e03cf75a6dd922011d0f6b9e2c43a80574334868bc2e9f7ca9be57156647fe03

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

saBSI.exe
Size

1.1MB
MD5

b3e4101a01e2460acded70366749e2d3
SHA1

135e644f2a0b1b2d601bd03b0a358ecc95ad294a
SHA256

e03cf75a6dd922011d0f6b9e2c43a80574334868bc2e9f7ca9be57156647fe03
SHA512

a8d26ad577c7a19267d44f6d4d7204bbd315839be97da3fd8289a7235b9642bd920846fc3cad58bbdb52196cb53902bf6ae0fb497c550566cfdc6834a0026c64
SSDEEP

24576:+xXu1+BvB2CDxXeudf8IKboisG3FZhblJRk5BE7DzJ7P0PJLSUB92Mp9xJ:+K+xB2CDxXTpU3FZhblJRk5anFP0hLSE

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	UIHost.exe

Executes dropped EXE 8 IoCs

pid	Process
1280	installer.exe
2528	installer.exe
1744	ServiceHost.exe
2412	UIHost.exe
5232	ServiceHost.exe
4536	ServiceHost.exe
5240	ServiceHost.exe
776	ServiceHost.exe

Loads dropped DLL 33 IoCs

pid	Process
4840	regsvr32.exe
3180	regsvr32.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
3288	regsvr32.exe
2104	regsvr32.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
2412	UIHost.exe
1744	ServiceHost.exe
2412	UIHost.exe
5232	ServiceHost.exe
5232	ServiceHost.exe
5232	ServiceHost.exe
5232	ServiceHost.exe
5232	ServiceHost.exe
4536	ServiceHost.exe
4536	ServiceHost.exe
4536	ServiceHost.exe
4536	ServiceHost.exe
4536	ServiceHost.exe
5240	ServiceHost.exe
5240	ServiceHost.exe
5240	ServiceHost.exe
5240	ServiceHost.exe
5240	ServiceHost.exe
776	ServiceHost.exe
776	ServiceHost.exe
776	ServiceHost.exe
776	ServiceHost.exe
776	ServiceHost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\DownloadScan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\navigatedtoday.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\installedextensions.luc	installer.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\jslang\wa-res-shared-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmit_ga.luc	installer.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\jslang\eula-tr-TR.txt	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\jslang\wa-res-shared-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\jslang\eula-de-DE.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_increase_bg_left.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sr-Latn-CS.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-hr-HR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-nl-NL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-hr-HR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\logicscripts.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\oem_business_logic.luc	installer.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\jslang\wa-res-shared-pt-PT.js	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\jslang\wa-res-install-hr-HR.js	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\jslang\eula-nl-NL.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.firefox.extension.json	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-warningbackground.gif	installer.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\jslang\eula-pt-PT.txt	installer.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\jslang\wa-res-install-cs-CZ.js	installer.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\jslang\wa-res-shared-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\wa-ui-install.js	installer.exe
File opened for modification	C:\Program Files\McAfee\Webadvisor\Analytics\mappings.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\card_bg_image.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-pt-PT.js	installer.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\analyticstelemetry.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\dkjson.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\data_collector.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-hu-HU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\tests_logic.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\score_ui_handler.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pt-PT.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\mfw-nps.cab	installer.exe
File opened for modification	C:\Program Files\McAfee\Webadvisor\Analytics\uwp_storage.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\postupdatereboottimelookup.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\suitestatus.luc	installer.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\jquery-1.9.0.min.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\installedapplications.luc	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\wa_settingsdb.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dwtoast.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\lookupmanager.dll	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\dataset_da.js	ServiceHost.exe
File opened for modification	C:\Program Files\McAfee\Temp731553312\jslang\eula-nl-NL.txt	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\resourcedll.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\base_provider.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\close_icon.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-fr-FR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-da-DK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\Temp731553312\lookupmanager.cab	installer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\ = "ScannerAPI Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\DownloadScan.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\ = "ScannerAPI Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\WSSDep.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\DownloadScan.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	regsvr32.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
484	saBSI.exe
484	saBSI.exe
484	saBSI.exe
484	saBSI.exe
484	saBSI.exe
484	saBSI.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
2412	UIHost.exe
2412	UIHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
2412	UIHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
1744	ServiceHost.exe
5232	ServiceHost.exe
5232	ServiceHost.exe
4536	ServiceHost.exe
4536	ServiceHost.exe
5240	ServiceHost.exe
5240	ServiceHost.exe
776	ServiceHost.exe
776	ServiceHost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1280	484	saBSI.exe	98
PID 484 wrote to memory of 1280	484	saBSI.exe	98
PID 1280 wrote to memory of 2528	1280	installer.exe	99
PID 1280 wrote to memory of 2528	1280	installer.exe	99
PID 2528 wrote to memory of 1096	2528	installer.exe	100
PID 2528 wrote to memory of 1096	2528	installer.exe	100
PID 1096 wrote to memory of 4840	1096	regsvr32.exe	101
PID 1096 wrote to memory of 4840	1096	regsvr32.exe	101
PID 1096 wrote to memory of 4840	1096	regsvr32.exe	101
PID 2528 wrote to memory of 3180	2528	installer.exe	103
PID 2528 wrote to memory of 3180	2528	installer.exe	103
PID 2528 wrote to memory of 1108	2528	installer.exe	105
PID 2528 wrote to memory of 1108	2528	installer.exe	105
PID 1108 wrote to memory of 3288	1108	regsvr32.exe	107
PID 1108 wrote to memory of 3288	1108	regsvr32.exe	107
PID 1108 wrote to memory of 3288	1108	regsvr32.exe	107
PID 2528 wrote to memory of 2104	2528	installer.exe	108
PID 2528 wrote to memory of 2104	2528	installer.exe	108
PID 1744 wrote to memory of 2412	1744	ServiceHost.exe	109
PID 1744 wrote to memory of 2412	1744	ServiceHost.exe	109

C:\Users\Admin\AppData\Local\Temp\saBSI.exe
"C:\Users\Admin\AppData\Local\Temp\saBSI.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484
- C:\Users\Admin\AppData\Local\Temp\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\\installer.exe" /s /upgrade
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Program Files\McAfee\Temp731553312\installer.exe
    "C:\Program Files\McAfee\Temp731553312\installer.exe" /s /upgrade
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4840
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:3180
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:3288
  - - C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:2104

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2412

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5232

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4536

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5240

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\McAfee\Temp731553312\analyticsmanager.cab

Filesize
1.6MB

MD5
bbb159ae38ec2c738c7bd5e84a6e20f2

SHA1
172cb377c7e93ffa9dac2fa0b612d5a9f04c04f3

SHA256
dc1e2bd7881539bca14fecb898a9e8ee3c7690b017f967c3579c662e01f5a627

SHA512
e628221fbe879c1839ccca76ba2b39755a302e06951b529c7cd4976262316787d4f058d19c68e9948f1c7400cd102a9c5e353898cc5ba6807cdae83fe44c2180

Download Submit
C:\Program Files\McAfee\Temp731553312\analyticstelemetry.cab

Filesize
57KB

MD5
a8c2f36014841ff74ae6411c93504167

SHA1
03ab0d8b536a2e6cea7b8a886a007fe5cdae9b5e

SHA256
91644ba0fd90fe785e7b0c6e29be85d1d9e6f0cc599cbb5f076af43556f216a0

SHA512
3f4f860c75db58779f7342c96f06c665fc3521c28a61d9c7e999f6bb53db69a03b9efb236b24f4af8e54cc8ec5b9360b95dc2da8a9e5fed42150352d4847ddfb

Download Submit
C:\Program Files\McAfee\Temp731553312\browserhost.cab

Filesize
1.2MB

MD5
c1f02d15ef06ae59bc00417607383737

SHA1
a863aec3bd8c57c956bdd1da6a6c47e66626e85d

SHA256
31ebc054f2ac686ce0fa89a418ab9830a700e994b051522bc6c73d4f658a412d

SHA512
7b477ec90bb24af5ad4f2daed0a731f04c38fc988a97932f3b0c21c9bde7886231b946328e4698a8c1996eac57932a3170cc1606c99a82f9074b3634788974b6

Download Submit
C:\Program Files\McAfee\Temp731553312\browserplugin.cab

Filesize
1.5MB

MD5
521754efc39a3c283353655045be4a82

SHA1
8000e17fd03069ddbbfe4f8404ac60a8717c8c98

SHA256
d18a51b623e68b5fcdf95aef2cc5c9bdf95d4fa02e718c725c478aa976b4fe46

SHA512
e7a28385a003913a458574ad2ccd39c7fb61beee843e8879595c8d289da7eb0c84f3b0f2e25f51f942b75dab8587b2fc1bb7e5270fb1b640e0540129dce55e44

Download Submit
C:\Program Files\McAfee\Temp731553312\downloadscan.cab

Filesize
1.5MB

MD5
62ff20ddf60c4f0b0bd9b7e50fb8895a

SHA1
b277151f3b10d519b94a43ef92547e9ab9445794

SHA256
30f4aa2a51fd51f00ce8885eb4ed24ae1bf07e38e62116d4de95a9a20e0b24fc

SHA512
aa5395c8c1e7a3eacf18a2315671226a3e3e93b731035461cc94b341746297ec1e04c5aaba0d9c608994eafc58b14e1b666533c0a1b655190fa901c99c140047

Download Submit
C:\Program Files\McAfee\Temp731553312\eventmanager.cab

Filesize
1.1MB

MD5
a44875fe6a3a3bfa19895419aef8ef39

SHA1
c6f739b8868ba10509680fb757963f62b597852e

SHA256
bed33376e7cbf7a822629c85acc0ed23e2836ed70acadeef9cc7c5210e7464b1

SHA512
55566b10a23755644bbc4e431e30fd026d252f4396c10005a23e0dc6e99092f530af6df309925dce92c67811dc573958e92d551d557df0e72306b3f9d9ee2c43

Download Submit
C:\Program Files\McAfee\Temp731553312\installer.exe

Filesize
2.4MB

MD5
0e63ec345bdd35d4111d274979ef490e

SHA1
6d1db257c3352c7393ec663f638d7102805ae426

SHA256
63ee6da291b22a6770a9b950adef7373b748ba356976398865f9b04ae40093fb

SHA512
0bd6bb4cf7f0034cdb9fa83daf0f873ac1187ee05c0b22d580b315e7e54a2c3757a7e19081a266cf8b152c978f49495fcf421c5c77ecd6764cf30d419cc5a05a

Download Submit
C:\Program Files\McAfee\Temp731553312\installer.exe

Filesize
2.5MB

MD5
fd5e4ee7b65dd7626f46f0828b969cbb

SHA1
8e948284c5b3f96a88b3588dc86dff736663fd7b

SHA256
cc9c920c6483836d4626715538884d97136f92da4ddc376fee85f254a9e2e87f

SHA512
8be02a3bfe9b4b1e7900657903caac6f7fdf2e823c32c45d4a2f8aee0c6b4f287a99b17e72115e41b00eca600fe0de50c3ea18d3a13b120ae4ced55dee72fbd4

Download Submit
C:\Program Files\McAfee\Temp731553312\l10n.cab

Filesize
274KB

MD5
ca63aa0a6ccd452a72f4fdb9f325e695

SHA1
03114a327e092dfb5b96fa38dd51a66a30620b01

SHA256
aa29cb2337ba240866bc7ffaa9870b81018e7dbf8a0db287b867fa3271850d61

SHA512
d32af530aa7eb1a989682f5191cdd4aec1bf2faf819d7522340c65d774def609f64f89e8d71fb96f51938f066c2e20db3ea55eef5611de1cbc942c03aea8a64e

Download Submit
C:\Program Files\McAfee\Temp731553312\logicmodule.cab

Filesize
1.3MB

MD5
49d60a025ac9b683b3e68183c781fec4

SHA1
f52b13827d84350a673a03430b954dd508f34374

SHA256
636fcbf78b307e569afa78fcaab732d02faa34798b49de2dd61180ac297d175c

SHA512
e908027128a95c31d950385b5e907a649816d91c958d003dc39c0d7d515b115c30ec91c9e7ae6445a11e865cc9a4ae980a34944c135db0734725370f223de9de

Download Submit
C:\Program Files\McAfee\Temp731553312\logicscripts.cab

Filesize
57KB

MD5
9487c0074a43c0fb9fabddf9940917eb

SHA1
e46c6d512993e7d3c64eec34a8f91fb3fc25b9f9

SHA256
45a6f08289eeb8e96f56cb33ca0a3f0b5ace69229088950925e823b07586e457

SHA512
faf6bfa9c12ae686597b7d74b578c3c04177b040ca97b9957f4a592787059d7dcd16b251d536c0b3438216190c3ce0cf82df742da6f44d383d57a91efaf11cef

Download Submit
C:\Program Files\McAfee\Temp731553312\lookupmanager.cab

Filesize
972KB

MD5
33e5184a889b61861c0a3b91cc047244

SHA1
14f200db134bdbe1570f5749c4f4234a749701e0

SHA256
fac8c13a875a6d228edeeb325a57625900e31cdb21fa20b7275962a4307bd69a

SHA512
d81afd8e80a7c81c1fb365e57f2b7c2fbc102a94ff39de974480c1135e72f4fcd93b1e276d7923c6cf7e6843417bf218ceb33fdc925f0a140c74f961ee63f673

Download Submit
C:\Program Files\McAfee\Temp731553312\mfw-mwb.cab

Filesize
30KB

MD5
544e0a323a4fdc6beb57ab1a3ef7d102

SHA1
954599bcb9fc91446ec87b86830e6e842fd4ddae

SHA256
273f28fac07dc8d4aa9b036dbac2b4b9689ef222469aef686429593e1ca695af

SHA512
aaf650e3d6703d032d4a66bc9c846fad2fb2345d9b1e87b33f42abe5c8e1702bbd4ddf457ccda26a9c340f557be11ee2b05087b3a7abd4f79604fc6a9e2c6022

Download Submit
C:\Program Files\McAfee\Temp731553312\mfw-nps.cab

Filesize
33KB

MD5
def62012bc3acfb09450b7b10e147ea0

SHA1
dbae47737de560b3667506681632aad6fe141995

SHA256
3f66097cd223a5859177f4943c7f42d39628d18c954dfcd60972e41a68175001

SHA512
47bd531a8b9feac999cf4960dbf20e1b04e1a6686fef2e7baa938c118dbc523f00e8d76a947e660fd14c691ae4404f7564e1792cb253614765222fd9af5c3ea4

Download Submit
C:\Program Files\McAfee\Temp731553312\mfw-webadvisor.cab

Filesize
902KB

MD5
c2983bc8890e79a87b295932f860a635

SHA1
bbfa88a853efc10bb5907b6fe38833b6543e2a27

SHA256
323c04a46b5477bbbdacc6354dfce9682b37cc6ccc398547f7242d80bf4d7c38

SHA512
4d99b03b99795b757e30b0522799fbbd53a1d2b1f9110d83178bb73d47a6e28e33a1c35e160d5f348538c537ddeacb912b6d29673ceca8eef61cef1e1854a4d8

Download Submit
C:\Program Files\McAfee\Temp731553312\mfw.cab

Filesize
310KB

MD5
3baede2632a666e1f1376d99285777d7

SHA1
220c935992fb7279b15510fdf35f211d4ec339c2

SHA256
c266f4b2a00927b4a19888bc8100c5224ea788bbf1be7e06ee5dd153e1970d88

SHA512
ffc7bec964c6f50d3a9a60c71788e0852b1f4a5316637777cb89d47d55fceacd680886a077508f7928ee40e87457eaac2b83a6913f5197965edc07229e651b54

Download Submit
C:\Program Files\McAfee\Temp731553312\resourcedll.cab

Filesize
50KB

MD5
661ab94134f443e91c08e847e4a586e3

SHA1
744354f2be6b184d481ec5542743549d383e0fbd

SHA256
9fce98ca830481414175c597e80591bdf1bfe57288ccc90285c346d6de995dac

SHA512
37220d895471363f27a56d85c3be6da77d7da213d723c61c1b792d528a67b33f000a5aefbadbe4d53660e0bb176c164ece8a08fdd35e8f3b4ec67057939bf5cf

Download Submit
C:\Program Files\McAfee\Temp731553312\servicehost.cab

Filesize
304KB

MD5
35201cf74164f94bd285aee3eefeb397

SHA1
8bcb1cc23d5eb94b6178af272de5650881e7cd48

SHA256
be00137b3bc1977a5c88106b03ff4ad4917539e3e8becdb6373f634644e592d1

SHA512
78c118b3a0b218a59464b3d1c273d8ee17dc6ead6b8068e9866c786a7d2110b1af496f0d89e12080c0eda85173f761a79c33ded19fdad09731e9d611d44be102

Download Submit
C:\Program Files\McAfee\Temp731553312\settingmanager.cab

Filesize
759KB

MD5
bef154680d012dae9378d613ad70990f

SHA1
7f3128539d9fb4fc10c738c18e34f723b5f337b6

SHA256
9cf433b199cbe7db6e27ff72675030a1df469bec7f5d6c886d00d979c1f8cdfa

SHA512
883168d01cecd5ed33dd565beae51233cd13c0ba69fff5c3e1eb37b1ecfbd2491262f2397ffc71b72218cdbc2d5904d5e3bd3f899543487ee0d312fe7bff7162

Download Submit
C:\Program Files\McAfee\Temp731553312\taskmanager.cab

Filesize
1.2MB

MD5
68cb44f0669d394be1e9a08cdfb587ca

SHA1
fc9dcde2822f815e90ea9de08c1871fed2f3cc6e

SHA256
999fb8b6fd1226ecf0a44e328f7f414f071454416dbf6c5ca929963c987dacb1

SHA512
a948b67cc3ff7a20975d690bae00012c2ae2dc4eecca38e225f164753aee31f366b5128d6c3b83223ddd59ebc90a0130a3cbf33c0488e8cabba55e45b1063a80

Download Submit
C:\Program Files\McAfee\Temp731553312\telemetry.cab

Filesize
88KB

MD5
55e975670a9f8b7b31821a093547c4d3

SHA1
c6449b5f4cc0792a3e6671f05550c3b5c592cda7

SHA256
b0fa13c7909c5cc9733d5fd89958eeeb9b4ea28d326c7ef603d08710bd2bcda3

SHA512
e4464ad379eb03ca4d7deea89c9fc215503ba24f4eb4a4100dc6b709ab5ae19aae29b58d0b2f395e8e45aa7e838f3712c9b59ed43bf55fc8f5b1a14ac56f80a0

Download Submit
C:\Program Files\McAfee\Temp731553312\uihost.cab

Filesize
299KB

MD5
49243f8a17a0f3837805f17cd044d045

SHA1
4b4b1d7fac7fe1fc136ec8c51efde97c5b3665c2

SHA256
c74d35e2e283abfa21090cd6ca28338bb39ccc0b36fe06c4b9448dffd7fd4550

SHA512
9fc9b47cda176b498cdb8057b7fc4d59bbaf4c28f54321bbbefdb3de403aca45059adb1e9847398e602899f79e6271304a5352435de7777a0de8786651d22d37

Download Submit
C:\Program Files\McAfee\Temp731553312\uimanager.cab

Filesize
1.1MB

MD5
8c4a663e2beda4b027b5ab6cd81a42c7

SHA1
7018f7272420ae9e9d3aeb9d237dced148189d8a

SHA256
ad7fd688c94a2bb5faad496988c89d26f217571e32d602938885147f804184af

SHA512
e8d45224638034fdc274fd2160fddfd9828f248987096d6a454bf99582c1c63f687d669f95ce835f7cec7beae39c0db1f5b20b5c84bc0d4cd9f4fdb0933f8b64

Download Submit
C:\Program Files\McAfee\Temp731553312\uninstaller.cab

Filesize
904KB

MD5
b1050cbed63fad9e83fa69630f42cdc4

SHA1
1ad392422abf4913e5dead7e60442339764e8661

SHA256
c6d58c9ea3fc4dadd5825bf1ee860da4a3589c71c6ecccc33c4c2d5a7c21ad55

SHA512
171d0f429809ec70ae25b316c29a31f59c59fafc9d43f92e6275e42ec3207e705eec52f31b31a21219c847962d3664cc8c9682a4630390bd0836a34d33da7145

Download Submit
C:\Program Files\McAfee\Temp731553312\updater.cab

Filesize
861KB

MD5
45ccc24ac9fd62d3713eb8b1f1ba86eb

SHA1
3195182c554ff583d05a838ae7e86513f6f97261

SHA256
3d5b43674bfa7f033b7a3079b2f974fdf41e54470ba64fb8873f06fd8118253f

SHA512
04a972c508d7fa9d527b13e28493bd7d1cfd3a5eef24104cd84bb9342c8076d19bef860ec2733b05f01213ac3cf706581943e7c4fde1d051b55621c1841cbeeb

Download Submit
C:\Program Files\McAfee\Temp731553312\wataskmanager.cab

Filesize
876KB

MD5
b9a017cb3ad55d4a34e79d1fe4479612

SHA1
a73185cee3f399dcf933d30e5a5407f46ec68fd0

SHA256
fcb508e3c0711fb9b7911952fe338958236b9d38c3d89d86757d370032dad5d0

SHA512
8144831f69f2d17a3e1d070181833506ab1d656f941b7b0518206732413a87c930f9549d6001fff9e06100f22ea3c3b51f0f8ccc5a3d7edc87c0830eb6990321

Download Submit
C:\Program Files\McAfee\Temp731553312\webadvisor.cab

Filesize
22KB

MD5
379b00db0cde5ad7200496673f09c33b

SHA1
1bb1e8437479b9dd0dc55163c169f21392e2ef93

SHA256
ee305bc90cf2e16b5f2d9240766310ffd37a7bacdc6d7dd8dad4625bbfd29b1d

SHA512
c1edccc5afd3db6065048d1fdc6e5cb0269d7083405d002206717ef249e5da4006e80303f7739d511f8d55d2089113137e8e62e4089c6af920b7a41f6a7c5156

Download Submit
C:\Program Files\McAfee\Temp731553312\wssdep.cab

Filesize
588KB

MD5
013210e916b91361bc8155258dd1daaf

SHA1
0711dbab470c07f1a88d43167552401bb6cdc7ad

SHA256
af5201548790983ca4a928c3e88de017e4a68078cae5b21c8bac42478c16dab1

SHA512
b31b614e121c1675938aecfb95f771e0d5fae51e6fe0dcddbe0248e11040cc7bfdb136b7af7c963fd19231148b25522e3bbcee7a5735fb80af21b9b7152c3f28

Download Submit
C:\Program Files\McAfee\WebAdvisor\AnalyticsManager.dll

Filesize
2.5MB

MD5
3ecc22686572b41b5ac424c287aa0fb7

SHA1
e76d0687ab00dcab8aa8bff929370e5abba67383

SHA256
49b427916a13935cb53bc4b1963b2b9fd6fb88bedd8bc209df1afe810e3304d5

SHA512
d195405bf2face8333d4938dc36d33f2621ddbcc55616abb5bf1458a1bc9784821ddbf75fe8e60179acfaf7a0a7ce763e6639b381b9f2326bd62ac9ca2292f51

Download Submit
C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab

Filesize
73KB

MD5
6f97cb1b2d3fcf88513e2c349232216a

SHA1
846110d3bf8b8d7a720f646435909ef80bbcaa0c

SHA256
6a031052be1737bc2767c3ea65430d8d7ffd1c9115e174d7dfb64ad510011272

SHA512
2919176296b953c9ef232006783068d255109257653ac5ccd64a3452159108890a1e8e7d6c030990982816166517f878f6032946a5558f8ae3510bc044809b07

Download Submit
C:\Program Files\McAfee\WebAdvisor\EventManager.dll

Filesize
1.8MB

MD5
28046dfb3ed0f2364b068297f7da317b

SHA1
5467e11099bbdaf97bb9ab89d51a259db79c5637

SHA256
897022836736991e633ec3c47d7a35dc5349c09f82d337e9afbdf93cce9f08ae

SHA512
217ff343f5dc91677205a7a033e57d2a119b045af0239716a88f883f893fe4622184d4bcd4e34c20b0167ab3253b69743efadfb96054b7dbefe0ad2b606ee06b

Download Submit
C:\Program Files\McAfee\WebAdvisor\LogicModule.dll

Filesize
1.9MB

MD5
6eeb595c0d9035ecd26f2bcd4c2e0f23

SHA1
cba7eb94b1c5d09a63af9710728441387f0fe634

SHA256
f93ebc231111e4bf049cc7433c009466b23b3327e5fd5f90c3aa4e7eb2296a29

SHA512
34793214f077bb7f6b1c56737221b50ff7dcc2107885f10d5ab321f77e3e0fe94f329e73edb267f3c7760f0937b3f352e4a47ffc282a2d3e60107dd76efb57b2

Download Submit
C:\Program Files\McAfee\WebAdvisor\LookupManager.dll

Filesize
2.8MB

MD5
83f8e834238a6cbba24ef0172540ed01

SHA1
a273162998dfdde291ee6299782ab6fe33b9f9c9

SHA256
ef0a1bba6ad4d395c593c3dfde89b459c8aa623b349a339815bb5a8cfb480520

SHA512
e4e047c3293011cff7ee2225a0c7560c73b5784ce7d6755afd51914105053cc02ca6db381ed2c36cd632250446c29ae67681bceef2fcb7d4f7e982476ca111ed

Download Submit
C:\Program Files\McAfee\WebAdvisor\Resource.dll

Filesize
37KB

MD5
9fab0f00db440cd966bb82f8d3eec66e

SHA1
12bda767a6996b5c965289c1f4ad874b7777317a

SHA256
ef39609fa5c7311597ba8cc924cf12cb7f36c9bb7ab6e1c8c2ceb11c309c5115

SHA512
899d38793a4350afda48780e8d5cade59b5433672f5346b4de4c191da03d21f9e4e2be10ba1271e51f580a1ee30c2e437adbab2cf8d722ef1359eba7cfa3d4be

Download Submit
C:\Program Files\McAfee\WebAdvisor\SettingManager.dll

Filesize
1.8MB

MD5
11aba04279fde16d12314d1344ca4d42

SHA1
202c054e447764957043d2abcb304e5a68361776

SHA256
7e006d4d0657653766b403300f2b0beff06d0a185e2ba55742f9d523201f47b4

SHA512
f1c10da4f49c245c9e5c81b80ee08749e77e0497364f99afd5e07ce637d6a75a41885c58572b1079fadc43cb78a7ed7a9efe4d44b7c450cd3d17263df44fb6d9

Download Submit
C:\Program Files\McAfee\WebAdvisor\TaskManager.dll

Filesize
2.0MB

MD5
999759c971b2c3ac9eff4a5ffc26c467

SHA1
273796f2743b8d94e781aa96cb434f122ba5447b

SHA256
a624af30f2442d65b0b3c6e2c0e2958e92eddd6d34610c71c5fb7bdfbcf388f4

SHA512
554422bb0f10a7443c357a246548a5f8a0d7c94f2e655533b5f2c65f1db71076c2311bbe3176323050555a872b91c2ed8ade55d098f64a9f5e90a3b2c9c60ba1

Download Submit
C:\Program Files\McAfee\WebAdvisor\analyticsmanager.dll

Filesize
1.9MB

MD5
bdcd44ec63a367baa7a90e80c3576b3b

SHA1
bbe82f97669bd6d864408d49355c8b8f1ab9d71a

SHA256
6d398419413a3011f3aa4c692266829abd0426dd5c1e26366420da13bbcd758d

SHA512
86911b5c0e968f5b09c5b49401d493f721a75c7c7a2716de61fd6e350054f1bb5ac7d1acf3937c1f26347367c8ccca36e7e297c2a85d2121f465edc53b2165aa

Download Submit
C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsEventsConfig.luc

Filesize
6KB

MD5
3a5fef41fa030eaf9cc0b3a24f1f7338

SHA1
9f17b36ee3e9309b2129a16fb69776fc56525d6c

SHA256
8cb42480474ccd64bdead9bbc7b3e2fbb5c47efd4d28adb2feb13ef85c2c9358

SHA512
3565001aa8c819bbf1b5b68d04210f000fb5c809d9930719003f38a937ef41960f1dab4b00b74e5461b71ba984a28e83335c5a89cf28e8f02fb431e1e2eb10ca

Download Submit
C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsTelemetryHandler.luc

Filesize
2KB

MD5
44fb4dda950ff2657e70c3b9547c42a2

SHA1
f19bf873ff560e9ff10e5630b76635deb3a88499

SHA256
f4dda08fe48d480fad4fd367758a9f48fdc83aa045d2b240a10dfd048d6d2a39

SHA512
06b4e4818d7437b0f99cc79417a8590041fbb74604be2fed723e062f42073bd258b6d764b4639ed07d0e9d1df0a87a51c61f5658ad630af1f16e7448a6bdd7d6

Download Submit
C:\Program Files\McAfee\WebAdvisor\eventmanager.dll

Filesize
2.3MB

MD5
2e3ec356227a4aec919b1b59ea714a55

SHA1
bad9b471dccb25fe59d81cc52d8954e7d3fcc77f

SHA256
f59940afe489caef3981ee69188e524bb95bfec50d41c45b199112b3365f9f83

SHA512
946f1bd1ae133ca9dd83fdeef82e78bef53863432279c759de00f4b5d12d38131a8cb9db9cb64d6a5a6cb9dc3a82ece2c5292f6281a5c2e801afd4a9cd8b1a6e

Download Submit
C:\Program Files\McAfee\WebAdvisor\logicmodule.dll

Filesize
1.7MB

MD5
b3411d6451ff4370dce964b5e5c9b013

SHA1
7cba503c6383e04debb0b759e511b25b1e231be3

SHA256
b067c28f889e987f9ee3fe30d94332c5b4546633a21ecd27b4a7a78e6d6a48c1

SHA512
3bf436e5c7d04dd47df62d0e7b43357f62440aa2e49b7c27af9f26f8f6660c047e03f15fed26b5723ecffaa289538e2afc4c19c79d210ef89f994b999f869b8d

Download Submit
C:\Program Files\McAfee\WebAdvisor\lookupmanager.dll

Filesize
2.1MB

MD5
7060a5bce1eea369ab0b5b4ca40e7ce3

SHA1
b140c93d3c53d66739ce9497465d31ee03142f57

SHA256
e557e07984537486a447a3558f66efcef195944ad04b7d4f669e4e101eb00f2d

SHA512
fb267f10e4e75c8d84c268b5ed951effe4a77587d202632130a9fe83db322e873ebb81c2553a5977d0bbc029e9dc34649f4350be16f0cc1b2e085612229cb403

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\class.luc

Filesize
656B

MD5
a26ca30e24efcab7964be441872e1f49

SHA1
79febc002be96953451ad6af7a959ae711110b4f

SHA256
934475f6be0208828f6f3ffd118243bb6bc5d78c50e417a664a4c6e5d6a88512

SHA512
af094ab2b11c46cba08e2ae286b5fb94f21289bccb41f8ae4340f86e591071490385de795593edf26e1ebaab78e056a3a9a6abaefeaaf8807ce4b114b6ea78e5

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\dkjson.luc

Filesize
9KB

MD5
db062d045a4a099fb2996b2df7d9d4ac

SHA1
ed16ca7d5831402a71b385554e75c73a9af1c463

SHA256
986a28ba730b30a0db14279f4880a8d50f5d9f095427a4497db531f9cd4bc8b9

SHA512
5008920ce7a408564031dd1f152caaf7fd92ef29f35b2a54b9df9ed3caf024970ea33d8dd8b3e051b954001de856c753df6faab901f008c7b3916563d879c282

Download Submit
C:\Program Files\McAfee\WebAdvisor\mfw\core\logger.luc

Filesize
672B

MD5
d5194f01778d77b26ed22f7dabb3755d

SHA1
e3ce01be6333b85a4b048e495dcb989b8e7054f1

SHA256
28647048b9ba0e4a8ca1020ef3eb3f9d1ca3d0a47381886799aa80465547dcf3

SHA512
31d91a922075f794f4001dd6b74788acac5f5472226b8818e1c25c937a18fa759d3bc9446b54d6144c6dd989dab024b7cd880da71d1de053547dcbed0f756a69

Download Submit
C:\Program Files\McAfee\WebAdvisor\servicehost.exe

Filesize
868KB

MD5
b0d6a817dd26e58cf023024b05238a60

SHA1
ddcd1be95371ccceb3077762ac0ac2b70fa5ff35

SHA256
8b2801d1873996e22cd21f334def7c52a75257d9bd7edd99bc0e26e9374df7cf

SHA512
33da0899aaa8a6213db618d97a5244d67019619172436f2775912f08526218d5ee822ba441ee6ba773b38381b9fcec23492e136f124b94561fe28fa061007092

Download Submit
C:\Program Files\McAfee\WebAdvisor\taskmanager.dll

Filesize
2.0MB

MD5
123d3353c64eb84e168dd8013fb50c13

SHA1
78e4c128949073711eaa0a853146a8baf54429e6

SHA256
180bf3e38071573b3773f3a5dadf5baf545f0d573fb6a32b595980c525d0e8a6

SHA512
e36295d6ed25edff8bb67813cca2e515f978dffd2a7169809047b239460eaff7e3fd489755949526e67eda747c44a5ae28ff39dddcc93dc528d84162f2c043e8

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\DimensionConfig.luc

Filesize
23KB

MD5
990348c5b72b683f4ec12d50748aca6f

SHA1
066cf2b0e41b105d94a76c60a13dfee95836ceb6

SHA256
b10924961f4c35f8e0d563930e1be2e98721f5c67ae056c429480a0cbbadf8d5

SHA512
cb228ae92560fc3708aa8d735ac6bcbf5f4fe4d1b01fe476723ae04efa8a662c5e89a1fb0065598ff4cc680f287be31bc3f9a04748b313e6b4d7132a5cbddcdb

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\DimensionProcessor.luc

Filesize
1KB

MD5
ad7609ac4826e5b3a559495fe146ea99

SHA1
c0e5605af8c41f9685561a478cb6364cdac47392

SHA256
6bdfb568893aa0d70f2e79eee3fcb18a0693a4e83e472a509fdaabc0b46b6c37

SHA512
4f48aa6513ef5929655025a0be24f49597b6974220af76640168bcd62647f732dcfd6c87989ad9ea42ea1e978a493215700475d54705a23b4c8cf7e13d95bc7d

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\TelemetryConfig.luc

Filesize
25KB

MD5
61222c488a54965e8b94dd20dbfe27f4

SHA1
9f83c19aba5395f544dea88f0faa135bca8139f4

SHA256
9a9d207b0dca525bac542d5e9748eaf31e3872a58c49b682b4dc6b9285c86202

SHA512
a75b39ff12399df8eb9246652906e47a66ebea0a7879fabb141eafdc9d511a736f6ae719f7cbba882a754bfd67cc5fe1a704c9b7f4c589b0e8d8b53ffa3caaf9

Download Submit
C:\Program Files\McAfee\WebAdvisor\telemetry\events\TelemetryHandler.luc

Filesize
2KB

MD5
84b0fa8b99269dba6b31ed76d6d7d4f8

SHA1
3a3f2532c99a1da51530dff082c53bf63a2a6762

SHA256
3d6ffe48dc433724df4ccc5ce227a79e7c970d1620967d529ab08febb8dc376e

SHA512
24efd681afaf19fe17aba1201fde70aec5a0b1b4811a52013aa219d60bed96d5262db5ff522cc1bd13b5c94a043424a460ad93f604a8577f3d23b33b0a33f740

Download Submit
C:\Program Files\McAfee\WebAdvisor\uihost.exe

Filesize
841KB

MD5
479423ed5fca6098f2552adf07435919

SHA1
10b5ce0bf3633df778a2419a65db9c3a9c637243

SHA256
30673d74f1d00e80dc7cbf31dd2c5980b9f635e01acde98f1041f1377af9a7b2

SHA512
3ddb6e22b7ba5705e6bcd9b51515b5b4b6667cd3632ff65ab1eb52b5838f5545aff6b271e4d50265eeaa477b414cc930542b5eaae67811deb5b8a44e02174dfb

Download Submit
C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll

Filesize
2.7MB

MD5
3aa78275eb72967cb95ec31a793e5725

SHA1
b8df71d9d3995d69cfa179a79b1708354621e7f2

SHA256
e439862c375ed41657a0ee9d316f4bba5ee5e6c08d5333a9bd5bd708aca12658

SHA512
597809bf1c1af70ccd8b0cef3ac5088623c67f71e0335f6fbb2adfe8a59604beb649f272af5412f8862fd9aba51100635de6e4e344b65ae80fb3814a443f6949

Download Submit
C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll

Filesize
364KB

MD5
60b4de30f65b0013a479f58fc3754053

SHA1
b04f52a65c68c7898a7029de0a7a60116c3cac3f

SHA256
48ec5710b6b135297110393b00e4f215faeca7ba7f78624452ad0e48ab9adfa7

SHA512
4b1206774587e25b810c7913806a7547453cc53f47392a2a8f88a03ca87c8a0a55d25ac9ac06dd0fe12abc86414f2fb36b2f254df6e8f01ce03d70486eeda731

Download Submit
C:\Program Files\McAfee\WebAdvisor\win32\downloadscan.dll

Filesize
1.8MB

MD5
b901b7d33332c8ffcb2e466beb6844f0

SHA1
0fb167cbf5bda66a5a12aece927c14868c1d79e9

SHA256
64da1114f15841d0983e6da81c07dcd90558ca84c3bb40ba5f2ad8ed92f6c9d2

SHA512
d8b36d57be432bf1d7d26ed2877a56751e3acce27ea39acaaa63b49399b16062b24aecad8f31cde5dea061fecb2a12110c06a0c6cac6049ec62decbda967eea7

Download Submit
C:\Program Files\McAfee\WebAdvisor\win32\wssdep.dll

Filesize
646KB

MD5
a01f14bad08ab70a5da1405cf745ae8f

SHA1
c078facd49caded7405c82b0c10d347ba0f9e6eb

SHA256
3e61fcacffdb0dd11ab7d2ce2630d919e1515caaa1187cce4a01ef1a23032099

SHA512
6d6506e30168dbe60d518948a3fc82c332422484daa7b61a1fc48e47588ecc388039d731c696640622f4bdb4c6ab73e12bcc869e8d00eda5f3ecc3348adab8c7

Download Submit
C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll

Filesize
2.7MB

MD5
819622a875004226504b53f8cf6c877c

SHA1
d059c6b8c505756781ee15dc26051181deb3c1f8

SHA256
a946fa0ef7f09d4ad35f92445fc88a6416e8e7334443f320430c648f68f6b850

SHA512
ee855364e2000f1f339d92201a3b32d6762563a6e3a35e4ab4f00812a1c09c7c57f4903195a6caabf162f131fecb903924131ca987c78d31ae315ed7cd238799

Download Submit
C:\Program Files\McAfee\WebAdvisor\x64\downloadscan.dll

Filesize
1.7MB

MD5
cdbfac4767c15c962d4c82c41a852436

SHA1
a6a56231561679f1b54aec208c6ec2c1674d46e0

SHA256
f1cbc12b33a52f462eac447f9508eed67c2ad5d5f5d9bbf0b2ae5c058150081e

SHA512
33128da77abbbdba2dda877feb63d08ff47244dfd711243d3e13579a30ebb768e026147a794948ff9999150e5ec4575e16c7e7302f0b7decc8e78557b8ced136

Download Submit
C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll

Filesize
803KB

MD5
cfaee5a184cf82786449dabc6155ab12

SHA1
9fa6f7af8130ba9d1bee6cc1eda4dcf04acddcdc

SHA256
20b3b7dd4cb13b4c44b05bb91ff31a7bc96add8d8111de988e28dea525858980

SHA512
a4be53fbe684d0bb4ed918def31915638c5d0caaaec277a5166f522cb39638b36bed4965f3c8b04c033187d35e63f7464d9567114e3e271d5d5437e7177d9646

Download Submit
C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log

Filesize
2KB

MD5
22bd36900f4bf3b99c04893157cf8d73

SHA1
6ca7abd2dc06c116d790dd5a52de591f9e1623e7

SHA256
4513df59c08339905ba6ac9deb63094df7f6a65a46479617cb3d5c4447dd9a8f

SHA512
aed68058d7d8607795d778f8fbcbee377ce018eca10a5639ab4733bfed484b0cb542002c10db8772be8c7eb87b85a346c8ffa865f7f03878e1a1e94711c701c2

Download Submit
C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log

Filesize
4KB

MD5
bc04c88c25e0d6992c4f54699762d049

SHA1
3994757acbdfcd86a7a495cf183ba4a4ee68bbb3

SHA256
59982d6e61a128e840a6d5bb3991d90b5c75ddcd038f023d9d1e60b7237dcf88

SHA512
316388389181bfe2ca77dc7fec93e40acde201abf5b256e15e0ee71a51ba528fb3e330492184d239f7a95f33ad1f2e1a3deac5cf36ab8054152053ebba5e8130

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
1KB

MD5
1513d53202f0c3775270429745ec3892

SHA1
a90a6514e778952a46b7e9fbf91f18858a00da15

SHA256
abfab816995e764670fe724bf54589c519773420987ecbebd797b3a5f4b41e6e

SHA512
1ad8f21e8ae0127736de053275991aadd90009186b8d1669f03dd8b3ffe0536d27e9451aaf341fbd50c0ec040f9b1b90c880cd0e28acdec67d49e5425f795fac

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
3KB

MD5
934c06ff3d5365b509ca95507b623a4f

SHA1
9486b735318973d882f64b01b8e669d315cc2fc6

SHA256
d976eed8cdd158bea762f2c097aba3614f1f5141b2d5b8119c4bccc1a54794e2

SHA512
ae2c0e2e36f91138e19fce73e30003efd5b6c68d7f8bcc03c69557e4813838a5c926556c2633475bf13a1fe3b5ec900f18b67c6ee9f81ca7302143b06f5077ca

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
5KB

MD5
3bbd5114967983b65f9a838b89ae8a29

SHA1
3508723d819ee95ea2b1567c61e2ccf2d1209f65

SHA256
b0424c293ade657d39f8d3cadb00b2abf61a204a1d7c2ed5978e5c4abbe39458

SHA512
f20be498ec51b2e772cb4bb63194af2aea4de9e1f679e4d2df3b8afa002bb24ea2853c7b3ffa611bfcdbe74c9c509b7b2cfe3c6d88dc886532cc3e5f522b7c5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\installer.exe

Filesize
2.2MB

MD5
812ac252ad8980a92768dc5ca2296985

SHA1
45744a8fd3ee654bb12749d3390a3fc44d6ba785

SHA256
94e6f52bf7d2d0ae1e37b35331bbf3c12359010f9a6147dd0ce58acc1b7b3ede

SHA512
ace8e25bfe84f854717b2aa8a590d3ad7d7d0bbaaf26edec6a9ad1073e1a51d865086aad69ac64ab5463af8a2d6eda9d8aeb497ab409736573f1ebc2336e3f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\installer.exe

Filesize
156KB

MD5
fe8f0c8eae209e215cf0a14ba0de117e

SHA1
07e600187afc8ce34957b2bb2afe4244a6db6feb

SHA256
698ea35879f401ae80f365d95953583d54fcdcf9f48a6f96797cd414dce10d11

SHA512
39764c43387596da77d5a38cf711bf3cff63a137afcd1f95b5289bd1367488a8025b70360ac4b971b121583caf386d152078e4a2ce6c48e1af82f4d01f3058c4

Download Submit
memory/2528-250-0x00007FF732AD0000-0x00007FF732AE0000-memory.dmp

Filesize
64KB

Download
memory/2528-235-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-1032-0x00007FF731690000-0x00007FF7316A0000-memory.dmp

Filesize
64KB

Download
memory/2528-1034-0x00007FF731690000-0x00007FF7316A0000-memory.dmp

Filesize
64KB

Download
memory/2528-1039-0x00007FF71AFD0000-0x00007FF71AFE0000-memory.dmp

Filesize
64KB

Download
memory/2528-1041-0x00007FF732AD0000-0x00007FF732AE0000-memory.dmp

Filesize
64KB

Download
memory/2528-1059-0x00007FF71AFD0000-0x00007FF71AFE0000-memory.dmp

Filesize
64KB

Download
memory/2528-1050-0x00007FF71AFD0000-0x00007FF71AFE0000-memory.dmp

Filesize
64KB

Download
memory/2528-1058-0x00007FF71F280000-0x00007FF71F290000-memory.dmp

Filesize
64KB

Download
memory/2528-1062-0x00007FF71F280000-0x00007FF71F290000-memory.dmp

Filesize
64KB

Download
memory/2528-1057-0x00007FF6D7E80000-0x00007FF6D7E90000-memory.dmp

Filesize
64KB

Download
memory/2528-1061-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-1051-0x00007FF7288A0000-0x00007FF7288B0000-memory.dmp

Filesize
64KB

Download
memory/2528-1049-0x00007FF732AD0000-0x00007FF732AE0000-memory.dmp

Filesize
64KB

Download
memory/2528-1047-0x00007FF71F280000-0x00007FF71F290000-memory.dmp

Filesize
64KB

Download
memory/2528-1056-0x00007FF6E6D10000-0x00007FF6E6D20000-memory.dmp

Filesize
64KB

Download
memory/2528-1054-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-1043-0x00007FF7288A0000-0x00007FF7288B0000-memory.dmp

Filesize
64KB

Download
memory/2528-1042-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-1048-0x00007FF6D7E80000-0x00007FF6D7E90000-memory.dmp

Filesize
64KB

Download
memory/2528-1046-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-1044-0x00007FF6E6D10000-0x00007FF6E6D20000-memory.dmp

Filesize
64KB

Download
memory/2528-1033-0x00007FF731690000-0x00007FF7316A0000-memory.dmp

Filesize
64KB

Download
memory/2528-251-0x00007FF7288A0000-0x00007FF7288B0000-memory.dmp

Filesize
64KB

Download
memory/2528-208-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-202-0x00007FF732AD0000-0x00007FF732AE0000-memory.dmp

Filesize
64KB

Download
memory/2528-226-0x00007FF71AFD0000-0x00007FF71AFE0000-memory.dmp

Filesize
64KB

Download
memory/2528-225-0x00007FF6E6D10000-0x00007FF6E6D20000-memory.dmp

Filesize
64KB

Download
memory/2528-189-0x00007FF71AFD0000-0x00007FF71AFE0000-memory.dmp

Filesize
64KB

Download
memory/2528-221-0x00007FF7288A0000-0x00007FF7288B0000-memory.dmp

Filesize
64KB

Download
memory/2528-1031-0x00007FF731690000-0x00007FF7316A0000-memory.dmp

Filesize
64KB

Download
memory/2528-300-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-309-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-319-0x00007FF732AD0000-0x00007FF732AE0000-memory.dmp

Filesize
64KB

Download
memory/2528-334-0x00007FF71AFD0000-0x00007FF71AFE0000-memory.dmp

Filesize
64KB

Download
memory/2528-355-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-388-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-409-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-511-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-520-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-522-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-531-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-578-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-677-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-595-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-556-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-537-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-438-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-493-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-497-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-462-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-452-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-456-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-397-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-385-0x00007FF732AD0000-0x00007FF732AE0000-memory.dmp

Filesize
64KB

Download
memory/2528-392-0x00007FF732AD0000-0x00007FF732AE0000-memory.dmp

Filesize
64KB

Download
memory/2528-387-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-369-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-305-0x00007FF732AD0000-0x00007FF732AE0000-memory.dmp

Filesize
64KB

Download
memory/2528-307-0x00007FF6CE500000-0x00007FF6CE510000-memory.dmp

Filesize
64KB

Download
memory/2528-262-0x00007FF71AFD0000-0x00007FF71AFE0000-memory.dmp

Filesize
64KB

Download
memory/2528-245-0x00007FF72E090000-0x00007FF72E0A0000-memory.dmp

Filesize
64KB

Download
memory/2528-181-0x00007FF731690000-0x00007FF7316A0000-memory.dmp

Filesize
64KB

Download
memory/2528-156-0x00007FF731690000-0x00007FF7316A0000-memory.dmp

Filesize
64KB

Download