8dc47ac2f1f484309425a9bb3940ea36968b085279f1a5c6228a6b3f580e1a84

Analysis

user interaction
yes
max time kernel
898s
max time network
500s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The Fall Guy 2024 2160p web YTS.torrent
Size 28KB
Sample260707-yxpkgsd16m
SHA256 8dc47ac2f1f484309425a9bb3940ea36968b085279f1a5c6228a6b3f580e1a84
MD5 964f0008d2cfdcf5b739c039468bf4c4
SHA1 4f482a73bfb781ce4a16d5ff8f0fcfcf3e9b7263
SHA512 f8a5c3d4c6cafc10986c738c012c3c6a860a3edd92a2dc420b1fb40bead06e01cecd9e6f84663b483664fad9a3ed5f4d98cde335972aafe9756c7862e445575e
SSDEEP 768:xR1ndGAbI4cTZ61maAjeaDgHThIzkOCkUrOxn:r1d7+cCIhIzak2i
TLSH
T119D2F19D13B9AFE177CB220EB36D42A76CF264E0E66F84960876F0DD5DD476461B0403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
134	3972	firefox.exe
196	4596	saBSI.exe
180	1660	btweb_installer.tmp

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	btweb_installer.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	UIHost.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
6080	btweb_installer.exe
1660	btweb_installer.tmp
1052	btweb_install_rr.exe
4676	saBSI.exe
4596	saBSI.exe
2100	installer.exe
5304	installer.exe
6872	ServiceHost.exe
6344	UIHost.exe
7740	updater.exe

Loads dropped DLL 18 IoCs

pid	Process
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
4596	saBSI.exe
5304	installer.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6344	UIHost.exe
6344	UIHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\AVAST Software\Avast	btweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	btweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	btweb_installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Avast Software\Avast	btweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	btweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	btweb_installer.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\McAfee\Temp1636499852\logicmodule.cab	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\jslang\wa-res-shared-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ss-toast-rebranding-bing.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.chrome.extension.json	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hr-HR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wps.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\mcse.exe	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-en-US.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\msspstatus.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticseventhandler.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\aj_toasts\wa-aj-toast-toggle.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\wa-ss-toast-auto-install-v2.css	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\json2.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\info-16.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-pt-PT.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticscontextconfig.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ext-install-toast.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-hu-HU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-hu-HU.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\wa_settingsdb.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\nps\laptop_circle.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\aj_toasts\wa-aj-toast-toggle.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-malicious-webpage-toast-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\icon_failed.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-checklist.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\mfw-nps.cab	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\jslang\wa-res-install-pt-PT.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-nl-NL.js	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\webadvisor.cab	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\jslang\eula-pl-PL.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\open_sideloaded_ext_alert_guide.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pl-PL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_msgbus.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_ai.js	ServiceHost.exe
File created	C:\Program Files\McAfee\Temp1636499852\jslang\wa-res-install-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\wa_install_close.png	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\wa_install_error.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_toast_light_mode_step1.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-it-IT.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\mcafeecerts.xml	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-sstoast-toggle-rebranding-step2.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-en-US.js	installer.exe
File created	C:\Program Files\McAfee\Temp1636499852\jslang\eula-ko-KR.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-rebranding-bing.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dialog-balloon.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fr-FR.js	installer.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\btweb_installer.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5924	1660	WerFault.exe	108
5392	1660	WerFault.exe	108

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btweb_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btweb_install_rr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x00080000000244a7-515.dat	innosetup
behavioral1/memory/6080-541-0x0000000000200000-0x00000000002EC000-memory.dmp	innosetup
behavioral1/memory/6080-815-0x0000000000200000-0x00000000002EC000-memory.dmp	innosetup
behavioral1/memory/6080-1030-0x0000000000200000-0x00000000002EC000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 40 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	btweb_installer.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	btweb_installer.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File\DefaultIcon	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File\shell\open	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File\ = "Torrent File"	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File\shell\ = "open"	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.btwkey\OpenWithProgids	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File\ = "BTWKey File"	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File\shell\ = "open"	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\ = "Magnet URI"	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File\shell\open\command	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\OpenWithProgids	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.btwkey	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\URL Protocol	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent Web\\btweb.exe \"%1\" /SHELLASSOC"	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File\shell	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent Web\\btweb.exe,0"	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\WSSDep.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\ = "Torrent File"	btweb_install_rr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\OpenWithProgids\Torrent File = "0"	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File\shell\open\command	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File\shell\open	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\Content Type\ = "application/x-magnet"	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell\open\command	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent Web\\btweb.exe,0"	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent Web\\btweb.exe \"%1\" /SHELLASSOC"	btweb_install_rr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.btwkey\OpenWithProgids\BTWKey File = "0"	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File\shell	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent Web\\btweb.exe,0"	btweb_install_rr.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BTWKey File\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent Web\\btweb.exe \"%1\" /SHELLASSOC"	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\Content Type = "application/x-magnet"	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\Content Type	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\DefaultIcon	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Torrent File\DefaultIcon	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.btwkey\ = "BTWKey File"	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell	btweb_install_rr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell\ = "open"	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell\open	btweb_install_rr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe

Modifies system certificate store 2 TTPs 10 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	saBSI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ServiceHost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ServiceHost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ServiceHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\btweb_installer.exe:Zone.Identifier	firefox.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	172	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	139	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	170	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1660	btweb_installer.tmp
1052	btweb_install_rr.exe
1052	btweb_install_rr.exe
4676	saBSI.exe
4676	saBSI.exe
4676	saBSI.exe
4676	saBSI.exe
4676	saBSI.exe
4676	saBSI.exe
4676	saBSI.exe
4676	saBSI.exe
4676	saBSI.exe
4676	saBSI.exe
4596	saBSI.exe
4596	saBSI.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe
6872	ServiceHost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	3972	firefox.exe
Token: SeDebugPrivilege	3972	firefox.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
1660	btweb_installer.tmp
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3416	OpenWith.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe
3972	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3972	4908	firefox.exe	93
PID 4908 wrote to memory of 3972	4908	firefox.exe	93
PID 3972 wrote to memory of 3480	3972	firefox.exe	94
PID 3972 wrote to memory of 3480	3972	firefox.exe	94
PID 3972 wrote to memory of 3480	3972	firefox.exe	94
PID 3972 wrote to memory of 4620	3972	firefox.exe	95
PID 3972 wrote to memory of 4620	3972	firefox.exe	95
PID 3972 wrote to memory of 4620	3972	firefox.exe	95
PID 3972 wrote to memory of 4620	3972	firefox.exe	95
PID 3972 wrote to memory of 1792	3972	firefox.exe	96
PID 3972 wrote to memory of 1792	3972	firefox.exe	96
PID 3972 wrote to memory of 1792	3972	firefox.exe	96
PID 3972 wrote to memory of 1792	3972	firefox.exe	96
PID 3972 wrote to memory of 3168	3972	firefox.exe	97
PID 3972 wrote to memory of 3168	3972	firefox.exe	97
PID 3972 wrote to memory of 3168	3972	firefox.exe	97
PID 3972 wrote to memory of 2684	3972	firefox.exe	98
PID 3972 wrote to memory of 2684	3972	firefox.exe	98
PID 3972 wrote to memory of 2684	3972	firefox.exe	98
PID 3972 wrote to memory of 2684	3972	firefox.exe	98
PID 3972 wrote to memory of 5244	3972	firefox.exe	99
PID 3972 wrote to memory of 5244	3972	firefox.exe	99
PID 3972 wrote to memory of 5244	3972	firefox.exe	99
PID 3972 wrote to memory of 5244	3972	firefox.exe	99
PID 3972 wrote to memory of 5460	3972	firefox.exe	100
PID 3972 wrote to memory of 5460	3972	firefox.exe	100
PID 3972 wrote to memory of 5460	3972	firefox.exe	100
PID 3972 wrote to memory of 5460	3972	firefox.exe	100
PID 3972 wrote to memory of 5468	3972	firefox.exe	101
PID 3972 wrote to memory of 5468	3972	firefox.exe	101
PID 3972 wrote to memory of 5468	3972	firefox.exe	101
PID 3972 wrote to memory of 5468	3972	firefox.exe	101
PID 3972 wrote to memory of 5552	3972	firefox.exe	102
PID 3972 wrote to memory of 5552	3972	firefox.exe	102
PID 3972 wrote to memory of 5552	3972	firefox.exe	102
PID 3972 wrote to memory of 5552	3972	firefox.exe	102
PID 3972 wrote to memory of 5036	3972	firefox.exe	104
PID 3972 wrote to memory of 5036	3972	firefox.exe	104
PID 3972 wrote to memory of 5036	3972	firefox.exe	104
PID 3972 wrote to memory of 5036	3972	firefox.exe	104
PID 3972 wrote to memory of 5180	3972	firefox.exe	105
PID 3972 wrote to memory of 5180	3972	firefox.exe	105
PID 3972 wrote to memory of 5180	3972	firefox.exe	105
PID 3972 wrote to memory of 5180	3972	firefox.exe	105
PID 6080 wrote to memory of 1660	6080	btweb_installer.exe	108
PID 1660 wrote to memory of 1052	1660	btweb_installer.tmp	113
PID 1660 wrote to memory of 4676	1660	btweb_installer.tmp	120
PID 4676 wrote to memory of 4596	4676	saBSI.exe	125
PID 4596 wrote to memory of 2100	4596	saBSI.exe	132
PID 2100 wrote to memory of 5304	2100	installer.exe	133
PID 6872 wrote to memory of 6344	6872	ServiceHost.exe	136
PID 6872 wrote to memory of 7740	6872	ServiceHost.exe	138
PID 7740 wrote to memory of 7116	7740	updater.exe	140
PID 7740 wrote to memory of 6936	7740	updater.exe	142
PID 3972 wrote to memory of 8232	3972	firefox.exe	145
PID 3972 wrote to memory of 8232	3972	firefox.exe	145
PID 3972 wrote to memory of 8232	3972	firefox.exe	145
PID 3972 wrote to memory of 8232	3972	firefox.exe	145
PID 3972 wrote to memory of 6512	3972	firefox.exe	146
PID 3972 wrote to memory of 6512	3972	firefox.exe	146
PID 3972 wrote to memory of 6512	3972	firefox.exe	146
PID 3972 wrote to memory of 6512	3972	firefox.exe	146
PID 3972 wrote to memory of 7808	3972	firefox.exe	147
PID 3972 wrote to memory of 7808	3972	firefox.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\The Fall Guy 2024 2160p web YTS.torrent"
1⤵
- Modifies registry class
PID:3956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27099 -prefMapHandle 1576 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {e15e3e3d-79ff-4b28-8860-db9f35bab6d8} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {8082dc3b-de10-415c-b1ae-8d11d113bfb7} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27276 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {00b4a93c-51dc-4814-98ce-be39155e5421} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27276 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {18a8c3d2-f934-4913-8698-3cbc0a646020} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 980 -prefsLen 34775 -prefMapHandle 3644 -prefMapSize 270279 -jsInitHandle 3648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2984 -initialChannelId {2cb3dd1d-e585-4d4c-8c4e-36b3a5143315} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4792 -prefsLen 34931 -prefMapHandle 4796 -prefMapSize 270279 -ipcHandle 4804 -initialChannelId {2cc6d790-fefe-4185-b9d5-215284e800c0} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5056 -prefsLen 32900 -prefMapHandle 5060 -prefMapSize 270279 -jsInitHandle 5064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5072 -initialChannelId {0e48ada7-8101-4ca7-87ab-29f1e3751093} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {5f79f0e7-4821-4622-b9d5-daece4a0c391} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {ebab3b45-3c8b-474c-afde-0e40ca3268c6} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6152 -prefsLen 33071 -prefMapHandle 6156 -prefMapSize 270279 -jsInitHandle 6160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6168 -initialChannelId {f2bb9b01-3882-47cb-97e4-aeb950e86904} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6640 -prefsLen 33071 -prefMapHandle 5140 -prefMapSize 270279 -jsInitHandle 5884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6488 -initialChannelId {c269648d-36b6-4d47-8638-ae41a2af549b} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5384 -prefsLen 36798 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5376 -initialChannelId {b3f33fe6-53ff-4274-a529-457e04f014bd} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:8232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3648 -prefsLen 36798 -prefMapHandle 4496 -prefMapSize 270279 -jsInitHandle 3336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7312 -initialChannelId {d7775b28-593c-47ec-9f62-6f7f7af2896c} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:6512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 37281 -prefMapHandle 7128 -prefMapSize 270279 -jsInitHandle 4992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9848 -initialChannelId {0b7506c3-7c2e-4440-8bce-ce0a82a80c72} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:7808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17980 -prefsLen 37281 -prefMapHandle 17864 -prefMapSize 270279 -jsInitHandle 18000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16512 -initialChannelId {88b4cec0-0c05-4001-a4cf-3b708cfdfc57} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:7132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13812 -prefsLen 37281 -prefMapHandle 13872 -prefMapSize 270279 -jsInitHandle 19704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19780 -initialChannelId {cb887baa-4b93-4e66-bcf3-4d988c9b1c11} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7572 -prefsLen 37281 -prefMapHandle 5220 -prefMapSize 270279 -jsInitHandle 6292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {967c6127-cb26-4b86-a043-cad997fe93f2} -parentPid 3972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:4396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4516

C:\Users\Admin\Downloads\btweb_installer.exe
"C:\Users\Admin\Downloads\btweb_installer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Users\Admin\AppData\Local\Temp\is-V5Z8M5JHKH.tmp\btweb_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-V5Z8M5JHKH.tmp\btweb_installer.tmp" /SL5="$401FC,930444,905216,C:\Users\Admin\Downloads\btweb_installer.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\btweb_install_rr.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\btweb_install_rr.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1052
- - C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\component0_extract\saBSI.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\component0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB InstallID=GnjW1demeOx2HvwqE1RcvauenJggf0Oxm3AuIEfhZSuR0fh1keSVcretM4ppdOS9tKfyqzCxbDyyHXoVCHu
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
      "C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true InstallID=GnjW1demeOx2HvwqE1RcvauenJggf0Oxm3AuIEfhZSuR0fh1keSVcretM4ppdOS9tKfyqzCxbDyyHXoVCHu saBsiVersion=4.1.1.865 CountryCode=GB /no_self_update
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
        
        "C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Program Files\McAfee\Temp1636499852\installer.exe
        
        "C:\Program Files\McAfee\Temp1636499852\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Modifies registry class
        
        PID:5304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 1948
    3⤵
    - Program crash
    PID:5924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 1948
    3⤵
    - Program crash
    PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1660 -ip 1660
1⤵
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1660 -ip 1660
1⤵
PID:3424

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6872
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6344
- C:\Program Files\McAfee\WebAdvisor\updater.exe
  "C:\Program Files\McAfee\WebAdvisor\updater.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:7740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )
    3⤵
    PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"
    3⤵
    PID:6936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

analyticsmanager.cab

Path C:\Program Files\McAfee\Temp1636499852\analyticsmanager.cab
Size 2.8MB
SHA256 d082eca9dc14a19e851eeb4b27344cfb86a10af4ae369f95c316954e1ec1f4c7
MD5 51b832b42a516d64b91cc8a89b852393
SHA1 d20760bef99cd11a755e8c1ad5296d0f1899e3d1
SHA512 5c894742313f6cbde64e8142a2d735405a2710441ef613be46ac7972806572fbb40dbeeefddd55a7162aef4a22741ead45eab992ae0c0b7cd1ac3c505b7b3625
SSDEEP 49152:As9JB+R/Fi7JbvwNISAlUaITzDoGWkylmm2DxJSIZw9JVX5WuXslgg+kX:AsjB+RdObYNzAD/XmmOxfuJVX5n8L7
TLSH
T1FFD533812D85C3E0F401557140D5F146A3EBEC9A68E5BCBA3C3D88A16ECBF193D63AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analyticstelemetry.cab

Path C:\Program Files\McAfee\Temp1636499852\analyticstelemetry.cab
Size 66KB
SHA256 d13d1720a8953a8a7491f2995b078ccb6aebdf26a9cf4af54eeee7bd5d32e941
MD5 ac3bf9c276ca7261e640efc3585cc167
SHA1 979280fb743df42c33b6e0dc1aaae9332c6ecbe2
SHA512 41952d6399ba871ef1d46b2feb4ac8b6b181b23d9d1e6c9fd24136044af9f71ee12891c29af7c238f59c90ba1f5f14488cb79d2c55b2ce7f2f04be6dfb6ece0a
SSDEEP 1536:2tiickTsWIuJ826OEzXNcy0CbTRRnGOZzwxsTGyP+Wz0G7ez:2tdlPpJ8zqCbd17d9TRPeGCz
TLSH
T1E063F1214E6465CC9B0AFE6830F2D727D534F794A88090D6A85E496F1FD97027CCEBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserhost.cab

Path C:\Program Files\McAfee\Temp1636499852\browserhost.cab
Size 2.0MB
SHA256 17f2dfd6e153e3211ef01fa10f794be97afc82810ee2fe33b783c7897a92b81d
MD5 5a6d1dc09ffb4bcb80bd7c8b31117235
SHA1 8e386ce74057b11e46be225cce5461f041e42ced
SHA512 937beec4373415eeca9d81d98361f7c9eaa5182070c13720cfbc42b7675514833ba1594b3ecc0513bd4393ccbbf96846a3d3ff72c21794d9ae22cb485b9c7c09
SSDEEP 49152:3iLU/yt+OwcLHhs5KceSXFfX1Gax98O4YcjEtEYR:p/7a6l1fXzA4/
TLSH
T19AA533E0AB5285C1C533D9070F7286A7A913F5BBD9F374BA50C0CF5723911A226E197D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserplugin.cab

Path C:\Program Files\McAfee\Temp1636499852\browserplugin.cab
Size 4.8MB
SHA256 fb4b6403fab3cd7ba5901ad2c56a61d0ba009c8fc9c253b3a85fd41f128eb393
MD5 ab01f64710bfb8890a62d7f1bba1d829
SHA1 52548995768215725a48be28dae3b597c49a4bad
SHA512 4e5db1cd9f1535218a30466f213dfb88823ff038f23af6403374d94ae2fc91a1a651f42a4e980640370535c9743d8faf75281391fc5719f6fe28accd0776db97
SSDEEP 98304:UkPZOaex9pjkl1F1JxJmNASEkYQZrctPk7bkAvAcRKEpR:nBOaj1F1rsN0kYQKs7bVvFwEpR
TLSH
T1223633FB80435156FA01EAF3BFE4FE2F4140232FA48119D162EDB727A39F6120699D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds_invoker.cab

Path C:\Program Files\McAfee\Temp1636499852\ds_invoker.cab
Size 3.7MB
SHA256 2aa1cad2a353b4b50e57c18d049a274d61205461537a275bbef7454393afa4d3
MD5 570c711a53eaf7045a1e98f95c3c3a62
SHA1 d49eb7bd589e21acae4b77918e46f1f01208f19c
SHA512 01888863b82df31da477b2199ec7b147c707395cbb1785d0e7620661b46d8e66cfc2c60ad880a93ea4675ca810426142127d814b4bdaeff5a56bfc4a5a081126
SSDEEP 98304:fhV5PYdZoREMu6x0su5rWP0OtoupNeJE1l:5V0ZoRJ0btmQJq
TLSH
T1580633D9517750E6F6B3F133C84919275A0617C0179B72AA46FFA2B2B74A0B40BB389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Program Files\McAfee\Temp1636499852\installer.exe
Size 3.1MB
SHA256 8ab97e61de7f76f8a44a3759263600a4c89833586b6917aeffbd02e06bc891cc
MD5 20914330ba7beaffefd4ef1b68de4a2f
SHA1 c31a5cc2c759ff5d93815918975225b6343482d1
SHA512 ff49ab4853bb9696ceef26b7da5d28a3bcf38925b7fe3ce2e7d9baa83daca9c049e76c081ca4239ca975c957104fa0c0c4d49adb0671bdf39fd27bd3f0578120
SSDEEP 49152:M4NpCMzxdocZfbIOI5LjPBOFE+rc1yc6GxGtYGAuZbL:z4cBIOI5LjkF3w1y+JuZv
TLSH
T137E58E1BB1FA40F6D876C078C903861AF7F3B41443214ADB1694566E6FBBAE44E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l10n.cab

Path C:\Program Files\McAfee\Temp1636499852\l10n.cab
Size 226KB
SHA256 c059763a1416365f31cce2e15a1b047fdb26dea50723db752f18e0356655ebca
MD5 a2722f67891303ddb4185e600ce96940
SHA1 215e07f592f5f1ecd55bf2ec144c0c4b5cf83941
SHA512 a814cd707364282903397e062ac342ed83eb2cacb3f2c9756d6ce5d514502b4398f7720c7e524851ed6a91d163038ab33230d9ca2ea350dfc569b9a8e612caf9
SSDEEP 6144:MoCFYjur5hHWpFzMtUEARQ3pGaJMqjOhuJ/AXm7Mde:aFYjfFzMDAqGGMqjMumqMU
TLSH
T1A634BDF25E4AAEECDA04C66A50224831C2529152CBD6ADC7C71F82AC2F5174F1DE7B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicmodule.cab

Path C:\Program Files\McAfee\Temp1636499852\logicmodule.cab
Size 2.3MB
SHA256 c2c4b18658c1efb388b3847ecd9bdcb086b82f5c3b51096b0fde27bbaac0c13a
MD5 0c20f740f99ce97407972c55d4e31cff
SHA1 0ef76b2414093420b272d20005902c00496e0342
SHA512 cf35599f38cc2fdeab76aa3f9bdc449aa66c81f9215cd5f3299b45db2f9da847d3ef30810f94a6302ab0c86f6f76e4c93a4815271da94c052445e66e11238d29
SSDEEP 49152:ZuEfbfR4/aJrJg/thhEou35aR6vp1Wj4xsJatEHbbnI8OOCSe41bxoGEa:JfbZ4/aJrknS3U6vbZGoE7bIYC341bx7
TLSH
T19EB5331D39F8D910FF1C656AA4C89377E271F56B62A7F0EA0257080645A70436E3FAEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicscripts.cab

Path C:\Program Files\McAfee\Temp1636499852\logicscripts.cab
Size 68KB
SHA256 4a5ae098afb6d9665be5ddacaeb271f4680ac80518fabaf27016e567c9dcc0d1
MD5 e1154acb0c282ff124edaf195a8f38de
SHA1 b53b2f91efbef4192640e58c57c9de377c0b21fa
SHA512 0927995e39eafd780e96e63885afe58294ed5a70762da9caeed866a36410e84df6e59032bf8110bc8b94127fd59c584e8424edf2930dd34aef25816de07ed988
SSDEEP 1536:PQhquuGYgjt9U2ckHx9npMooQQKGhbGmG9fqsJNe78Sem:PQAuuGe2ckR9npMooPrLybezr
TLSH
T1466302A1653DBC87AE4DCDE3F0C01667F9BD918ABCF4A4D390159A0CAA443593ACF570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-mwb.cab

Path C:\Program Files\McAfee\Temp1636499852\mfw-mwb.cab
Size 20KB
SHA256 8f89478dc6614d1020e22a7a37720851549a08ba1969c136234cc4111361fa70
MD5 3b844d8f2248881956c17f8529e8b0e8
SHA1 acd1dcf1d6cd48468be073e2d4bd976541f0b6b6
SHA512 f80b605176553afd92de709c2a1bf5c8bd613a25616adbd2a29d3abef44c5b38b79e568e0865d4e7e2bf6250185b55346831b7ff6680ace1a0fba21a90bfc728
SSDEEP 384:WnQyU4GTXsegIDz0QPB/M7oHkP++C/ytWACrGp+6ki29d1ikkqZgGy8RbmL4nNyM:WQzZg+PB/MUkfCKtbf2PssF5AL+cS
TLSH
T15692AE3649201643FF479CB6F0E09827AD38A2567AF090D3A261892C5B943C23BDD1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-nps.cab

Path C:\Program Files\McAfee\Temp1636499852\mfw-nps.cab
Size 22KB
SHA256 d990b001e68114cf7c5d31adaebcbccb8b0210e6a5699985e27c9984e95210b3
MD5 a3e6a96e443574cccf204c3a79b6b19c
SHA1 3cac70b0f36c42bfcaa94802c13740d07487a696
SHA512 99742c84b298d5c9445f9e325f92483b54959d71d8426e49e15c863dd921c661e2b7195f074a4fa97364d69afeab641e0315221487f56c11b028b669f62ba156
SSDEEP 384:nFD7V4vuZTVdUs5pUWPfOW0kr/6ki29d1ikh2y8RbmL4nNy6mTQH:nt7V4vuBDn6WzU2PsF5AL3UH
TLSH
T144A2BFE24C940483EEC7BC31F0C0552399392395ADF4ECD39566D26A0F593D36ADA49E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-webadvisor.cab

Path C:\Program Files\McAfee\Temp1636499852\mfw-webadvisor.cab
Size 701KB
SHA256 6528005933dcaba451bd60c2fbeb39f3e8a280e6a17ee030bd235df317b4a56c
MD5 5e7d4cc018806cfab14ada0a97c530df
SHA1 fc374f5db43e45e7355a733f82a1f5c472c871f7
SHA512 a0bd82a7fddf8724ab7e7609e39a7f710298025da31831cb7413de2c9ac89d18491e669c8d2487d2bab1a3a4b645e17823b81083d57419cd7f86ad336bcbd0b9
SSDEEP 12288:4k3TDTeekS9Of8wqlwK2yq8P8n+NS2+UPGHUfLtHO1XG:4GTDTebfywK2yq8kn+Kh0ztHZ
TLSH
T101E42332AEA29F4BED2AE570B19C3E357B1E1ED7304109D43153A32D957368738A7934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw.cab

Path C:\Program Files\McAfee\Temp1636499852\mfw.cab
Size 786KB
SHA256 1c73bc42ee0b439974a05e3c635cb6b901fbc34432d714e328f90b26cb27a984
MD5 641b6a5c8d3947192332d2e505a64c66
SHA1 3d1207f0745c7ab64c56da464c1a9cb91cb78f04
SHA512 1bd2a29655ceab55dd3bd662e6c578c491edb483757216b957090fdd8c1aae537dcc5bc5df19e9178cd4f2980bc27ebe6bac3268d57c1088e8c853950480081c
SSDEEP 12288:HFuaDc/VLpUgp6KLQsrz9FhWW6SsKbUymjI5KDqz6Cro5OJO1u8BanQd:02QV9UgpnpYN3yK+L6X5cAp
TLSH
T16D05230151F71F577E099A783E5D0E73DE8ABEBB2E962CCE2787080462434616DBE385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resourcedll.cab

Path C:\Program Files\McAfee\Temp1636499852\resourcedll.cab
Size 37KB
SHA256 16cfea49ef5a6d963aa2c5289976aa0d81c7c65955ca071898d716858a03ffbc
MD5 40e4ad57592cf3c3a7eba9c37a3ce525
SHA1 0e1d9394977502a39ca8565579829af30b1cbc52
SHA512 cf420784d0129a7802345351d84621f077705fec8ac802c1b26feb47d78bd642e52e4f0af0199780800ad7231d110c6e5455a2df3190f6ff6a9f5a38a2bb4bbb
SSDEEP 768:50Yks1lE47nrP0oiZtDHZh8oOtRN1ZZTOg7pcVQbB2PsG5ALhN:2M1SirniZmTjj68pcgB7jN
TLSH
T18503E1B71A5E090BFDB75C2470D880A79E79F1592DD4B0A261AEC364CBC43C52F6D2AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicehost.cab

Path C:\Program Files\McAfee\Temp1636499852\servicehost.cab
Size 331KB
SHA256 4eae6096e35cc1cc7d82b16d5f455e16e985794dcedf5343742dd572713926a7
MD5 5378e2d1e038fbc0f5617c45f9e0e628
SHA1 96c26d4c55c52a2b7d2165344941acdc55bde8e2
SHA512 c4052207781a4fa4efd45a88c4ac8538598af0aac2c9cb0eb012bfc539742dc35291e2e9fe4026cd75c49794708459e0e446d92da67d24cb9e63a2a4639ec389
SSDEEP 6144:6kISvQsMYKnSROSLu08N2yy7v/uMjbwkFnL9SDZV2sNjBzK1CtmV174TQK88gTss:DISv5n1Rb78e7Njb9dsNFVQVGTx88Du1
TLSH
T1377423CD64311A47FC4FB271A09A1B969AB003ECBA9D2386ADD18790DED03469FCD717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingmanager.cab

Path C:\Program Files\McAfee\Temp1636499852\settingmanager.cab
Size 818KB
SHA256 4655ea44d1e18fc75f50f61406330d6c33e43c121512cb8b909948bc6efe8705
MD5 1b12570892673c3a50befd5aba64ea91
SHA1 72c1fcb8aa48c536d1c9bb0dbbf76f1b303f3dcb
SHA512 7f4432843375209d68991712e7d8c9089ce1db695fff387b5adca19d7e82859979a361b79a73c9e623feafbe533140bd3f1f726a4cbbf06ddd63d873ddc7355f
SSDEEP 12288:S3CyazwqWFz3OhRC0Dqm+f9aFdOK5gfqcQ3/0N91wm2RZImKquCUHmGd:S3sqz+hR3EVEFbDMNQbhuCUHmy
TLSH
T1D10523F94708077DB9DB6B2C40552A864D78EFF79FB4C1771AB81800E096B98B84F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskmanager.cab

Path C:\Program Files\McAfee\Temp1636499852\taskmanager.cab
Size 3.7MB
SHA256 739fd841e011f54ef66186d42a4ae6e65459723d9326e24d5dcc57e3068801a9
MD5 4ea9b48d56aff2e7cba3a8f4d2795375
SHA1 02146609d08b386a685adc534d49d8cc4091b940
SHA512 142fad22fdc6fa26c32646e3979efd7217b403f66ed12495dfb3b9fdd5a5e449de4e7a11857c88e3bce2dbf932e75042fa3c1b17aa9e9842054316e8ef37a907
SSDEEP 98304:Zpx08sXRzH6l7xktSyz1euCm8WnjQyW455QL8LnxeS:T4S/yzMG8AjPEqxp
TLSH
T1E00633D5319ECB9B8F4279415690339CF5339032B82542FB9A3EF26D5B8BFB32A49405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uihost.cab

Path C:\Program Files\McAfee\Temp1636499852\uihost.cab
Size 399KB
SHA256 735bca069ad9c98fa10787ec008402eec3bc7a17aedd011404fec76933e71dff
MD5 cb70cf897738c9337a07a1136f25762f
SHA1 3b895f3f69f0654e2307b75773c251abdf6ada84
SHA512 043c00e24a2b9068cb2cd6fe67447aea2a4f5d5a9250a86fddc0a8e1cf76173910088bb0e97964462d9163eb6fbb461ae8921305f78d0a6b733cbabdb0c1d4a4
SSDEEP 12288:R0YXwNdFWr1dMThOnxu7t3OF605QTPmiei/:R07N7WxSQS3W6AQTmil/
TLSH
T1C69423ED15607C9A4CC764382291D262ED76A3096F6C91E0B3FE0D177A863906CF21FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uimanager.cab

Path C:\Program Files\McAfee\Temp1636499852\uimanager.cab
Size 4.8MB
SHA256 6f53488adf7cbfd7e784b0170fe0c971f51918719617847a0525a6a8a49bfdd2
MD5 1d20ac7e08d6165d9011bef3faafe9cf
SHA1 0b7b414d3185a22d86130b68013739c0a07bd49c
SHA512 0e06a04940e4f263499529a1f8f0e546ee6ccc47606cffa6e6f849739affcf4547e49e11d4d55cdfdd55ac33ae57e4a4d8bc224d523b9c988bc88bfb32e35da4
SSDEEP 98304:wlqyHVsQyMHoxQ131kXftIUQbgDym4Ri0UNxCvODsqoSOWTNKC+4BTb9+mAlhphl:wJuQyaV1FU6EOiN+cTNd+L1Nb7
TLSH
T1B536332A073E0CA154272CAABC9FFDF726854982014DF599E6B2F7D4851679B1FBC083
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstaller.cab

Path C:\Program Files\McAfee\Temp1636499852\uninstaller.cab
Size 1.1MB
SHA256 7ec55f7397ee3346b6e624f1c316889ecf65390397ce020a374b4f1cf47148bd
MD5 d836841ff9fc0d402957673d4e348b7a
SHA1 58a78b0a7c9a46c8fdfe4a9a2ce3364e661a19f4
SHA512 b74866600069d6b7b133809c59b30457edb62585bfc39c292dd325976354be4a52ee4ab44617a45544c6e9ba7bbaacc8a97c1cfa6d3607ab9e34d56883c528d1
SSDEEP 24576:DUOCepNnokLXoAWG7hAMRSg9Y5mI5gXvzigCuNaZJ1h6EALCR:DUOCepNnPXRtxYg9kmI5KziJwaZJ1YE7
TLSH
T1483533890B3574E18BBCCCD99B22AD369EAF11772ECC679109894CCF133CBD9125985B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.cab

Path C:\Program Files\McAfee\Temp1636499852\updater.cab
Size 999KB
SHA256 0d19cfcbf00a2c3c7913a77e696aff8573e9f2bdb2b9dc4a9b0e2d6441d836aa
MD5 c5ccb5fae01172c5918dbd2f93ac17c2
SHA1 3eda615e1fcb8e1f0933e2ad91bd059c052e872f
SHA512 b53040f5afa6da6b880dd5caa558a512e4fde8dd0099ea38d2ad2c269afa37571ab30dc8173e96a59701d70892f5f36843272ab3876af4f411588d29b10521ee
SSDEEP 24576:o/N3wq/6M26QCk7iyooXOMcNGDAo1orIS5u:o/hwq/8Ik7iyoo+fo1z
TLSH
T13A2533E2615988D0A7B2C2247E9F1769C72D7D811C287A515F8086FF3A81A0FD3DED63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webadvisor.cab

Path C:\Program Files\McAfee\Temp1636499852\webadvisor.cab
Size 11KB
SHA256 d2377fbbb8ee38ab139b3aad9e95546a78c44a78b646b59ca2c45c2ceec03833
MD5 361bb982014f052be428c61c08acca82
SHA1 eb98d3e41f252d576c6dfb71c14e5086e1e7f7b0
SHA512 7524e3e3c5b8c8d57b58161944508a4a85788b46e3e80cddb6d1e08fc394cc54214c0d81c786d5ece207f51fc97522d82cf69f85eb67cbd785212b3190ed8a8d
SSDEEP 192:FxS5kiXK9r6kSDnicM9Lx76iiX0iqtX05TAULc8pq8RuwdmL4pUQrNymDGORU:FxS5ki69r6ki29d1ikbOfy8RbmL4nNyH
TLSH
T1FE326B6348641C03EE87ADB5F0D499139D74E3C62DE9E0D3B46A82641BC43923FDE29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.cab

Path C:\Program Files\McAfee\Temp1636499852\wssdep.cab
Size 575KB
SHA256 adb75fe8f8f474b38e1499ef53aaad1d56f72cb48c3b78bf21897cf12e258cc6
MD5 e6ba44a5e6f6fee1845be3d053e80846
SHA1 7e20aabb4eb254e671bbf09989a0476591daca5c
SHA512 4b72170ef9fe942071969c12a0eddeacc712a9c25eaa8f6bbee234e31d7eb3eb3264eed17f3b601f5fd6ccd03bf7966eeccaa333bbacab0006309d7549287a0e
SSDEEP 12288:CxrCA8jXw7ubhWVcReV87FDd/iPMRfFk3Cpb7j5Wp/qa0DA:B7Xw7qWmMV87FRa8Npb7joAa0M
TLSH
T17BC423B1A5348B472A91415372266056F0209BD3DECD74C60914EFEFA3563E82FE1AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataConfig.cab

Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
Size 79KB
SHA256 953708c221f4508bf6dad28e4221d3dc1f0d8b5b3e23600c187acee3803a45f6
MD5 b227f9f832673658423871ea9df95563
SHA1 7370120147da7cb94aa66290aaf32477318b32f0
SHA512 bf4dc351012c94012189ba16c48570915787419e7a9a0bb30b9a576d167e9ce5936cbc5dc6d7ff0c627a2d7547afa9ed16a8bcbad2b57da3c2243931819060cb
SSDEEP 1536:KHcDqgVhiUuNjTCxHG8JQDgtgnbZk+n2OGtfgstZ9v56jMs2+g2mIGPHCqCEuFaR:KHcDqgVhBuNjTCxlm16+2OAYsJv56jM3
TLSH
T1468301439D683853CE46EC75B1C8FCA36DB0A2A718C484D35215C49D6E493E2ABEA12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceHost.exe

Path C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
Size 947KB
SHA256 33e92f4795fe90989dc739bd645d970ed0345492e48756acef34cfe30fd1eeab
MD5 a923219b13f4e99fbbddd946f18bd9ba
SHA1 e61c19190442ef97b9cf0b68439f3407457b9b25
SHA512 86028026f24095629fdd04e5e6612e4070c74c3a0b932796479e248f99a11cf82c783177b897537af89e04b355bd839cd8890274b85cd18a5e6c5abdcfd31452
SSDEEP 12288:oJ2ypAo34+GYdD/9vJKztzrfGg/wVMRZGfoYiMUSBedpo/fnyDgN:K2ypA843YbwROkwVMRZg4SBedpuvmE
TLSH
T193257B2FDB9862FDC5B1D2B9C6425A01FA71B40A536165CF07A044A67F7B6E00E7E323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analyticsmanager.dll

Path C:\Program Files\McAfee\WebAdvisor\analyticsmanager.dll
Size 9.1MB
SHA256 ad472d4c99f5884af2fb15c7abdc78cd5305999e5d18ff98f38d68c7ba594cc4
MD5 a99d568e16cc7f33228326b16a170249
SHA1 3d3042092ae1835f4cecf2917734983cbc6ff0d5
SHA512 2c3d826f289734725772dd2519d289a7ce8d94929d52e26ba4ed0449795620b8f7d3e0db02acea8cd49ea3598c49beb22738470517005f01ffa2a637f674dcce
SSDEEP 98304:ZRnDyiX8iZt1VCMjADEXHIEg/VGCzR7fAKlNyWdQCEB3/q+i:ZRnvsipVCMjkmdCz1fAKmJS+i
TLSH
T109A66C47F6BA00E5C8FAC1388A576227FAB2BC55473097DB0694562A0F73BF0A63D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsEventsConfig.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsEventsConfig.luc
Size 12KB
SHA256 5ccfafb7f2f93c07c83cfd4ed624003e53e8c8dfc482d1ef4be64e25a84db143
MD5 ecd5c5a72af080405a5c542e14731368
SHA1 7cb51ce209677373b02906491ca74a0320ffd777
SHA512 81d0683211cd9df506be77da7ac339f79bb07f0b9ced210ca11c54addb33fdfe9f391acd5fc70ced4c70a5205c094de9f7c74647321e3411c8597e7a1c9e2258
SSDEEP 192:GbCOwwmJ3rA8ygkZ0pov0gxs/wSgqucppFv3F1H3c1Ft2l+Q0l:5dZ3s8ygk2p34Sgqucppd3Ft3c1n2l+J
TLSH
T14C4294AA5FBE6A6DFEBFC2DD5AF006E409304989B0C005F687AD8D5401C35654FAA70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsTelemetryHandler.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsTelemetryHandler.luc
Size 2KB
SHA256 7b2b11fa9299cc39415859d157b8f7ff8422a7be37bb2663d9f12d412af6bda8
MD5 c55de98acc712c329e88b21cae2ce813
SHA1 9bdd2b5084fc528afc787a1ea03da077dc6927c1
SHA512 01659464f81821fa16e4f12a35d97bb25007a7c2c40fcf7fc000ab2f8aad148a50450221b64f509b9350b64395155ac78e30ae8ccb17ac53d2e1633577fe4e31
TLSH
T19C416549F90C54955536528F6793DF05E3B0DFADB312C1A390827FBE4095234FAC7259
MD5 SHA1 SHA512 TLSH

Submit Download

class.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\class.luc
Size 656B
SHA256 7151e08f52ee2f12197ef167e425ecb8f71eae3dbce1d55050474aed801f36ee
MD5 3e855c4ef0b39f8200de2b70c0fd04d3
SHA1 880a88291da529c147a22772ba698c34518211d8
SHA512 b41fc32f5663b3eb7827986db4f5854a5408a636e8235e27e7d5ada5a1c352965af228f148513bf47a764788b04b997cd6c0cb751be8009fd788aced9f9466ba
TLSH
T1AAF0D3AD26DC7157B41EC111449B9D109990DD168F26432B5353C1ADDE33649171FFCD
MD5 SHA1 SHA512 TLSH

Submit Download

dkjson.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\dkjson.luc
Size 9KB
SHA256 891a7b9d927bc4912aca3463ef788659330d154c6cd0ac854c183845d89b05d3
MD5 21c79b28ca14d5d083e7479af9a1c6ec
SHA1 3f54fa48e61f326eca4a6bc22b5d4d3c66915af5
SHA512 df4e1b3ade5d2d05f25346c5c3894920a176c18fb87f517272a77558ee5b3239c6b0489e26fbec990b58d5d408c6424787e7e74f60a8931e35657cfe92d0cde7
SSDEEP 192:jWXBkgh/3g7O7qaNfEyc80vDGwVd4Wog1DYEZpQ7+hC+Tf8IkZ0JOWeV:ckgBGO7q8RcTvf7xNZUq/eV
TLSH
T1C022E91F92C81B57753ED03A9A72CF34A6905C1EFF124F4B612A96B1F55221C9BC638C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logger.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\logger.luc
Size 699B
SHA256 dd4624972533c5a4fe3567465c84000e0437ecc57c86296f36141924936d71a5
MD5 990847ca884fe1db980501f51b351c7f
SHA1 14969a692534c14ce576a7907a2813bfc75b3fc1
SHA512 e5435ade14609e21574ec639eed5887003052ddd4800945e9061a05b73a6a761ccaa5f5a96914f8705f52af7465ab9d14b749ef9dccb9814ccbe3a229d3b6878
TLSH
T1BC01C5062AF9145FC121E74B5415B7D56D30B8867305CB1E460576A506402D1DFD73ED
MD5 SHA1 SHA512 TLSH

Submit Download

settingmanager.dll

Path C:\Program Files\McAfee\WebAdvisor\settingmanager.dll
Size 2.0MB
SHA256 215cbf16e52edce65a5435a624bfcb1601b0df3a35f3fd7db652183322480efe
MD5 5e2ad130d4375ef777a9f7ad7dc83da8
SHA1 d62b8a74fe3f696b9982d3cc3edf3273d4439eeb
SHA512 3a4a8576dfa9d28c1978d9bca2058028f7e62381bf33dabd2a0de7dd095f3df1c98a28e01cc5f8ef54c9e783fc10e31db11dc342b9656bd277bc8b1ed9fd3eec
SSDEEP 49152:j0avIJ/fVdycecTOhrievxF5aMiaUHH/CY5r:v2/fVdCg4JKaG1r
TLSH
T1EBA57C1BA3AB80F9DCA6D1B4C9078517EBB2B446476056DB02A44A5D2FB77F04A3D33C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskmanager.dll

Path C:\Program Files\McAfee\WebAdvisor\taskmanager.dll
Size 7.4MB
SHA256 a4eb29f496c169afc7647379ff96a52c219e410ad2ab073d2e145f7c4641475c
MD5 618198008907d6c575b0a03abbb637ca
SHA1 a987b92a01ca09f1d5f2858f663af046b6af6574
SHA512 a202ce0fdc385afe259b7ade66632117d6209dbc71a7b7c49e7d3313bfab6d7faa4a55975e6789309f16af0fae96cfe109b2f6bb495fc4929cc84261c9e4ed94
SSDEEP 49152:SPiZP+xuoSOqPWFE5bM7kY1kFS+rGvf8tvFX5AKd3uPDgWMMAyvk8oNwsAuOGG2Y:3ODMxYaSU7pp4oNwb2KVCZGe5EDZPN
TLSH
T1BF765A47F6BA50E1C8BAC134CA132223FAB1B8558334A7D74694662E4F73BF0963D758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.dll

Path C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
Size 785KB
SHA256 e81639145340ee162222bb469c459f2098c38844882fbe4016acf2e099e3a3dc
MD5 28e52c6ccfc7a24269098427256c21fc
SHA1 2a103fc470e9d8a3180f2dd0980e81c3bfa01a84
SHA512 c87cddefd71132d56a57f701655d6f0ef25919fb929c32bc7877f679ce82a62ba8ff7159a847d9e09e7689755a83b326c2cf21de79f0ba94b323dfdbc4452b7b
SSDEEP 12288:gSMUeSJFVwoykQGh5YHWSGBjfWeVoNEOPgdZo:gSbRJFBykQ8YHWvFWeVKEOPgk
TLSH
T1C2056C1A7BAC41B5E1B7C17AC9578A1AF7B278151B319BCF0260826E1F377E50E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 703235106a5038e173f2dfd734f9715401d463288d5739562ecf1ab07bb51e9c
MD5 429236b0a4736a7d56f8b7bcfbe1a194
SHA1 29f4e49b649ba7485b5ceba966e89c641fc4b372
SHA512 a2e417dc49f1253403984db4df9de3f3313c2873ebc5c6e3cf98b07f41359e4a059277b952d4f0a5981a1298cab2b932b8f0a257f360f3658b37a61a5e97714d
TLSH
T1D2312546B8AD8E2DB5D1C874E9E0847C582D0719ACABAF38647C61CC46056EDBB3C5F4
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 fade4a210eb2671e43bf4b23760ce1b8944a97556b0de06b376f39e7d745e20a
MD5 b176635714b22cb0d5eb3a6aa2099dda
SHA1 d7278ed02748d12d85f1cf932f826c0fb214c413
SHA512 aaf91d5716c5d35a39c467f374ac42ee9a2176c8a707e0235d092a621108a090eb7d6a1a8df7d228d195608dec5ed11ea59edb086597a6ab47b55ae46266f79b
SSDEEP 24:wMFtdFtRKFtFVG6dQYFtQJnzVGQsYsFQa+Ft3VG+YsFrpFtr2Ftr2FtrAVGrzBFi:tblTs+VG5iw
TLSH
T17791E74AB9AD8D3DB5D0CC78FDE1847C14290711ACA7EF38A47C61888605AEDA73C6F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 9eddaed2248fdda1ca6ffa7218148803e9edd5ed10cd95080bbf29f65549ca75
MD5 3a07f73b674e1e38a2aa43aa812c6360
SHA1 6711f9a55f8425d1bfa49ad3cd214d7b28bf829e
SHA512 358a21224b07b79bfd2e2c1f1d7c4898d12199230cc5dbfd1bc09de933b92042ec37c4179548cd14a8537aed2cb7d0dede3b07cab4f695628923bf60cd53e78f
SSDEEP 24:w9FtfSFt3FtkVGPdQKFtKFt5FtMVGndyFtOXFtRFt2VGFdPXFtajFthFttQVGVdg:gOWC4
TLSH
T19C91F446A9AD4E3DB5D0CC70FED1887C34290715AC9BAF34A87C618C86156EDB3386F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 8KB
SHA256 4c3275822610153569dc48c2c4b3e6a14900b09d8676ff199647d5e4c3865985
MD5 5ac3cb3deff5d198b30150d352ecb5ec
SHA1 56c17a5ef5841fa283006b949765d7922140b949
SHA512 f1c2b6fd5472a9c3599eee1e5804e022e182fafb51fe43cc2b78ff37500867f747201002cd7c0df00356797e7fad985d96aafad6853dffa8bcad30b6f3b54814
SSDEEP 24:w9FtfSFt3FtkVGPdQKFtKFt5FtMVGndyFtOXFtRFt2VGFdPXFtajFthFttQVGVd7:gOWCmSFqfge4
TLSH
T14702054AA9AD4E3DB5D0CC74FED1887C24290715AC9BAF34A4BC618C86456EDB33C6F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 b93c9042cb3e3eb3bd18a175cdfdefc9d0069d04a6062cac7a3019715afec02b
MD5 89a03dcfb7af410fb539b250e8360753
SHA1 230aa03e2cb8a1bcc87c2ea88d38b2ceaa8f3584
SHA512 1e71391f2ba2e50d7f7b3119c1b04864e983d595ca71027cf8ad28a7a441df815ceb8b0edfdc6b176628a45735d285ad49b2efbef3b9f1de1f90407cc708999c
TLSH
T1B4215A85B97DC92FA5E2C871F9B4C4BC2839072EAD9B9F3D607C208C060559A37BD5A4
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00200057003F001D0006.txt
Size 302B
SHA256 2e2e356d129380ac5693f107a5a7dd776ebed1da9dba569ed20b15b787625b3e
MD5 e27cf9b4cf794ae5e0fb09c49656c325
SHA1 0a94082b0f75af6dd51462957390846abde4a83e
SHA512 c46e4430aaf5cadbcdd4f06e9e433fd492b87718fc32715d9cc12ed87ec818c8da11b4399b1972226072ee49b54fa5340b8480a4162b7cd81018d02457d3150e
TLSH
T1AEE0CD54BD1B755560FAD470F1C5403F8DCF850F402114FC652571451FB197E342F462
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
Size 33.5MB
SHA256 000e31921a46aa4d198bb6d3ca6c695780ddd4a4aafe0a6909b072a27b056217
MD5 46e2cd9e7a3224d3e49ff41087495453
SHA1 a8e24f6a7c421698b80c3543ff6361bb14b9d294
SHA512 e98046d2f33d0a6e87011f809fb0dedb0c4351053bb150ebf2228e08343da2617413fb9eb6963a567d130eb80e41f1a2edd6f02bfffb75237372197249400fd1
SSDEEP 786432:4nk9D1uMJGqmZoZ2qiKMXr+qaO+FuUHVzzs/HSba+Eo1jsuN:JsMJ/x2PKMb/aO9UlssPY6
TLSH
T1A077339E616649FBE00648346E14231DE3753D3603855FDFBA98A2AF6EF71900EB7E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
Size 1.5MB
SHA256 5ec42b168f2541dbb413d6f87aa5569470a2b0c6c574c3e655242461a4524763
MD5 7a1b6316d5d64a740b847d8261ea3e83
SHA1 e130deed179693218679e09f0eef6fb33c369146
SHA512 355f190eb5c83b14ea7ca19c901ff9124962a25f78ff03f1bc9f09387751f8def203e47f017ac0bd295c70ace8efbdc5f193d92d67207329aa1db4dbd0cc7183
SSDEEP 24576:8Vxe28BXUGuG2bjI+O5IRumwloSRB0nPUa6xDuC4d+bk+2miTwX/yQw01:8Vxeyk+tWoS/0PUa6xDv40bk+BiTwXF5
TLSH
T142757C133283C031EC6211B08969DFAB86ADB4345B6148DB67D06E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\activity-stream.contile.json
Size 4KB
SHA256 77f18bf3e1644393d16e64a43f73ecd8cb1fcb88f0d390e7fff922c2f11d68c1
MD5 6e3c53315a84b08ca0c4e949b5b7a40c
SHA1 8805b2742f790b658a82a95ffce8f6062c64a047
SHA512 2f1960a6670bf3e8c75ebaa0c401c7bb62b7f98881dab304d89a27c91b824f88b8b41e537fe82da0846b067df5571ea927c5969d2f2fb3d53eb6c87679df1c0e
SSDEEP 96:Tm2fs8Df/Vp3V4zlYcT+mR/VrHKY9cKnMz6Y6DxVFol:1XnVp3V4zlumR/VrtkFwxV6l
TLSH
T1FBA1E7BB99A5C5930721BBF27C5A3799B04B710ECDE9CA46BBD9CC1095E430780EF681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 bf7754160e9269a4596980927b2fe6e47bd9767d1ed275f5dc063c18cb9efe45
MD5 fea2a0116124d4111ee1403f4a1a2006
SHA1 8df0a606a309b05bf5a79d2c38bf2813a79f331d
SHA512 d49caa0051c9dcfda081b6e5e93b58a65bd3d16908e6a1a848f12f9a4a4ac8e2656632f12164774f57943bdc59e4245777e5536eead2487efe5036af658f3ce3
SSDEEP 384:H9XghOiO024YQdcs3hk2nhfdDE2Ba/rIVy8ecJJ:dX+ZYQdv3hk2nhfS2sDIVy8l
TLSH
T1DC729EBF9F016C591967D585C8BD9369ED14F9BBCBF690A608203449CB84326B0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BDE1A605A5721FE09FC45F211341A7D9D09B75D5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\BDE1A605A5721FE09FC45F211341A7D9D09B75D5
Size 383KB
SHA256 926d2ce34f68b6cb34a419d7540a4e62d788caaef0051ad002549095aa98e6ae
MD5 8151702e25aeb994e4974160a7e459ee
SHA1 e912fb0eeb9d1892bc2ff852ecd2a3a53345e840
SHA512 b5b3adf09f8c82fa70d0cd84418ff270e057bafbbd651b0d6d545484e179fc6d66a625d5de0a695e5853ca86c52a1e7ea59bfabbf93daeddee49119e8ec8010e
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKW31:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7eQ
TLSH
T1088423FEA074A8892A0565A09B2D9F05F4F74357CDD8E3D4C9F1BCA0E8C81F6E15842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D857035E02EE4ADBF0953043D6AD91E2C0861331

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\D857035E02EE4ADBF0953043D6AD91E2C0861331
Size 94KB
SHA256 e1c15c80bfacc164de931c8f477b8f5df4c1bce3ba3e9956fbec0351566b4714
MD5 a75bae4bb7fa7ccfbee9f4a8c6028fc5
SHA1 4cad4e37b71903533a4c2434e861a0c4ca0abb85
SHA512 0c3a9cd43de649187ac6a0ab54859defbc6a8b28a1a7d901fd6d8732d3dca78b6c6c9ccd01fdd9088fd3e0ec739627cdd1636a1094b38b204370dd8a66e1f2e2
SSDEEP 1536:/l+EeYdDVK3EUC37Qwecq2Uf7FUzkgIOVyKvY1hTo27r7pcd4GFgb+YryRuAdfm8:/veYdxtUCcwDqTazjIrt1hT5NmqbhrUB
TLSH
T19F9312372F8D5C729AD48FA05E27A08E2D909B13F18654BE5AF01614D4BCE38FE921C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fcd0b98-10af-4d8d-91bb-f05e2036ad01.zip

Path C:\Users\Admin\AppData\Local\Temp\5fcd0b98-10af-4d8d-91bb-f05e2036ad01.zip
Size 3.7MB
SHA256 fa4bb42248df1a52130e8be56d582f50e1ab0bdc25c23f6d9f7e828a1f4045a8
MD5 1eafccfc48eb1e70528e63d20d6c012a
SHA1 43c571e55fba742938fec9b6d3fc9958f6a518f3
SHA512 9546855a178ebe36645573326dd6fbb5b09cf4453d499a5239a52dbf447555877b005fc36d0223541a838c0e459b86f76f087187bf1d53138b2d2e9f9e86528e
SSDEEP 49152:lhXF3Mp5f9e1lmgt+m33JFb35sYNg0BoysGGvK5qUC4GSoaHDxcOkBhMOSMLsUW5:lhXlmH4/35jVEvK5JC4ZHxivLsUWwCJ
TLSH
T1E706DF35D6DC1F08C98F83BA873C2F82987C4F66B057AB6F6A6E9D715CA31D21B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

106.png

Path C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\106.png
Size 47KB
SHA256 0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
MD5 4cfff8dc30d353cd3d215fd3a5dbac24
SHA1 0f4f73f0dddc75f3506e026ef53c45c6fafbc87e
SHA512 9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139
SSDEEP 768:RtwR1Dy4rQznr1GYfvLn6froelhVNSyCPtSOeVlTTqYueg:zwR1DybhPwhvSyClSOk/geg
TLSH
T18623F1618E36D41ED38BE69B1F1D9824277AF197F59C1673866879230C039ADCC1DCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

107.png

Path C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\107.png
Size 152KB
SHA256 2f116cdef55e05549d6f06913afe39a91b715b188e110188c7fbf7f5eb69b318
MD5 4e2421d76f1b0c5627f732d4e945a023
SHA1 89e3de5bcbfe50c18f17b5ee731dd24213f1812d
SHA512 13c97b5ec52344b605d1b9658dbe15ca05841fdb786f2e06ab52a4f80ca6398adfa7c0dda304ec343ab733df85d9a9da29012ac21d96e680a19ecbbfeb0b9001
SSDEEP 3072:zkL8PqE1l4NJoxLiog7R+1tNx+ZEaLbplAfkFO/lb95N:zFowWo7tv8bpyp9j
TLSH
T138E3121A702324BAB44EF4D6F1DB65C2EC22AAFD214D10A7D79A5C7428C0B66FC5D2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

108.png

Path C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\108.png
Size 51KB
SHA256 35bbd8f390865173d65ba2f38320a04755541a0783e9f825fdb9862f80d97aa9
MD5 aee8e80b35dcb3cf2a5733ba99231560
SHA1 7bcf9feb3094b7d79d080597b56a18da5144ca7b
SHA512 dcd84221571bf809107f7aeaf94bab2f494ea0431b9dadb97feed63074322d1cf0446dbd52429a70186d3ecd631fb409102afcf7e11713e9c1041caacdb8b976
SSDEEP 1536:GcHlp3vMusTtWEgKqx8zHom+GChNPDViFKWUyG:Ggz3kTNgKq66VcFKW9G
TLSH
T1A93302FD07B84A1DFB0447B12014CBFF5AA231DBC13E163A69E7691CA9AF1353224167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btweb_install_rr.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\btweb_install_rr.exe
Size 20.7MB
SHA256 417f5b1165bbbc6b13b897402c66686bdb363ad0ba469214e669114724a42eee
MD5 3bc613bf0c7b72311ed2d9a1662460fa
SHA1 64386393034c4634222bb6b0c23efe148ba1abad
SHA512 09769e3b7fca30f31c8499e7b9f258a49e984c687317c86ee2b1ad912bdb9ad3911cca4790896cd3ec6f152781b49baa46d05cf40e248791d9d51427a9e78e5d
SSDEEP 393216:1GK65jo8j14/Nu8qq2m3BSfWExFwI0hGQeBa+FcazaN5KA4nICZ8aTJqG8p5Z:1GV5jo8Ruu+SfWUsc/7WNvK8KoG8Z
TLSH
T19927339F3AB64AD8F0B9A1F6C405F5163CE0B3EB26B64C43D390B45D4FAD492257920B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component0.zip

Path C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\component0.zip
Size 515KB
SHA256 cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
MD5 f68008b70822bd28c82d13a289deb418
SHA1 06abbe109ba6dfd4153d76cd65bfffae129c41d8
SHA512 fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253
SSDEEP 12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
TLSH
T1C8B4237E2323A734A201E7A425373B520A1E63C6733C15EB7EC1AB927D3053D76A456B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IYPJBD67WT.tmp\component0_extract\saBSI.exe
Size 1.1MB
SHA256 f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
MD5 143255618462a577de27286a272584e1
SHA1 efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA512 c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9
SSDEEP 24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
TLSH
T1D2458D317586C031E1A211B219F9EBA585ADB8359F7244CBB7C05F2ED930AD25E36F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btweb_installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-V5Z8M5JHKH.tmp\btweb_installer.tmp
Size 4.2MB
SHA256 9cb0eabb0a6e9f3f07844bf753d81708213b11d6586238da01ed4e37ecfcc2bd
MD5 8fbd0d0d3eec5b6a5d98a2ea977ec53a
SHA1 27a4627737d5b6bc07744cf07f62aea35ccd4cc1
SHA512 c76658f8d875eec5318dce6eb8a38f848df14c9567007f4fd174dfcc7537b3620e72c580e1105e46be229563b614d55ad878ab9307985d33fd5c0673465c8e48
SSDEEP 98304:u3U5HY/KwjoYY1j48UWm2eTMFdC+J9333s:n4/1jorPmEc
TLSH
T1F7168F03B348753EE4671A3A583FA680983F7A213A26CD4B6BF40D5C8F396416D3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwa3F32.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwa3F32.tmp
Size 135KB
SHA256 926061fc6a92079aa227cc2e426bd5b2130501422a95e6a8984f15f05dee2e70
MD5 32528f494643e0e05625d5a5b8e61263
SHA1 701eb330c5f29b2178c6196404f3bc53e297987e
SHA512 80979203400fde66bc2f5567c2cc5a60448b8336dca93b8ef7d2d77033a063a9c581b9acdb99f81c1affae5fe159f2b4bc74b842104ffbb05172cb4656ab561b
SSDEEP 3072:ppIo/Z/nT74FOGNcO7/exDn/1ISZ3kHoh3I42H01Vqx:ppb7tpssD/1IQ332H2Vqx
TLSH
T1FFD38D01B090C072E5BE19390864DF725B7EB874DF906DCB63A50B7A9E703C19E35A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwa5971.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwa5971.tmp
Size 173KB
SHA256 6dd62d41da015e4a1486a8866fcb28ac1209a552be8313dbd63e821cb46811c8
MD5 6e7f3a7401c7da1e60f5df4531738ab4
SHA1 fc6305ca9ae4023d45ca8d7e67304f59a8ed2aa7
SHA512 4f6984e41b17bfe78a8d27c6fae33b3a2f7d8db3479f73ce3a1d42782db7ee029bc44b77cdc3ebe0d046e72a613ccfe406748878d5002e947cfce266cf90af41
SSDEEP 3072:1WKqE1/0WjsAGX5Gn39yf19led13p9tyDTQrf:1J1MWoAGJqe1neftyP4f
TLSH
T15C045C1BB7A400BBE577D27888930A06F777781107609B9F03A4477A5F27790AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1CB7.tmp\FindProcDLL.dll
Size 3KB
SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
MD5 b4faf654de4284a89eaf7d073e4e1e63
SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
TLSH
T1E07186BA56E54FFDD1541A3030CE7003EBDE75B416AB625AC93B261A7BD0191D83CA22
MD5 SHA1 SHA512 TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1CB7.tmp\INetC.dll
Size 24KB
SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
MD5 640bff73a5f8e37b202d911e4749b2e9
SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
TLSH
T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1CB7.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1CB7.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisFirewall.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa1CB7.tmp\nsisFirewall.dll
Size 8KB
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
TLSH
T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btweb.exe

Path C:\Users\Admin\AppData\Roaming\BitTorrent Web\btweb.exe
Size 9.1MB
SHA256 9bb31a5915ec31e9b40a0ed06a30ce58c6bae839a9f526eff29f50096cee8200
MD5 d9e181378787a6ca37e2356c86cef226
SHA1 234919a850abbc7a231ac738d6878c7a6f7c1a54
SHA512 2b2268f5c0d7af528dd6a693dc6c978dbb70f0355eb715ce34869272d3983d5f165551740c84b73ced0330b07830529e2cf897884bfb437d3dad15454fec8ab2
SSDEEP 196608:NfW/i1/tS5u1wFHmWh6cf34OU1VfAlAD08OFA79a:QUU5u1GHID08uA79a
TLSH
T1C3A67D223AD58229F5E202F2A57C6F7E8439BD394F2542DB93941A1D59306E32B31F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 20KB
SHA256 3d0b99a00480129d70fe30ccd3b2a7926384cb902d81dbaddfd534411334b751
MD5 bfe9131f33b8c0b6872ceb2a5590678d
SHA1 e9b19cffdbe382a4827838b17fb5015a655f510a
SHA512 1bc34c1b0fc8d57c02f3b534af8e66b51a096e615cbbd37b3bb5b91c0f6bfd20f0c0093083cbf7bc1b76f885dc46d712cc1119f8a934c5d18300c5d6cb11ffba
SSDEEP 96:lE/F/hH3O+xUyN9mG4IA7IRzxOTBRMsaQ2MLdbE/R9UbTIO+PSk6YwO+rC:lE9/hH3d93AqUTBRFT2a5EZ9STINwpC
TLSH
T10C9263010BF70955F6F3AB717A72BB56AB73FC119B16925E8180914D0D72B60C92EF23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 19KB
SHA256 cef7e7829a4f68ead0b4334840c92ef19aae99f9dbcc0d5e6dd2c035669f6937
MD5 268089eed9fc0e8d8560c578f47d7386
SHA1 fc77d3d42ac8aba5d0f25b571a775b8b73a4cad2
SHA512 1759f61f6ab675d581b9e7680ab9f014dafec131f00c43a9c756ad0ee8ceebac17f254516fe200f7074db2971f31a49d9c3fc85913268d4f2e50e1cc36b39210
SSDEEP 192:P0b5e//hoz94zAqUTOzRFT2nz5EZ9SczIZWwp0WJ:P0b5e/poz2zADTOzRQnz5E7Scz+WA0WJ
TLSH
T1C69254010BF70955FAF3AB71BA31BB56AB73F8119B07925E8181914D0D72B60C92EF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 10KB
SHA256 5abe64c3044fc95fe2899e53296a17e685160b145f92eadaf1f222e20f6b46b1
MD5 ee5fe87d0874597a4921ce6621317dac
SHA1 24cb279171599ed31c358a8936b2eca27a3234fb
SHA512 b846ed96b5935f6e20fc43e6b65e8c7fb25c206df9aa6ebb59a6d6512737e2f77705c7434b6426dbc647818c144067fbaf5e8ca48d919fca8c0480e2c314e69e
SSDEEP 24:suhMZiW91EIN29x7IY9BHIE9Vv9Iv5q9F55A5YIQ9FxIc9llI:KnNsWSamB+xI56xaYO8
TLSH
T17C2285E76B75A8B2F0A2CFB44058B64C8C33172519A99585CF54E0F303C1AE9913EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 26KB
SHA256 df11fa04a1648187bfa4e04843aeab2a6bccab420d01987c98bf276b50f2ac6f
MD5 fea8919483ce1494623424d43782924d
SHA1 3f4b0fa3c18e203a51f4409cab705b12053a7b86
SHA512 9809778ccfa022abcb48e674fd377c85717bc41fa21b2669f785d870105aa9cc54b6eb1ae92f40c1842c97fb893a16063dee6446651c99decc476d96fc94e3f8
SSDEEP 96:0JgM/p9+w7NJ1pr4UXAzQ+A3tFwGXUGjGaVN9OEYkAnW39:5QfhpY
TLSH
T1B8C2D8FF97796852F0928F7D1098BF8CCC332A19146887989E54E1A70382799D47EB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 26KB
SHA256 a425a5fdbd00104781309b844a67e247002e3494c7dda5791fdb92e6609d5094
MD5 4ccf9c834c41fb134356fb38b84870cc
SHA1 8551d02afd37fc55a7df86320de48c47ec203beb
SHA512 119db57a205872db86b631c31045959d49aed932dec292de6f54cdf35a68e51470d99d17a21e60ceacdab4be8157e4f405fb7c271f804b9ac7a55e41529140bd
SSDEEP 96:2yx2fTyuZfsy8tYrHS8pJI6mYgM/p9+w7NJ1pr4UXAzQ+A3tFwGXUGjGaVN9OEYc:222LZZEFttQfhpY
TLSH
T129C2CAFB5BB56852F0528FB814ACBA5CCC33162918688698DE54E4E303817A9D17FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 26KB
SHA256 492d7bbff411cd490e463ee371f67a1e105dfdba2e1f4a9a6ddb09d5ff2264dc
MD5 1d3251800cd99dbc94768b2f49d1a0a7
SHA1 97277501ac60ea2cba7f12bf75be6f4e316a7688
SHA512 bf2ce5cc77e05f15286853bba7c3f542ed487a8bd16312cb855ee84d84c2ff49a4dcea1ecbe0434d6f9367a568c642196a447d582dc39180a14add961f476001
SSDEEP 96:Cyx23zyuZ3WDy8tQkaCIpJo6yUgM/p9+w7NJ1pr4UXAzQ+A3tFwGXUGjGaVN9OET:C22DZZGDFt9QfhpY
TLSH
T154C2CAFB9BB56852F0528FBC14A8BA5CCC331629586886D8DE44E4E303817A9D17FF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\AlternateServices.bin
Size 17KB
SHA256 e31c4332b74ed403050f70a124bc107215403254f538e2629ff3af40388c06ad
MD5 a98ffe9945539ae98e3d2b8651e30ad9
SHA1 7983519d8e636cbfb4cd40610783777c8a9558a0
SHA512 04037c0c518bde8b10dae1706754676d5f07b318c4f88d64b702a3c69c773fbdf4b70946b3e0ca86a54b3315c7a41aa6ebab7a337ac9f9cb8d5578cad759538f
SSDEEP 96:Z6zHnjhBfUI56kpJYOFVzXM/p0nJFiULG88GbG2r4:aQ
TLSH
T1548286F7AB7568A2F0528FB94054B78C9C331729146896C4DE44E4E703C2BA9D13EFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 79KB
SHA256 1d61c1005d0bcf819ecf0a025a66b55ddac31760848381395ba72fd9bcc3a3c8
MD5 1dbcb9c60c98c2d0655c5be56abb2d11
SHA1 383389023887b2bfae5ddc61d44f7c629cfabd65
SHA512 f42046f17d65c1dc9a279f4eda438093ce3b8d1183539649525018a5655285a09ee77d4cd58eae02a5d065dda17d30b4109f8915505fbbc0b3f8490155d120ca
SSDEEP 1536:DsLRSLGLypq2+rs1VtSvM5TZgFrShFASAevWI7QegAdLH4OELgZwaz5KeY:DslS2y0XYFxT4rShySNWQBH0L/AdY
TLSH
T139832244EB1A553FD92803BA9CD21B003F79F8895A1A2BA7371C64782D873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 148KB
SHA256 c26209c1143ceb4cb0d5af8eabfbe311998e3bdef38c17fa20b7af8924329e1e
MD5 6e61e63abcee1ebb361dc87742e8274c
SHA1 30ec4bfb3c216253cda1912b62053499fcdcb424
SHA512 6629e97c30c14f9f23099ffa1b38398b2e23280916d5d9652b100c1aeae6780bb40125b25d154600335f876f83bfc6f0d88b43c14faba8da8619763851e4abe6
SSDEEP 3072:aslS2y0XYFxT4rShySNWQBH0L/AdZB48jNxDymfyA79v5xFl:asg2y0XYFxT4rShySNWQBH0L/AdZB48J
TLSH
T10FE35AD4DB26407BFC1085BFB495673C2625F4304A599B0B2AEC04761DCB7BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 141KB
SHA256 2d210c52ac3bed31e28152a50baaeab97489af77d5ecc4f46b1ce57cf317f86f
MD5 fbd20b658d02de5f696c19e71b2cd178
SHA1 6584e83b2dbb515e08ac375b39e47e94f45ee00e
SHA512 16c6e2a15a83300192a507a849e0e2621f487c355aa36b90447761509471a87ace53ada4541c96dfaada5b4a73506e2a414e2d52b61c26523169263c71552198
SSDEEP 3072:Q3qb4yfrVhYsvsUPk6QzlW83B48jNxDy2fyA79v5xGa:Q3S4yfrVhYsvsUPk6QzlW83B48jNxDye
TLSH
T17FE36AD4DB26407BFC1085BFB495673C2621F4314A599B0B2AEC04761DCB7BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 141KB
SHA256 6b3d47b801e3f8bf3d2742cd65ae2a216d734ac62c224557d6b4a359b34fce2a
MD5 0dff5a3b514fd452f2a886a474585035
SHA1 e665c297068a42c3830bb9e4f7320b238358ee65
SHA512 b880e2c000bd79bf94f8a680a5901e3ab7590c168c50a70ac07149519d3d79eae860a9bcc0ed2d2987804995704e6b515fca6153a7f23172a1ae582d4724acc7
SSDEEP 3072:I3qb4yfrVhYsvsUPk6QzlW83B48jNxDy2fyA79v5xGy:I3S4yfrVhYsvsUPk6QzlW83B48jNxDy+
TLSH
T1EBE36AD4DB26407BFC1085BFB495673C2621F4314A599B0B2AEC04761DCB7BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6a6624c6345c6ff55670a1715a0328eb54a8819eb088d3d148ec26551bf0c954
MD5 3b59acf7f2a086140c6700d907cdb466
SHA1 4ffd49f660531202b2cbb00c12e26c3e1921f177
SHA512 45bc17f9b7d35fab828e82c51fc817c1b2e4faaa27eef0fbcceaf39b00759f94b934f03006ece692c4e634d9de45d32dcda7e79bc2fcacb524e6818374fdd939
SSDEEP 192:vPOv5zbowZqmyjFM7ELKsc1d66JozGzgCl6mc0d:vgbowZqmyjyJd66JozGzgC1j
TLSH
T11BE11EA4EA28463FC408027BCCA61F814F35399AD84E3F29319D751C2D5B2DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d5a0ece883d702daa80ca12c60a7ca76a38ba03d729a6480bceb2762f77f2729
MD5 1ed6dd32b386b7f44697fafcb141ec0b
SHA1 1ffa6b3e9d6e27adfa2ff01d57a3b4e8fa86f894
SHA512 b9f78bac3710a4dd1ac7acd0ae8c96addab02b0810bb060dd457aa668ad7b76164650111383bf14f264d46ac27fdf61c5cae0246c7fb46db2b44154a056042e3
TLSH
T11B21458D79BD4E6A6CC7E29C7480138EA3458A0A04871C4B5D92FE8CCF91ADD326A439
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 4KB
SHA256 50d791f92c3c04226a984ad2dc17a2e9d8bd9378e08e81f6e7a857b2d2163464
MD5 7bd2c7765647f22fe53598cf5c18303e
SHA1 e35eaf3b3ef62f6bb67e5081b04277904e973932
SHA512 96277451b8f5cf1a2330fb6e70331af1ea4a85922378cb3b241d52270a595d6eecae6221e1ddd6b65fb50290b100251f46474ed932efb42549e0f7010a4e49ed
SSDEEP 96:Gh0YhXmQ3dvCv4Yd3dpTNZd4k60ED7AU32P:G7Xt1uBNpTNX4bDUU32P
TLSH
T175A11F1DB56D0C7E6DDBD29CB880078D868D4B06C48B1C8B5CC7FE49CE96A9E325E129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e04af3e-9c86-42d5-b380-249a64129b7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\6e04af3e-9c86-42d5-b380-249a64129b7a
Size 38KB
SHA256 a2d07fce919f64245406e6cba2d816def8953284ad1eec74f065e2cf686c833f
MD5 73b28d531ac4d80f4c3e565c79b08e50
SHA1 62a551c48bcc2c672486bb956e4c7121f893c5c1
SHA512 4a0ccec9a245ccafedc805d968ad08ee06a918b4f564166d13e99036d38a484e49a63693f921516403c35c531a33f0c4cdd364123eab534628d40c54ee7a9570
SSDEEP 768:TIBbX0KlokE3g5R2qUYY7XCEPMKWuIaxWGHCpaHumbMLm/ccW/S5jitw:BK2kVzuIGHCp6y2cr/tw
TLSH
T163031AFDDD1240473D25E52AF2A9ADAB2013183149CCC7DE6AFC483A27D6DBB0527768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94602b12-132e-45c0-af35-e7e52edca1f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\94602b12-132e-45c0-af35-e7e52edca1f0
Size 2KB
SHA256 ea6f391c8868395c750a3aaa661b4ee6b274cbc72aeffb150c4ee4f421952872
MD5 62727526ae7c59ef35752eb36060ebe4
SHA1 e2d35dbb2d797ddcb473089f12b0e1ad36eca3e7
SHA512 9e50cff17590a79d0b22795a5d73a9c4bb20bf40853fbd5f16d0ee21d0dca70130094da63af5dabecb62a3a828591fd47acb24e1d389717f492712015c4de64a
TLSH
T13641535C75789CB69C9AF29CD192338E53A18E0740C61C833E53EF4C8C8569E236A537
MD5 SHA1 SHA512 TLSH

Submit Download

9a42ee03-0acc-4fc4-a05b-3485a74bfeea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\9a42ee03-0acc-4fc4-a05b-3485a74bfeea
Size 235B
SHA256 e1b0a457e13f6147b3649e10d9e7b01bf79a5a8ecf4e2e910dde5007e1f081de
MD5 ad6977655b026e63ac4884b7ca952452
SHA1 cbb8703f80cddce66a00a85a36965ab5e87b2742
SHA512 7fb25f8ad45b4e0e0611f7f94a7083acac77f965339f199e64ae3d386fa1052a5cd4414c4e514a6592ba4630c77fe8f016a29d3d4be6a90e3bdaf15d75275016
TLSH
T1C1D09780248CAB2D08040F02B0A069C230648C3318A45898CAA184348ABAAC80292A1B
MD5 SHA1 SHA512 TLSH

Submit Download

b05242da-c967-480b-a09d-01365f172b17

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\b05242da-c967-480b-a09d-01365f172b17
Size 886B
SHA256 928c643a2f10b13f9e9b440e9a1667deee7cfd75b5f8981715ff4d87c3b85dcc
MD5 90bf558c75720fd4011863c567811eb6
SHA1 0c22c77c55290f15929fe77c1b80bb13169d7e13
SHA512 dfcf04e4561cb7416f235d5952dbfe76a6d28d2da129d806d4131afededd048ec28b648397ec4704488dfdad4e75b7de76818c2e5d6fd56e84a6ce898ff95b11
TLSH
T1111100D19A30B9729C2C828795E077928BD0B433C0CA58143E913B280EAA51E936A717
MD5 SHA1 SHA512 TLSH

Submit Download

c62bd1e7-948a-4191-9298-cd9ae617d2d6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\c62bd1e7-948a-4191-9298-cd9ae617d2d6
Size 883B
SHA256 714a1a807ad992ebc75be81594a30a779b715763f7331f7012d30104ee201c23
MD5 dc2a3dc966504d80839ee24df715febc
SHA1 d87dad396d2bca3a4dadb1ea12b9a189e5cb19bf
SHA512 51f86a479046b06cf187bf282238bd141d6f46f48f073b2c7831c92956a295fc71837f6fbeccf8f19b9f75db3ce0cfd6720462a2e504c071dfb3890bf9944b17
TLSH
T1781123C19530B972CCACC24B87A13B528FE47523C4CA84143DB23E280D7D91E936E70B
MD5 SHA1 SHA512 TLSH

Submit Download

ef00f2b3-fbb3-4b79-bb15-bd7b736f2372

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ef00f2b3-fbb3-4b79-bb15-bd7b736f2372
Size 16KB
SHA256 e4e4bbc3e941c4058a5d4323b178e75101b722141855b741569514e041308c10
MD5 fafdaf421c3c4e1a933173d192b02f38
SHA1 5bb41f55563aaaf960202ed6175228eac89454ef
SHA512 3565f54699f97c41da92c6ff0bbebac96edf5fdd9ad30fa624248209f2aee99f9e17fc4675b6b980a9a3041a68e7e1bf149477658734acfb8fd7053f5a72312d
SSDEEP 192:lETs1dd3G+H8BHc2mr0FbwSLgKHzxayk5xQKHSzOIzVfe6eBcogWEI7HgWD2/j/j:TW+H8xmWwSLgKHlayYxQKyzZlLPreY
TLSH
T1D272D956682045BA8651E36894FCBFC3E6F528CF4C419FCADBE47D082DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5616821-e449-4327-bf7d-ed50dbafef9c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\f5616821-e449-4327-bf7d-ed50dbafef9c
Size 235B
SHA256 518c785d10157c62b5ae6f77999ed1a268619b93c5df80273d49407bf2100581
MD5 e8a43e9b28e19ca7fceb9b6cbe26efc0
SHA1 e325f70855c7fb1daaed0ea9810e34d8cee826d0
SHA512 7b214900368a1149dd54fac80079f0c819c650e0aa98dd6497c73eb9314f0d19eb5a6d2cf4982655ec65e5cf80d1d500110b21a6ecd9cdb703655a1b63a4f665
TLSH
T1D8D0238C18E86B2C09100F03F4F06AC331858C3320B0B820D5B042B8DDFEEC80212C3B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 6333a93949560bd21c5a0b244f6a2de171452b2867cc9a7296975347eedc63e1
MD5 fec55da7148f7974f015d704f20f85ba
SHA1 5bf6abdc33cc5177a3a9db45ca5248fb78d2f6d0
SHA512 53add7aae6fe0d854146512165f52fe2274fdd13ab8fd5ddf555c62315e3a64fbf3313a7061f428e223cf1bb599a225d5aa1cda66eeefc9c2b300e7750db6fc5
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4H924h9:ujI4VRfOXN4e60434L474f4w4L
TLSH
T13A72541545049EB8294FA78AEA367E01C37D573B60845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\places.sqlite
Size 5.0MB
SHA256 737c95d8ebea716fb83cb328141f574327828ea3448e5913b42d3a4215d4ff35
MD5 014aff2ffd39b3d48cfb8fdfbe493924
SHA1 b2bda353c5f2059e5c8d6c429886852383149475
SHA512 e667f3197eb9efdc8afcf51409fb54528934ce7035f2e13c7938424af4ceb779010e6d87f126b49db64870c7c9acf76f27992ff7fbba61d357c2a9fb0ffecc19
SSDEEP 384:M8r54w0VW3xWzkLAd2MlhFEOOvFJyNpo8Bw:rqVW3oHHkx
TLSH
T18536A46FBB244055D5EA9231EDE36B28083F71068AB376822D94156D4DE0723F92CCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 12KB
SHA256 923d1f87ea2d26ad53e62e5c874493cc9f8ca4840b6238294d66aa44e972b1b4
MD5 d1436b98365fdebb70df25e539ac06e6
SHA1 8f6551c2061fbc36a97ff160378f96691e075879
SHA512 071c20b31eb850cf517eaaa879729563805b41d58b05545eb2f95ecaab5b87f9189eff6dea15684d7319f35affa7450fc7d214c652cb8fb13275cc6465f3ca68
SSDEEP 192:GACRdfhRvFSSSpXLRApvOBw8800h8RPn1:wWtRA6wN8N
TLSH
T1CC42A93C92048A7F24B3327DAC254AA059514237B7BFBCD715FCDC810449F2845EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 12KB
SHA256 cdc6c27676cfe6424f16463d24f939ed83215ee7f11c335a35a57638990c4555
MD5 7b4d22fd19609798e5d21cc6013f4844
SHA1 18556cdd001db67a7ba22442dac4abb133718a4d
SHA512 19a2520e9eb71c9b97111bf8d925ab49c84c3d639302a8ed80307c8757b7d3e97a08edaee83722fbf63ea3b590807d374a60f3683843df36d81063b2b7ab2de7
SSDEEP 192:GACRdfhRvOSSSpXLRApvOBw88r+/mLrk1:wbtRA6w6WY
TLSH
T1DB42BD3C91049B7F24B3327D6C254BA059624237B7BFBCDB15F9A881184DF2841E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 146f1d7bbe203c859fb1b3dd6f9ef55991201457c4d795efef36b24e36c4ed9d
MD5 de3f589db74d1fdf0d7e96b26a588608
SHA1 0cc0551890b9e3bd88343700f4dbb933ba6dd37f
SHA512 4d904fc15ef083f2ceb16b9f31bd2f9c154acdb589f433395b6d242c457431ba0fc476b1b6f9120438f4d0cc99e02bd9b2590d6773af526567a34cc949bfb272
SSDEEP 96:xHcUTUuqGqdf2oE1zS9dSSlDdv9jTnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oE0dSSS9A1Bw88+w
TLSH
T1CEE1307894088BBF74B6767CAC6888716AB2413BB7BF68C750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 bd761d7ebf93c2c3d8386e2f8b5c5f981394711dcfc1dc3a9b49a4393672b986
MD5 43abc9ff1586adb7340c7eb0ef622d90
SHA1 c80215b2794b5077f980a0ec3d6e3d218dd2ec06
SHA512 a15c877c17911a8fa8b145b7e6b5a90e1ecef565fe4c6916609c3243abfd413fbbcc79ac69ec2bddc2e0b1c3c61a4c3092fd986b0c23c3684f2eb00d9f0203ac
SSDEEP 96:xHcUTUuqGqdf2RvkzSrSSlDdv9jZGAnERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2RvJSSSp9A1Bw88+X
TLSH
T109E1307894088F7F64B6767CAC6888716AB2413B77BF68C750B554C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 7KB
SHA256 2ac9a2bc620bc642798b0d064bca8ec3df0c9fb57903d15c1f80a333f9201022
MD5 004d460aa62c9d7973291c12730b2496
SHA1 9ef302d0b83bec6e9075f20420d93c9d96305788
SHA512 6ab8f37c0ca0ae478182b2f234e467258c41bc3be99232ff77d7e5df56fd17bbf029c1c13bff727c793166c2b11f2fc852922629f84b3dc9bb50235b695b99a0
SSDEEP 96:xHcUTUuqGqdf2RvNbzSrSSlDdv9jZGAnERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2RvOSSSp9A1Bw88+X
TLSH
T10EE1307894088F7F64B6767CAC6888716AB2413BBBBF68C750B554C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 7KB
SHA256 b9fe0ab08c8ef94121650652e9e364430d2d666fe2983073b4e796588534e178
MD5 a6aba350670422a3727b4c192d7b6f78
SHA1 2f4fbdb4324caac07626c73f5d9246553181ef7c
SHA512 a434404e0eb872a3bfbe3f95597005c1562bce271c593ea84f1de218d58de1f7c806fb0fd481ef8a35ffc1f27738b13f248747ed355a0cf0f1771ac440abf070
SSDEEP 96:xHcUTURPqGqdf2RvNbzSrSSlDdv9jZGAnERH9O+y1Bw88n8L4cnrzBHjGS:6hCRdf2RvOSSSp9A1Bw88+X
TLSH
T1E0E1307894088F7F64B6767CAC6888716AB2413B7BBF68C750B554C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 7KB
SHA256 e0d20ce2fd4f52ea80030064116679ce7f1df5917252b8b91b132209dac937fb
MD5 83ed4032058c26681ed444628efd68c6
SHA1 df9785ab8b99307c55b2ff00f6a3d62ef237985b
SHA512 81f7e3162bce1aa2ed86a5db7798a6f1f3b60f08cf120854d5ef5dc88e6b53afa2e098920da450fb62cf532f0d9518a81712c53174722000179a182bba5f470d
SSDEEP 96:xHcNTURPqGqdfhRvNbzSrSSlDdv9jZGAnERH9O+ycBw88gwQQ8L4cnrzBHjGS:6ACRdfhRvOSSSp9AcBw88gHX
TLSH
T153F1EF7C91088B7F74B6767CAC244A715A62023B77BF68C750B95485050CF3846F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 8870c0704e0bb2800e0716df5f4fa0200ad549460539f07d6e433cbf9fd4568b
MD5 a2f84da6d2eb864d4f74073077a462fc
SHA1 d6b5cc1afd0c75f0e6da03924732367c6dcb7811
SHA512 29b7c89c7f50cd85d572f2d4ad53ca28d512cb764ba97609363247ba38a6fee121a97ddfe9bbb0c32102e34382c94e69d898f3043f11a8333bd879e10fbc71c7
SSDEEP 96:xHcUTUuqGqdf2Rv1zSrSSlDdv9jZGAnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2RvaSSSp9A1Bw88+w
TLSH
T1FDE13F7894088B7F64B6766CAC6888716AB2413BB7BF68C750B554C4050CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 fb7e4a4178e1bb3334e1e5782a0b4b62cc6827045a4c1d62da6e6095b39395ac
MD5 d124903755a28ac991413b727f1693e5
SHA1 3e234ed56f1b6a72e11fa7abe28c761c3245a76f
SHA512 5fb5a5daae01e3c8b2ee2505c4e5804c531085c72ab6a2658e862038dbff8f762c864aa66a5405ac6f42d2d255ec41f6da2c41e74794e2294193893dec78484f
SSDEEP 96:xHcUTUuqGqdf2oE1zSrSSlDdv9jTnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEaSSS9A1Bw88+w
TLSH
T114E1307894088BBF74B6776CAC6888716AB2413BB7BF68C750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 12KB
SHA256 41326aab37537cf2fec1494db9c5308fde6cad35cf4d6252bf7b4650e42a7ed8
MD5 d462c1e89416961292c160cb08a1293f
SHA1 6d675bca2039b2a2a5cf0e6671aa689fa6b79f8b
SHA512 fe205d214283cb4a2abb51ea623e1e423eb3ff64772268e486c00e8cd9228c4d85e309a9d6db4d969b3291c46b6404331a03dd570bf2a01a591bb9f029c1dec0
SSDEEP 192:GACRdfhRvFNSSSpXLRApvOBw8800h8RPn1:wQtRA6wN8N
TLSH
T17142A93C92048A7F24B3317DAC254AA059514237B7BFBCD715FCDC810449F2845EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 8056196eb260dd2311f53b16237ae8a4d27307b0e329dfc4e1466ff997c82f4b
MD5 d59103ae490d2b0bb9f81b57b02494bd
SHA1 fd4cfacd005e9d05883d1cf7a9f4c62a201758ba
SHA512 10fafce2642b877839148b241e2730ab87f411b083091dca24f705e67544e26634c3c435c8bd06adced69258dd50c9073456924dad6b723de2eef407f4155a34
TLSH
T112410A5E7D3F2DFC7E11828D30C81BAA9F94442B02689C9099C1F16B00AC70936D9597
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 b7dca2a961a307106f52741d7d28ebf213ee8fbe3d7272f84b0b67bbd8bfcf4f
MD5 268d8f7a73fc8996295ff68cf6094987
SHA1 b5e2b1319ea1c6b56a9752a09161311e130e2493
SHA512 cad6afc9d3bea2c859f417fa2df8a23be33b6186abf9b86af47c11e0d8526ded062270f6696efde264fb099b707aa1acb9478ca790019f4ba29810ed215c67cd
SSDEEP 96:G2KejG9Cyk8dlDpQL69f/SnvG9nGDMY/g9aXlwrJP:Gaq9vJXSLlOr6Va
TLSH
T114815BDBA5202CA85B71E4C598CB2F1A1BF11D5B887D26424E60E23D4958BDE1BB83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 9d5b9490b3883ca4a60637e7f8190430791058f695f5ba1bf2c3f6e8329e80ff
MD5 7c0d2947d087f0b6c72859aece05da15
SHA1 17e63a47b7f8733635456033ddcd743aebaa49d6
SHA512 a8a3dbbe90bf8f6dec7fb30b274f0d254feda71a8ef69bf2c2149fc6cedbbf21e8e31a76bfb935cf0ab02bba00cf0426821c295207acc347681affea11a54885
SSDEEP 96:bqMqTXEPQjOkb9Vyk8clDpUnKf/SxvGZnPWcg/BX809FTOFjYt8J0Ux6xHtngJ:bqMsEPQCkb9wJ6wOMcgt9FyFjYt8JlYo
TLSH
T10EB18D93E6242CD12B319C404CD32E9E4B222C48C57F684C8D85CA144828B9F77FC3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 391d4da7321a939820c581ebb0b2f836600df4296102411f1932164fa6505889
MD5 b2889544be89269430c831172f986c56
SHA1 b8724d6b78280f8196981a3acf2c9b36266463e2
SHA512 586eef8a16892902ebf1f8106eea045ec1452f9656aa8564354ffd2c8a7d49a90fb790a2e568922aae5b7b3da24e473f4d1ab44481ee42d70f14fc177fc6ad0f
SSDEEP 192:PqMsEZ62tMi0v/4WZisN9lyJpjtHF9dyF3pgv4DInB:P13Z2pg+i+2Xjtl9dyh+kIB
TLSH
T1F2F1BFE725247CF63B75DCA45C8B0F9907322C04807F450E6D949A37806C79AA2E874E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 e43846769772ce421892963328021383d667187c83e61662f11c615fb34a75c9
MD5 e6c61a3e79019abd9d4e20031f7f0ad7
SHA1 3663ba9438d67aac1f4034f1fd106405a18cc545
SHA512 7a5d215b5c08602397674457d56e2e4da0c218fe287f237c0f25ed7ff5fb96e7c6509e25b642fcb97c0f721d88acf7125f405c36697936b0206cce76015feae9
SSDEEP 96:lf1u8ACrLjG9Cyk8FqlDpML69f/SjZvG9nPDVcvFn3809FTOFjseYnq7T/xIri2K:F1u85q9vJF8WLbOTcvF39FyFjjYnONI0
TLSH
T1A9A18EC7E2486CD12B72ED419CEB2B1A17726C09C46A3884CDA8C2148C6C7EE376C3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 ddbcb08acb82e4523edbd0b47f792d647885f0403fad6e35bd8f078afc78abd0
MD5 11b488d5c7386ffa24165c1566873769
SHA1 9ee9e225802310575aa172ac5d6ae43b60216f79
SHA512 4778cd9ea826d35efac935c8158b0dcbd813d92d94e665685438684b4d58073f1fc5d469d8bb8692cfe7417844f2f8f8f61fa73b65a548e0887418c92b074649
SSDEEP 96:d241rP/j+9Cyk8BlDpR9f/S+vUo+9nsKQRf809FTOFjY3YBd0UxaUIngJ:Tri9vJD1Mo+TQZ9FyFjY3YBdlas
TLSH
T1E9B18E83B6442CD05775A8508CE729D90AB22D54C16AB544CE61C605C96C75F23BC3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 baf6e8bae907173c88c23e80bf02c6ad248c9e34941d90702676772c820d4228
MD5 c48cbdbae74655e8ce590e320860e55a
SHA1 fe8e1b13b3ef971a168fd92cb0fce804ef383bdd
SHA512 a30440d0aef4895eb2245acfcc262df9872bfe111a98378f32180b252069bf73386e61fae498262e636cf045be9e018848002a9b9db55eeb0893c66fd3080e5e
SSDEEP 192:PqMsEk6TtIi0v/4PZisN9lyJpjtHF9dyF3pgviInN:P13kvpgBi+2Xjtl9dyh+iIN
TLSH
T103F1BFF725247CB63775DCA45C9B0F9907712C04807F810D6E959A3B806D79AA2E874F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 567b3d56881310c3824091332e08907e7642efe6918eeec3dedf64697bf142d5
MD5 8132bb1a680544e3c229343196866caf
SHA1 59f92ab0fb53b67ec7f323333632d225da559bf0
SHA512 ecc3281614a1ce704db090429ee45fb2b76a45ae16e8d8aedeeb39d861526948320b1fe752c7d794b5d2934f76cda723db6195360fe3e51b39d6ca63e6b9c22b
SSDEEP 192:kqMsEbxU6Z/49cG09XkBgZlrj7DTi0v/4DOcwD6KmLq9nbyFJZzI0oi:k13bxU0/a0uml7DTpgDRwWgnbyNIk
TLSH
T15522C0E3EC3EBC577630CC9878DB0F6C0A530094956A600D4D55CD35B26CB98D9A8B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 8ce18351da2f58c427bf7314ef4a80cef0f316f39a9508d7ac8d0aceeb0b61ff
MD5 836107f59517b62f94d212f40714c3a4
SHA1 d87ef10817a86a2f0f0e0f16f2466c2c6c0ee894
SHA512 2882f620e52d9c45a7c5c9d90c10741f53abaf127f7ef2baee44e922a1efb65e51a25f7ba459bd6f5e5fdd567543b77b1c5e9860c094e0bb38a0e0600c3f1a09
SSDEEP 96:I59Y4JKSjd9Cyk8hqlDpq9f/S8vJ+9nuiGcxdE809FTOFj0YQwiUxIIyI4H:WH9B9vJh8kh+ctgdE9FyFj0YQwDIIa
TLSH
T17AB17D83A6405CE09735ED51CCE71AA54F712C64C1676988CD66C306897C75F37BD3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 c4ed658edcfbc85b7b49d92e074361726f8e72135f00f03e19571bb0d1fa04d9
MD5 d3501e95dfd29d6e4fc3adf777dfa9c9
SHA1 8a0df9bf8b775a03b077eda2b1e8fe5100e49924
SHA512 650994227f68cec5d1d5fe74d0c731f7eb58e2cd2d4cc74d245eded742f327560630af7df16ca441efbc8bad1e515d22cc0b6a94f788451596341f5654d6b131
SSDEEP 49152:DL9LyIaeUT6QC5zYYuhBJ5QWvyxFkdWBm60l7+wxT2vZgwpUZP1Knhralr+G2oiW:VXZhUZP1KnhqU67P+k
TLSH
T188665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btweb_installer.MD81iFuC.exe.part

Path C:\Users\Admin\Downloads\btweb_installer.MD81iFuC.exe.part
Size 2.1MB
SHA256 7292394d186ec5e8ab3a55b05b70336e1284c436df235cbbf06c340292ca2951
MD5 be931068730a612392dd250a9ed5150e
SHA1 87e5a6be69032095cd00d0d3f6c4c2590f90f5e1
SHA512 a5f7268970779838a77643316379f660f51130c7103e13073d9469301cb4a3e61d023017baa9f2d0ab6e01a28f0cfd36c4eca934b4594a2b589d82cfccfcf68a
SSDEEP 49152:2uI5hCFNhtUUh6moKWmi+4P6ACwj5/RYepaXDHU4l:25/cNhKsoKzin6Fwd/RYKIJl
TLSH
T1E3A5D03FB28B653EE46E5A357A76E610583B7A61A5024C1697F4C84CCF250B02E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1660-855-0x0000000003CC0000-0x0000000003E00000-memory.dmp

Download

memory/1660-962-0x0000000000F70000-0x00000000013B6000-memory.dmp

Download

memory/1660-661-0x0000000003CC0000-0x0000000003E00000-memory.dmp

Download

memory/1660-1029-0x0000000000F70000-0x00000000013B6000-memory.dmp

Download

memory/1660-835-0x0000000003CC0000-0x0000000003E00000-memory.dmp

Download

memory/1660-816-0x0000000000F70000-0x00000000013B6000-memory.dmp

Download

memory/5304-1358-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1236-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1235-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1234-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1233-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1232-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1231-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1230-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1229-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1228-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1245-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1226-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1259-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1261-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1266-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1272-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1215-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1214-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1212-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1274-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1210-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1208-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1275-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1206-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1288-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1293-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1203-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1202-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1200-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1192-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1297-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1305-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1319-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1322-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1327-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1331-0x00007FF6FE2F0000-0x00007FF6FE300000-memory.dmp

Download

memory/5304-1344-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1346-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1368-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1373-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1374-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1396-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1405-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1406-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1415-0x00007FF74F950000-0x00007FF74F960000-memory.dmp

Download

memory/5304-1416-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1418-0x00007FF752230000-0x00007FF752240000-memory.dmp

Download

memory/5304-1433-0x00007FF762030000-0x00007FF762040000-memory.dmp

Download

memory/5304-1436-0x00007FF705010000-0x00007FF705020000-memory.dmp

Download

memory/5304-1237-0x00007FF764190000-0x00007FF7641A0000-memory.dmp

Download

memory/5304-1221-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1193-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1197-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1194-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/5304-1195-0x00007FF76B8B0000-0x00007FF76B8C0000-memory.dmp

Download

memory/6080-541-0x0000000000200000-0x00000000002EC000-memory.dmp

Download

memory/6080-1030-0x0000000000200000-0x00000000002EC000-memory.dmp

Download

memory/6080-815-0x0000000000200000-0x00000000002EC000-memory.dmp

Download