6870e8dbcfaf543500add1d303de528c34e3b1f4d4424b0097c4ffb408a44fcd

Analysis

max time kernel
110s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
Size 3.3MB
Sample240221-2e7j5agb7w
SHA256 6870e8dbcfaf543500add1d303de528c34e3b1f4d4424b0097c4ffb408a44fcd
MD5 7c2e5ef59e9589422bcd5bf3726fbcb1
SHA1 c4dac6966ac4cd3500d6a7fe44138a0db639d507
SHA512 28870d9cb07f964ba0ecedfb25762cb4530bda869cc717dd4fffcd176085f03c05fd129b23e826dd6ac33ae6af8132bf9dc317ebffb52448b83236ad2349ca45
SSDEEP 49152:XZi5hu7I/BzfK/ZHg1pHtOUYqP3CFOrtG/RR9sXafgkDFMVR9C1UhPJXMK701hOw:XI5ht/BzfKW1t0xOouBiCV2Ht
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit persistence spyware stealer upx

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
3752	takeown.exe
5380	takeown.exe
5500	icacls.exe
5308	icacls.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3752	takeown.exe
5380	takeown.exe
5500	icacls.exe
5308	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002327f-64.dat	upx
behavioral2/memory/2696-68-0x0000000000840000-0x0000000000E19000-memory.dmp	upx
behavioral2/files/0x000600000002327f-70.dat	upx
behavioral2/memory/3428-74-0x0000000000840000-0x0000000000E19000-memory.dmp	upx
behavioral2/memory/3120-87-0x0000000000350000-0x0000000000929000-memory.dmp	upx
behavioral2/memory/3120-82-0x0000000000350000-0x0000000000929000-memory.dmp	upx
behavioral2/memory/4040-93-0x0000000000840000-0x0000000000E19000-memory.dmp	upx
behavioral2/memory/1484-117-0x0000000000840000-0x0000000000E19000-memory.dmp	upx

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	OperaGXSetup.exe
File opened (read-only)	\??\F:	OperaGXSetup.exe
File opened (read-only)	\??\D:	OperaGXSetup.exe
File opened (read-only)	\??\F:	OperaGXSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-pt-PT.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\browserhost.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-nl-NL.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-pt-PT.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\wa_logo2.png	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\wssdep.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-zh-CN.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\balloon_safe_annotation.png	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\resource.dll	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-cs-CZ.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-pl-PL.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-pt-PT.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\wa_install_close2.png	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-es-MX.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-it-IT.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\lookupmanager.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\mfw-nps.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\mfw-webadvisor.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\telemetry.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\uninstaller.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-sk-SK.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\analyticsmanager.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\icon_failed.png	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-it-IT.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\eventmanager.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-el-GR.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\wa-ui-install.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-sv-SE.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-pl-PL.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-ko-KR.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\icon_laptop.png	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\wa_install_check2.png	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-sr-Latn-CS.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\mcafeecerts.xml	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-es-ES.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-en-US.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\mcafee_pc_install_icon.png	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\webadvisor.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-da-DK.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-shared-es-ES.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\browserplugin.cab	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\wa-res-install-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\wa_logo.png	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-de-DE.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2166663703\jslang\eula-fr-FR.txt	installer.exe

Executes dropped EXE 10 IoCs

pid	Process
1056	saBSI.exe
2696	OperaGXSetup.exe
3428	OperaGXSetup.exe
3120	OperaGXSetup.exe
4040	OperaGXSetup.exe
1484	OperaGXSetup.exe
4976	saBSI.exe
4444	LDPlayer.exe
1196	installer.exe
1620	installer.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3404	sc.exe
3824	sc.exe
5448	sc.exe
4636	sc.exe
4776	sc.exe
5740	sc.exe
5684	sc.exe
4424	sc.exe
6000	sc.exe

Loads dropped DLL 8 IoCs

pid	Process
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
2696	OperaGXSetup.exe
3428	OperaGXSetup.exe
3120	OperaGXSetup.exe
4040	OperaGXSetup.exe
1484	OperaGXSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 4 IoCs

evasion

pid	Process
4420	taskkill.exe
5032	taskkill.exe
1192	taskkill.exe
4200	taskkill.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
1056	saBSI.exe
1056	saBSI.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
1056	saBSI.exe
1056	saBSI.exe
1056	saBSI.exe
1056	saBSI.exe
1056	saBSI.exe
1056	saBSI.exe
1056	saBSI.exe
1056	saBSI.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
4976	saBSI.exe
4976	saBSI.exe
4444	LDPlayer.exe
4444	LDPlayer.exe
4444	LDPlayer.exe
4444	LDPlayer.exe
4444	LDPlayer.exe
4444	LDPlayer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
Token: SeShutdownPrivilege	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
Token: SeCreatePagefilePrivilege	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
Token: SeDebugPrivilege	4420	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	1192	taskkill.exe
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeTakeOwnershipPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe
Token: SeDebugPrivilege	4444	LDPlayer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4420	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	88
PID 5048 wrote to memory of 4420	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	88
PID 5048 wrote to memory of 4420	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	88
PID 5048 wrote to memory of 5032	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	91
PID 5048 wrote to memory of 5032	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	91
PID 5048 wrote to memory of 5032	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	91
PID 5048 wrote to memory of 1192	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	93
PID 5048 wrote to memory of 1192	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	93
PID 5048 wrote to memory of 1192	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	93
PID 5048 wrote to memory of 4200	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	95
PID 5048 wrote to memory of 4200	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	95
PID 5048 wrote to memory of 4200	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	95
PID 2696 wrote to memory of 3428	2696	OperaGXSetup.exe	100
PID 2696 wrote to memory of 3428	2696	OperaGXSetup.exe	100
PID 2696 wrote to memory of 3428	2696	OperaGXSetup.exe	100
PID 2696 wrote to memory of 3120	2696	OperaGXSetup.exe	101
PID 2696 wrote to memory of 3120	2696	OperaGXSetup.exe	101
PID 2696 wrote to memory of 3120	2696	OperaGXSetup.exe	101
PID 2696 wrote to memory of 4040	2696	OperaGXSetup.exe	102
PID 2696 wrote to memory of 4040	2696	OperaGXSetup.exe	102
PID 2696 wrote to memory of 4040	2696	OperaGXSetup.exe	102
PID 4040 wrote to memory of 1484	4040	OperaGXSetup.exe	103
PID 4040 wrote to memory of 1484	4040	OperaGXSetup.exe	103
PID 4040 wrote to memory of 1484	4040	OperaGXSetup.exe	103
PID 1056 wrote to memory of 4976	1056	saBSI.exe	104
PID 1056 wrote to memory of 4976	1056	saBSI.exe	104
PID 1056 wrote to memory of 4976	1056	saBSI.exe	104
PID 5048 wrote to memory of 4444	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	97
PID 5048 wrote to memory of 4444	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	97
PID 5048 wrote to memory of 4444	5048	LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe	97
PID 4976 wrote to memory of 1196	4976	saBSI.exe	105
PID 4976 wrote to memory of 1196	4976	saBSI.exe	105
PID 1196 wrote to memory of 1620	1196	installer.exe	106
PID 1196 wrote to memory of 1620	1196	installer.exe	106

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_jp.co.shueisha.mangaplus_3040_ld.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM dnplayer.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM dnmultiplayer.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM dnmultiplayerex.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM bugreport.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\LDPlayer\LDPlayer9\LDPlayer.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=3040 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=1048616
    3⤵
    PID:2952
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      PID:5368
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        
        PID:5560
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      PID:3264
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      PID:5316
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      PID:5540
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      PID:5916
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3752
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5380
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5500
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5308
  - - C:\Windows\SysWOW64\dism.exe
      C:\Windows\system32\dism.exe /Online /English /Get-Features
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\C5E387FA-B0DA-4312-847D-6C033BD62E33\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\C5E387FA-B0DA-4312-847D-6C033BD62E33\dismhost.exe {C8FCDD91-76FD-4F20-8BCD-1A41CE151A68}
        5⤵
        
        PID:1300
  - - C:\Windows\SysWOW64\sc.exe
      sc query HvHost
      4⤵
      Launches sc.exe
      PID:5740
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmms
      4⤵
      Launches sc.exe
      PID:5684
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmcompute
      4⤵
      Launches sc.exe
      PID:4424
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      PID:6076
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      PID:5980
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      PID:5984
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      PID:3500
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      PID:4636
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      PID:6000
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      PID:2360
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      PID:5876

C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\saBSI.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
  "C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true saBsiVersion=4.1.1.818 CountryCode=GB /no_self_update
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
    "C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Program Files\McAfee\Temp2166663703\installer.exe
      "C:\Program Files\McAfee\Temp2166663703\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
      4⤵
      Executes dropped EXE
      PID:1620
    - - C:\Windows\SYSTEM32\sc.exe
        
        sc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"
        5⤵
        Launches sc.exe
        
        PID:4776
    - - C:\Windows\SYSTEM32\regsvr32.exe
        
        regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
        5⤵
        
        PID:4860
    - - C:\Windows\SYSTEM32\regsvr32.exe
        
        regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
        5⤵
        
        PID:2260
    - - C:\Windows\SYSTEM32\sc.exe
        
        sc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//0
        5⤵
        Launches sc.exe
        
        PID:3404
    - - C:\Windows\SYSTEM32\sc.exe
        
        sc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"
        5⤵
        Launches sc.exe
        
        PID:3824
    - - C:\Windows\SYSTEM32\sc.exe
        
        sc.exe start "McAfee WebAdvisor"
        5⤵
        Launches sc.exe
        
        PID:5448
    - - C:\Windows\SYSTEM32\regsvr32.exe
        
        regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
        5⤵
        
        PID:5440
      - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
        6⤵
        
        PID:5504
    - - C:\Windows\SYSTEM32\regsvr32.exe
        
        regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
        5⤵
        
        PID:5600

C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:operagx --launchopera=0
1⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe
  C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=97.0.4719.84 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2f8,0x6ecdb3f0,0x6ecdb400,0x6ecdb40c
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3428
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2696 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20240221223237" --session-guid=93240f85-ced1-4766-ba7a-d7dd74feee22 --server-tracking-blob=OWU3NDZmZWI4NzQ2YzliNDBkZjJhZGExOWExYmQzNjk0NDMzNDBkZDBmNjk5MDM4Y2JkNTE1YmMzMDlhMGVmNDp7ImNvdW50cnkiOiJJTCIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9YWlzJnV0bV9tZWRpdW09YXBiIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjgyNDA4MzY5Ljg4ODUiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTEyLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvcGVyYWd4IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiYWlzIn0sInV1aWQiOiI2M2ZkNTRmNy0xZjBiLTQ0NDEtYmNjOC05ZTI0YzFjZDM3ZjAifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A005000000000000
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe
    C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=97.0.4719.84 --initial-client-data=0x2e4,0x2e8,0x2f8,0x2c0,0x2fc,0x6e05b3f0,0x6e05b400,0x6e05b40c
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1484
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402212232371\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402212232371\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402212232371\assistant\assistant_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402212232371\assistant\assistant_installer.exe" --version
  2⤵
  PID:744
- - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402212232371\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402212232371\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x11b4f48,0x11b4f58,0x11b4f64
    3⤵
    PID:4416

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
1⤵
PID:3488

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
PID:5568
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  PID:4076

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
PID:4852

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
PID:2228
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  PID:1060

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
PID:5172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LDPlayer.exe

Path C:\LDPlayer\LDPlayer9\LDPlayer.exe
Size 1.4MB
SHA256 ca5298c315bff5decb40ef3fac6cbffa0c0c2582839af5101b4758d67a702759
MD5 0ed23002068a9c0840e0db5a27b3abae
SHA1 516322b51e2e220724808b1a0398f70bf3a5607f
SHA512 057f3b7883387a153e68fa458497937f5b2f395cedea007c6962b45c38374202fd8ad9b27e8713897ee47e7431faf554c812ecbe1c146bcfa5391f3dc4c82a59
SSDEEP 24576:J/XP42kU0uk6ceBe2CeQvUpObnXNDWDUq4PrVxxBwoGOIHi0KnEWf:9gxhuRcKD5rOLX31uoGOIHi0KnEWf
MD5 SHA1 SHA512 SSDEEP

Submit Download

LDPlayer.exe

Path C:\LDPlayer\LDPlayer9\LDPlayer.exe
Size 896KB
SHA256 11ec869a5ad715a7c49dde3469a6683e89c78d085a5fced3cd52b628d5c07212
MD5 76be01ff7099dfc98da68124c85b3f74
SHA1 f9772450397f36b70a1e17fc6f7b8331e0b3149b
SHA512 46b9d055b7c69d97fbe05b8ef1601dad180acd91752620d7dc76df178aef7afd11136e21de67b72093feb31a6776056bdc32bdfa209cd94abdc99741806ef60a
SSDEEP 24576:J/XP42kU0uk6ceBe2CeQvUpObnXNDWDUq4PrVxxBb:9gxhuRcKD5rOLX319
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 51KB
SHA256 68feaaf31b4cf0c3b1ebf5ecdf8f551914f0e50fadb38c23fcbb396b1808f8bd
MD5 44018fcece5f173e4e931d1d681f8607
SHA1 302060adf3e797b6c5aa9dbeba755b640943268e
SHA512 90afee634f07d8e8026e2f368e2036a93355f9ea6b8e420a05ff2ee069eeaa2147c5df50fcd996faf99837b4142dac76a70de64b967daf7511b17d7647d02dda
SSDEEP 1536:RPGyMprkvxXb0HOafrHIQM4Q7HxfkL7ZUx:UyVpVaDoQM4QY
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 2.6MB
SHA256 e2d94723f14c4baa68f08ef98a5d230d89eccbc7138f954cbc017bacf11cdf68
MD5 7c770659f9210f68980a85d1e7a95b12
SHA1 3a80aa9d7a2f7beed35e888cd09ca0a85c4d797c
SHA512 77c93d7e3da49c5bd7427d2a62d3c4b1a6c137fd1b33a77369b43fda728dca37c20eab11f9f710a3e18d7a5296392e61670653db32e20d07b0d4ee64416d19d1
SSDEEP 49152:pvSi/Rt+YIuUU53Cr+8ZmBQbd0evANaUMT3ZAOBfG+x5KnCC:hSiptxUa3Wzbd0ewNMTJ4+x5KCC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 1.8MB
SHA256 bf7ac0943c27969930e222ed2cf5e64f6252c938ea399d07d6caba9ea3e57e22
MD5 04334f8c589d9a5cf4c4e4aad25c65a5
SHA1 9b6c5cd94089290f9bd9526ecc0fff2efaa1a23e
SHA512 8b94204c2ada981fe68e3d977a96089ac81cb40b81380d2d32a77c756a6aef2d7e1c68fa5a6ef02d2515d571151374968965f2ff23e16b0507a071d788c47164
SSDEEP 24576:pXggRI1RsVBRtME40YsLiYIuBrNpfglvs53Cra8E34xwO2i3+amkL831euZMd0gJ:pvSi/Rt+YIuUU53Cr+8ZmBQbd0e1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 2.0MB
SHA256 8883c73e76a9b82cc615f13b003d52c1b09d956fba46c900df9e48ff184acdd7
MD5 17dc771ff4ad89b192bafa832518721f
SHA1 c4380990fcdf72061081a4468cf6b165db5638d7
SHA512 467407fe31d849aa5fd55525459fa9013ca9bf1eaa46b8e0b0396421afc17a10ebe3a97f9886711e5380d9e2b44df4c2a061d148875e724b15de7b9d2ac9a37a
SSDEEP 49152:N3n/nnEWVOQZR5bKbZk4LTn9s7D5YT9VHSRPpc04Vr30Mg:N3/nvxWblvGnmbHS5O0S30Mg
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp120.dll

Path C:\LDPlayer\LDPlayer9\msvcp120.dll
Size 444KB
SHA256 891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9
MD5 50260b0f19aaa7e37c4082fecef8ff41
SHA1 ce672489b29baa7119881497ed5044b21ad8fe30
SHA512 6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d
SSDEEP 12288:aZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77m:a/8wVwHZFTwFOOos3Ooc8DHkC2e77m
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\LDPlayer\LDPlayer9\msvcr120.dll
Size 947KB
SHA256 2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112
MD5 50097ec217ce0ebb9b4caa09cd2cd73a
SHA1 8cd3018c4170072464fbcd7cba563df1fc2b884c
SHA512 ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058
SSDEEP 12288:6BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJSH:SmFyjLF847eiWWcoGZVOIxh/WxIAIbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

analyticsmanager.cab

Path C:\Program Files\McAfee\Temp2166663703\analyticsmanager.cab
Size 1.6MB
SHA256 6473b68565947761067587131ba42a42937ab497a5584c44e43cb6f41e92dcc1
MD5 1f08fb486750295c77fe137f07062fa8
SHA1 cf72ef73e813eff006c01dab2ec5eb65106af9a7
SHA512 8c3a449062d64506e7cea03e1b9b921d4fa10a10bb6a796c400056a601b256f97006bef95e65d26ab2fd0b38bb58af64583971864be9e01386e5d975dfe57c4b
SSDEEP 24576:eEcc1L9YhlQwMAjp46g7Ncj87vUKXdvM8kE/z3HoCTsF/k6Ce8KDiKK:ZcZQZq46cIGLkqbsF/k6Cecv
MD5 SHA1 SHA512 SSDEEP

Submit Download

analyticstelemetry.cab

Path C:\Program Files\McAfee\Temp2166663703\analyticstelemetry.cab
Size 58KB
SHA256 3829fea320ad3c1aea101d47de31f93411114c2b4473fc75d11a809bdf1906c6
MD5 f4f1873a7f68239272ecb3a92f1a128a
SHA1 288f5295325dc3986269b07f901aa186736bfa79
SHA512 4e195d038a83e8d7a0a52f9809c4ab2ece1f934220e0aaf143716bc35e8a8d682b101a42d218f00646a282bdf87cec73ef4211662ef56ca5caea691521fd8000
SSDEEP 768:BXn2qMpajqLnBNfv1D5aYNrD2/1eSiykrKt0v2wQJUkYq2HiPvYGAMxkEW2PsnAp:RjwBNfv1fN6w23p4i/xS7HxI
MD5 SHA1 SHA512 SSDEEP

Submit Download

browserhost.cab

Path C:\Program Files\McAfee\Temp2166663703\browserhost.cab
Size 1.2MB
SHA256 3dffaab4c4d8ca047a24e5eaf50bfcc2eb649e8eac7d292adfca4683b687b071
MD5 0c693c6f86339af4e5373bf2882733ef
SHA1 e1b19d022b2e7abc4912979208e926cc53e0e990
SHA512 fddfda39c795614779a93deb2f3579eb7df3dbe597ca5da50648c44f7a5d6aa26661de85c18f3cab9cb9b03fd677779572819e2b274a19934c010b7a108d7307
SSDEEP 24576:lGTQW+RF1jbtXYVUHOLpaDz22TCfti9Dz95XvRahb/Ecuvt7F4xu6UKiHQ:l9W+zhYDpaDH4IV8BwRF4bUhQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

browserplugin.cab

Path C:\Program Files\McAfee\Temp2166663703\browserplugin.cab
Size 1.1MB
SHA256 5fc1984061e8b8249828e36df722f663a3124da8f10f96957a579a623bcc4177
MD5 cd0e4d4d18af26ee082a38e28ed1f78c
SHA1 a8a18a58905bc54e0d01192e1948f76074adff7b
SHA512 bc640bd8fdeb648dcdd478b4c7da7e7b9c1f640aa356592aa59dab1ead31fe044403e79707bd51e4b719dadca87c655248f30bedde3cf6c87805225c2a792fe9
SSDEEP 24576:o3XYPTVXmpKiPiBW/91qKpNKDXkwKd7AIcLbNYSymvFYHa98AynvwS9BRsNO:KXYPT5mpKHW/94GNsXkwKmLbmSWHY8A4
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloadscan.cab

Path C:\Program Files\McAfee\Temp2166663703\downloadscan.cab
Size 1.1MB
SHA256 d79e158adcffe72b24dd7d3261006c707934a6a4076b4028baac55ee3311da5c
MD5 12ec1c2ed4b2fa82184fe419b3bf6e76
SHA1 7a788623a0d52da17b8fca9bcb17cea077b79aff
SHA512 a6477a524ffec4eb1177443db872b2a3d937d141a984d216edcefc261a9b3cf6e8d1cdc12fc52f32f98c7356a9888fffe28c5e37e4f78c354d0b5b3419e3d624
SSDEEP 24576:hI+9eYSqawHTv3pWPBEEgkeUvnWTbtyFdhNK8szt2YgaxC:5sqjq/7NKXphgaxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

eventmanager.cab

Path C:\Program Files\McAfee\Temp2166663703\eventmanager.cab
Size 960KB
SHA256 7a35c329cd5cc8f495db03b61af67be40d00e43f52f0145f5e7ed45fcabe11f9
MD5 01177e8570dd98dae92eac5842368a45
SHA1 a4bb216508c36063355fb10cc1d9bb249eaf5cb6
SHA512 95caece511f418009b59530c3a17aa376bf9da3030c156820b65f25c5682bb4f2805d294c64fb881f2c6b7ca98b74287c895229efbd70a70d128e0796a8afe74
SSDEEP 24576:jgi+eNleThtoZlNyGqui/mhhGZm8dNd6LpBZe:DleklsIDhkxNdWpq
MD5 SHA1 SHA512 SSDEEP

Submit Download

installer.exe

Path C:\Program Files\McAfee\Temp2166663703\installer.exe
Size 2.4MB
SHA256 f8b10a122ff9c932ca97f80e6bcf6f210b8d54599aed029d43a07017073d6bc4
MD5 9daf36d81b100292bfd1104a310756f6
SHA1 c2a21215b054212591ea5b094a268c612d3f6d3f
SHA512 b068431bba264f0324cf42e88bc6d13027dec32012dc3a3b7f7e65cba2df196cf68b77e753d87d6d32fb7ae15df8f853e930bd21432fa52404272901a6688617
SSDEEP 49152:mJVTGnf4b66t+YffWJVbZ6lKyf2jMEq8euZbin:KJlVAVbZ6/uiuZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

l10n.cab

Path C:\Program Files\McAfee\Temp2166663703\l10n.cab
Size 273KB
SHA256 d3cf77bae0af34388d45005b24ac009daab7490b00c9d8b9907481167262eb27
MD5 53b2ba2438c18cc602b7601348beb129
SHA1 b95175800086f98062fe011d1435d152b449feed
SHA512 b19008619c29a4843f83807e2dd9b402bb3028967e788d2e05bcb52fb64f077c140980d2996ca54f53c1c31688c987974248fc41b45693b8f7909e93d1be3e36
SSDEEP 6144:A7v/TAhXO58TkGyRKRsgVLAsDF6kAinE1EMVIZZg9I6SVq4S0:c85O58QBzgVLjokW+sGZwgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

logicmodule.cab

Path C:\Program Files\McAfee\Temp2166663703\logicmodule.cab
Size 832KB
SHA256 6346c00e1a032e4a4b7b5333c262fab361ab43bd963a5c4fcdd4bb8e8e12514f
MD5 b2f87dddc6145a40daa1cbb489e04df8
SHA1 6c9715b2422304fba848d179fa33546685a27f75
SHA512 d60a79f211a492f78004cbbb4eae539da4cb76ac1132b335af2b684737c4d94ffaad95b7592b95dcb0cfe590206129f11d30fbb8ae694481dfb754d2f209e371
SSDEEP 24576:wonvZkS2wP5KsO1Qz3tMliRjvH2Pcl6mo+:woRkS2KKsOkMlyePnmo+
MD5 SHA1 SHA512 SSDEEP

Submit Download

logicscripts.cab

Path C:\Program Files\McAfee\Temp2166663703\logicscripts.cab
Size 57KB
SHA256 4549a4c73c3ca3898ee8443e28795effd85cddc87d57ac38c5087c53c14f056c
MD5 d55a19592f1160fed1f7f7ddff36cf21
SHA1 e19a058fa52f3c8635517ce7646fad181a28c015
SHA512 70758593cd42aa8be9874cf196e229bb2824e28ef748f9e704c550dae57417299db66fb4965fd2afaa59a6d12d0b9477873bf449c2f2ae1d6e413c95ef77abcb
SSDEEP 1536:9eN86G8FzSEZuvNM6p2HYNrGUh54i2OxL7yjx4:9eLG8FzdZW66pNdGUh546u+
MD5 SHA1 SHA512 SSDEEP

Submit Download

lookupmanager.cab

Path C:\Program Files\McAfee\Temp2166663703\lookupmanager.cab
Size 640KB
SHA256 9d5631c2d21c91a7c654794040251b05e32d029dfbc79cfe7ac5a12008d90c7e
MD5 f3364784b6b2ae6776fda2dcef7fa698
SHA1 d544dc8142c8c90b83e5de365c58ecd0dab53a94
SHA512 3de33cb2b22cd2055776f90eda43095a73f81ac9a1b8921476177d9de224add7fa2ca339eaeee39760c3568b2fef07dcc971a1b887f4bac801153727e5e0e6d8
SSDEEP 12288:7wBEo+5grij38G09/ZB5Ww0zxVFAJlW5VDbJzM5QB9V7I4H8HuFSABT918An:7DkZqRP80VDaiBn8hAN8An
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfw-mwb.cab

Path C:\Program Files\McAfee\Temp2166663703\mfw-mwb.cab
Size 30KB
SHA256 3c83f0a109a619d1a95633d3832140b4988b787fb78ed11a7ec47f680577deed
MD5 bfc0cadcba91d927561d76bcf8b151c6
SHA1 1fb6ae9629aebcdd54308f72dd8bc43da29dfa5a
SHA512 704278c3b0381a7080ef1cdb8641592a4b2715039388f582121750391989b625790dd307508f1b1e01b04cc11950350aa7b285a980455755b968e547a4d774dc
SSDEEP 768:wvG7UzV+2HiPvYqmeYAMxkE4AI2PsBiAMxkEz:qG4zV+4iex8F76xH
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfw-nps.cab

Path C:\Program Files\McAfee\Temp2166663703\mfw-nps.cab
Size 33KB
SHA256 9778ed9ea19854a4312579c2e595d16f6c5c5645e4e8b91debe7fb582cf78573
MD5 754ec5710b8d2b0d08c2d4e49aeadaec
SHA1 088f9c3baf8c91b3677435c517930b0e33b008ae
SHA512 38db5777d535003cccaef7bebc2a87837a097b4eb725458e0f8b70fbd8854811981af66365bcb5bc3afa1f1f305af365b49926540d167c5001fcc4192e3bbba0
SSDEEP 768:CWHD+ss23BFz32HiPvYUAMxkEL2PsoAMxkEH:C4+o34iTxX72x7
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfw-webadvisor.cab

Path C:\Program Files\McAfee\Temp2166663703\mfw-webadvisor.cab
Size 915KB
SHA256 aaf18dbdef0d5362d2f2789b0dce5e1e91d0fd1fd4d8fef6f88acaf38ecbdf4b
MD5 4d56a925b39d2aa9bbc2a415be2e1235
SHA1 9fb6ddd87d9586995099fb0c1423553d409e1ad0
SHA512 d9f670b661cd83988f8092f638fd76474288a7a0ca27d819046e99d9db042e9bfe323676e485c29b3f4a2970a2f7f6aa2a84171997380e3325266373a6c6dbcd
SSDEEP 24576:NqYQMJ+bhFbFW1q+TGlFU6/6Q50lr8kDAXqeHr8:Nq/MJ+vpWYTlFV6Q69DAVL8
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfw.cab

Path C:\Program Files\McAfee\Temp2166663703\mfw.cab
Size 310KB
SHA256 bc48b292f67082e8515149ba81d3064359c09f5c646a7ee8e113940a6b812afd
MD5 a64bb575ff72e6c81d3358d07325fe46
SHA1 03d49603bbb7a5b3d4b96453d20845f794bdb1b0
SHA512 acf2a01d119e518a0de8dd419dd32e270b92a0c89d90428eaf6899d18959a1ea58891ff7ad95ccba14248b0d6a07d6e6f8d25ef7bd5889eb2e19eb0700267cf6
SSDEEP 6144:zCy0i4CC6L7OPUEA1y/xC28OYJZVjrw6Wv6jm8yTSz0F2ssolOH05uke4X2er:f0iyT0TJk6w8XzsyKQ9kJXxr
MD5 SHA1 SHA512 SSDEEP

Submit Download

resourcedll.cab

Path C:\Program Files\McAfee\Temp2166663703\resourcedll.cab
Size 50KB
SHA256 e3e6908b669ab0503133ef8cca2834782dd174be9de67b7c01bff10f953c4855
MD5 d452e574c6113a01b3a45d836a15a3b6
SHA1 ec6e41d57bd803347410fa5861e7521dbeec0a87
SHA512 2775ccfa8bb146a1b27d57f330923b8a80fb932a7fc1b3fdcd9747d45fe84fab48cacf593cdb16e33500680c891c8b04d9daa16a7d33ed40b00891be68e7a959
SSDEEP 768:AZ+0F0mM5iGYbPo6ByHmJnn4V6vFti+ImECyS1C72HiPvYvcAMxkE32PsUZAMxkE:AZ+0F0v5cag4VitmmBXS4iu6xT7UBxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

servicehost.cab

Path C:\Program Files\McAfee\Temp2166663703\servicehost.cab
Size 304KB
SHA256 dd65a1a4042505f4afc1d9a64d6e4bcceb707374137f519a7eb1ff8a96e91d53
MD5 2c91564d2834024d02b0eecaa911d097
SHA1 d9fcc86142edb4c3e32886f82537675a89944dce
SHA512 844ade18bee42800dae54d91dce34f126cc250a02b3e82d280ba5ec0d532b4d294b65ef000c520b8939ba932ebdaf818b2e5bf5c984bc933f048bd0935d77591
SSDEEP 6144:OaE0hzBiDPwefplzIe6SjJm/ljV8wg9yrRzExWxyPevVgR4Ju:OaEIzKxF0SjJ+1V8w+8QIscVr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

settingmanager.cab

Path C:\Program Files\McAfee\Temp2166663703\settingmanager.cab
Size 448KB
SHA256 663c95f23cadf606ab0dbc8e6e45ccf510854a86a3c2d4d35b1e28a12949a79c
MD5 bdbe235a86c5bcb4de623717747f51af
SHA1 70883c1fdcde27b40edea7dc8e65b8cfb1d8ca48
SHA512 1c9e25be9f6647e6494423e00e986136dc99789a554a7388a63c152017a144e9b6929ac1beb73e990dbc516aa0b1a7b476575d8e136b512f44207227a746da70
SSDEEP 6144:tjq/rs1yJusuNC/YQDZQ5wsR3lNbnoOCKDy7O2xRChKX29TG2CWx9qIBgfiiHTjA:tv1YruQbtsR3lN0iGpxk/oZW+Gmiiz8
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskmanager.cab

Path C:\Program Files\McAfee\Temp2166663703\taskmanager.cab
Size 512KB
SHA256 ae388af08eea67a4bed8d5a13a56f907c3e460dca9cdf8974ea32caae1c7520f
MD5 4038008eb23866be30c7f34ce7df3e5e
SHA1 cc2456449a35ee9f4f51659c4997936f75048fbc
SHA512 c0bc915a78a9c4d55feee99a460aa9c8241a556a1931a4eec7a5a5fb909a1dff4e90a516b7589da423489f1967d93999b110ff80f58d17bdddd2c9ef36914957
SSDEEP 12288:SquA1ww7HUbtaF7PzswCBy8YTqxK8ar1L5+qz49:luQtHUbtaFD8yTTqA8OL549
MD5 SHA1 SHA512 SSDEEP

Submit Download

telemetry.cab

Path C:\Program Files\McAfee\Temp2166663703\telemetry.cab
Size 89KB
SHA256 f0c76b1d6316039ec00b406f0a825a6d9e515d92d455b3760b9cc63f21898ec3
MD5 575ad9c9e0831d7689544eddd1e4ac98
SHA1 23fdfa59bd8c51627679d2f1414174bd176aa194
SHA512 afa269d2ac0e1d6d89e5d18060060759ff1a714672aa355b48473abf90230913dc3eb640e301718c66258bb7c03a478e5aaf720eb9405893e44368ea4a02d808
SSDEEP 1536:N9y2lzzNi1q9CziJFysBU0vqgx7qXH7Mi7zGDg9x92zG4iDxw7mbxU:N9yCz9UADBUg5qXbMifQg9YG4xSm
MD5 SHA1 SHA512 SSDEEP

Submit Download

uihost.cab

Path C:\Program Files\McAfee\Temp2166663703\uihost.cab
Size 256KB
SHA256 6e78e5e4bbd6eafd99274d0600a8c718b9150609073788e9e05cb83d71bffd94
MD5 e5be06193ed21e443d7ba8bda77b8c83
SHA1 9a7cdf183e1f56da5742810fc75301375008e452
SHA512 1e37656da30693ad2db4e6a413598919e3097931728278e4d02413e05fc5bc95f5800fa9dcc339b1545c268c69ccacf22fa0e23c8414cbca9902a0fb820cdea0
SSDEEP 6144:zKSDVAOxRAA1B8x2MYeCx32cy3ht0ACF42g3Vfah+CtoggF:tDVXRBCY9x3sUk3VfCtoggF
MD5 SHA1 SHA512 SSDEEP

Submit Download

uimanager.cab

Path C:\Program Files\McAfee\Temp2166663703\uimanager.cab
Size 320KB
SHA256 ae8067356d9718be5b5be68e49893855708956f1973d74051af6c9f8cbfc49e1
MD5 38c55c6b87c94028b5183607148b0532
SHA1 81517c1968167e512a7c25a5ce55ead53ad8ee2c
SHA512 a99e435db93aadfea9bd0dac55189e7ef0a08212c467cefe3d1e385a8194afe9878e16805fad469abe01d6a2f1597e0d5e387f0d305a0fc53f96b709fa7e9285
SSDEEP 6144:9d/mgsEdGALC6UudY7lDxoLt8ZzfyP91JjIuaybazQI2WGGBK:v/gcLYuolDxS81fJuMkJW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

uninstaller.cab

Path C:\Program Files\McAfee\Temp2166663703\uninstaller.cab
Size 256KB
SHA256 13f5c97de380bcf081c8e5c7fe16d6f8750307cb89318adc4968f4ee5b9a1291
MD5 25a9e36bb337b293188935b3c6b03db2
SHA1 eb586b0921625eb3e4463166986d76817622b4fa
SHA512 130b457cb240ca1cb83b2e230ea7be9eef83dd75ef02217a0e795c48b87bbecb1553b3d662bf2879b14408cec2f099f0b97d8480569a830aa43b942f2ef60c2b
SSDEEP 6144:C9dP/72btLcr4DkNu6Ty79k/Gm2obJHvPDPs5Or+NB9:QqbtLPGBTcgMOror
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.cab

Path C:\Program Files\McAfee\Temp2166663703\updater.cab
Size 859KB
SHA256 7460fa97eecc122064a0f5b5a7e01e6d8109032b62c46fad1e064ddb92d86d0c
MD5 8e1f6734dab477d2b463edde808bbe1d
SHA1 9e1b7e5efe5b9390297a991c21d0daa2b0a97a13
SHA512 e9e19870a14990c452b7369fbeb56cfd74c82ab979f26b6e505c7f748c38ce8d1423201bcd39c677c21ed36573dbdf2b94b45fcb459870b24eaa9aa3c1dd1f6b
SSDEEP 24576:/rOknmAC/QqNekou3WcOlM21LTuAaVKvDWl:/pnmVrQpAWk2B9a1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

wataskmanager.cab

Path C:\Program Files\McAfee\Temp2166663703\wataskmanager.cab
Size 192KB
SHA256 cbcd83dfbe2e53683f217343b93d92c8e9679091649c80c3ff8b7dceef39975a
MD5 f3872eb0d72a589c193a50389e464c99
SHA1 2ca464116f7f8ff678ba199e8677590e246c5e80
SHA512 6e069d048f059efc40b8d3df65f232eb373744683f4f10418caf1bfdcb8a1095eca9e056ec76274c4508188a848f98dadc7da2a2a61eeb4c228671ff510935fb
SSDEEP 3072:sDfjL+uHtX5tVgy4WM+OzHfgBMdletTSZwYZSozVo8cQi+PXajvC/vKqgtvbQAnD:En+icMM+0oBMdEpSZZTJncQpPXajvovE
MD5 SHA1 SHA512 SSDEEP

Submit Download

webadvisor.cab

Path C:\Program Files\McAfee\Temp2166663703\webadvisor.cab
Size 22KB
SHA256 eff6add8271a4051979fd858d19b696e95bf8081f075c1f4b710f484f7b79634
MD5 c9ffb55425fe109c6b3a6af2311fa6d7
SHA1 e14f14534a589a6a56a73f61a80b3d7346f1bbc5
SHA512 27c58deeb4acc4aac394d269517089c2778c2fb78fd71895b3b9d259fbf421a00c2f3c6073a7c55bd8bf60b08482d0f30722d593d79e61f714747cffee4842f4
SSDEEP 384:vRdJe7qX6ki2HPviQUDvYHqCxAM+o/8E9VF0NyC06ki29d1ik/CoAM+o/8E9VF0v:vRdJe7qq2HiPvYKmAMxkEi2PswAMxkEy
MD5 SHA1 SHA512 SSDEEP

Submit Download

wssdep.cab

Path C:\Program Files\McAfee\Temp2166663703\wssdep.cab
Size 586KB
SHA256 099630a529fe6632953d7ca7578e8de6a7edf011872fbe96e5c8c82e3b88a2ad
MD5 f49089c1a928792125a30c050753d3f3
SHA1 c82bbd114692f938a75c6c5a6707992a01272792
SHA512 f11b80f7c1e3bdeedb69b0767a9ce7940b256aac2a7e84e351385bf856358e4eed57711da628619edd32ed74da0f5f68c090cc8985c6c6e8f50bc8ce42bbc34b
SSDEEP 12288:UnzFD0LXORj+bRpZGIkNexdfpcd4NNTYmdEbaeI:Uzt07VRecxJpcd4NbEOeI
MD5 SHA1 SHA512 SSDEEP

Submit Download

dataConfig.cab

Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
Size 72KB
SHA256 350bf925609830e683e5007dbe8feb4000a0c32a2b991798dc6b84608a2a8e89
MD5 eb105c0885ee2e4b9e2734f6f7284019
SHA1 327479f7820d19e6c236dc11f8707efd0d6bf6e2
SHA512 7e6805c2aabb1b1b8768eaf2c816dadbe78878249ea66eb89dd595fd9119ed0f8926213aa51028337fd1674aee532de301877458b5c7d9c0a2271c32a48ac611
SSDEEP 1536:cB2Avg2lS1AL9yebfIqOADOSIdBLDt411/Tlf/+BknD1PZq/sM3xxl:cB2R2lS1AL9yifIqpKdBft41zO2nDzq5
MD5 SHA1 SHA512 SSDEEP

Submit Download

WSSDep.dll

Path C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll
Size 512KB
SHA256 6a5541ab012eb3d6b0408b5e07ad45b6cb69bd28625f3b07ad2db5d368bcb954
MD5 d85ebdda20e460cf0ec02c7d3a143495
SHA1 c9ab7ab3563a811f5f257f83cc7a2106a0f68d20
SHA512 314fb8c4e531f29ff27535e9f8eba129eb90643e9920a24a95b6beccc0da2c91990d4cb22e0747ee277b58074dc7f7aae6f371db4b0ec32bd355babcdd0b353b
SSDEEP 12288:21btYO+v7ftQNF8XpEB3iePkNEoj+rgSfshPyMjEmjC:8b3g4oj+pMjEmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

wssdep.dll

Path C:\Program Files\McAfee\WebAdvisor\win32\wssdep.dll
Size 192KB
SHA256 d87bf6b49f57401e0ca36343bd7840d57d9aba1c64b5d35074c8bb6bb94cf938
MD5 2667dcbe0f7f5cf7f2ee0d4774e5aae3
SHA1 59ff07be80c81addaee449132d5475d2918d3453
SHA512 40bc3395b8848a753e40e2b7883ce8563a473da3ba023c965a6af17f12bb0ee636c6d53e223eeeb13b54a54dc095f634b61bea8b4c297653870f6fe922b3ec3f
SSDEEP 3072:6Z601bOYYipTBl33nQld+42uftQNF8XpMKJsJ/Wiozs2mbSydNxs3+F+XYk1CF8u:21bOYYOTBl33mv7ftQNF8XpZeWodX1YW
MD5 SHA1 SHA512 SSDEEP

Submit Download

WSSDep.dll

Path C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll
Size 803KB
SHA256 d79f4b0c2f3340920cc2935a9a8aba41115ca0f700bf338fa696797ed6d3741f
MD5 410309c9c2a76857b2fb0acfab2c91df
SHA1 072dcfc550b7bbaa6a03b479b408bfc57baedd16
SHA512 7c660d5090b9e78bc0f53530ef951e9715a65e33b62fb74b7d09f34cd8db8d54beee8a53725eb6dbc46c29bc5d4d8c4799e069220b939c85914d92f9f7384f26
SSDEEP 12288:kSMUeSJFVwoykQGh5YHWSGBjfWeVoNErPgdeh9Y:kSbRJFBykQ8YHWvFWeVKErPgMa
MD5 SHA1 SHA512 SSDEEP

Submit Download

wssdep.dll

Path C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
Size 640KB
SHA256 34bc4e34bd0cabc0a31020fafdd724423e7720acdb6defed32527fc0ca8fe971
MD5 8a980778e9cbb6680a8a1b9e33129f68
SHA1 4a9b90a92de769b9ae1f98ba00a8fe1088068d1c
SHA512 3ae62352baf0ac0752bf7e63fbd60ca8bed285945993b029891d1a2e7f33332128c023eadf787d010c80947232fb15f9179ac76f768cd2f8ab9c126c238bedd3
SSDEEP 6144:JnWFfQ7BeiUldEyy7x7CcZnJWA3B/XAoqFYpQ4xsCh5WDXECmEGz42rUhgRPuJPD:kSMUeSJFVwoykQGh5YHWSGBjfWeVoNE+
MD5 SHA1 SHA512 SSDEEP

Submit Download

AnalyticsManager000.log

Path C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log
Size 2KB
SHA256 279a6601a65073310c7e0ce49fe425b24400cf4715e3b318bb1e2113c64ae9e2
MD5 9148cd843a86b1373ca9bb67109a6f52
SHA1 d5a0777f484f59084f3d9b7cc02a1c6c6d9b8db6
SHA512 1b69029c95f18fbc841df8f8b801add0fa5ed2728bcb0bdc07aab9a3f78d4af8173857607f20e1e0cb7143fabe7f8688923acbe18ffe60c8354c6b17c1ec254e
MD5 SHA1 SHA512

Submit Download

AnalyticsManager000.log

Path C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log
Size 17KB
SHA256 dfdf10b05a9c43daab0fc2f14c4ac91da8c310a74d08a0ddabd0db29ecb2e5d6
MD5 a69d8d0ca56d8ac24020e8fa3a72cca4
SHA1 077badfda2d808638c6b8247b143feea9f128676
SHA512 694bcb8bc145e8133291b5696b2ffb6a25d2a89ac7fd76e037c7745325147dd0e2f638167e916db26ab849adf7d5c10913fcf9494fc03823bcbd82421e3e6f76
SSDEEP 192:6dwdHwguThnwrQrroRlIS8MImzURDz9/9zrTw/ZO+ZnNuz2s52nNuzhaf8nNuzcx:M+COutoYb4BslQltlGlqjir
MD5 SHA1 SHA512 SSDEEP

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 f982d81e3cb930e65c5b4131b5e30adf940d0ffe14cd6f18f235d2827d26b46b
MD5 0207d1c14007ce3fb5474c6dbd4147dd
SHA1 c0647dd8a6c26c295e1504a9f4fa2a141de35ff0
SHA512 07d994afbb079e374262603c61519877ad9317628ea63507992e679d154f513849e5cf65fd4f9f3014b32657d657e38bbe4363114f0178561d12ac74b7f82064
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 2KB
SHA256 3c023b3bd41d4c806c7ef3db1455901bb19057029d05f7ed1837d710a921a6f8
MD5 a0ece001c6e4bdcf0b020ce8fa9f56bc
SHA1 1170816445109e992ce4aec00fc9891f30edcff0
SHA512 4feaa016008b4a68c8cea28baf93a43ccbad2b19689ed4637f04d280cbe2243de423c28e53f217bec15eb1843ce7bb8ec93a2652fd9f813c9df9e3de240eb74d
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 2KB
SHA256 fcf14289ac0a0ce6b6861215cd98cb0b6ec27dfca30ffdabd35f275c81dbc669
MD5 e315dd03878978bcae1689735263da49
SHA1 0bdaf0a7fc37446f2a925335c4958de75e7d72c9
SHA512 a33d14b0879a76a693d4af23064dc8352723f9e9da2f16e1172af59fe6534f6c6fcfef8ecaa59d9e94eb09bf694db7a63547f701a45bcab3454bcab548d4b9c9
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 3KB
SHA256 c1db23e5a62c4350c27529c381628c15dfe00e748b590ebb774c433dc0ba669a
MD5 9797ee2fad4d9cd389547da8fdc6e0a9
SHA1 7632efb97b8535a60551f78a392673eefa375d2c
SHA512 06a6336a21f73ef041de80a96bda5a708a80c16ddc00db6221aa1894989c40385ccfad1cc860b1466db5991b92e35e6f91abd6945d7d32ddc8f79a26677e0e84
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 3KB
SHA256 ae6109844721125171dd510a109f534e8b699b1b76d2ab03363206b7dfabe536
MD5 d12082526ddfe657e669b53c51e124ee
SHA1 c67ed278e8c2369e2afbe353f91e4097c38ba271
SHA512 aa5c25a94d60da76e3e7f7287e653711b2a3e43cc0829906cbb4920557158f412d63d31589e90e1cf080e9538eab7807509e7bafdeb051a602a4c7c372fed21f
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 52b0623802fd23568ee38dc21f333b5851d942382ff0d6dbea0bb6056d70aa57
MD5 3a316a420d5fa5c1e18b0493ac23d7a7
SHA1 785c381ba6b089121082c98eb2809f68c9cfd121
SHA512 3174ed530167031ecf4708701ad4422d22049a2609320404506e1d3a11b1e6c3d2c165d63a4dda5fc192fd288bcf6da433a5b178fb8afef247ba40f43f3c206c
SSDEEP 48:wj6jwLjAUcjjLNAU8dPvvPvlLWlULOJeLOdNLwgljLeGi:MLjAUwLNAU8dPXP1
MD5 SHA1 SHA512 SSDEEP

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 7c407d6dd9b3298a9e57a19a987040ef9731c26d1ff4df403ec188e18a6729d7
MD5 8ea58666a0350ad69af884b986c2e3e7
SHA1 29daadbc5126c5e7860b8a4ed5a107c042b24e62
SHA512 f179508044e82c164b4e25f54a7832bdc657029bc44c09b0268f5db0d583b382c331e58890c7d705c2398392c039c84646c91a0901f4cd4ade65bd059c421372
SSDEEP 48:EFjJQXWxNjYhjwjXjjjJjhyypAyyqyyKyJy8GyeyZywyuyUy3HjvDFjpwaZj6P:xWfb2E
MD5 SHA1 SHA512 SSDEEP

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 5KB
SHA256 1adb58b8d373ff18c736cb70cd498cc3a93e498393dd5a27a248ce3207717a3a
MD5 fa9c0e118c319e6dd1052f9fb5be6065
SHA1 0f112af8a019590b8fa6b18c29d4eea3546ce854
SHA512 73829179fc5962e78c123b98bb9505ff0e471e71df521f43c472f8cc0b2675b32401d87fdfbdb456ae3e1474f2d3075056f7e55e28a3f9849a48eae5d40635be
SSDEEP 48:EFjJQXWxNjYhjwjXjjjJjhyypAyyqyyKyJy8GyeyZywyuyUy3HjvDFjpwaZj6mjH:xWfb2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 854B
SHA256 940515d73baac4d64a9b6db73b8419783e8fdb3c999cb50b2e07755ef77bbb37
MD5 27c6912df9e65e36b532b23eda879f53
SHA1 e3ea977b7183454d23abc647f6304b9ddfb5d503
SHA512 3e5e6132c50c2b8d7f94ffe3ba3249753e6f2b49eda394449c90764b7f5b3d0b947923b957e6e688a9f2cd8b26b7196e1e2c4645cfcfcf9aa630cea1e44645e8
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 0ca9c06a5fc02af29080538f4c0e4b88252574feb3ee75ee0ee809e5ffb27c89
MD5 05d05742ce3473080f3eecd0b701df20
SHA1 bdfd1eb712e8f2c4b2a80368efae65478ab1dd5f
SHA512 39276c2c976b3291504912c2bf861304b3732bf2735e269b528d10bf1791080dc75f8f609e85eb02ac6b40316ab7809f51dd025b624f986faffc824bac99008b
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 19cb564a740596949bcf1fdb0b8d3c2833227286af5be2510ff7ba4aefc332fa
MD5 3d29898a074db4f4587605c19aee6ee2
SHA1 ab30d331c529187e47d171374b9ece01be53c711
SHA512 1e97aa5e19360c4beaca56a0dfced6f888d38d6ed3194e5abed2932a81812f91f9254775de3ab96ada3fe9db65efb24645275726482151ddc3457b6a5fc6f2b2
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 2KB
SHA256 fdb9fe6e590e4d619d438363ca51a10c197334cbd19f9a53ba6120be5d39fbbb
MD5 f2c92027c328a64dc792f7a419a0e5ac
SHA1 b37644e56aa58ff5ed0774075e2779ad625dff9f
SHA512 56f2a749e1436a3f37b5240e4d1f2cae091f208dbcecd1a4959191b828560e110a7fcfa5a9091c87ab919248975c7bfc2fd7ab932b9b68a528243ffbbd80df04
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 2KB
SHA256 6aef52ea4be25161ad2ca8ebd5fc91ab5cee86d7aaaf2cb46b87f6344133bc02
MD5 a212e95c53f5b64c514632d7a456db9a
SHA1 c5d019e84305b3e1044edf7163d888ce5a2c6fbf
SHA512 01a43a9811ef0225cff9657e53cb8c77a65ad88698c9b8a8f7c86f5059acc539a676d10b2c592bb97e2911fb0475ce0c86c91ee721ea0f2c3b23ad7e0db8d6c6
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 3KB
SHA256 0c4edf9b0ade4279398509767c5206a16e2375a7389de1d3952d2da89c0e2af9
MD5 43d56d8e7d3e00b3e20c4a59579737b3
SHA1 1531e6fcf737e485032aa24fd7872df046aaf984
SHA512 43a5b326b152af2aca52d89535b44e4e7646c22575672170e852adc7ab19b231d9881273b91b5cce94e9dc6b59709e389d4c02c24e05ab19f05171c286c90574
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 3KB
SHA256 6e28ff5ae20ef710d193b655bb66eb23f934636cde8c02a4840cd785162aaf67
MD5 a01eaca6f4343dd359b3114361a7cf37
SHA1 350ed68e9e47478e75adc9b999d3af791176b527
SHA512 030257e5119e663fec04b470fcf153c862125a8221bbe36462be391439a2f21923cce34a8d3083bd4fa9af95cb1c9712164eda1f0bd82f54f21d2ef96049bff0
MD5 SHA1 SHA512

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 6f804f70029fd3156869fffbe55167fa8f9d1dde8fe1958dcda75597eabbed9b
MD5 05fa4b4fed0730ff03c72c7214b0dd49
SHA1 801a8f95e968d333fe6a12272457db8411df68b5
SHA512 4aca9bfd8c48777a728b15784d5ee8e9fc333f2b57f062f5bd2f00e70eae6c3c528594138ab79d34a81294adb3f2b04ebd02ea3650a3ab0a9ef859372478f63f
SSDEEP 48:qj42jfLiMLOmLOhLw3XMvLj21L2OLGwMLamK:5kF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00200057003F001D0006.txt
Size 570B
SHA256 ebeae6b30c816332ba302cefb258fc592de11a19b546e69423102e8cf1042b87
MD5 b2c87952eed6859feba55db6f7bfaa47
SHA1 7e854751a06a8970dca8da09ab4275b98dfd495c
SHA512 e6d8ad3e6d427a3933b65c1dcc8ca2fd3ed7abd660d67c6b04b7bfb9f87724cc6a3727a79eaad4d957025257b60a7e13c0903672a538ca43a96dcc160e0e6c94
MD5 SHA1 SHA512

Submit Download

installer.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
Size 6.8MB
SHA256 f96f534ca08cf7111fe22a871cf029ac5137ad40cc410929d6bb08210fb343b0
MD5 c97a7042bfb3352539ff137a96964004
SHA1 35b43a84d4e24822245ec410ad137f51eae1467c
SHA512 f5946d74c2f5ee6cb28b1c1ed3665657301f577afc6caca46f43930de4087391bdd9753089ba53bd63ca7ad0a3e15b4adf5a29f8ab80736cadf9ea60da17a073
SSDEEP 98304:/xm6m8tkpqp2BhgURYGKuYOFLSmPbmpKlS+Ud2IIcH0uUs2UE8eJ73mSNa1as:/8FBhG0+mzmMl5UJlDE8eVWSNa1as
MD5 SHA1 SHA512 SSDEEP

Submit Download

installer.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
Size 4.7MB
SHA256 498a71904735a767470a2b457af1b3315524cdbc75d383af82adc72b21d14086
MD5 ede15b7b046147d36d5c5502da602f38
SHA1 c5ebb9ba6c2a92391abd611bba198f5c0c839d4b
SHA512 199f56797109f0339f1e7d0af9201091f54d472b13b6c9fb7c57339d46f5aa22ce16aa56ab739b64611cf6c90e159238f4660e07e2ef43a46db8e7013495d71e
SSDEEP 98304:/xm6m8tkpqp2BhgURYGKuYOFLSmPbmpKlS+Ud2IIcH0u/:/8FBhG0+mzmMl5UJl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

saBSI.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
Size 1.1MB
SHA256 f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
MD5 143255618462a577de27286a272584e1
SHA1 efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA512 c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9
SSDEEP 24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402212232371\additional_file0.tmp
Size 1.4MB
SHA256 e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
MD5 e9a2209b61f4be34f25069a6e54affea
SHA1 6368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA512 59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
SSDEEP 24576:4ACKcQz8HkfJ8dQnd4GrbwsgY+UfLBCQdI5f3cjCRgCPPWCUZry8k/GUrbN:5pT8HkfJ5eGrbmR0afsXCBrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

opera_package

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202402212232371\opera_package
Size 2.6MB
SHA256 3c1d640b4bb1b3ddbb1c8235b96f5860f9bce3bf15ec936becbb99d613da7e60
MD5 5d2c44d0bb74f2ea22128c6b13e09c72
SHA1 42c74df0949023862c19da4b302ec6a9a6fd37f4
SHA512 930a5b71d37d545df8176685876e7dfb9fd2d53862d5b78df0e4a21a50c5fb9bb454d93b184378e3e0f021bb5cab0bb2bb729264b0f6f4eae84794f66042ac1e
SSDEEP 49152:apHPac6cO9KYgKNMpMMkJ77NjnOWOn6+eof2nKKBCM7P8WfNi4qucuV+vDg7kPeq:adac6c4K6KpnkFNL+6+1OKKQQNzqk+VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperaGXSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe
Size 192KB
SHA256 f6c93bf7504095e20b1d7d47bdf1326db6a3c1dc1be53b8f4c02c008693137cc
MD5 a0936cc0ec6a35eeae58ac5dc701626a
SHA1 662638f765cbe0d7bec7db9394b2fce4515f8cdc
SHA512 d699a7f80a91dac4d159bf5f48f91d0b51b8ed329892c7f7e0a6d1a82061310c40568bd77683901a029b3d9698f72db4af41031e06c4fbf734d3adae2cb8f9d7
SSDEEP 3072:azGuk5sCXxtiDtwGcoRXZxMczlVWi5gO7F2dp8RBz7Tym08BuqlvNhSpVVBzf:pXmPbM879l7rRBW38B7l6ZBb
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperaGXSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\OperaGXSetup.exe
Size 3.4MB
SHA256 7ae3a2f53d2839c640b052d4bf276747fee3892f8028f68a9064c505b4d823f6
MD5 184e818b7e543ccedbeb99c4ceca2b0d
SHA1 1e967197b197166f34b63b57e35f38572967f257
SHA512 4a9d06de5fccea8d1e30fca63fbf6f039cabe7c50925017a6b74f98e0112f5e05c780d47924cec328f0e175b9c1bc84e778d1cb1a6e264b0e9ea04902f7d04b5
SSDEEP 98304:wetjtwwd1ftOXBmwK0EBZFn9asZjvS9I9b+wlWBX3rW1KF:w8b7as5YaKpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

saBSI.exe

Path C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\saBSI.exe
Size 1024KB
SHA256 4c77c7aa4ab7e9b16163ca8bbfea85c850a50caac43cb9e4425ed959f0e28a7b
MD5 e6cacd004b153a2f056d4cf8e3963535
SHA1 fdcd8291ab1dca8eab71fd7f9086c02de1b66763
SHA512 ad4762240eb830b461cd39bac0c7455fd5832158e8f335dd92cbd38c3ee85c4fc56e7bb6b3b2e82b4a8375d9f73a09fe8526728bed3496fe0230811d94e397ca
SSDEEP 24576:xoBm5Cq04JaEboVGtDNmCHUJX+va3BR1j0TbcsuefReNbHgYdGcp6S58p0Q894x:Bo2oVGtDJvva3BR1jxCfReNbHgYdGcQG
MD5 SHA1 SHA512 SSDEEP

Submit Download

saBSI.exe

Path C:\Users\Admin\AppData\Local\Temp\LDPlayer_files\saBSI.exe
Size 384KB
SHA256 3cea072bf6aa956667c24c260643b3bf63717080ec46e6b502f7b83df4d9a1ec
MD5 581188bbbbbda618811ead947d5a6f9a
SHA1 68cbdcb0f36e5b9eb02dd48183d349827df86057
SHA512 e5727fcb335257d7093f5bf2aa3e75272ee7d5282ce117bcb0bb9d7a704bcb1c007f2b6e79b5d65656847a0fb393c5128c9efe93798990a5f2bffe1197cb62f9
SSDEEP 6144:x4OcB683IRE6ppPCq04JanE82LLoVGtDN3OZScCQz4U5MtPw3xJmCRFkRFCdHD+K:xoBm5Cq04JaEboVGtDNmCQcUOw3xJ5RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2402212232358932696.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2402212232358932696.dll
Size 64KB
SHA256 bf3a26c8d46fc9c230dd2ac3d8c6125e71f2685588e8316f4fc97cb997d37a20
MD5 a741b72c753a5f8e88d42ab4a8f9951d
SHA1 cf057da247aef5ad69022df636170fbe20fd5840
SHA512 f8ffa32583a83928f0150ecf286e21dba26d5c0a4985f384030f093253d1a16a5032ac5c4416a2b45ed5f9798056e5041816bc912813484499cf2fc0efe8d3af
SSDEEP 768:BER7yLydCt003xeeUe3ZU2vmFRZY7Vxx8kAOAmV8jAz:OR7yLydCt003xe0vmFRZgVxx8kL9V8jY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2402212232363463428.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2402212232363463428.dll
Size 5.1MB
SHA256 8966bf2dc077cdfc40df684f4f7d63bd4d42540ae2f883067541f126042f817b
MD5 08d5d2309dcb5c1a1d3022b59e8f9e97
SHA1 28f4a325878eba2a9ce482b09d1a263b7e914a07
SHA512 08999b194f85504656b9f997ef661336aeb3efb7da568280828f3eba7d4536e111b6c7c90f65c4eb0908ab0cc3464da0768b57e20b16a42bf797d37436d5a39e
SSDEEP 98304:s6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwq:zpxSNZtdSbBn8fGLTVJVHnBiz63bbyFW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2402212232369083120.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2402212232369083120.dll
Size 4.1MB
SHA256 6d307e0e07ec192a098ff88bff95a30f3247eb29f28d36a14ba51c0366703560
MD5 be14a9b7f40af9de44510ef6b89e64f8
SHA1 ea4e324c5a154d239355cf1aa34757705ae058a9
SHA512 8c2dff3651a6508a3b1d17f205cafb1b33ac8a1eeb8d1bed55cd468e6271ddd53b2d63f85b29576a5da5ee84d070b1f2a2ed7c52e2f98b4e40b2162c08ceea36
SSDEEP 98304:s6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwI:zpxSNZtdSbBn8fGLTVJVHnBiz63bbyFS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2402212232369083120.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2402212232369083120.dll
Size 3.9MB
SHA256 649eb0ea8cf0cdcb0c63cb2155901d4388deb88e131acde7b89f6e0eb92165b6
MD5 7c90da25de0ff0a05dcfdffa23d265d8
SHA1 c259695c087f0d3936a5ef78b2189e033ca16ad2
SHA512 007cc6b62f5954e9a48924abac6674a911b835a066e67cb15cd890e569a7d83766b92e029b38f797806aee78c509ca61858abf71080ed72df3f93e9872f28c18
SSDEEP 98304:s6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwd:zpxSNZtdSbBn8fGLTVJVHnBiz63bbyFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2402212232372834040.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2402212232372834040.dll
Size 3.5MB
SHA256 7f1a4bdbdc7aa1a910b32ca83437994ad8dad5676e0f3968721cde24e091f8cd
MD5 efeba51e8a6064db3f624c4c0f266a2b
SHA1 421f8e5f62ea01fa2a889bd58a7194ea788853ea
SHA512 53e10b275f9eab8447e1687aa0d7f42cac7911635ee49d28c4338cc6d4c2c8600e56a4e3d2d4cfb33558fd58b44dc995b521341ea74934847e86c9426ab699f9
SSDEEP 98304:s6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwb:zpxSNZtdSbBn8fGLTVJVHnBiz63bbyFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2402212232385181484.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2402212232385181484.dll
Size 5.2MB
SHA256 43d6fb187dac9ed36700cbd9d4f07df9a7d82eaae01c353cb48da5aefd726937
MD5 e01fb33524413d17069bfce2461ec0ce
SHA1 7523b1f5131ab95ca4fa8df495bfb6fe59dc0d6d
SHA512 95fa991e39e109616a3561d43b0f58fc0a47b534e398de590ef97f2d1d9acf17f3e2ea6bbbf4b7d541f84d04f39c98a1d1ec66ff1478aa5b28a138474bbeebad
SSDEEP 98304:s6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwL:zpxSNZtdSbBn8fGLTVJVHnBiz63bbyFR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ds.dll

Path C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Size 67KB
SHA256 e1fb95609f2757ce74cb531a5cf59674e411ea0a262b758371d7236c191910c4
MD5 7d5d3e2fcfa5ff53f5ae075ed4327b18
SHA1 3905104d8f7ba88b3b34f4997f3948b3183953f6
SHA512 e67683331bb32ea4b2c38405be7f516db6935f883a1e4ae02a1700f5f36462c31b593e07c6fe06d8c0cb1c20c9f40a507c9eae245667c89f989e32765a89f589
SSDEEP 1536:T8Y2QwozMa9efe5hfEZHFLK/Aw7TPxV9jHK7h9FPxZ:Q3QwlebfONK4wfxzGb5xZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_3nhl3rpv.hw2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3nhl3rpv.hw2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 f5363391b4395aa021bee2597f1d934332a6d76264c0aac9c27cf7ee6ef6af9f
MD5 be8b95dc112c29a1a333222e36eea723
SHA1 6ae91329e109b2fc5681aee7772eaa511ff76dfa
SHA512 9b9bfd002220d79e28d3c20872e64e259cffb433394bfffee4b94ad897ddf7a9fc340bfd8b2465a0186112dd43fcf4d0b7010f9cbfd6b942a145335d8411c559
MD5 SHA1 SHA512

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 214KB
SHA256 56517ea9d445bf443e8b4f06617ca9affbff0ca7914a43fe3b92da6aa322348e
MD5 5522acf58982be5b5eff42f0479aec49
SHA1 a1439ba48efabe68f7b7b4cb7ee19c65c9c614d3
SHA512 7562a0cbff46501843e912f84df621eed65f94dbb4e3246d6002f488a9bb4d7980b254a35962673c06cf8b73efae988f22fbfee940f2937e01bd453e64d611d9
SSDEEP 1536:NLinSgC0jqYJLbsfGAx6py1bVAuEHctNL0R2+kk9X:pinSgLj9pbwPx4ObGumcf0RQk9X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1484-117-0x0000000000840000-0x0000000000E19000-memory.dmp

Download

memory/1620-573-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-1328-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-677-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-668-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-659-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-630-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-615-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-346-0x00007FF75D8E0000-0x00007FF75D8F0000-memory.dmp

Download

memory/1620-555-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-549-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-564-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-515-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-490-0x00007FF6FA750000-0x00007FF6FA760000-memory.dmp

Download

memory/1620-437-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-423-0x00007FF6FA750000-0x00007FF6FA760000-memory.dmp

Download

memory/1620-414-0x00007FF75ED20000-0x00007FF75ED30000-memory.dmp

Download

memory/1620-464-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-385-0x00007FF75D8E0000-0x00007FF75D8F0000-memory.dmp

Download

memory/1620-663-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-382-0x00007FF75D8E0000-0x00007FF75D8F0000-memory.dmp

Download

memory/1620-651-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-652-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-383-0x00007FF75D8E0000-0x00007FF75D8F0000-memory.dmp

Download

memory/1620-584-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-384-0x00007FF75D8E0000-0x00007FF75D8F0000-memory.dmp

Download

memory/1620-411-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-567-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-475-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-710-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-725-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-721-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-736-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-775-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-762-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-785-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-821-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-531-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-994-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-538-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-1293-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-797-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-792-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-778-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-752-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-741-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-1294-0x00007FF75D8E0000-0x00007FF75D8F0000-memory.dmp

Download

memory/1620-1296-0x00007FF75D8E0000-0x00007FF75D8F0000-memory.dmp

Download

memory/1620-1335-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-1346-0x00007FF6FA750000-0x00007FF6FA760000-memory.dmp

Download

memory/1620-1396-0x00007FF75A2E0000-0x00007FF75A2F0000-memory.dmp

Download

memory/1620-1458-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-1429-0x00007FF75A2E0000-0x00007FF75A2F0000-memory.dmp

Download

memory/1620-1402-0x00007FF74B4D0000-0x00007FF74B4E0000-memory.dmp

Download

memory/1620-1389-0x00007FF712F60000-0x00007FF712F70000-memory.dmp

Download

memory/1620-1368-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-1342-0x00007FF75ED20000-0x00007FF75ED30000-memory.dmp

Download

memory/1620-1339-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-1321-0x00007FF75ED20000-0x00007FF75ED30000-memory.dmp

Download

memory/1620-1319-0x00007FF747220000-0x00007FF747230000-memory.dmp

Download

memory/1620-717-0x00007FF754AF0000-0x00007FF754B00000-memory.dmp

Download

memory/1620-1323-0x00007FF6FA750000-0x00007FF6FA760000-memory.dmp

Download

memory/1620-1295-0x00007FF75D8E0000-0x00007FF75D8F0000-memory.dmp

Download

memory/1620-1454-0x00007FF75ED20000-0x00007FF75ED30000-memory.dmp

Download

memory/2360-3394-0x000000006CE60000-0x000000006CEAC000-memory.dmp

Download

memory/2360-3389-0x0000000006700000-0x0000000006732000-memory.dmp

Download

memory/2360-3524-0x0000000072FD0000-0x0000000073780000-memory.dmp

Download

memory/2360-3522-0x0000000004E60000-0x0000000004E70000-memory.dmp

Download

memory/2360-3478-0x0000000007790000-0x00000000077AA000-memory.dmp

Download

memory/2360-3477-0x00000000076B0000-0x00000000076BE000-memory.dmp

Download

memory/2360-3452-0x0000000007670000-0x0000000007681000-memory.dmp

Download

memory/2360-3276-0x0000000004E60000-0x0000000004E70000-memory.dmp

Download

memory/2360-3277-0x00000000054A0000-0x0000000005AC8000-memory.dmp

Download

memory/2360-3265-0x0000000072FD0000-0x0000000073780000-memory.dmp

Download

memory/2360-3432-0x00000000076F0000-0x0000000007786000-memory.dmp

Download

memory/2360-3423-0x00000000074E0000-0x00000000074EA000-memory.dmp

Download

memory/2360-3417-0x0000000007AB0000-0x000000000812A000-memory.dmp

Download

memory/2360-3307-0x00000000053D0000-0x00000000053F2000-memory.dmp

Download

memory/2360-3264-0x0000000002820000-0x0000000002856000-memory.dmp

Download

memory/2360-3411-0x0000000007330000-0x00000000073D3000-memory.dmp

Download

memory/2360-3405-0x0000000004E60000-0x0000000004E70000-memory.dmp

Download

memory/2360-3322-0x0000000005CB0000-0x0000000006004000-memory.dmp

Download

memory/2360-3404-0x00000000066E0000-0x00000000066FE000-memory.dmp

Download

memory/2360-3278-0x0000000004E60000-0x0000000004E70000-memory.dmp

Download

memory/2360-3390-0x000000007EF50000-0x000000007EF60000-memory.dmp

Download

memory/2360-3341-0x0000000006180000-0x00000000061CC000-memory.dmp

Download

memory/2360-3335-0x0000000006140000-0x000000000615E000-memory.dmp

Download

memory/2696-68-0x0000000000840000-0x0000000000E19000-memory.dmp

Download

memory/3120-87-0x0000000000350000-0x0000000000929000-memory.dmp

Download

memory/3120-82-0x0000000000350000-0x0000000000929000-memory.dmp

Download

memory/3428-74-0x0000000000840000-0x0000000000E19000-memory.dmp

Download

memory/4040-93-0x0000000000840000-0x0000000000E19000-memory.dmp

Download

memory/5048-32-0x000000000B8E0000-0x000000000B900000-memory.dmp

Download

memory/5048-47-0x0000000006470000-0x0000000006480000-memory.dmp

Download

memory/5048-23-0x0000000009D80000-0x0000000009DE6000-memory.dmp

Download

memory/5048-22-0x0000000009CE0000-0x0000000009D7C000-memory.dmp

Download

memory/5048-24-0x000000000A320000-0x000000000A84C000-memory.dmp

Download

memory/5048-21-0x0000000004900000-0x0000000004944000-memory.dmp

Download

memory/5048-25-0x0000000006470000-0x0000000006480000-memory.dmp

Download

memory/5048-27-0x000000000A1B0000-0x000000000A1BA000-memory.dmp

Download

memory/5048-30-0x000000000AB70000-0x000000000AB8A000-memory.dmp

Download

memory/5048-28-0x000000000A270000-0x000000000A2C0000-memory.dmp

Download

memory/5048-29-0x000000000B7E0000-0x000000000B892000-memory.dmp

Download

memory/5048-33-0x000000000B940000-0x000000000B972000-memory.dmp

Download

memory/5048-19-0x0000000008ED0000-0x0000000009474000-memory.dmp

Download

memory/5048-26-0x0000000072FD0000-0x0000000073780000-memory.dmp

Download

memory/5048-20-0x0000000004820000-0x00000000048B2000-memory.dmp

Download

memory/5048-34-0x000000000B9F0000-0x000000000BA56000-memory.dmp

Download

memory/5048-35-0x000000000B980000-0x000000000B99E000-memory.dmp

Download

memory/5048-36-0x000000000B9C0000-0x000000000B9DA000-memory.dmp

Download

memory/5048-37-0x0000000006470000-0x0000000006480000-memory.dmp

Download

memory/5048-31-0x000000000B7A0000-0x000000000B7B2000-memory.dmp

Download

memory/5048-12-0x0000000006470000-0x0000000006480000-memory.dmp

Download

memory/5048-16-0x00000000088E0000-0x00000000088F4000-memory.dmp

Download

memory/5048-18-0x0000000072FD0000-0x0000000073780000-memory.dmp

Download

memory/5048-17-0x0000000073920000-0x0000000073934000-memory.dmp

Download

memory/5876-3538-0x0000000002130000-0x0000000002140000-memory.dmp

Download

memory/5876-3537-0x0000000072FD0000-0x0000000073780000-memory.dmp

Download

memory/5876-3548-0x0000000005340000-0x0000000005694000-memory.dmp

Download