d04bbcd2855d3bba4627cbb1da3a0e5fa79fe0b27b371024605ff1382ea94c58

Analysis

max time kernel
151s
max time network
149s
platform
windows7_x64
resource
win7
submitted
23-09-2020 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FileZilla_3.50.0_win64_sponsored-setup.exe
Size

12.9MB
MD5

90f560ce71cc77fc2e121761eeef265c
SHA1

85ff0ad4728e31539e1d3757a543d47e9cd42f74
SHA256

d04bbcd2855d3bba4627cbb1da3a0e5fa79fe0b27b371024605ff1382ea94c58
SHA512

c5a6b3890743ff0f1ea3f6fc9c2f28cf70e9f47c4067830ca63b38c3a1b10d386dc0d889c3041a553876b4a14fafd094f4a7d41279273b85148d6a8f9b9d54e1

Score

10^/10

ransomware macro persistence stealer adware spyware discovery

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\String1033.txt

Ransom Note

DN_AlwaysInstall=Always Install IDPROP_EXPRESS_LAUNCH_CONDITION_COLOR=The color settings of your system are not adequate for running [ProductName]. IDPROP_EXPRESS_LAUNCH_CONDITION_OS=The operating system is not adequate for running [ProductName]. IDPROP_EXPRESS_LAUNCH_CONDITION_PROCESSOR=The processor is not adequate for running [ProductName]. IDPROP_EXPRESS_LAUNCH_CONDITION_RAM=The amount of RAM is not adequate for running [ProductName]. IDPROP_EXPRESS_LAUNCH_CONDITION_SCREEN=The screen resolution is not adequate for running [ProductName]. IDPROP_SETUPTYPE_COMPACT=Compact IDPROP_SETUPTYPE_COMPACT_DESC=Compact Description IDPROP_SETUPTYPE_COMPLETE=Complete IDPROP_SETUPTYPE_COMPLETE_DESC=Complete IDPROP_SETUPTYPE_CUSTOM=Custom IDPROP_SETUPTYPE_CUSTOM_DESC=Custom Description IDPROP_SETUPTYPE_CUSTOM_DESC_PRO=Custom IDPROP_SETUPTYPE_TYPICAL=Typical IDPROP_SETUPTYPE_TYPICAL_DESC=Typical Description IDS_ACTIONTEXT_Advertising=Advertising application IDS_ACTIONTEXT_AllocatingRegistry=Allocating registry space IDS_ACTIONTEXT_AppCommandLine=Application: [1], Command line: [2] IDS_ACTIONTEXT_AppId=AppId: [1]{{, AppType: [2]}} IDS_ACTIONTEXT_AppIdAppTypeRSN=AppId: [1]{{, AppType: [2], Users: [3], RSN: [4]}} IDS_ACTIONTEXT_Application=Application: [1] IDS_ACTIONTEXT_BindingExes=Binding executables IDS_ACTIONTEXT_ClassId=Class ID: [1] IDS_ACTIONTEXT_ClsID=Class ID: [1] IDS_ACTIONTEXT_ComponentIDQualifier=Component ID: [1], Qualifier: [2] IDS_ACTIONTEXT_ComponentIdQualifier2=Component ID: [1], Qualifier: [2] IDS_ACTIONTEXT_ComputingSpace=Computing space requirements IDS_ACTIONTEXT_ComputingSpace2=Computing space requirements IDS_ACTIONTEXT_ComputingSpace3=Computing space requirements IDS_ACTIONTEXT_ContentTypeExtension=MIME Content Type: [1], Extension: [2] IDS_ACTIONTEXT_ContentTypeExtension2=MIME Content Type: [1], Extension: [2] IDS_ACTIONTEXT_CopyingNetworkFiles=Copying files to the network IDS_ACTIONTEXT_CopyingNewFiles=Copying new files IDS_ACTIONTEXT_CreatingDuplicate=Creating duplicate files IDS_ACTIONTEXT_CreatingFolders=Creating folders IDS_ACTIONTEXT_CreatingIISRoots=Creating IIS Virtual Roots... IDS_ACTIONTEXT_CreatingShortcuts=Creating shortcuts IDS_ACTIONTEXT_DeletingServices=Deleting services IDS_ACTIONTEXT_EnvironmentStrings=Updating environment strings IDS_ACTIONTEXT_EvaluateLaunchConditions=Evaluating launch conditions IDS_ACTIONTEXT_Extension=Extension: [1] IDS_ACTIONTEXT_Extension2=Extension: [1] IDS_ACTIONTEXT_Feature=Feature: [1] IDS_ACTIONTEXT_FeatureColon=Feature: [1] IDS_ACTIONTEXT_File=File: [1] IDS_ACTIONTEXT_File2=File: [1] IDS_ACTIONTEXT_FileDependencies=File: [1], Dependencies: [2] IDS_ACTIONTEXT_FileDir=File: [1], Directory: [9] IDS_ACTIONTEXT_FileDir2=File: [1], Directory: [9] IDS_ACTIONTEXT_FileDir3=File: [1], Directory: [9] IDS_ACTIONTEXT_FileDirSize=File: [1], Directory: [9], Size: [6] IDS_ACTIONTEXT_FileDirSize2=File: [1], Directory: [9], Size: [6] IDS_ACTIONTEXT_FileDirSize3=File: [1], Directory: [9], Size: [6] IDS_ACTIONTEXT_FileDirSize4=File: [1], Directory: [2], Size: [3] IDS_ACTIONTEXT_FileDirectorySize=File: [1], Directory: [9], Size: [6] IDS_ACTIONTEXT_FileFolder=File: [1], Folder: [2] IDS_ACTIONTEXT_FileFolder2=File: [1], Folder: [2] IDS_ACTIONTEXT_FileSectionKeyValue=File: [1], Section: [2], Key: [3], Value: [4] IDS_ACTIONTEXT_FileSectionKeyValue2=File: [1], Section: [2], Key: [3], Value: [4] IDS_ACTIONTEXT_Folder=Folder: [1] IDS_ACTIONTEXT_Folder1=Folder: [1] IDS_ACTIONTEXT_Font=Font: [1] IDS_ACTIONTEXT_Font2=Font: [1] IDS_ACTIONTEXT_FoundApp=Found application: [1] IDS_ACTIONTEXT_FreeSpace=Free space: [1] IDS_ACTIONTEXT_GeneratingScript=Generating script operations for action: IDS_ACTIONTEXT_ISLockPermissionsCost=Gathering permissions information for objects... IDS_ACTIONTEXT_ISLockPermissionsInstall=Applying permissions information for objects... IDS_ACTIONTEXT_InitializeODBCDirs=Initializing ODBC directories IDS_ACTIONTEXT_InstallODBC=Installing ODBC components IDS_ACTIONTEXT_InstallServices=Installing new services IDS_ACTIONTEXT_InstallingSystemCatalog=Installing system catalog IDS_ACTIONTEXT_KeyName=Key: [1], Name: [2] IDS_ACTIONTEXT_KeyNameValue=Key: [1], Name: [2], Value: [3] IDS_ACTIONTEXT_MigratingFeatureStates=Migrating feature states from related applications IDS_ACTIONTEXT_MovingFiles=Moving files IDS_ACTIONTEXT_NameValueAction=Name: [1], Value: [2], Action [3] IDS_ACTIONTEXT_NameValueAction2=Name: [1], Value: [2], Action [3] IDS_ACTIONTEXT_PatchingFiles=Patching files IDS_ACTIONTEXT_ProgID=ProgID: [1] IDS_ACTIONTEXT_ProgID2=ProgID: [1] IDS_ACTIONTEXT_PropertySignature=Property: [1], Signature: [2] IDS_ACTIONTEXT_PublishProductFeatures=Publishing product features IDS_ACTIONTEXT_PublishProductInfo=Publishing product information IDS_ACTIONTEXT_PublishingQualifiedComponents=Publishing qualified components IDS_ACTIONTEXT_RegUser=Registering user IDS_ACTIONTEXT_RegisterClassServer=Registering class servers IDS_ACTIONTEXT_RegisterExtensionServers=Registering extension servers IDS_ACTIONTEXT_RegisterFonts=Registering fonts IDS_ACTIONTEXT_RegisterMimeInfo=Registering MIME info IDS_ACTIONTEXT_RegisterTypeLibs=Registering type libraries IDS_ACTIONTEXT_RegisteringComPlus=Registering COM+ Applications and Components IDS_ACTIONTEXT_RegisteringModules=Registering modules IDS_ACTIONTEXT_RegisteringProduct=Registering product IDS_ACTIONTEXT_RegisteringProgIdentifiers=Registering program identifiers IDS_ACTIONTEXT_RemoveApps=Removing applications IDS_ACTIONTEXT_RemovingBackup=Removing backup files IDS_ACTIONTEXT_RemovingDuplicates=Removing duplicated files IDS_ACTIONTEXT_RemovingFiles=Removing files IDS_ACTIONTEXT_RemovingFolders=Removing folders IDS_ACTIONTEXT_RemovingIISRoots=Removing IIS Virtual Roots... IDS_ACTIONTEXT_RemovingIni=Removing INI file entries IDS_ACTIONTEXT_RemovingMoved=Removing moved files IDS_ACTIONTEXT_RemovingODBC=Removing ODBC components IDS_ACTIONTEXT_RemovingRegistry=Removing system registry values IDS_ACTIONTEXT_RemovingShortcuts=Removing shortcuts IDS_ACTIONTEXT_RollingBack=Rolling back action: IDS_ACTIONTEXT_SearchForRelated=Searching for related applications IDS_ACTIONTEXT_SearchInstalled=Searching for installed applications IDS_ACTIONTEXT_SearchingQualifyingProducts=Searching for qualifying products IDS_ACTIONTEXT_SearchingQualifyingProducts2=Searching for qualifying products IDS_ACTIONTEXT_Service=Service: [1] IDS_ACTIONTEXT_Service2=Service: [2] IDS_ACTIONTEXT_Service3=Service: [1] IDS_ACTIONTEXT_Service4=Service: [1] IDS_ACTIONTEXT_Shortcut=Shortcut: [1] IDS_ACTIONTEXT_Shortcut1=Shortcut: [1] IDS_ACTIONTEXT_StartingServices=Starting services IDS_ACTIONTEXT_StoppingServices=Stopping services IDS_ACTIONTEXT_UnpublishProductFeatures=Unpublishing product features IDS_ACTIONTEXT_UnpublishQualified=Unpublishing Qualified Components IDS_ACTIONTEXT_UnpublishingProductInfo=Unpublishing product information IDS_ACTIONTEXT_UnregTypeLibs=Unregistering type libraries IDS_ACTIONTEXT_UnregisterClassServers=Unregister class servers IDS_ACTIONTEXT_UnregisterExtensionServers=Unregistering extension servers IDS_ACTIONTEXT_UnregisterModules=Unregistering modules IDS_ACTIONTEXT_UnregisteringComPlus=Unregistering COM+ Applications and Components IDS_ACTIONTEXT_UnregisteringFonts=Unregistering fonts IDS_ACTIONTEXT_UnregisteringMimeInfo=Unregistering MIME info IDS_ACTIONTEXT_UnregisteringProgramIds=Unregistering program identifiers IDS_ACTIONTEXT_UpdateComponentRegistration=Updating component registration IDS_ACTIONTEXT_UpdateEnvironmentStrings=Updating environment strings IDS_ACTIONTEXT_Validating=Validating install IDS_ACTIONTEXT_WritingINI=Writing INI file values IDS_ACTIONTEXT_WritingRegistry=Writing system registry values IDS_BACK=< &Back IDS_CANCEL=Cancel IDS_CANCEL2=&Cancel IDS_CHANGE=&Change... IDS_COMPLUS_PROGRESSTEXT_COST=Costing COM+ application: [1] IDS_COMPLUS_PROGRESSTEXT_INSTALL=Installing COM+ application: [1] IDS_COMPLUS_PROGRESSTEXT_UNINSTALL=Uninstalling COM+ application: [1] IDS_DIALOG_TEXT2_DESCRIPTION=Dialog Normal Description IDS_DIALOG_TEXT_DESCRIPTION_EXTERIOR={&TahomaBold10}Dialog Bold Title IDS_DIALOG_TEXT_DESCRIPTION_INTERIOR={&MSSansBold8}Dialog Bold Title IDS_DIFX_AMD64=[ProductName] requires an X64 processor. Click OK to exit the wizard. IDS_DIFX_IA64=[ProductName] requires an IA64 processor. Click OK to exit the wizard. IDS_DIFX_X86=[ProductName] requires an X86 processor. Click OK to exit the wizard. IDS_DatabaseFolder_InstallDatabaseTo=Install [ProductName] database to: IDS_ERROR_0={{Fatal error: }} IDS_ERROR_1=Error [1]. IDS_ERROR_10==== Logging started: [Date] [Time] === IDS_ERROR_100=Could not remove shortcut [2]. Verify that the shortcut file exists and that you can access it. IDS_ERROR_101=Could not register type library for file [2]. Contact your support personnel. IDS_ERROR_102=Could not unregister type library for file [2]. Contact your support personnel. IDS_ERROR_103=Could not update the INI file [2][3]. Verify that the file exists and that you can access it. IDS_ERROR_104=Could not schedule file [2] to replace file [3] on reboot. Verify that you have write permissions to file [3]. IDS_ERROR_105=Error removing ODBC driver manager, ODBC error [2]: [3]. Contact your support personnel. IDS_ERROR_106=Error installing ODBC driver manager, ODBC error [2]: [3]. Contact your support personnel. IDS_ERROR_107=Error removing ODBC driver [4], ODBC error [2]: [3]. Verify that you have sufficient privileges to remove ODBC drivers. IDS_ERROR_108=Error installing ODBC driver [4], ODBC error [2]: [3]. Verify that the file [4] exists and that you can access it. IDS_ERROR_109=Error configuring ODBC data source [4], ODBC error [2]: [3]. Verify that the file [4] exists and that you can access it. IDS_ERROR_11==== Logging stopped: [Date] [Time] === IDS_ERROR_110=Service [2] ([3]) failed to start. Verify that you have sufficient privileges to start system services. IDS_ERROR_111=Service [2] ([3]) could not be stopped. Verify that you have sufficient privileges to stop system services. IDS_ERROR_112=Service [2] ([3]) could not be deleted. Verify that you have sufficient privileges to remove system services. IDS_ERROR_113=Service [2] ([3]) could not be installed. Verify that you have sufficient privileges to install system services. IDS_ERROR_114=Could not update environment variable [2]. Verify that you have sufficient privileges to modify environment variables. IDS_ERROR_115=You do not have sufficient privileges to complete this installation for all users of the machine. Log on as an administrator and then retry this installation. IDS_ERROR_116=Could not set file security for file [3]. Error: [2]. Verify that you have sufficient privileges to modify the security permissions for this file. IDS_ERROR_117=Component Services (COM+ 1.0) are not installed on this computer. This installation requires Component Services in order to complete successfully. Component Services are available on Windows 2000. IDS_ERROR_118=Error registering COM+ application. Contact your support personnel for more information. IDS_ERROR_119=Error unregistering COM+ application. Contact your support personnel for more information. IDS_ERROR_12=Action start [Time]: [1]. IDS_ERROR_120=Removing older versions of this application IDS_ERROR_121=Preparing to remove older versions of this application IDS_ERROR_122=Error applying patch to file [2]. It has probably been updated by other means, and can no longer be modified by this patch. For more information contact your patch vendor. {{System Error: [3]}} IDS_ERROR_123=[2] cannot install one of its required products. Contact your technical support group. {{System Error: [3].}} IDS_ERROR_124=The older version of [2] cannot be removed. Contact your technical support group. {{System Error [3].}} IDS_ERROR_125=The description for service '[2]' ([3]) could not be changed. IDS_ERROR_126=The Windows Installer service cannot update the system file [2] because the file is protected by Windows. You may need to update your operating system for this program to work correctly. {{Package version: [3], OS Protected version: [4]}} IDS_ERROR_127=The Windows Installer service cannot update the protected Windows file [2]. {{Package version: [3], OS Protected version: [4], SFP Error: [5]}} IDS_ERROR_128=The Windows Installer service cannot update one or more protected Windows files. SFP Error: [2]. List of protected files: [3] IDS_ERROR_129=User installations are disabled via policy on the machine. IDS_ERROR_13=Action ended [Time]: [1]. Return value [2]. IDS_ERROR_130=This setup requires Internet Information Server for configuring IIS Virtual Roots. Please make sure that you have IIS installed. IDS_ERROR_131=This setup requires Administrator privileges for configuring IIS Virtual Roots. IDS_ERROR_1329=A file that is required cannot be installed because the cabinet file [2] is not digitally signed. This may indicate that the cabinet file is corrupt. IDS_ERROR_1330=A file that is required cannot be installed because the cabinet file [2] has an invalid digital signature. This may indicate that the cabinet file is corrupt.{ Error [3] was returned by WinVerifyTrust.} IDS_ERROR_1331=Failed to correctly copy [2] file: CRC error. IDS_ERROR_1332=Failed to correctly patch [2] file: CRC error. IDS_ERROR_1333=Failed to correctly patch [2] file: CRC error. IDS_ERROR_1334=The file '[2]' cannot be installed because the file cannot be found in cabinet file '[3]'. This could indicate a network error, an error reading from the CD-ROM, or a problem with this package. IDS_ERROR_1335=The cabinet file '[2]' required for this installation is corrupt and cannot be used. This could indicate a network error, an error reading from the CD-ROM, or a problem with this package. IDS_ERROR_1336=There was an error creating a temporary file that is needed to complete this installation. Folder: [3]. System error code: [2] IDS_ERROR_14=Time remaining: {[1] minutes }{[2] seconds} IDS_ERROR_15=Out of memory. Shut down other applications before retrying. IDS_ERROR_16=Installer is no longer responding. IDS_ERROR_1609=An error occurred while applying security settings. [2] is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error [3] IDS_ERROR_1651=Admin user failed to apply patch for a per-user managed or a per-machine application which is in advertise state. IDS_ERROR_17=Installer terminated prematurely. IDS_ERROR_1715=Installed [2]. IDS_ERROR_1716=Configured [2]. IDS_ERROR_1717=Removed [2]. IDS_ERROR_1718=File [2] was rejected by digital signature policy. IDS_ERROR_1719=Windows Installer service could not be accessed. Contact your support personnel to verify that it is properly registered and enabled. IDS_ERROR_1720=There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor. Custom action [2] script error [3], [4]: [5] Line [6], Column [7], [8] IDS_ERROR_1721=There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: [2], location: [3], command: [4] IDS_ERROR_1722=There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action [2], location: [3], command: [4] IDS_ERROR_1723=There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action [2], entry: [3], library: [4] IDS_ERROR_1724=Removal completed successfully. IDS_ERROR_1725=Removal failed. IDS_ERROR_1726=Advertisement completed successfully. IDS_ERROR_1727=Advertisement failed. IDS_ERROR_1728=Configuration completed successfully. IDS_ERROR_1729=Configuration failed. IDS_ERROR_1730=You must be an Administrator to remo

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Blacklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

116 3040 msiexec.exe
118 3040 msiexec.exe
120 3040 msiexec.exe
Creates new service(s) 1 TTPs
persistence

New Service
T1050

flow	pid	process
116	3040	msiexec.exe
118	3040	msiexec.exe
120	3040	msiexec.exe

Executes dropped EXE 18 IoCs

Processes:

byy.exesaBSI.exeinstaller.exeinstaller.exeServiceHost.exefilezilla.exeUIHost.exeupdater.exeCloseFAH.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exe

pid	process
1404	byy.exe
948	saBSI.exe
2156	installer.exe
2176	installer.exe
1032	ServiceHost.exe
1144	filezilla.exe
2172	UIHost.exe
2364	updater.exe
2948	CloseFAH.exe
1160	ISBEW64.exe
580	ISBEW64.exe
2384	ISBEW64.exe
3064	ISBEW64.exe
1484	ISBEW64.exe
2320	ISBEW64.exe
300	ISBEW64.exe
1960	ISBEW64.exe
2852	ISBEW64.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\in71125248\3AE23A7A_stp\winzip64.msi	office_xlm_macros

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

UIHost.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\International\Geo\Nation UIHost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\International\Geo\Nation	UIHost.exe

Loads dropped DLL 99 IoCs

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exeregsvr32.execmd.exebyy.exesaBSI.exeinstaller.exeregsvr32.exeregsvr32.exefilezilla.exeregsvr32.exeregsvr32.exeServiceHost.exeUIHost.exeregsvr32.exeregsvr32.exeMsiExec.exeMsiExec.exe

pid	process
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
432	regsvr32.exe
1564	cmd.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1404	byy.exe
1404	byy.exe
948	saBSI.exe
2156	installer.exe
2156	installer.exe
2468	regsvr32.exe
2572	regsvr32.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
460
460
1144	filezilla.exe
1144	filezilla.exe
1144	filezilla.exe
1144	filezilla.exe
1144	filezilla.exe
1144	filezilla.exe
1144	filezilla.exe
1144	filezilla.exe
1144	filezilla.exe
1144	filezilla.exe
3068	regsvr32.exe
2268	regsvr32.exe
1032	ServiceHost.exe
1032	ServiceHost.exe
1032	ServiceHost.exe
1032	ServiceHost.exe
1228
1228
1228
1032	ServiceHost.exe
1032	ServiceHost.exe
2172	UIHost.exe
2172	UIHost.exe
1032	ServiceHost.exe
1632	regsvr32.exe
2900	regsvr32.exe
1032	ServiceHost.exe
1032	ServiceHost.exe
2552	MsiExec.exe
1548	MsiExec.exe
1548	MsiExec.exe
1548	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks for any installed AV software in registry 1 TTPs 7 IoCs

Security Software Discovery

T1063

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	FileZilla_3.50.0_win64_sponsored-setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast\Version	FileZilla_3.50.0_win64_sponsored-setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	FileZilla_3.50.0_win64_sponsored-setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV\Dir	FileZilla_3.50.0_win64_sponsored-setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	FileZilla_3.50.0_win64_sponsored-setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\AVAST Software\Avast	FileZilla_3.50.0_win64_sponsored-setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	FileZilla_3.50.0_win64_sponsored-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exefilezilla.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	filezilla.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

JavaScript code in executable 13 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsd25927061964825\libeay32.dll	js
\Program Files\FileZilla FTP Client\filezilla.exe	js
\Users\Admin\AppData\Local\Temp\inH2593013201005\libeay32.dll	js
\Program Files\FileZilla FTP Client\filezilla.exe	js
C:\Program Files\FileZilla FTP Client\filezilla.exe	js
C:\Program Files\FileZilla FTP Client\libgnutls-30.dll	js
\Program Files\FileZilla FTP Client\libgnutls-30.dll	js
C:\Program Files\FileZilla FTP Client\libstdc++-6.dll	js
\Program Files\FileZilla FTP Client\libstdc++-6.dll	js
\Program Files\FileZilla FTP Client\filezilla.exe	js
\Program Files\FileZilla FTP Client\filezilla.exe	js
\Program Files\FileZilla FTP Client\filezilla.exe	js
C:\Users\Admin\AppData\Local\Temp\in71125248\3AE23A7A_stp\winzip64.msi	js

Drops file in System32 directory 6 IoCs

Processes:

ServiceHost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	ServiceHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	ServiceHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	ServiceHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	ServiceHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD	ServiceHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD	ServiceHost.exe

Drops file in Program Files directory 1857 IoCs

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exeinstaller.exeinstaller.exe

description	ioc	process
File created	C:\Program Files\FileZilla FTP Client\resources\default\480x480\showhidden.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\telemetry.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\dimensionprocessor.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\jslang\wa-res-shared-cs-CZ.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-da-DK.js	installer.exe
File opened for modification	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\jslang\eula-ja-JP.txt	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\lone\16x16\refresh.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\msac.ico	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\settingsdblookup.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dialog-balloon.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-de-DE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-zh-TW.js	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\upload.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\ascii.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\lone\48x48\showhidden.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\jslang\wa-res-install-hu-HU.js	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\classic\16x16\compare.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\folderup.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\class.luc	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\lone\32x32\upload.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\jslang\wa-res-install-ko-KR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\stop-video-alert-icon.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-uninstall-icon.png	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\find.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\bookmark.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\auto.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\flatzilla\24x24\upload.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-atp-upsell-toast.png	installer.exe
File opened for modification	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\jslang\eula-es-MX.txt	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\opencrystal\48x48\processqueue.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-top.gif	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-cs-CZ.js	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\remotetreeview.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\opencrystal\theme.xml	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\webadvisor.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\suitestatus.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\ipc_stats_handler.luc	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\processqueue.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\opencrystal\32x32\speedlimits.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\tango\48x48\binary.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\firefoxversion.luc	installer.exe
File opened for modification	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\jslang\wa-res-install-pt-PT.js	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\flatzilla\16x16\server.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\flatzilla\32x32\speedlimits.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-fr-CA.js	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\classic\16x16\refresh.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\tango\32x32\uploadadd.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\jslang\wa-res-shared-pt-PT.js	installer.exe
File opened for modification	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\jslang\wa-res-shared-es-MX.js	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\cyril\16x16\download.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File created	C:\Program Files\FileZilla FTP Client\resources\opencrystal\16x16\logview.png	FileZilla_3.50.0_win64_sponsored-setup.exe
File opened for modification	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\browserplugin.cab	installer.exe
File opened for modification	C:\Program Files\McAfee\WebAdvisor\Temp1801804985\mfw-webadvisor.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\downloadscan.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-sr-Latn-CS.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-en-US.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sv-SE.js	installer.exe
File created	C:\Program Files\FileZilla FTP Client\resources\defaultfilters.xml	FileZilla_3.50.0_win64_sponsored-setup.exe

Drops file in Windows directory 30 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI330E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AF5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI407A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3418.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E65.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI364F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI390F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F31.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4165.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BD1.tmp	msiexec.exe
File created	C:\Windows\Installer\f76118e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D89.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4250.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76118e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3176.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3477.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI432C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3524.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI35F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F9F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46D6.tmp	msiexec.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exebyy.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FileZilla_3.50.0_win64_sponsored-setup.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FileZilla_3.50.0_win64_sponsored-setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	byy.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	byy.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exebyy.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FileZilla_3.50.0_win64_sponsored-setup.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FileZilla_3.50.0_win64_sponsored-setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	byy.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	byy.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exebyy.exeregsvr32.exeFileZilla_3.50.0_win64_sponsored-setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Default Visible = "Yes"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0412	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0412\ButtonText = "McAfee 웹어드바이저"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0804	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0804\ButtonText = "迈克菲联网顾问"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	byy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\MenuStatusBar = "MStatus bar View SiteReport"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0412\ButtonText = "McAfee 웹어드바이저"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\MenuText = "McAfee WebAdvisor"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0411\ButtonText = "マカフィーウェブアドバイザー"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\CLSIDExtension = "{29B24532-6CE1-41BA-8BF0-F580EA174AF1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\CLSIDExtension = "{29B24532-6CE1-41BA-8BF0-F580EA174AF1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0411\MenuText = "マカフィーウェブアドバイザー"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0412\MenuText = "McAfee 웹어드바이저"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0804\MenuText = "迈克菲联网顾问"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\MenuText = "McAfee WebAdvisor"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0412\MenuText = "McAfee 웹어드바이저"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0804\MenuText = "迈克菲联网顾问"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\@ = "WebAdvisor Menu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\ButtonText = "McAfee WebAdvisor"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\HotIcon = "C:\\Program Files\\McAfee\\WebAdvisor\\WebAdvisor.ico"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Default Visible = "Yes"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0804\ButtonText = "迈克菲联网顾问"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\ButtonText = "McAfee WebAdvisor"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0411	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0411\MenuText = "マカフィーウェブアドバイザー"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\CLSID = "{32CFFBE7-8BB7-4BC3-83D8-8197671920D6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0411	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0411\ButtonText = "マカフィーウェブアドバイザー"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\@ = "WebAdvisor Menu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\CLSID = "{32CFFBE7-8BB7-4BC3-83D8-8197671920D6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Icon = "C:\\Program Files\\McAfee\\WebAdvisor\\WebAdvisor.ico"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0412	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Lang0804	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\Icon = "C:\\Program Files\\McAfee\\WebAdvisor\\WebAdvisor.ico"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\HotIcon = "C:\\Program Files\\McAfee\\WebAdvisor\\WebAdvisor.ico"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}\MenuStatusBar = "MStatus bar View SiteReport"	regsvr32.exe

Modifies data under HKEY_USERS 87 IoCs

Processes:

ServiceHost.exeupdater.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ServiceHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	updater.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe

Modifies registry class 70 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeFileZilla_3.50.0_win64_sponsored-setup.exeregsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\InProcServer32\ = "C:\\Program Files\\FileZilla FTP Client\\fzshellext_64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\IEPlugin.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook\ = "{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}"	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\ = "McAfee WebAdvisor"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\InProcServer32\ThreadingModel = "Apartment"	FileZilla_3.50.0_win64_sponsored-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\InProcServer32	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook\ = "{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\WSSDep.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}\ = "McAfee WebAdvisor Extension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\IEPlugin.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\InProcServer32\ = "C:\\Program Files\\FileZilla FTP Client\\fzshellext.dll"	FileZilla_3.50.0_win64_sponsored-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\directory\shellex\CopyHookHandlers\FileZilla3CopyHook	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\DownloadScan.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\directory\shellex\CopyHookHandlers\FileZilla3CopyHook	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\DownloadScan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}\ = "McAfee WebAdvisor Extension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\ = "FileZilla 3 Shell Extension"	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\ = "McAfee WebAdvisor"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\ = "FileZilla 3 Shell Extension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\ = "ScannerAPI Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Programmable	regsvr32.exe

Modifies system certificate store 2 TTPs 18 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exesaBSI.exeServiceHost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ServiceHost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	FileZilla_3.50.0_win64_sponsored-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	saBSI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	saBSI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ServiceHost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	FileZilla_3.50.0_win64_sponsored-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	FileZilla_3.50.0_win64_sponsored-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	FileZilla_3.50.0_win64_sponsored-setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	saBSI.exe

Suspicious behavior: EnumeratesProcesses 195 IoCs

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exebyy.exesaBSI.exe

pid	process
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1404	byy.exe
1404	byy.exe
948	saBSI.exe
948	saBSI.exe
948	saBSI.exe
948	saBSI.exe
1404	byy.exe
1404	byy.exe
1404	byy.exe
1404	byy.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

filezilla.exe

pid process

1144 filezilla.exe

pid	process
1144	filezilla.exe

Suspicious use of AdjustPrivilegeToken 135 IoCs

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exebyy.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeShutdownPrivilege	1404	byy.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeDebugPrivilege	1496	FileZilla_3.50.0_win64_sponsored-setup.exe
Token: SeShutdownPrivilege	772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	772	msiexec.exe
Token: SeRestorePrivilege	3040	msiexec.exe
Token: SeTakeOwnershipPrivilege	3040	msiexec.exe
Token: SeSecurityPrivilege	3040	msiexec.exe
Token: SeCreateTokenPrivilege	772	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	772	msiexec.exe
Token: SeLockMemoryPrivilege	772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	772	msiexec.exe
Token: SeMachineAccountPrivilege	772	msiexec.exe
Token: SeTcbPrivilege	772	msiexec.exe
Token: SeSecurityPrivilege	772	msiexec.exe
Token: SeTakeOwnershipPrivilege	772	msiexec.exe
Token: SeLoadDriverPrivilege	772	msiexec.exe
Token: SeSystemProfilePrivilege	772	msiexec.exe
Token: SeSystemtimePrivilege	772	msiexec.exe
Token: SeProfSingleProcessPrivilege	772	msiexec.exe
Token: SeIncBasePriorityPrivilege	772	msiexec.exe
Token: SeCreatePagefilePrivilege	772	msiexec.exe
Token: SeCreatePermanentPrivilege	772	msiexec.exe
Token: SeBackupPrivilege	772	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

byy.exe

pid process

1404 byy.exe
1404 byy.exe
1404 byy.exe
1404 byy.exe
1404 byy.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

byy.exe

pid process

1404 byy.exe
1404 byy.exe
1404 byy.exe
1404 byy.exe
1404 byy.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

FileZilla_3.50.0_win64_sponsored-setup.exebyy.exefilezilla.exe

pid	process
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1496	FileZilla_3.50.0_win64_sponsored-setup.exe
1404	byy.exe
1404	byy.exe
1144	filezilla.exe
1144	filezilla.exe

Suspicious use of WriteProcessMemory 171 IoCs

Processes:

FileZilla_3.50.0_win64_sponsored-setup.execmd.execmd.exesaBSI.exeinstaller.exeinstaller.exeregsvr32.exe

description	pid	process	target process
PID 1496 wrote to memory of 432	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	regsvr32.exe
PID 1496 wrote to memory of 432	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	regsvr32.exe
PID 1496 wrote to memory of 432	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	regsvr32.exe
PID 1496 wrote to memory of 432	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	regsvr32.exe
PID 1496 wrote to memory of 432	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	regsvr32.exe
PID 1496 wrote to memory of 432	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	regsvr32.exe
PID 1496 wrote to memory of 432	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	regsvr32.exe
PID 1496 wrote to memory of 1308	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	cmd.exe
PID 1496 wrote to memory of 1308	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	cmd.exe
PID 1496 wrote to memory of 1308	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	cmd.exe
PID 1496 wrote to memory of 1308	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	cmd.exe
PID 1308 wrote to memory of 1564	1308	cmd.exe	cmd.exe
PID 1308 wrote to memory of 1564	1308	cmd.exe	cmd.exe
PID 1308 wrote to memory of 1564	1308	cmd.exe	cmd.exe
PID 1308 wrote to memory of 1564	1308	cmd.exe	cmd.exe
PID 1564 wrote to memory of 1404	1564	cmd.exe	byy.exe
PID 1564 wrote to memory of 1404	1564	cmd.exe	byy.exe
PID 1564 wrote to memory of 1404	1564	cmd.exe	byy.exe
PID 1564 wrote to memory of 1404	1564	cmd.exe	byy.exe
PID 1564 wrote to memory of 1404	1564	cmd.exe	byy.exe
PID 1564 wrote to memory of 1404	1564	cmd.exe	byy.exe
PID 1564 wrote to memory of 1404	1564	cmd.exe	byy.exe
PID 1496 wrote to memory of 948	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	saBSI.exe
PID 1496 wrote to memory of 948	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	saBSI.exe
PID 1496 wrote to memory of 948	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	saBSI.exe
PID 1496 wrote to memory of 948	1496	FileZilla_3.50.0_win64_sponsored-setup.exe	saBSI.exe
PID 948 wrote to memory of 2156	948	saBSI.exe	installer.exe
PID 948 wrote to memory of 2156	948	saBSI.exe	installer.exe
PID 948 wrote to memory of 2156	948	saBSI.exe	installer.exe
PID 948 wrote to memory of 2156	948	saBSI.exe	installer.exe
PID 2156 wrote to memory of 2176	2156	installer.exe	installer.exe
PID 2156 wrote to memory of 2176	2156	installer.exe	installer.exe
PID 2156 wrote to memory of 2176	2156	installer.exe	installer.exe
PID 2176 wrote to memory of 2400	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2400	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2400	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2424	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2424	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2424	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2424	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2424	2176	installer.exe	regsvr32.exe
PID 2424 wrote to memory of 2468	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 2468	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 2468	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 2468	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 2468	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 2468	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 2468	2424	regsvr32.exe	regsvr32.exe
PID 2176 wrote to memory of 2532	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2532	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2532	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2572	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2572	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2572	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2572	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2572	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2628	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2628	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2628	2176	installer.exe	sc.exe
PID 2176 wrote to memory of 2972	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2972	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2972	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2972	2176	installer.exe	regsvr32.exe
PID 2176 wrote to memory of 2972	2176	installer.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\FileZilla_3.50.0_win64_sponsored-setup.exe
"C:\Users\Admin\AppData\Local\Temp\FileZilla_3.50.0_win64_sponsored-setup.exe"
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\FileZilla FTP Client\fzshellext_64.dll"
2⤵
- Loads dropped DLL
- Modifies registry class
PID:432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /d /c cmd /d /c C:\Users\Admin\AppData\Local\Temp\a3v\byy.exe /covr:WbBfWgv8YjJ/iBJBRac9IinISEYHpiEyYs5EHwy7MHp43h4ZF7MxFFXyYlEKti0cS/9jQx6tL35wxFsbGKF2dW3VEwEI+3BuZfYxLSa5ZGNy5ioiP6MXZFbPcj4/ox5fYO17KG2kNXs5+3s6dL5GfB3SIyZ0vk9HK/AqMCajbmQbkV5WK6FnZBiQU1QgoWpsEZNnPlTUOHURjWclUNkvegSWcD5FwjEDKrBLDmf/D1srulwEaPUYQTelWRV/mGlWBeBYDzW1aU0E5VgONadpVwXmWAY0rmlKBelYEzWoaVYE7VkSNblrSATtWhE0v2tXBetaHzSna1gF6VoBNKAjQgXjEhRxoCJaBeMSE3GgIlUF4xIGcaAiUgXjEhtxpyJWBeQSEHGnIkEF5RIYcaYiUQXlEgFxpiJDBeISAHGhIkYF4hIXcaEiRwXnEB03sSJHOvZuCHi3Ilcu9nAEE8QjcEH0ZUANxCpwWvV8QAnFP3BB9XpADMU/cVr1cUEbxTxxXrFuCybFPDtg92UKIsYpO2T3bgsixiI6a/dyCjHGPjt493cKLIM1fn73fQosxzw6f/ZqCjfHPjtw9m8KOcc/O3qzbUECgT41ULFtBRuBJDVLsHIFHYA/NEuwfAQDgDk0QLByQBLKCjRW+FtAHowJcFu8X0AejBFwSr1HQBmNEHFPvV1BDo0UcUC8QkEGjA1xVLxAQAKMA3BOvExAHYwJcFn4WwohjAk7Y75eCjWPFjthvloKJo8MO2m+SgoqjwI7fL5QCjWPFjt3vkYKJsoUfm6+Rk4rjhB+br5eTjqPCH5pv19PP48Sf36/W08wjg1/dr5CTySOD35yvkxOPo4Dfm2+Rk4pjxB+fb9ZTjCPHH5/v0lOK8sbNFO/SQUbjh00V79aBQGOFTRHv1YFD44ANF2/SQUbjgs0S79aBR2NADRRvEgFAY0ON1i/VEMKyxw3WPtZBw7LHDdA+0gGFssbNkH6TQYMygw2RfpCBxPKBDdc+lYHEcsAN1L7TAcdyx83WPtbBg7LFDZc+kIGCMoLNkX6TgYKyhs2Xr5JTCbKG31u+09MIsoIfXT7R0wyygR9evtSTCjKG31u+1lMPsoIfWj7Tkwryhh+cftUTznKBH5/+F1MJYwPOG34XQklyQk4afhOCDnJDTl/+F8IL8kdOW35VAkpjQZzUflFChSDPHNX93QHBcYgNkf0dAQexSc0WfRhBRDFMHFCv0hADY4ccUS/XkAUyxY0RvpCBQTIFjdd+UIGHsgHNln5QQcQyBBzQrJoQhiAOzZKsXwHHoA0Nk70Zkw2gDR9eLFyTDGAI31nsWFPP8UzO3exYQkvgDU4ZrJsCTbGPnNOsmxBFsYuc0T0dgcGgDBzR/R2CgXGJDhQv2ZBE483c0a/e0IQyz02U/toBAnJMDZQ+HcHHMg5N1X5fwcRySo1R/twBAvJKTVfs1NMHYIHNViyVgUagwBxSLFRBQCDAnFSskVABoMNcVb3Xwsugw06YLJLCymDGjp/slgIJoMUOXf3Rk0/gxR/Z7JATi6AGX9+9EsFBoAZNFf0W0ATgB85UPlbQyqAHzdt+VwGPY0df3/5WgY6gyNye7JwBjyDJDdosnBOK8Y3Omm/cgs5jiFyfPdkQzODJnJnsnILIoMmf3Cxdws4gyR/arJjTj6DK39u93kFFoMrNFiybQURgzw0R7J/QBXGNzRH9G8FE8UmN0r0dkMYjg43SvpcBRuOFDdI+kYGD8sSN0f6QkMVgDo3R7F0BgGAPTdQsWsGH8U5clexa0APgD9xRrJmQBbGNDpusmZOPIA3OnSyZE4mgyN/crJrTiLGOTRasmsFFIMtNF2yfAULgz40RPdsQAyDPnJUsmpDHYAzck30YQg1gCU6ZPRtCDeAPzlwsWsIOIA7fGr6Qwg4yw05fvpECC/LEjlt+lFNP44ZOW28QQg5jQg6YLxYTjLGIDp29HFOPsYiOmz3ZQs4xi06aLJ/QBDGLXFe92tAF8Y6cUH3aEADgzo0S/doBhPGPDda9GUGCoA3fHL0ZQggxjR8aPRnCDrFIDlu9GgIPoA6ckb0aEMIxS5yQfR/QxfFLXJV9G8GB4AnclWyf0MBgzZxWLJmBQrIHnFO+k8FBsgccVT5W0AAyBNxULxBCyjIEzpm+VULL8gEOnn5TAs/yB06b7xPTifIHXx/+UlNNssQfGa/QgYeyxByWr9CQAuOGjRD+kgEAMoMNE76SQQbyx80SPtaBBrLDDRf+15ADYEmNF+wawYFgjE3QLNzTTjHNjl99WELKsc2f2izcE4vgjx8dbNsTTiCPDl/s3sLJoEhOnazewsmxz06dPZ7CzyCPn9u9nYLPMY1O3j2ewstxig6e/Z7Cj7GKTpo9mwKOoI+cEL2bEEPxDZzVfVzQhePCzZS+04HBsoLNkO+TQcEjwE1Xr5RBBOPAXBUvkZCDYwcc12+RkINygBzX/tGQhePAzZF+0tCF8sEclH7VkMHywVzQvtXQxTLEnNGv0AJPssSOHP5SAopyA1wUbxIBBTIBzRb+EEECYwOcE+9SUEDjxNwU75eQQPKGXBE+EBCHskQcET4QAQCyRI1RPhaQQGMCDVJ+FoFB8gfNVD5SQUUyQY1WflHBRDJCTVDvVtPO4wUfm+9XU8tjA19fIFeKjHXG3gM5TVIItQFRXKLUBc+tjhjSokP6w /mnl
2⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\cmd.exe
cmd /d /c C:\Users\Admin\AppData\Local\Temp\a3v\byy.exe /covr:WbBfWgv8YjJ/iBJBRac9IinISEYHpiEyYs5EHwy7MHp43h4ZF7MxFFXyYlEKti0cS/9jQx6tL35wxFsbGKF2dW3VEwEI+3BuZfYxLSa5ZGNy5ioiP6MXZFbPcj4/ox5fYO17KG2kNXs5+3s6dL5GfB3SIyZ0vk9HK/AqMCajbmQbkV5WK6FnZBiQU1QgoWpsEZNnPlTUOHURjWclUNkvegSWcD5FwjEDKrBLDmf/D1srulwEaPUYQTelWRV/mGlWBeBYDzW1aU0E5VgONadpVwXmWAY0rmlKBelYEzWoaVYE7VkSNblrSATtWhE0v2tXBetaHzSna1gF6VoBNKAjQgXjEhRxoCJaBeMSE3GgIlUF4xIGcaAiUgXjEhtxpyJWBeQSEHGnIkEF5RIYcaYiUQXlEgFxpiJDBeISAHGhIkYF4hIXcaEiRwXnEB03sSJHOvZuCHi3Ilcu9nAEE8QjcEH0ZUANxCpwWvV8QAnFP3BB9XpADMU/cVr1cUEbxTxxXrFuCybFPDtg92UKIsYpO2T3bgsixiI6a/dyCjHGPjt493cKLIM1fn73fQosxzw6f/ZqCjfHPjtw9m8KOcc/O3qzbUECgT41ULFtBRuBJDVLsHIFHYA/NEuwfAQDgDk0QLByQBLKCjRW+FtAHowJcFu8X0AejBFwSr1HQBmNEHFPvV1BDo0UcUC8QkEGjA1xVLxAQAKMA3BOvExAHYwJcFn4WwohjAk7Y75eCjWPFjthvloKJo8MO2m+SgoqjwI7fL5QCjWPFjt3vkYKJsoUfm6+Rk4rjhB+br5eTjqPCH5pv19PP48Sf36/W08wjg1/dr5CTySOD35yvkxOPo4Dfm2+Rk4pjxB+fb9ZTjCPHH5/v0lOK8sbNFO/SQUbjh00V79aBQGOFTRHv1YFD44ANF2/SQUbjgs0S79aBR2NADRRvEgFAY0ON1i/VEMKyxw3WPtZBw7LHDdA+0gGFssbNkH6TQYMygw2RfpCBxPKBDdc+lYHEcsAN1L7TAcdyx83WPtbBg7LFDZc+kIGCMoLNkX6TgYKyhs2Xr5JTCbKG31u+09MIsoIfXT7R0wyygR9evtSTCjKG31u+1lMPsoIfWj7Tkwryhh+cftUTznKBH5/+F1MJYwPOG34XQklyQk4afhOCDnJDTl/+F8IL8kdOW35VAkpjQZzUflFChSDPHNX93QHBcYgNkf0dAQexSc0WfRhBRDFMHFCv0hADY4ccUS/XkAUyxY0RvpCBQTIFjdd+UIGHsgHNln5QQcQyBBzQrJoQhiAOzZKsXwHHoA0Nk70Zkw2gDR9eLFyTDGAI31nsWFPP8UzO3exYQkvgDU4ZrJsCTbGPnNOsmxBFsYuc0T0dgcGgDBzR/R2CgXGJDhQv2ZBE483c0a/e0IQyz02U/toBAnJMDZQ+HcHHMg5N1X5fwcRySo1R/twBAvJKTVfs1NMHYIHNViyVgUagwBxSLFRBQCDAnFSskVABoMNcVb3Xwsugw06YLJLCymDGjp/slgIJoMUOXf3Rk0/gxR/Z7JATi6AGX9+9EsFBoAZNFf0W0ATgB85UPlbQyqAHzdt+VwGPY0df3/5WgY6gyNye7JwBjyDJDdosnBOK8Y3Omm/cgs5jiFyfPdkQzODJnJnsnILIoMmf3Cxdws4gyR/arJjTj6DK39u93kFFoMrNFiybQURgzw0R7J/QBXGNzRH9G8FE8UmN0r0dkMYjg43SvpcBRuOFDdI+kYGD8sSN0f6QkMVgDo3R7F0BgGAPTdQsWsGH8U5clexa0APgD9xRrJmQBbGNDpusmZOPIA3OnSyZE4mgyN/crJrTiLGOTRasmsFFIMtNF2yfAULgz40RPdsQAyDPnJUsmpDHYAzck30YQg1gCU6ZPRtCDeAPzlwsWsIOIA7fGr6Qwg4yw05fvpECC/LEjlt+lFNP44ZOW28QQg5jQg6YLxYTjLGIDp29HFOPsYiOmz3ZQs4xi06aLJ/QBDGLXFe92tAF8Y6cUH3aEADgzo0S/doBhPGPDda9GUGCoA3fHL0ZQggxjR8aPRnCDrFIDlu9GgIPoA6ckb0aEMIxS5yQfR/QxfFLXJV9G8GB4AnclWyf0MBgzZxWLJmBQrIHnFO+k8FBsgccVT5W0AAyBNxULxBCyjIEzpm+VULL8gEOnn5TAs/yB06b7xPTifIHXx/+UlNNssQfGa/QgYeyxByWr9CQAuOGjRD+kgEAMoMNE76SQQbyx80SPtaBBrLDDRf+15ADYEmNF+wawYFgjE3QLNzTTjHNjl99WELKsc2f2izcE4vgjx8dbNsTTiCPDl/s3sLJoEhOnazewsmxz06dPZ7CzyCPn9u9nYLPMY1O3j2ewstxig6e/Z7Cj7GKTpo9mwKOoI+cEL2bEEPxDZzVfVzQhePCzZS+04HBsoLNkO+TQcEjwE1Xr5RBBOPAXBUvkZCDYwcc12+RkINygBzX/tGQhePAzZF+0tCF8sEclH7VkMHywVzQvtXQxTLEnNGv0AJPssSOHP5SAopyA1wUbxIBBTIBzRb+EEECYwOcE+9SUEDjxNwU75eQQPKGXBE+EBCHskQcET4QAQCyRI1RPhaQQGMCDVJ+FoFB8gfNVD5SQUUyQY1WflHBRDJCTVDvVtPO4wUfm+9XU8tjA19fIFeKjHXG3gM5TVIItQFRXKLUBc+tjhjSokP6w /mnl
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\a3v\byy.exe
C:\Users\Admin\AppData\Local\Temp\a3v\byy.exe /covr:WbBfWgv8YjJ/iBJBRac9IinISEYHpiEyYs5EHwy7MHp43h4ZF7MxFFXyYlEKti0cS/9jQx6tL35wxFsbGKF2dW3VEwEI+3BuZfYxLSa5ZGNy5ioiP6MXZFbPcj4/ox5fYO17KG2kNXs5+3s6dL5GfB3SIyZ0vk9HK/AqMCajbmQbkV5WK6FnZBiQU1QgoWpsEZNnPlTUOHURjWclUNkvegSWcD5FwjEDKrBLDmf/D1srulwEaPUYQTelWRV/mGlWBeBYDzW1aU0E5VgONadpVwXmWAY0rmlKBelYEzWoaVYE7VkSNblrSATtWhE0v2tXBetaHzSna1gF6VoBNKAjQgXjEhRxoCJaBeMSE3GgIlUF4xIGcaAiUgXjEhtxpyJWBeQSEHGnIkEF5RIYcaYiUQXlEgFxpiJDBeISAHGhIkYF4hIXcaEiRwXnEB03sSJHOvZuCHi3Ilcu9nAEE8QjcEH0ZUANxCpwWvV8QAnFP3BB9XpADMU/cVr1cUEbxTxxXrFuCybFPDtg92UKIsYpO2T3bgsixiI6a/dyCjHGPjt493cKLIM1fn73fQosxzw6f/ZqCjfHPjtw9m8KOcc/O3qzbUECgT41ULFtBRuBJDVLsHIFHYA/NEuwfAQDgDk0QLByQBLKCjRW+FtAHowJcFu8X0AejBFwSr1HQBmNEHFPvV1BDo0UcUC8QkEGjA1xVLxAQAKMA3BOvExAHYwJcFn4WwohjAk7Y75eCjWPFjthvloKJo8MO2m+SgoqjwI7fL5QCjWPFjt3vkYKJsoUfm6+Rk4rjhB+br5eTjqPCH5pv19PP48Sf36/W08wjg1/dr5CTySOD35yvkxOPo4Dfm2+Rk4pjxB+fb9ZTjCPHH5/v0lOK8sbNFO/SQUbjh00V79aBQGOFTRHv1YFD44ANF2/SQUbjgs0S79aBR2NADRRvEgFAY0ON1i/VEMKyxw3WPtZBw7LHDdA+0gGFssbNkH6TQYMygw2RfpCBxPKBDdc+lYHEcsAN1L7TAcdyx83WPtbBg7LFDZc+kIGCMoLNkX6TgYKyhs2Xr5JTCbKG31u+09MIsoIfXT7R0wyygR9evtSTCjKG31u+1lMPsoIfWj7Tkwryhh+cftUTznKBH5/+F1MJYwPOG34XQklyQk4afhOCDnJDTl/+F8IL8kdOW35VAkpjQZzUflFChSDPHNX93QHBcYgNkf0dAQexSc0WfRhBRDFMHFCv0hADY4ccUS/XkAUyxY0RvpCBQTIFjdd+UIGHsgHNln5QQcQyBBzQrJoQhiAOzZKsXwHHoA0Nk70Zkw2gDR9eLFyTDGAI31nsWFPP8UzO3exYQkvgDU4ZrJsCTbGPnNOsmxBFsYuc0T0dgcGgDBzR/R2CgXGJDhQv2ZBE483c0a/e0IQyz02U/toBAnJMDZQ+HcHHMg5N1X5fwcRySo1R/twBAvJKTVfs1NMHYIHNViyVgUagwBxSLFRBQCDAnFSskVABoMNcVb3Xwsugw06YLJLCymDGjp/slgIJoMUOXf3Rk0/gxR/Z7JATi6AGX9+9EsFBoAZNFf0W0ATgB85UPlbQyqAHzdt+VwGPY0df3/5WgY6gyNye7JwBjyDJDdosnBOK8Y3Omm/cgs5jiFyfPdkQzODJnJnsnILIoMmf3Cxdws4gyR/arJjTj6DK39u93kFFoMrNFiybQURgzw0R7J/QBXGNzRH9G8FE8UmN0r0dkMYjg43SvpcBRuOFDdI+kYGD8sSN0f6QkMVgDo3R7F0BgGAPTdQsWsGH8U5clexa0APgD9xRrJmQBbGNDpusmZOPIA3OnSyZE4mgyN/crJrTiLGOTRasmsFFIMtNF2yfAULgz40RPdsQAyDPnJUsmpDHYAzck30YQg1gCU6ZPRtCDeAPzlwsWsIOIA7fGr6Qwg4yw05fvpECC/LEjlt+lFNP44ZOW28QQg5jQg6YLxYTjLGIDp29HFOPsYiOmz3ZQs4xi06aLJ/QBDGLXFe92tAF8Y6cUH3aEADgzo0S/doBhPGPDda9GUGCoA3fHL0ZQggxjR8aPRnCDrFIDlu9GgIPoA6ckb0aEMIxS5yQfR/QxfFLXJV9G8GB4AnclWyf0MBgzZxWLJmBQrIHnFO+k8FBsgccVT5W0AAyBNxULxBCyjIEzpm+VULL8gEOnn5TAs/yB06b7xPTifIHXx/+UlNNssQfGa/QgYeyxByWr9CQAuOGjRD+kgEAMoMNE76SQQbyx80SPtaBBrLDDRf+15ADYEmNF+wawYFgjE3QLNzTTjHNjl99WELKsc2f2izcE4vgjx8dbNsTTiCPDl/s3sLJoEhOnazewsmxz06dPZ7CzyCPn9u9nYLPMY1O3j2ewstxig6e/Z7Cj7GKTpo9mwKOoI+cEL2bEEPxDZzVfVzQhePCzZS+04HBsoLNkO+TQcEjwE1Xr5RBBOPAXBUvkZCDYwcc12+RkINygBzX/tGQhePAzZF+0tCF8sEclH7VkMHywVzQvtXQxTLEnNGv0AJPssSOHP5SAopyA1wUbxIBBTIBzRb+EEECYwOcE+9SUEDjxNwU75eQQPKGXBE+EBCHskQcET4QAQCyRI1RPhaQQGMCDVJ+FoFB8gfNVD5SQUUyQY1WflHBRDJCTVDvVtPO4wUfm+9XU8tjA19fIFeKjHXG3gM5TVIItQFRXKLUBc+tjhjSokP6w /mnl
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1404

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\in71125248\3AE23A7A_stp\winzip64.msi" /qn XAT=dci5
5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\saBSI.exe
"C:\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\saBSI.exe" /affid 91088 PaidDistribution=true InstallID=yE0Azy0EtCtCyEyD0E0ByD0F0AtD0FyC2RtBtDtBtDtDzytBtAtCyEtDzztCzyzztCtB Pixel=SyDDEQoInmkPeJMZewuSan954RoYOsNYA3uXHg55nh4NeJMcBnieFA97gUNYL8JeAx7CTn8t0UVNJtUKXTvEHwx0lBUHf5EdDHGQHv5MAAAAPkmnLA==
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2156

C:\Program Files\McAfee\WebAdvisor\Temp1801804985\installer.exe
"C:\Program Files\McAfee\WebAdvisor\Temp1801804985\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\system32\sc.exe
sc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"
5⤵
PID:2400

C:\Windows\system32\regsvr32.exe
regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
5⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
6⤵
- Loads dropped DLL
- Modifies registry class
PID:2468

C:\Windows\system32\sc.exe
sc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"
5⤵
PID:2532

C:\Windows\system32\regsvr32.exe
regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
5⤵
- Loads dropped DLL
- Modifies registry class
PID:2572

C:\Windows\system32\sc.exe
sc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//0
5⤵
PID:2628

C:\Windows\system32\regsvr32.exe
regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
5⤵
PID:2972

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
6⤵
- Loads dropped DLL
- Modifies registry class
PID:3068

C:\Windows\system32\sc.exe
sc.exe start "McAfee WebAdvisor"
5⤵
PID:3028

C:\Windows\system32\regsvr32.exe
regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
5⤵
- Loads dropped DLL
- Modifies registry class
PID:2268

C:\Program Files\FileZilla FTP Client\filezilla.exe
"C:\Program Files\FileZilla FTP Client\filezilla.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1144

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:1032

C:\Program Files\McAfee\WebAdvisor\UIHost.exe
"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:2172

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll"
2⤵
PID:2676

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll"
3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:1632

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll"
2⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:2900

C:\Program Files\McAfee\WebAdvisor\updater.exe
"C:\Program Files\McAfee\WebAdvisor\updater.exe"
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )
3⤵
PID:572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"
3⤵
PID:2896

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blacklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 57D09FA5DF86F3C1D08512D9F169DF1C
2⤵
- Loads dropped DLL
PID:2552

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D6B9152C-11F1-4C90-8692-00DB891DD284}
3⤵
- Executes dropped EXE
PID:1160

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{78899ADA-95B6-4948-9895-0AFCE10A90D4}
3⤵
- Executes dropped EXE
PID:580

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A002AC29-C740-4983-BA76-0102A8C7AC24}
3⤵
- Executes dropped EXE
PID:2384

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0444DF9D-11F8-4BD7-8C4A-8ADA211EDC90}
3⤵
- Executes dropped EXE
PID:3064

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E73C086A-1F72-4033-82E5-56D86AA1439F}
3⤵
- Executes dropped EXE
PID:1484

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BC18FB1C-73E4-41F8-871E-E649B32EFE20}
3⤵
- Executes dropped EXE
PID:2320

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2475F331-00BF-4182-B948-9AFD60128E64}
3⤵
- Executes dropped EXE
PID:300

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EAC57EFB-EAD6-4173-A781-49FFE23CBC62}
3⤵
- Executes dropped EXE
PID:1960

C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4DAED5F9-5092-481A-854E-808EA1A01920}
3⤵
- Executes dropped EXE
PID:2852

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 5CE1B281B6C499CA1724A091B696A733
2⤵
- Loads dropped DLL
PID:1548

C:\Users\Admin\AppData\Local\Temp\CloseFAH.exe
"C:\Users\Admin\AppData\Local\Temp\CloseFAH.exe"
3⤵
- Executes dropped EXE
PID:2948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

New Service

T1050

Browser Extensions

T1176

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Security Software Discovery

T1063

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\FileZilla FTP Client\filezilla.exe

Download Submit
C:\Program Files\FileZilla FTP Client\fzshellext_64.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libfilezilla-9.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libgcc_s_seh-1.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libgmp-10.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libgnutls-30.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libhogweed-6.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libnettle-8.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libpng16-16.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libsqlite3-0.dll

Download Submit
C:\Program Files\FileZilla FTP Client\libstdc++-6.dll

Download Submit
C:\Program Files\FileZilla FTP Client\resources\16x16\unknown.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\48x48\filezilla.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\cancel.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\close.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\compare.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\disconnect.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\dropdown.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\file.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\filter.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\find.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\folder.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\leds.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\localtreeview.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\logview.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\processqueue.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\queueview.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\reconnect.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\refresh.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\remotetreeview.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\server.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\sitemanager.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_down_dark.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\sort_up_dark.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\speedlimits.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\480x480\synchronize.png

Download Submit
C:\Program Files\FileZilla FTP Client\resources\default\theme.xml

Download Submit
C:\Program Files\FileZilla FTP Client\resources\defaultfilters.xml

Download Submit
C:\Program Files\FileZilla FTP Client\zlib1.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\EventManager.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\LogicModule.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\LookupManager.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\Resource.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\SettingManager.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\TaskManager.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\browserhost.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\browserplugin.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\downloadscan.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\eventmanager.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\ieplugin.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\installer.exe

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\l10n.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\logicmodule.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\logicscripts.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\lookupmanager.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\mfw-mwb.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\mfw-nps.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\mfw-webadvisor.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\mfw.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\resourcedll.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\servicehost.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\settingmanager.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\taskmanager.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\telemetry.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\uihost.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\uimanager.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\uninstaller.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\updater.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\wataskmanager.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\webadvisor.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\Temp1801804985\wssdep.cab

Download Submit
C:\Program Files\McAfee\WebAdvisor\UIHost.exe

Download Submit
C:\Program Files\McAfee\WebAdvisor\UIManager.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\WATaskManager.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\MiscUtils.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\base_provider.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\ff_monitor.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\oem_business_logic.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\providers\bing.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\providers\duckduckgo.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\providers\yahoo.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\providers\yandex.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\providers_selector.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\logic\ss_logic.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\PostInit.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\PriorityQueue.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\UiArbitratorHelper.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\UiHandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\UiThreadExitHandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\Win32Helper.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\class.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\dkjson.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\handlers.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\init.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\json.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\logger.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\triggeracceptor.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\utils\BrowserUtils.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\utils\PackageUtils.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\utils\SettingsDB.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\utils\StringUtils.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\utils\Telemetry.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\utils\common_utils.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\mwb\mwbhandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\nps\npshandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\atp_upsell_toast_handler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\av_scan_upsell_handler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\checklisthandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\chrome_extension_push_handler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\ext_install_handler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\overlay_ui_handler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\productupselltoast.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\securesearchhandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\upsell_checklist.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\upsell_toast_handler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\packages\webadvisor\wacsecuresearchl10n.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\servicehost.exe

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\DimensionConfig.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\DimensionHandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\DimensionProcessor.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\BaseAffidLookup.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\BingPartnerCode.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\ChromeBasedBrowserVersion.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\CurrentBrowserVersion.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\DaysSinceSettingsDBLookup.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\DefaultBrowser.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\EventSupplied.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\ExternalUtilityFunction.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\FeatureTrackingFeature.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\FirefoxVersion.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\ISBIsSecureSearch.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\InstallDate.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\LastBrowserUsed.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\LastOEMCheck.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\Locale.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\OSFlavour.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\PercentageHandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\PostUpdateRebootTimeLookup.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\ProfilesCounter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\ProxySubTypeHandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\ProxyTypeHandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\RegistryLookup.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\SearchAnnotations.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\SequenceNumber.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\SettingsDBLookup.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\StaticValue.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\SuiteStatus.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\TelemetryVersion.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\UpdatePending.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\UpdatePendingVersion.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\WSSAffid.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\WSSCSPID.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\WSSEulaDate.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\WSSPackageType.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\WSSSetting.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\WSSSettingExpiry.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\WSSVersion.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\EventFormatter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\EventHandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\EventTransmitter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\HandleOnNavigate.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\SendOnPing.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\TelemetryConfig.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\TelemetryHandler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\formatters\EventFormatter_JSON.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\AdblockCounter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\BlockPage.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\BrowserNavigate.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\CommonLogicLoader.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\DailyCounters.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\DailyPing.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\DomainNavigatedCounter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\DownloadScan.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\LogicScriptError.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\MetricCounter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\NavigatedToday.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\NewTabCounter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\SMAReputationCounter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\SearchSuggestCounter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\SearchTerm.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\SecureSearchHit.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\SendImmediately.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\WABadgeNotificationCounter.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\WSSAnalytics.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\WSSAnalyticsRaw.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\browser_host_launchers_handler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\ipc_stats_handler.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\Transmit_Azure.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\version.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\SecureSearchStateChange.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\ToastCheckCompleted.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\ToastCheckTriggered.luc

Download Submit
C:\Program Files\McAfee\WebAdvisor\uihost.exe

Download Submit
C:\Program Files\McAfee\WebAdvisor\updater.exe

Download Submit
C:\Program Files\McAfee\WebAdvisor\updater.exe

Download Submit
C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll

Download Submit
C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Download Submit
C:\Users\Admin\AppData\Local\Temp\CloseFAH.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI60c40.LOG

Download Submit
C:\Users\Admin\AppData\Local\Temp\a3v\byy.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\a3v\byy.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\in71125248\3AE23A7A_stp\winzip64.msi

Download Submit
C:\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\installer.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\saBSI.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
C:\Users\Admin\AppData\Roaming\l6r_0F1L1I1P0Z1L1I1I1T1V0N1P2WtJ1V0W1L1G2T1L1EtCzy.txt

Download Submit
C:\Users\Admin\AppData\Roaming\l6r_1N1I1F1S1T1I0M1F1Q2Y1I1P1B0C1F1Q1P.txt

Download Submit
C:\Windows\Installer\MSI3176.tmp

Download Submit
C:\Windows\Installer\MSI31F4.tmp

Download Submit
C:\Windows\Installer\MSI330E.tmp

Download Submit
C:\Windows\Installer\MSI3418.tmp

Download Submit
C:\Windows\Installer\MSI3477.tmp

Download Submit
C:\Windows\Installer\MSI34C6.tmp

Download Submit
C:\Windows\Installer\MSI3524.tmp

Download Submit
C:\Windows\Installer\MSI35F0.tmp

Download Submit
C:\Windows\Installer\MSI364F.tmp

Download Submit
C:\Windows\Installer\MSI38B0.tmp

Download Submit
C:\Windows\Installer\MSI390F.tmp

Download Submit
C:\Windows\Installer\MSI39DB.tmp

Download Submit
C:\Windows\Installer\MSI3A2A.tmp

Download Submit
C:\Windows\Installer\MSI3AF5.tmp

Download Submit
C:\Windows\Installer\MSI3BD1.tmp

Download Submit
C:\Windows\Installer\MSI3CBC.tmp

Download Submit
C:\Windows\Installer\MSI3D2A.tmp

Download Submit
C:\Windows\Installer\MSI3D89.tmp

Download Submit
C:\Windows\Installer\MSI3DD8.tmp

Download Submit
C:\Windows\Installer\MSI3E65.tmp

Download Submit
C:\Windows\Installer\MSI3F31.tmp

Download Submit
C:\Windows\Installer\MSI3F9F.tmp

Download Submit
C:\Windows\Installer\MSI407A.tmp

Download Submit
C:\Windows\Installer\MSI4165.tmp

Download Submit
C:\Windows\Installer\MSI4250.tmp

Download Submit
C:\Windows\Installer\MSI432C.tmp

Download Submit
C:\Windows\Installer\MSI45BC.tmp

Download Submit
C:\Windows\Installer\MSI46D6.tmp

Download Submit
\??\pipe\{1B8D7CD0-CF6F-4B7A-84A7-BC5C3FF0D963}

Download Submit
\Program Files\FileZilla FTP Client\filezilla.exe

Download Submit
\Program Files\FileZilla FTP Client\filezilla.exe

Download Submit
\Program Files\FileZilla FTP Client\filezilla.exe

Download Submit
\Program Files\FileZilla FTP Client\filezilla.exe

Download Submit
\Program Files\FileZilla FTP Client\filezilla.exe

Download Submit
\Program Files\FileZilla FTP Client\fzshellext.dll

Download Submit
\Program Files\FileZilla FTP Client\fzshellext_64.dll

Download Submit
\Program Files\FileZilla FTP Client\libfilezilla-9.dll

Download Submit
\Program Files\FileZilla FTP Client\libgcc_s_seh-1.dll

Download Submit
\Program Files\FileZilla FTP Client\libgmp-10.dll

Download Submit
\Program Files\FileZilla FTP Client\libgnutls-30.dll

Download Submit
\Program Files\FileZilla FTP Client\libhogweed-6.dll

Download Submit
\Program Files\FileZilla FTP Client\libnettle-8.dll

Download Submit
\Program Files\FileZilla FTP Client\libpng16-16.dll

Download Submit
\Program Files\FileZilla FTP Client\libsqlite3-0.dll

Download Submit
\Program Files\FileZilla FTP Client\libstdc++-6.dll

Download Submit
\Program Files\FileZilla FTP Client\uninstall.exe

Download Submit
\Program Files\FileZilla FTP Client\zlib1.dll

Download Submit
\Program Files\McAfee\WebAdvisor\Temp1801804985\installer.exe

Download Submit
\Program Files\McAfee\WebAdvisor\Temp1801804985\installer.exe

Download Submit
\Program Files\McAfee\WebAdvisor\eventmanager.dll

Download Submit
\Program Files\McAfee\WebAdvisor\logicmodule.dll

Download Submit
\Program Files\McAfee\WebAdvisor\lookupmanager.dll

Download Submit
\Program Files\McAfee\WebAdvisor\servicehost.exe

Download Submit
\Program Files\McAfee\WebAdvisor\servicehost.exe

Download Submit
\Program Files\McAfee\WebAdvisor\settingmanager.dll

Download Submit
\Program Files\McAfee\WebAdvisor\taskmanager.dll

Download Submit
\Program Files\McAfee\WebAdvisor\uihost.exe

Download Submit
\Program Files\McAfee\WebAdvisor\uihost.exe

Download Submit
\Program Files\McAfee\WebAdvisor\uimanager.dll

Download Submit
\Program Files\McAfee\WebAdvisor\updater.exe

Download Submit
\Program Files\McAfee\WebAdvisor\updater.exe

Download Submit
\Program Files\McAfee\WebAdvisor\wataskmanager.dll

Download Submit
\Program Files\McAfee\WebAdvisor\win32\downloadscan.dll

Download Submit
\Program Files\McAfee\WebAdvisor\win32\ieplugin.dll

Download Submit
\Program Files\McAfee\WebAdvisor\win32\wssdep.dll

Download Submit
\Program Files\McAfee\WebAdvisor\x64\downloadscan.dll

Download Submit
\Program Files\McAfee\WebAdvisor\x64\ieplugin.dll

Download Submit
\Program Files\McAfee\WebAdvisor\x64\wssdep.dll

Download Submit
\Users\Admin\AppData\Local\Temp\a3v\byy.exe

Download Submit
\Users\Admin\AppData\Local\Temp\inH2593013201005\libeay32.dll

Download Submit
\Users\Admin\AppData\Local\Temp\inH2593013201005\ssleay32.dll

Download Submit
\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\installer.exe

Download Submit
\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\saBSI.exe

Download Submit
\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\saBSI.exe

Download Submit
\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\saBSI.exe

Download Submit
\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\saBSI.exe

Download Submit
\Users\Admin\AppData\Local\Temp\ns20813EE1\2D6B7D05_stp\saBSI.exe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd25927061964825\libeay32.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsd25927061964825\ssleay32.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\INetC.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\Math.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\StartMenu.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\UAC.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\UserInfo.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\nsDialogs.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\nsi2034.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\nsx6F5.tmp\nsis_appid.dll

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISBEW64.exe

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\ISRT.dll

Download Submit
\Users\Admin\AppData\Local\Temp\{4DA8EC67-B574-438A-8C80-DAE8320E18CB}\_isres_0x0409.dll

Download Submit
\Windows\Installer\MSI3176.tmp

Download Submit
\Windows\Installer\MSI31F4.tmp

Download Submit
\Windows\Installer\MSI330E.tmp

Download Submit
\Windows\Installer\MSI3418.tmp

Download Submit
\Windows\Installer\MSI3477.tmp

Download Submit
\Windows\Installer\MSI34C6.tmp

Download Submit
\Windows\Installer\MSI3524.tmp

Download Submit
\Windows\Installer\MSI35F0.tmp

Download Submit
\Windows\Installer\MSI364F.tmp

Download Submit
\Windows\Installer\MSI38B0.tmp

Download Submit
\Windows\Installer\MSI390F.tmp

Download Submit
\Windows\Installer\MSI39DB.tmp

Download Submit
\Windows\Installer\MSI3A2A.tmp

Download Submit
\Windows\Installer\MSI3AF5.tmp

Download Submit
\Windows\Installer\MSI3BD1.tmp

Download Submit
\Windows\Installer\MSI3CBC.tmp

Download Submit
\Windows\Installer\MSI3D2A.tmp

Download Submit
\Windows\Installer\MSI3D89.tmp

Download Submit
\Windows\Installer\MSI3DD8.tmp

Download Submit
\Windows\Installer\MSI3E65.tmp

Download Submit
\Windows\Installer\MSI3F31.tmp

Download Submit
\Windows\Installer\MSI3F9F.tmp

Download Submit
\Windows\Installer\MSI407A.tmp

Download Submit
\Windows\Installer\MSI4165.tmp

Download Submit
\Windows\Installer\MSI4250.tmp

Download Submit
\Windows\Installer\MSI432C.tmp

Download Submit
\Windows\Installer\MSI45BC.tmp

Download Submit
\Windows\Installer\MSI46D6.tmp

Download Submit
memory/300-1743-0x0000000000000000-mapping.dmp

Download
memory/432-523-0x0000000000000000-mapping.dmp

Download
memory/572-1626-0x0000000000000000-mapping.dmp

Download
memory/580-1726-0x0000000000000000-mapping.dmp

Download
memory/772-1657-0x0000000000000000-mapping.dmp

Download
memory/948-542-0x0000000000000000-mapping.dmp

Download
memory/1032-1620-0x000007FF1FD10000-0x000007FF1FD20000-memory.dmp

Filesize
64KB

Download
memory/1032-1646-0x000007FF1FD10000-0x000007FF1FD20000-memory.dmp

Filesize
64KB

Download
memory/1032-1642-0x000007FF1FD10000-0x000007FF1FD20000-memory.dmp

Filesize
64KB

Download
memory/1032-1631-0x000007FF1FD10000-0x000007FF1FD20000-memory.dmp

Filesize
64KB

Download
memory/1144-1435-0x0000000000000000-mapping.dmp

Download
memory/1144-1501-0x0000000006C80000-0x0000000006C81000-memory.dmp

Filesize
4KB

Download
memory/1160-1722-0x0000000000000000-mapping.dmp

Download
memory/1308-526-0x0000000000000000-mapping.dmp

Download
memory/1404-1304-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1261-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1295-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-530-0x0000000000000000-mapping.dmp

Download
memory/1404-536-0x00000000022A0000-0x00000000024E1000-memory.dmp

Filesize
2.3MB

Download
memory/1404-537-0x00000000022A0000-0x00000000024E1000-memory.dmp

Filesize
2.3MB

Download
memory/1404-538-0x00000000034F0000-0x00000000039C3000-memory.dmp

Filesize
4.8MB

Download
memory/1404-547-0x0000000005380000-0x0000000005391000-memory.dmp

Filesize
68KB

Download
memory/1404-548-0x0000000005790000-0x00000000057A1000-memory.dmp

Filesize
68KB

Download
memory/1404-550-0x0000000005380000-0x0000000005391000-memory.dmp

Filesize
68KB

Download
memory/1404-551-0x0000000005380000-0x0000000005391000-memory.dmp

Filesize
68KB

Download
memory/1404-1259-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1260-0x0000000005F50000-0x0000000005F61000-memory.dmp

Filesize
68KB

Download
memory/1404-1294-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1264-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1274-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1277-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1278-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1282-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1283-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1290-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1292-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1303-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1299-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1293-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1404-1296-0x0000000005B40000-0x0000000005B51000-memory.dmp

Filesize
68KB

Download
memory/1484-1735-0x0000000000000000-mapping.dmp

Download
memory/1496-12-0x0000000005BA0000-0x0000000005BB1000-memory.dmp

Filesize
68KB

Download
memory/1496-513-0x0000000005BA0000-0x0000000005BB1000-memory.dmp

Filesize
68KB

Download
memory/1496-533-0x000000000C200000-0x000000000C220000-memory.dmp

Filesize
128KB

Download
memory/1496-8-0x0000000005190000-0x0000000005674000-memory.dmp

Filesize
4.9MB

Download
memory/1496-13-0x0000000005FB0000-0x0000000005FC1000-memory.dmp

Filesize
68KB

Download
memory/1496-14-0x0000000005BA0000-0x0000000005BB1000-memory.dmp

Filesize
68KB

Download
memory/1496-511-0x0000000005BA0000-0x0000000005BB1000-memory.dmp

Filesize
68KB

Download
memory/1496-512-0x0000000005BA0000-0x0000000005BB1000-memory.dmp

Filesize
68KB

Download
memory/1548-1664-0x0000000000000000-mapping.dmp

Download
memory/1564-527-0x0000000000000000-mapping.dmp

Download
memory/1632-1572-0x0000000000000000-mapping.dmp

Download
memory/1960-1746-0x0000000000000000-mapping.dmp

Download
memory/2044-6-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp

Filesize
2.5MB

Download
memory/2156-1314-0x0000000000000000-mapping.dmp

Download
memory/2172-1557-0x000007FF1ED60000-0x000007FF1ED70000-memory.dmp

Filesize
64KB

Download
memory/2172-1516-0x0000000000000000-mapping.dmp

Download
memory/2176-1396-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1402-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1364-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1429-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1428-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1370-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1360-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1371-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1374-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1375-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1376-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1377-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1378-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1379-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1427-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1381-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1382-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1383-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1384-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1385-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1353-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1386-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1354-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1387-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1355-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1388-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1389-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1390-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1350-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1391-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1426-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1392-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1356-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1393-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1394-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1395-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1425-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1367-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1397-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1398-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1424-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1399-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1400-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1423-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1348-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1351-0x00000001065D0000-0x00000001065E0000-memory.dmp

Filesize
64KB

Download
memory/2176-1422-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1403-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1368-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1404-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1362-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1405-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1347-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1406-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1346-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1407-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1363-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1411-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1359-0x0000000160970000-0x0000000160980000-memory.dmp

Filesize
64KB

Download
memory/2176-1412-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1413-0x000000016ABA0000-0x000000016ABB0000-memory.dmp

Filesize
64KB

Download
memory/2176-1414-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1415-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1416-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1325-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1417-0x0000000169760000-0x0000000169770000-memory.dmp

Filesize
64KB

Download
memory/2176-1318-0x0000000000000000-mapping.dmp

Download
memory/2176-1419-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1421-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2176-1420-0x00000001530A0000-0x00000001530B0000-memory.dmp

Filesize
64KB

Download
memory/2268-1466-0x0000000000000000-mapping.dmp

Download
memory/2320-1740-0x0000000000000000-mapping.dmp

Download
memory/2364-1580-0x0000000000000000-mapping.dmp

Download
memory/2384-1729-0x0000000000000000-mapping.dmp

Download
memory/2400-1349-0x0000000000000000-mapping.dmp

Download
memory/2424-1352-0x0000000000000000-mapping.dmp

Download
memory/2468-1358-0x0000000000000000-mapping.dmp

Download
memory/2532-1365-0x0000000000000000-mapping.dmp

Download
memory/2552-1661-0x0000000000000000-mapping.dmp

Download
memory/2572-1369-0x0000000000000000-mapping.dmp

Download
memory/2628-1380-0x0000000000000000-mapping.dmp

Download
memory/2676-1570-0x0000000000000000-mapping.dmp

Download
memory/2852-1749-0x0000000000000000-mapping.dmp

Download
memory/2896-1635-0x0000000000000000-mapping.dmp

Download
memory/2900-1574-0x0000000000000000-mapping.dmp

Download
memory/2948-1691-0x0000000000000000-mapping.dmp

Download
memory/2972-1430-0x0000000000000000-mapping.dmp

Download
memory/3028-1431-0x0000000000000000-mapping.dmp

Download
memory/3064-1732-0x0000000000000000-mapping.dmp

Download
memory/3068-1433-0x0000000000000000-mapping.dmp

Download