download

                                            memory/5164-1233-0x000001FD13940000-0x000001FD13A86000-memory.dmp
                                            Download

                                            memory/5344-1510-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1517-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1526-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1500-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1525-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1528-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1499-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1529-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1527-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1524-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1531-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1530-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1533-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1532-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1535-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1537-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1534-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1536-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1539-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1540-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1542-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1544-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1545-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1546-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1541-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1494-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1495-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1486-0x00007FF7BEA00000-0x00007FF7BEC18000-memory.dmp
                                            Download

                                            memory/5344-1521-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1520-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1516-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1501-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1511-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1513-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1512-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1509-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1484-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1507-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1505-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1506-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1502-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1504-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1493-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1492-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1490-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1489-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1508-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1491-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1488-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1515-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1514-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1518-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1485-0x00007FFD68370000-0x00007FFD688AF000-memory.dmp
                                            Download

                                            memory/5344-1519-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1522-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1523-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1543-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1503-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5344-1487-0x00007FFD67880000-0x00007FFD68363000-memory.dmp
                                            Download

                                            memory/5924-265-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                            Download

                                            memory/6028-264-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                            Download