994f4fdbb996d84889f53a059a87676b61d71965ebf4c116b9c0e927563ebe65

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2023, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com.steam.322170_installer_43177719.msi
Size

9.7MB
MD5

8918f21ab70ac4f7ec8f02348b646091
SHA1

76a48198293a500978f25289f69a94b086174767
SHA256

994f4fdbb996d84889f53a059a87676b61d71965ebf4c116b9c0e927563ebe65
SHA512

66b1b334399fd66b01f38454c30697dde766bf4345328f7947538b602587a1b66ca4433c8e1cf4f9fd5befab8f6139ae2711eda223331af89e4eb6329b6c569d
SSDEEP

98304:vY/NsAuemMInSPrRZuO1SqUi9rjaAk8VqPan6jU4XoY6YLAXeOjGuENwE26wy8Vc:jSDLukdUi9vZ4XY5zVyBHyA9JH

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 20 IoCs

flow	pid	Process
4	1644	msiexec.exe
6	1644	msiexec.exe
25	3244	powershell.exe
27	3812	powershell.exe
36	2012	powershell.exe
37	3024	powershell.exe
38	3932	powershell.exe
48	2784	powershell.exe
49	2784	powershell.exe
52	5020	powershell.exe
58	3168	powershell.exe
59	3976	powershell.exe
61	1216	powershell.exe
64	3436	powershell.exe
66	3436	powershell.exe
77	4196	powershell.exe
80	2124	MsiExec.exe
82	2124	MsiExec.exe
86	2124	MsiExec.exe
88	2124	MsiExec.exe

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2292	7za.exe
1728	MSI4A13.tmp
3040	7za.exe
3292	MSIDBF1.tmp

Loads dropped DLL 47 IoCs

pid	Process
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
3564	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
2124	MsiExec.exe
2124	MsiExec.exe
2124	MsiExec.exe
2124	MsiExec.exe
2124	MsiExec.exe
2124	MsiExec.exe
2124	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe
4328	MsiExec.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCStartup = "powershell -noninteractive -ExecutionPolicy bypass -c \"$w=\"$env:APPDATA\"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCEUpdater = "powershell.exe -WindowStyle Hidden -ExecutionPolicy bypass -c \"Start-Sleep 2100\";\"& 'C:\\Users\\Admin\\AppData\\Roaming\\Browser Extension\\updater.exe' /silentall -nofreqcheck\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCEStartup = "powershell.exe -ExecutionPolicy bypass -c \"$f=\"$env:APPDATA\"+'/Browser Extension/BE.txt';$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^', '0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.BrowserExtension.S]::Start()\""	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCUpate = "powershell.exe -WindowStyle Hidden -ExecutionPolicy bypass -c \"Start-Sleep 300\";\"& 'C:\\Users\\Admin\\AppData\\Roaming\\BBWC\\updater.exe' /silentall -nofreqcheck\""	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6A8D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{89869F7A-EBE9-433B-8D15-0EDCBC8BDBC9}	msiexec.exe
File opened for modification	C:\Windows\Installer\e570557.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI753.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1466.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8A95B695-9D35-4192-8AA1-8DAA1619AE5D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCFD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICABA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e570553.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA78E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A14.tmp	msiexec.exe
File created	C:\Windows\Installer\e570557.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0D5.tmp	msiexec.exe
File created	C:\Windows\Tasks\{6C3C9C8F-1665-41A2-A3DE-E8C5DAFC9440}.job	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BCA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA983.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDBF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF2B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D41.tmp	msiexec.exe
File created	C:\Windows\Installer\e570552.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE017.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDD4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6C3C9C8F-1665-41A2-A3DE-E8C5DAFC9440}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF028.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57054f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1407.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC11.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF20F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e570553.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9164.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF017.tmp	msiexec.exe
File created	C:\Windows\Installer\e57054f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8318.tmp	msiexec.exe
File created	C:\Windows\Installer\e570556.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3001.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9115.tmp	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000206f4107d723b55a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000206f41070000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900206f4107000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000206f410700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000206f410700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4480	Notepad.exe
2788	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
3496	powershell.exe
3496	powershell.exe
3244	powershell.exe
3244	powershell.exe
3812	powershell.exe
3812	powershell.exe
3964	powershell.exe
3964	powershell.exe
3964	powershell.exe
3592	msiexec.exe
3592	msiexec.exe
2012	powershell.exe
2012	powershell.exe
2012	powershell.exe
3024	powershell.exe
3024	powershell.exe
3024	powershell.exe
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
2784	powershell.exe
2784	powershell.exe
2784	powershell.exe
4016	powershell.exe
4016	powershell.exe
4016	powershell.exe
2784	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe
3580	powershell.exe
3580	powershell.exe
3592	msiexec.exe
3592	msiexec.exe
3168	powershell.exe
3168	powershell.exe
3976	powershell.exe
3976	powershell.exe
1216	powershell.exe
1216	powershell.exe
4736	powershell.exe
4736	powershell.exe
3436	powershell.exe
3436	powershell.exe
2888	powershell.exe
2888	powershell.exe
3436	powershell.exe
4196	powershell.exe
4196	powershell.exe
3592	msiexec.exe
3592	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1644	msiexec.exe
Token: SeSecurityPrivilege	3592	msiexec.exe
Token: SeCreateTokenPrivilege	1644	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1644	msiexec.exe
Token: SeLockMemoryPrivilege	1644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1644	msiexec.exe
Token: SeMachineAccountPrivilege	1644	msiexec.exe
Token: SeTcbPrivilege	1644	msiexec.exe
Token: SeSecurityPrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeLoadDriverPrivilege	1644	msiexec.exe
Token: SeSystemProfilePrivilege	1644	msiexec.exe
Token: SeSystemtimePrivilege	1644	msiexec.exe
Token: SeProfSingleProcessPrivilege	1644	msiexec.exe
Token: SeIncBasePriorityPrivilege	1644	msiexec.exe
Token: SeCreatePagefilePrivilege	1644	msiexec.exe
Token: SeCreatePermanentPrivilege	1644	msiexec.exe
Token: SeBackupPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeShutdownPrivilege	1644	msiexec.exe
Token: SeDebugPrivilege	1644	msiexec.exe
Token: SeAuditPrivilege	1644	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1644	msiexec.exe
Token: SeChangeNotifyPrivilege	1644	msiexec.exe
Token: SeRemoteShutdownPrivilege	1644	msiexec.exe
Token: SeUndockPrivilege	1644	msiexec.exe
Token: SeSyncAgentPrivilege	1644	msiexec.exe
Token: SeEnableDelegationPrivilege	1644	msiexec.exe
Token: SeManageVolumePrivilege	1644	msiexec.exe
Token: SeImpersonatePrivilege	1644	msiexec.exe
Token: SeCreateGlobalPrivilege	1644	msiexec.exe
Token: SeCreateTokenPrivilege	1644	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1644	msiexec.exe
Token: SeLockMemoryPrivilege	1644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1644	msiexec.exe
Token: SeMachineAccountPrivilege	1644	msiexec.exe
Token: SeTcbPrivilege	1644	msiexec.exe
Token: SeSecurityPrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeLoadDriverPrivilege	1644	msiexec.exe
Token: SeSystemProfilePrivilege	1644	msiexec.exe
Token: SeSystemtimePrivilege	1644	msiexec.exe
Token: SeProfSingleProcessPrivilege	1644	msiexec.exe
Token: SeIncBasePriorityPrivilege	1644	msiexec.exe
Token: SeCreatePagefilePrivilege	1644	msiexec.exe
Token: SeCreatePermanentPrivilege	1644	msiexec.exe
Token: SeBackupPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeShutdownPrivilege	1644	msiexec.exe
Token: SeDebugPrivilege	1644	msiexec.exe
Token: SeAuditPrivilege	1644	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1644	msiexec.exe
Token: SeChangeNotifyPrivilege	1644	msiexec.exe
Token: SeRemoteShutdownPrivilege	1644	msiexec.exe
Token: SeUndockPrivilege	1644	msiexec.exe
Token: SeSyncAgentPrivilege	1644	msiexec.exe
Token: SeEnableDelegationPrivilege	1644	msiexec.exe
Token: SeManageVolumePrivilege	1644	msiexec.exe
Token: SeImpersonatePrivilege	1644	msiexec.exe
Token: SeCreateGlobalPrivilege	1644	msiexec.exe
Token: SeCreateTokenPrivilege	1644	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1644	msiexec.exe
Token: SeLockMemoryPrivilege	1644	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1644	msiexec.exe
4480	Notepad.exe
2788	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4328	3592	msiexec.exe	87
PID 3592 wrote to memory of 4328	3592	msiexec.exe	87
PID 3592 wrote to memory of 4328	3592	msiexec.exe	87
PID 4328 wrote to memory of 3496	4328	MsiExec.exe	88
PID 4328 wrote to memory of 3496	4328	MsiExec.exe	88
PID 4328 wrote to memory of 3496	4328	MsiExec.exe	88
PID 4328 wrote to memory of 3244	4328	MsiExec.exe	90
PID 4328 wrote to memory of 3244	4328	MsiExec.exe	90
PID 4328 wrote to memory of 3244	4328	MsiExec.exe	90
PID 4328 wrote to memory of 4724	4328	MsiExec.exe	95
PID 4328 wrote to memory of 4724	4328	MsiExec.exe	95
PID 4328 wrote to memory of 4724	4328	MsiExec.exe	95
PID 3592 wrote to memory of 3564	3592	msiexec.exe	96
PID 3592 wrote to memory of 3564	3592	msiexec.exe	96
PID 3592 wrote to memory of 3564	3592	msiexec.exe	96
PID 3564 wrote to memory of 3812	3564	MsiExec.exe	97
PID 3564 wrote to memory of 3812	3564	MsiExec.exe	97
PID 3564 wrote to memory of 3812	3564	MsiExec.exe	97
PID 3564 wrote to memory of 3964	3564	MsiExec.exe	100
PID 3564 wrote to memory of 3964	3564	MsiExec.exe	100
PID 3564 wrote to memory of 3964	3564	MsiExec.exe	100
PID 3564 wrote to memory of 2012	3564	MsiExec.exe	104
PID 3564 wrote to memory of 2012	3564	MsiExec.exe	104
PID 3564 wrote to memory of 2012	3564	MsiExec.exe	104
PID 2012 wrote to memory of 2292	2012	powershell.exe	107
PID 2012 wrote to memory of 2292	2012	powershell.exe	107
PID 2012 wrote to memory of 2292	2012	powershell.exe	107
PID 3564 wrote to memory of 3024	3564	MsiExec.exe	108
PID 3564 wrote to memory of 3024	3564	MsiExec.exe	108
PID 3564 wrote to memory of 3024	3564	MsiExec.exe	108
PID 3564 wrote to memory of 3932	3564	MsiExec.exe	110
PID 3564 wrote to memory of 3932	3564	MsiExec.exe	110
PID 3564 wrote to memory of 3932	3564	MsiExec.exe	110
PID 3592 wrote to memory of 1728	3592	msiexec.exe	112
PID 3592 wrote to memory of 1728	3592	msiexec.exe	112
PID 3592 wrote to memory of 1728	3592	msiexec.exe	112
PID 3564 wrote to memory of 4576	3564	MsiExec.exe	113
PID 3564 wrote to memory of 4576	3564	MsiExec.exe	113
PID 3564 wrote to memory of 4576	3564	MsiExec.exe	113
PID 3564 wrote to memory of 4016	3564	MsiExec.exe	119
PID 3564 wrote to memory of 4016	3564	MsiExec.exe	119
PID 3564 wrote to memory of 4016	3564	MsiExec.exe	119
PID 4328 wrote to memory of 4656	4328	MsiExec.exe	121
PID 4328 wrote to memory of 4656	4328	MsiExec.exe	121
PID 4328 wrote to memory of 4656	4328	MsiExec.exe	121
PID 3592 wrote to memory of 1008	3592	msiexec.exe	122
PID 3592 wrote to memory of 1008	3592	msiexec.exe	122
PID 3592 wrote to memory of 1008	3592	msiexec.exe	122
PID 1008 wrote to memory of 5020	1008	MsiExec.exe	123
PID 1008 wrote to memory of 5020	1008	MsiExec.exe	123
PID 1008 wrote to memory of 5020	1008	MsiExec.exe	123
PID 1008 wrote to memory of 4364	1008	MsiExec.exe	126
PID 1008 wrote to memory of 4364	1008	MsiExec.exe	126
PID 1008 wrote to memory of 4364	1008	MsiExec.exe	126
PID 1008 wrote to memory of 3580	1008	MsiExec.exe	128
PID 1008 wrote to memory of 3580	1008	MsiExec.exe	128
PID 1008 wrote to memory of 3580	1008	MsiExec.exe	128
PID 1008 wrote to memory of 3168	1008	MsiExec.exe	130
PID 1008 wrote to memory of 3168	1008	MsiExec.exe	130
PID 1008 wrote to memory of 3168	1008	MsiExec.exe	130
PID 3168 wrote to memory of 3040	3168	powershell.exe	132
PID 3168 wrote to memory of 3040	3168	powershell.exe	132
PID 3168 wrote to memory of 3040	3168	powershell.exe	132
PID 1008 wrote to memory of 3976	1008	MsiExec.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\com.steam.322170_installer_43177719.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1644

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B27D27AC6E70E8C1EF2C6BA2BE780E3 C
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssD20C.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssED49.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3244
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Eclipse Media Inc\Installer Assistant\prerequisites\WCSetup_EmuWC.msi" /q
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Eclipse Media Inc\Installer Assistant\prerequisites\BESetup_EmuWC.msi" /q
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssFB4D.tmp.ps1"
    3⤵
    PID:2476
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FCBCA48635C40B3FE86591786E02E2E1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss91A.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss1572.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3964
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss2228.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Users\Admin\AppData\Roaming\BBWC\7za.exe
      "C:\Users\Admin\AppData\Roaming/BBWC/7za.exe" x C:\Users\Admin\AppData\Roaming/BBWC\WC.7z -y -p1.21.1046.31159
      4⤵
      Executes dropped EXE
      PID:2292
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss3065.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3024
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss3C11.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss4A2F.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4576
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss6ADA.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4016
- C:\Windows\Installer\MSI4A13.tmp
  "C:\Windows\Installer\MSI4A13.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\BBWC\" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noninteractive -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()"
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 77DE0A215D3DBE2710ED356B670F5B36
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss83D8.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:5020
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss9178.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss9DF0.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssACF7.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Users\Admin\AppData\Roaming\Browser Extension\7za.exe
      "C:\Users\Admin\AppData\Roaming/Browser Extension/7za.exe" x Data.7z -y -p1.20.146.32792
      4⤵
      Executes dropped EXE
      PID:3040
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssBD38.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3976
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssCB17.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssDC32.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssF03B.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2888
- C:\Windows\Installer\MSIDBF1.tmp
  "C:\Windows\Installer\MSIDBF1.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\Browser Extension\" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/Browser Extension/BE.txt';$h=Get-Content -Path $w -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.BrowserExtension.S]::Start()"
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:116
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4E3B41560BC7A450D4B362809262FA08
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2124
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssE00C.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:4196

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noninteractive -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2784

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\FindBackup.js
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:4480

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FindBackup.js"
1⤵
PID:3728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/Browser Extension/BE.txt';$h=Get-Content -Path $w -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.BrowserExtension.S]::Start()"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UnblockPublish.bat" "
1⤵
PID:1604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UnblockPublish.bat" "
1⤵
PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UnblockPublish.bat" "
1⤵
PID:4104

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\UnblockPublish.bat
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e570551.rbs

Filesize
12KB

MD5
76540d26ed28c075e98faefc9cbf7d6d

SHA1
4668ab71f8af7b8056ebd262118d849625e5927f

SHA256
91d0d12456321fd08cd9f9c2367185d8c1fd094e71a35f42e5e5c1e4b1fc9448

SHA512
6edaff863aac433d1c41ef7a7f99fea738ebb37286e266aa0963757a8f76d5c26993b8bf1a4d889616ec12333f33c8c90ad5459991975e8b05c0ce7efd3515c2

Download Submit
C:\Config.Msi\e570555.rbs

Filesize
12KB

MD5
e2e01b8a2b79f52ccd172149597872bc

SHA1
8f480fa1c5d969d67df24aebda338001fdae2b7b

SHA256
744f9c3b79214018bc5a3f6a8a7d5d7c987425de6ff79f00684fb1d1627b216a

SHA512
7a707d8a8cf880d31600b6ec1d7bc749c0c2a1232b101e54c145224084d2648bec2866301cfa69d3c11e7035c66396abd03cf128467aeb955947cebea38b9bbf

Download Submit
C:\Config.Msi\e570558.rbs

Filesize
481KB

MD5
55033d0fe655216d7d6c8c5aab5b73cd

SHA1
4b69fb18a9b039458d872112000eccd3cb4e8f38

SHA256
7f0075b82cf505a66140eb393e35db9afb92c7b9d36577330cc995837f659449

SHA512
feffe51bb43ae625bb5d9fe70f952c3ddb8ad65222c7719eb02918b5e2a12b467fc8c58e291e1d3be843ac0a4fce5d19f71a9f445f8bda1cba5301620c771ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
0774a05ce5ee4c1af7097353c9296c62

SHA1
658ff96b111c21c39d7ad5f510fb72f9762114bb

SHA256
d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4

SHA512
104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
51a8460e3199b3f3ac1e084577b2fc06

SHA1
927ba022f23bae68cea89a8fe48ee3cba4fdb772

SHA256
9286ec86c854542a44e0b12d023af39327630c57040be7c738e3ae919e38dea4

SHA512
c301590a963f8cef0c2ac4e87f3955b94251ab1ef5b99bd3aef1273d02ec9431bc2072e191041b9cbe5faf3e012ad56b0ddceff9f9478cf46534e4180660fc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
1015effbaedf7653e5a71962e22a9ad5

SHA1
343e5cb8fbaeb4cfa533dcbc739686c753d8f948

SHA256
8581ddd5a4d8b17d9cb63df456399a75b05f4908a842c6a2e5d770b055fa53f7

SHA512
470e75ac4dca5f515228cc6b7c83a3cdc5dd843148d0803874c678fe6983888abfe5ea5d13094bb65a8537cb5c5e803454c64aef2f5ed4bd953d8114a41f9388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
62c138fc4a2a84ec840ca6ce44047b8d

SHA1
d93c6a306c25e70e5b14450ffda253686a8c59e7

SHA256
b32542bd046128658a1f9d396c41f6132cf25b3378ea68e4312ee8e18d84be37

SHA512
abd2fbc2f06cfcd8fa4f199f9509004e8ad0d4d0fbcf37f686e6b882aaf9a7d5afe007e8af7faebb05d981315501d430abe5f48d49651d10ea3b9c0e87c89154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
df47fadf60d3be0f55a0304f30434eef

SHA1
5ac086132dcc4d2ab4f59d37bb41b68c6a7ae607

SHA256
5faf4b13654069ece0711613d3ea5a792ce2174debd578b52d220b1612809352

SHA512
bf76b9d8611a0284217dcb2e0e0ee0996f41e723422b6de54b8dcc6b0a3c808a7db5e0131ceca3f93639d308f85388376708d6fd4e40a84a909b8b38648b8b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
9e9522cd4a776b9642a29a12ed49dd16

SHA1
9f5da9fbc9fd9005e5163ffbfaaaf90deee8a557

SHA256
31ccf14730261b4df90aa04c43e1630008aa31ae0b34a259e6527b7a855905e3

SHA512
a4dd432c744c0da4a2c1b19d0d74ec2161ba791dfed2188b4a8a7c7bf7298b7b2391dbd9b4be641774b6705883434b3abfc3086d85f7c45268728e6e047efc21

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1A.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1A.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC95F.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC95F.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID18E.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID18E.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEAC4.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEAC4.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEB13.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEB13.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEB13.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEB72.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEB72.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIED09.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIED09.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEDE5.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEDE5.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEE54.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEE54.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEE83.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEE83.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFEB1.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFEB1.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFF3F.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFF3F.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFF3F.tmp

Filesize
568KB

MD5
a3aa72600009a787d43e416607b93788

SHA1
edca472f111824f894692e827960d93a96695319

SHA256
4682dde803565d892faeb5e4cde49364829d950e6f71592eeaf9ad2d2c227c7c

SHA512
c733862e75cb6bed056b0f8399e28865ca2b4ae346c83ae5fc6c0996c9ab2c56f688edf46b3ccf01cf3bbeba80b284e7e749897b3094337fac55c72cc9f3d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ProCB37.tmp

Filesize
21B

MD5
27931970a207104aef1bf5e876df72d1

SHA1
c887556f7b68a01cad1a80891dbe710ac94c369e

SHA256
d7caf088ea4653dee1bde8664827d051e02b377d354f39b559056c7f9ebca5b8

SHA512
52e050972eb4102fcaa49b875da572270bceba60fc1a724ac775721b67d70fffe79ab65238f96c52879b8a85bc0375e4d86a90cb28c025a2c598f2adb2701e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\ProF04B.tmp

Filesize
164B

MD5
0c6982404ea88056e090dc67ff7dc467

SHA1
ea0c65e486eef042a62df1e3a0519c3b4ff55e36

SHA256
70e82ce55c841c21f0790217c4beffc37df50b052c2e65e8e12d8eeb0e7bd7db

SHA512
47b172f6c7fa868610c79f5363b658eff96dd5bf590c3a9b580dce333e316eaffc499aedc918e0b28c51a71afc068bca057fc0efaf242a772d8d3318835d592d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aekwg5dh.stn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msiD1CC.tmp.txt

Filesize
60B

MD5
14e48023710bb53aa0d2467b947db981

SHA1
5eb25a9a993e21ed32d19426a919bcf0bb934534

SHA256
33795ac1d9e89ab87f74009a2c9d4bcccebdbbed49c932dbd9018f694e3dac3f

SHA512
1cdc404b2594ea321a191ba89994af674e052fe961259fb58b01c4930f3ee1bf7c67b552a06b70d103141c8d0cc4a246f5fb972cff6dc9eeb1ea32ed8aec1099

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss1571.tmp.ps1

Filesize
1KB

MD5
92e8f020390914efb6138613cc07f449

SHA1
8b4fa4c6d0b8832eb4380b3f9a861c0788ec18e5

SHA256
26cf0f5c2dfa1e3589e689f4a16041be87fcaf2b31b7be0ded273c483d9577c2

SHA512
980d19faf254a634b0b362c0d19ecb041caf32ccdfdb3ab45acc5f7a6e307a209def8ce5aea5523ec3517fc1c2eb49e10dc41759cb83becff61f13347309f677

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss1572.tmp.ps1

Filesize
5KB

MD5
654d98e58200f1de5a472328c201b1a1

SHA1
a48ba2fb31b5fa455dadfab4e7994af2129fdc44

SHA256
21ae360db55a7b36b53b15a401cecce526b173f3460a7d8e98786c52bca3b1a1

SHA512
26315eacef8b69559a6cf6d17da2795023d9a5b4532ae60b3edd2dcd0aed36350b72c23f5ff6d16d73949015d519a26d2b4fa0ea85c78dcb6d33a10077e0195f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss2227.tmp.ps1

Filesize
4KB

MD5
98c39ee167d7d4f2cfb24a7099f1e17c

SHA1
78a5b3189e047a08cc20efc97225b929d657bb75

SHA256
57f751a5f378dda9c0d03a4d28000f18a53ca68a95a7305f3f70000f509302d8

SHA512
f160b9194e27778fe3df80ac0629dd4367ec055b62cbbe69a39d2efb9977bca7357f2a180d462175b15ae3af7526274d4faa8706ba0d02be2f0827509ebb05a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss2228.tmp.ps1

Filesize
5KB

MD5
89dd94fe0395975add0246e96da0234b

SHA1
b21f6c37cad6cf075c14a8b0797f11b14c24465d

SHA256
f3e6beebec57ee25871d6b2fc5fa7fcaa186673dee3c4fe6d20d0272527f4332

SHA512
174079273f1519149f922a16a0dfde28c6e5bde3d03f03231187c30e2fd39a70e00a5ee9a3b377c0ad9984d9fb3afb273952776e234beb6714ca6999239444ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss3064.tmp.ps1

Filesize
2KB

MD5
2fb50179c009486a333c1b3d840b3e7d

SHA1
d7a82d974a6c32f12bbaa0bca69ffc184ca3e1b7

SHA256
2119543c1367e770a797405578d245715ded63d6c728b209507f07654e961cdc

SHA512
038db0850b81a71fa6d022de408680c9be49d5e72ad6191131814a7dfe97888d8cc026f4977331adc530a75aa4a22ce7ac094eade9fa95cd4efb41556b17f588

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss3065.tmp.ps1

Filesize
5KB

MD5
3beb85af68747c026bc847c3bdb4aa9e

SHA1
ac609d1ef4fec390752f01d52c8660e6120ad465

SHA256
16d132245efa6c1e5f135431d57d627bd71c28244ef8fb95028eb51f8f255571

SHA512
bb2c7c913e4ba0e34b4613fa3821074bebc1fbe6aeb36416a0338fb067217719981b783dd21a3b5b9ea48c56429a70147f3641de51e6e693e01173a364ca66d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss909.tmp.ps1

Filesize
2KB

MD5
f64892b5a7640e2ea30f3b99bb2543cb

SHA1
7b805176d1b66d633132150478cc800e3cdb2e21

SHA256
cfb6033af495ba339d587a8a1799c16804ee3c8da53d1f0148509931f2586299

SHA512
ee31a8dc593b3d642e0f5a97ca3bdb485472e51741822aa031b7e32894c50e2566ccb32bcbf6a17438284d9235ab3d9aec2cfe8fc6898eadef47768b4e187db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss91A.tmp.ps1

Filesize
5KB

MD5
14619eabce46d455ae78e7a05514e0b5

SHA1
20d99ee308e63370cd6b6c0c517a906464daad19

SHA256
216edfb81ab41458da6b851ceafd073f82a7ac4a4adc4b698d3768ef90627cb1

SHA512
775adf6c2c6ceec4b69e3a89b175ab5a5d5a1be09fbc8da7196392e72d93803ae3d9a3c98481ba7f90cd136704edac4aad877d88e2bac2599ac3642071925f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssD1DC.tmp.ps1

Filesize
1KB

MD5
b73a574214c3df0808adb8ed865c922b

SHA1
bf0ac25a4f40c7f4f5023face07d22b100cfa10f

SHA256
40d28970bbb468a94819e72eb69a908a788ee999fece87f421c680a5eee91c34

SHA512
929553551e42e9180b77d063ce7a10c30f3b6ccba5560a1bf179b1d8436b39671be5e1bbc715470f3b9b9f4c2ad73bbc3dbb6beb6c2cef5ff5b9fe0c49d8bffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssD20C.tmp.ps1

Filesize
5KB

MD5
f96663edbe44a1c28bb9a2784cb92f05

SHA1
00cbd70a4ab92c7a642eebc083ba547894ee2ba0

SHA256
0c371a359ea99542ebb2310852e0068754031276ec80e25fbfc14934f16515bc

SHA512
5bd97b60d4e96ced55382035f3685c12993607376980514646c74dd2a85082ca424505153ecdc68d9ea8228429a2c47ba6809dcb0e433c35acbbddb28db90475

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssED48.tmp.ps1

Filesize
2KB

MD5
1965ee29cc565ce1582fe3bc77941934

SHA1
a8ae9c5de6fea8756eedbc40016eea80b2505ac3

SHA256
b62b83e8b0da2db2777b05cddd5370eb43f8a3fb30971674f0c367d1c3c2da14

SHA512
d007755c00b231baea688d767a452992628cb9837c6233233fcda20b70f7bbbcdcc8ec3215fca420ba4294f7117694d153a1d248357693d14e75d5d252796ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssED49.tmp.ps1

Filesize
5KB

MD5
ad2758cee581f0c56c8c038c4d2b1ff8

SHA1
fbed288347dd2b909cf53b71c92b8582f1a6ef97

SHA256
ae12fa9edbdcf114798646fdae8dc721464fede05ba344153fe1cb12c64df4a9

SHA512
4374003444794e355b51cc9c32a7e97579c9b1eca99b9d6f442e867bfdfbb28853f00a348516e451dad8ccd1a8828243e4668eade20bd94b62b516f86cb394cc

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\7za.exe

Filesize
732KB

MD5
e1b508c705764b2a5a6a3ad9aa0c4a8b

SHA1
ab87b6aad2691893fef442c6d23856019e586e32

SHA256
36ec352e960101094ec09ce9a22e077f7135f38aa70a974ba115c04d74a2ba88

SHA512
0bec72890d51429ce4aa7253d7cfeccb94dbb7460196d0c6f760d57693a9476ded5353f4cc51a925aad9ecd8408dab59c6ef62df94d8da1ed10c85269d505447

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\WC.7z

Filesize
689KB

MD5
e880d7f1f77be72738c5458baa11908a

SHA1
663fbfeaf9aaa6f0f7c6b1df0501be0d8ebc2ae3

SHA256
0f6c2664399fd4a86d286310e98a4465f77ef4ad641f0c2328cbcbd86f2dc0f8

SHA512
5d200916fb295be3c015bc01b471d725f446d6e8fcf7e39bb3cab1eb49658dd60dad8d141f0e564d26137947497256b5b055d421fa029ba51b1cebe5a3d8b193

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\intermediate.dat

Filesize
8B

MD5
9c34c54c5e6668103fcf068060c98744

SHA1
2d63c2e127d63d576a9f00868a3160e76b07c3ab

SHA256
5f814ea9a5a91f8478c04fd0329467130f89376730547fb6d965fa9883618dd8

SHA512
f4543d492de7027326e640616ff0ffb317782c327d8b9e0f4eb44230e954faee1be84a9dd6dada41d8dca498ea8ae77e33a88d9f5e573586fc7db61f7dd758ba

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\updater.ini

Filesize
281B

MD5
1f1d129bce8738bccb06b1bdce937434

SHA1
bfe76d0a87d4e1a1f55e462482b9c3fbcf21cda6

SHA256
bffd9deb5617560e320a20a1f6b8343e52d991da2512d64d378e65869f93aa79

SHA512
6b6730b7f3801d044308a720d61bc7a8f410e0f8b41186772b881163f29b70f568d918bce2cf0b3bf39c24e93ff397d8cea99b59d730adc395ef989b04ffbac0

Download Submit
C:\Users\Admin\AppData\Roaming\Browser Extension\SafeBrowsingExtension\.data\be.json

Filesize
118B

MD5
3ff65fa8775e4aa59fdd3702fb9c4f1c

SHA1
0d70acb7ee10ce5ae410610d9f7c58d7e9ea8d6c

SHA256
922bf487aac03ab40bb87891ad4df001ce216f4f6c1f4dd7bc9d0849efe44bd9

SHA512
a8bee7ded48fb7762aa22f627017d6206f1f753f09f140dc90c0b8f07feaedb8f1beddcde15fd77f960dc8520dbd7d53d459abe4f1485eddb109a6b9a95998a9

Download Submit
C:\Users\Admin\AppData\Roaming\Eclipse Media Inc\Installer Assistant\prerequisites\WCSetup_EmuWC.msi

Filesize
3.0MB

MD5
cc0cdad317b637cf780b74c683eac942

SHA1
f47a23fd7085d1511f62c7b7c1970aeba6f95b0f

SHA256
b97f7b0ce9b8160d2b6c2813b20911d86563a4a0d4791466fdd53df3d2d81ea9

SHA512
1b292f37daece9982d885b25406665d157ffb4a93cd4c2d08e0e66b6cd62824a007d5b6adb8ad62f1669c2f8e406e622b06bd7bec0c40d1b3efc23ce2e49a80f

Download Submit
C:\Windows\Installer\MSI1407.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI1407.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI1466.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI1466.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI14F3.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI14F3.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI1D41.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI1D41.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI21B8.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI21B8.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI3001.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI3001.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI3BCA.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI753.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI753.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI85D.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI85D.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI85D.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\e570552.msi

Filesize
3.0MB

MD5
cc0cdad317b637cf780b74c683eac942

SHA1
f47a23fd7085d1511f62c7b7c1970aeba6f95b0f

SHA256
b97f7b0ce9b8160d2b6c2813b20911d86563a4a0d4791466fdd53df3d2d81ea9

SHA512
1b292f37daece9982d885b25406665d157ffb4a93cd4c2d08e0e66b6cd62824a007d5b6adb8ad62f1669c2f8e406e622b06bd7bec0c40d1b3efc23ce2e49a80f

Download Submit
C:\Windows\Installer\e570556.msi

Filesize
3.5MB

MD5
badb9fba44bdbc6623e3d94e22797d8b

SHA1
818a0e280eaa6978ad6cb4bba55555cb78c33d22

SHA256
d958225ff9ea9eaa8b60d0b18e5364e5912165c39a37abe2bc8d0774c997682e

SHA512
1301bf7eaacaba2a41ea150081f799d79e529b60219e264546aa0da656a74ed0dffd7a77408eadbf87526a362689b417a38a3ec4c978da67d6e9b1cdd3480a33

Download Submit
memory/2012-389-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/2012-387-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/2012-386-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/2784-529-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/2784-527-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/2784-528-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/2784-482-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/2784-480-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/2784-479-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3024-423-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3024-427-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3024-424-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3168-667-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/3168-668-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/3168-669-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/3244-236-0x0000000009630000-0x0000000009B5C000-memory.dmp

Filesize
5.2MB

Download
memory/3244-237-0x0000000007BD0000-0x0000000007C62000-memory.dmp

Filesize
584KB

Download
memory/3244-230-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3244-234-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3244-229-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3244-235-0x0000000008400000-0x00000000085C2000-memory.dmp

Filesize
1.8MB

Download
memory/3496-155-0x0000000004F10000-0x0000000005538000-memory.dmp

Filesize
6.2MB

Download
memory/3496-158-0x0000000004E60000-0x0000000004E82000-memory.dmp

Filesize
136KB

Download
memory/3496-170-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Filesize
120KB

Download
memory/3496-159-0x00000000055B0000-0x0000000005616000-memory.dmp

Filesize
408KB

Download
memory/3496-178-0x0000000007EF0000-0x000000000856A000-memory.dmp

Filesize
6.5MB

Download
memory/3496-176-0x00000000061C0000-0x00000000061E2000-memory.dmp

Filesize
136KB

Download
memory/3496-154-0x0000000002660000-0x0000000002696000-memory.dmp

Filesize
216KB

Download
memory/3496-177-0x00000000072C0000-0x0000000007864000-memory.dmp

Filesize
5.6MB

Download
memory/3496-173-0x00000000048D0000-0x00000000048E0000-memory.dmp

Filesize
64KB

Download
memory/3496-175-0x0000000006140000-0x000000000615A000-memory.dmp

Filesize
104KB

Download
memory/3496-156-0x00000000048D0000-0x00000000048E0000-memory.dmp

Filesize
64KB

Download
memory/3496-165-0x0000000005540000-0x00000000055A6000-memory.dmp

Filesize
408KB

Download
memory/3496-157-0x00000000048D0000-0x00000000048E0000-memory.dmp

Filesize
64KB

Download
memory/3496-174-0x0000000006C30000-0x0000000006CC6000-memory.dmp

Filesize
600KB

Download
memory/3580-596-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

Filesize
64KB

Download
memory/3580-597-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

Filesize
64KB

Download
memory/3812-271-0x0000000004910000-0x0000000004920000-memory.dmp

Filesize
64KB

Download
memory/3812-270-0x0000000004910000-0x0000000004920000-memory.dmp

Filesize
64KB

Download
memory/3812-284-0x0000000004910000-0x0000000004920000-memory.dmp

Filesize
64KB

Download
memory/3932-446-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/3932-448-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/3932-447-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/3964-303-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3976-717-0x0000000003200000-0x0000000003210000-memory.dmp

Filesize
64KB

Download
memory/3976-716-0x0000000003200000-0x0000000003210000-memory.dmp

Filesize
64KB

Download
memory/4016-517-0x000000006F240000-0x000000006F28C000-memory.dmp

Filesize
304KB

Download
memory/4016-516-0x00000000031D0000-0x00000000031E0000-memory.dmp

Filesize
64KB

Download
memory/4016-515-0x00000000031D0000-0x00000000031E0000-memory.dmp

Filesize
64KB

Download
memory/4016-514-0x00000000031D0000-0x00000000031E0000-memory.dmp

Filesize
64KB

Download
memory/4364-584-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/4364-585-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/4364-583-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/4576-483-0x0000000007820000-0x0000000007852000-memory.dmp

Filesize
200KB

Download
memory/4576-496-0x000000007F540000-0x000000007F550000-memory.dmp

Filesize
64KB

Download
memory/4576-495-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

Filesize
40KB

Download
memory/4576-494-0x00000000077E0000-0x00000000077FE000-memory.dmp

Filesize
120KB

Download
memory/4576-484-0x000000006F240000-0x000000006F28C000-memory.dmp

Filesize
304KB

Download
memory/4576-481-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4576-469-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4576-459-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/5020-559-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/5020-558-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/5020-561-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download