61fb5d019abeafb092a53bba24c7e004b59f319e642ae7c9a4cda8f111128d0b

Analysis

max time kernel
151s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bitcomet_setup.exe
Size 2.9MB
Sample260730-vqdmvsshjf
SHA256 61fb5d019abeafb092a53bba24c7e004b59f319e642ae7c9a4cda8f111128d0b
MD5 f9d884cce1b5f7016b5051a6d13eb73a
SHA1 f3003136d42abfc22ce9b5c232ebf71a1c1b381d
SHA512 65c9ff7b5e1ee200bc97eb0299a8dce0a1ef2d5b2929b3ae878dd18c67e9885d2aaebe621996bf6067c3b7ac382f64e19e93edb675685b0b79edb25a9b0a471c
SSDEEP 49152:IuI2haM3rc6k4b5IqeI23ZBgQ/ol0teLvuBRr3MQAw:I5OaMI6kaEV/ptLTrT
TLSH
T1A2E5F13BB24B653EE06E1A397572E210553B6E61A4128C4296E4FC4CEF360B11E3F797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	2988	saBSI.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
6136	bitcomet_setup.tmp
2024	BitComet_2.21_setup.exe
1380	BitCometService.exe
2752	saBSI.exe
2988	saBSI.exe
4144	installer.exe
3020	installer.exe
1216	ServiceHost.exe
3604	servicehost.exe
3364	UIHost.exe
1932	updater.exe

Loads dropped DLL 21 IoCs

pid	Process
6136	bitcomet_setup.tmp
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2024	BitComet_2.21_setup.exe
2988	saBSI.exe
3020	installer.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
3364	UIHost.exe
3364	UIHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\SOFTWARE\AVAST Software\Avast\Version	bitcomet_setup.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	bitcomet_setup.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	bitcomet_setup.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\SOFTWARE\Avast Software\Avast	bitcomet_setup.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	bitcomet_setup.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	bitcomet_setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\BitComet\ip2location\ip2location.bin	BitComet_2.21_setup.exe
File created	C:\Program Files\BitComet\tools\BitCometToastsNotifier.png	BitComet_2.21_setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-ES.js	installer.exe
File created	C:\Program Files\BitComet\CrashReport.exe	BitComet_2.21_setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.chrome.extension.json	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\browsernavigate.luc	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\csp_client.js	ServiceHost.exe
File created	C:\Program Files\McAfee\Temp1769079241\wa_install_icon.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\loading-spinner.gif	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-FR.js	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\jslang\eula-ru-RU.txt	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\jslang\wa-res-shared-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\info-16.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\edge_close.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\auto-install-done-ui.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-fr-FR.js	installer.exe
File created	C:\Program Files\BitComet\tools\ChromeLauncherManifest.json	BitComet_2.21_setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dialog-balloon.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\smart_toasting\selectors\smart_toast_trigger.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-pl-PL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticswpssetting.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close.png	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\jslang\wa-res-shared-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ss-toast-rebranding-bing.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-nl-NL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-pl-PL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-nb-NO.js	installer.exe
File created	C:\Program Files\BitComet\lang\bitcomet-uk.mo	BitComet_2.21_setup.exe
File created	C:\Program Files\McAfee\Temp1769079241\jslang\eula-ko-KR.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\packageutils.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle-rebranding.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nb-NO.js	installer.exe
File created	C:\Program Files\BitComet\lang\bitcomet-lv.mo	BitComet_2.21_setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_toast_dark_mode_step2.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-ES.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-it-IT.js	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\wa_install_close2.png	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\jslang\eula-zh-CN.txt	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\jslang\wa-res-shared-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\auto-install-done-ui.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pt-PT.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\green_check.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor_v2.json	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hr-HR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fr-FR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-nl-NL.js	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\jslang\wa-res-shared-sr-Latn-CS.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_exclamation.gif	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\nps\laptop_circle.png	installer.exe
File created	C:\Program Files\BitComet\tools\EdgeExtension.crx	BitComet_2.21_setup.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-de-DE.js	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\balloon_safe_annotation.png	installer.exe
File created	C:\Program Files\McAfee\Temp1769079241\jslang\wa-res-shared-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-noxup.gif	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitcomet_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitcomet_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitComet_2.21_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitCometService.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1232-0-0x0000000000C00000-0x0000000000CF4000-memory.dmp	innosetup
behavioral2/memory/1232-16-0x0000000000C00000-0x0000000000CF4000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bitcomet_setup.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	bitcomet_setup.tmp

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\TypeLib\ = "{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BitCometAgent.BcAgent.1\CLSID\ = "{C8FF2A06-638A-4913-8403-50294CFF6608}"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}\1.0\0\win32\ = "C:\\Program Files\\BitComet\\tools\\BitCometAgent_1.92.7.9.dll"	BitComet_2.21_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\shell\open	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BitCometAgent.BcAgent\CLSID\ = "{C8FF2A06-638A-4913-8403-50294CFF6608}"	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}	BitComet_2.21_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\MIME\Database	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{59CABE4F-3BB1-43bf-8AF1-D08E4C6F1660}	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.torrent\ = "bittorrent"	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bc	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bc\shell\open\command\ = "\"C:\\Program Files\\BitComet\\BitComet.exe\" /url \"%1\""	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\Implemented Categories	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BitCometAgent.DLL	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\shell\open\ddeexec\ = "[open(\"%1\")]"	BitComet_2.21_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\DefaultIcon	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}\1.0\HELPDIR\ = "C:\\Program Files\\BitComet\\tools"	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{59CABE4F-3BB1-43bf-8AF1-D08E4C6F1660}	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BitCometAgent.BcAgent.1\CLSID	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BitCometAgent.BcAgent\CurVer	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8A058D1-C830-437F-A029-10D777A8DD40}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8A058D1-C830-437F-A029-10D777A8DD40}\TypeLib\ = "{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}"	BitComet_2.21_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.torrent	BitComet_2.21_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\shell	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\shell\open\command\ = "\"C:\\Program Files\\BitComet\\BitComet.exe\" /url \"%1\""	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{59CABE4F-3BB1-43bf-8AF1-D08E4C6F1660}\AppName = "BitComet.exe"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\TypeLib	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}\1.0\0	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\DefaultIcon	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\Low Rights	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\ = "BitComet Agent"	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8A058D1-C830-437F-A029-10D777A8DD40}\ProxyStubClsid32	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\DefaultIcon\ = "\"C:\\Program Files\\BitComet\\BitComet.exe\",1"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\ProgID	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}\1.0\HELPDIR	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8A058D1-C830-437F-A029-10D777A8DD40}\TypeLib	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\ = "BitComet File"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\shell\open\ddeexec\Topic\ = "TORRENT"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\BitComet\\BitComet.exe\",1"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BitCometAgent.BcAgent.1\ = "BitComet Agent"	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}\1.0	BitComet_2.21_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\MIME	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bc\URL Protocol	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\VersionIndependentProgID\ = "BitCometAgent.BcAgent"	BitComet_2.21_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\shell\open\ddeexec	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BitCometAgent.BcAgent\ = "BitComet Agent"	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\shell\open\command\ = "\"C:\\Program Files\\BitComet\\BitComet.exe\""	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\magnet\ = "URL: MAGNET-URI Protocol"	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\InprocServer32	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D2C1FBD-624D-4789-9AE0-F4B66F9EE6E2}\1.0\FLAGS	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bc\DefaultIcon	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	BitComet_2.21_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C8FF2A06-638A-4913-8403-50294CFF6608}\VersionIndependentProgID	BitComet_2.21_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8A058D1-C830-437F-A029-10D777A8DD40}\ = "IBcAgent"	BitComet_2.21_setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\bittorrent\shell\open\ddeexec\Topic	BitComet_2.21_setup.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	saBSI.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2752	saBSI.exe
2988	saBSI.exe
2988	saBSI.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe
1216	ServiceHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6136	bitcomet_setup.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 6136	1232	bitcomet_setup.exe	89
PID 6136 wrote to memory of 2024	6136	bitcomet_setup.tmp	92
PID 2024 wrote to memory of 1380	2024	BitComet_2.21_setup.exe	94
PID 6136 wrote to memory of 2752	6136	bitcomet_setup.tmp	98
PID 2752 wrote to memory of 2988	2752	saBSI.exe	99
PID 2988 wrote to memory of 4144	2988	saBSI.exe	100
PID 4144 wrote to memory of 3020	4144	installer.exe	101
PID 1216 wrote to memory of 3364	1216	ServiceHost.exe	105
PID 1216 wrote to memory of 1932	1216	ServiceHost.exe	107

C:\Users\Admin\AppData\Local\Temp\bitcomet_setup.exe
"C:\Users\Admin\AppData\Local\Temp\bitcomet_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\is-FK71PCK045.tmp\bitcomet_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FK71PCK045.tmp\bitcomet_setup.tmp" /SL5="$400A2,1697709,940544,C:\Users\Admin\AppData\Local\Temp\bitcomet_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\prod_m_extract\BitComet_2.21_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\prod_m_extract\BitComet_2.21_setup.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Program Files\BitComet\tools\BitCometService.exe
      "C:\Program Files\BitComet\tools\BitCometService.exe" /reg
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1380
- - C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\prod0_extract\saBSI.exe
    "C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB InstallID=GnjW1demgLf8ftFqiwg0UHSW8vglxaHsd8Gnsj9oNP5k8dKIPx9rjzo3ctv0rSa3QyfGuPY0pWPaONTQ2Fb
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
      "C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true InstallID=GnjW1demgLf8ftFqiwg0UHSW8vglxaHsd8Gnsj9oNP5k8dKIPx9rjzo3ctv0rSa3QyfGuPY0pWPaONTQ2Fb saBsiVersion=4.1.1.865 CountryCode=GB /no_self_update
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
        
        "C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4144
      - C:\Program Files\McAfee\Temp1769079241\installer.exe
        
        "C:\Program Files\McAfee\Temp1769079241\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Modifies registry class
        
        PID:3020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5068

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3364
- C:\Program Files\McAfee\WebAdvisor\updater.exe
  "C:\Program Files\McAfee\WebAdvisor\updater.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1932

C:\Program Files\McAfee\WebAdvisor\servicehost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BitComet.exe

Path C:\Program Files\BitComet\BitComet.exe
Size 30.3MB
SHA256 5eadd865a4c95133ff9251ebf38626d842788ac8b3aa297c611faab3870a14b9
MD5 402fd12b5aa324c7227dabb581485b22
SHA1 8fb7301e80c466d07c1d60775b5cd6692cda968f
SHA512 0c26969ac1db5a4a5418a62da9099d59ceaf605f3b89e34edd77bf6bf35b4899ae0c4ca645e928f4d1e9e13c0c195b961be4d2a5b9b776c1ce1b00a8c9d8807c
SSDEEP 393216:wAgswrL7I9EQnR9QpW0XzVVceW1nzpKV8AsVxBBJEPompaCX:nnqAEyiEjAxPomp
TLSH
T1EF67AF5AB6A401E5E0B7D578CD978943E3B278654B354BEF01A105AF0F3BAE08E7D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bitcomet-it.mo

Path C:\Program Files\BitComet\lang\bitcomet-it.mo
Size 260KB
SHA256 8d3bb2874a31661d2c6fe19dba2f87e186030fdc54785e666cef0c0460cd197e
MD5 76dd7b9875a925780b86a95d9f872672
SHA1 4edb3dc075fa6c1e1d700bcbe85aab2ac134f8be
SHA512 f05b357fb331cfd748df667c50374aa371d38b2212ffc955373187531e7cb6b83277dd174fd1af6c15434b70b480852eaa43a4073c876241364cf39948a383a3
SSDEEP 6144:I9LsW5BGuXIyQhRLvSOLwPpo7gUaO8SzIJVwVKRugkTt8fvSLokDg5ZWem+u:vT7d3f
TLSH
T18C443B1B76884E25CDF70234C2055221EF7680CD3718EF354568D23CAA97BA9E5EB6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BitCometAgent_1.92.7.9.dll

Path C:\Program Files\BitComet\tools\BitCometAgent_1.92.7.9.dll
Size 871KB
SHA256 32cac384e0361a7538aca9b31e50ff4bbe6666a0567b062083610643351ba1fb
MD5 2eba751a1ed9d254d4e8da5ece436158
SHA1 8556f3918506ec480902ac5c4b6dae19e56ec50d
SHA512 edbdf5651b5cf9341d843af982c5d14a2c53745d03f98296fd7ec5f7eae83d172056c76b6edda1aa0f309b166b976d9c464ccfe5edffe4d828c9ab66bea8a983
SSDEEP 24576:13Nl5M13aSTbgmwPEEXeADIfNsZmMAQ/z:/M13LTsthXeADdZmMAQ/z
TLSH
T15E15AE117A81C075E6AF0171097DE7BA497EAD310B7098CBF7D42A2DAE344E26B32717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BitCometService.exe

Path C:\Program Files\BitComet\tools\BitCometService.exe
Size 2.6MB
SHA256 b234be795f9472b90c7746b7189ead8ffb2e81ccfc1546d6ea93ebdb6b08010b
MD5 174a32c8dca516230ff6eb0805d6f829
SHA1 f0fcce7bf22532e0829812473b3aed437fc105b1
SHA512 823de8a7cfc1e73657ceeefa827b7e9e720769d67e9c51c25c31c547fb5aa27d0405ee8721d8f7528b3bfe321dc4e72fd01fa772f7f4d4e3c23f6a2b9745e19b
SSDEEP 49152:k8RtOFS+g/q2/1upBe3ytP4VKpHThGZ7aM0KB4JRwTckxs8sLZ:k8RV/qloC6VKPGhB4Jz
TLSH
T137C5D002F783C172E893457548BEA73FD93AAE20473489D7E3D43A294D325D1A73A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analyticsmanager.cab

Path C:\Program Files\McAfee\Temp1769079241\analyticsmanager.cab
Size 2.9MB
SHA256 49c13a3f53ba4c7c883b956cfeabd9991900cfaeb1999a904a94e97cfc2e2d55
MD5 7508d2b3448f2f67f8c4ca5a508e7a82
SHA1 468cabf758e9c802070b898fa6604cb570363839
SHA512 f1906d1aad8cb0f92cce88ab912f9f2823899c9a6398d835028ec2779711d1e277d1a3574d92543646060ad06c7a1ade0de4a9008077d9f7bfdeccdcf5f64793
SSDEEP 49152:NABYqsGZANvJ4LX5QAqO/4e3eXW15dL9Ad0S0GZwWlg5:NdqsHReQvOQeOXG5980wwWlg5
TLSH
T139D5331EDA36F8C3CE45F87FF7E4E1A0A236B2A34E713065508D940EC4452A78D65DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analyticstelemetry.cab

Path C:\Program Files\McAfee\Temp1769079241\analyticstelemetry.cab
Size 68KB
SHA256 eecdbd9faddab9759c5c155c4491991b1493e1f0fe10d7ab20e8262b9b8983ee
MD5 9fa7874de637f02cfff0502ddbc86c0c
SHA1 de295ba2de0b4efe66bb118889e340e54187bc06
SHA512 cdc2d53992eee83049bd5850432ffdd77a911ee48563b96d6f184b7e55d58e5098555d4780f7c6333a8d0f997c8d6eeb2b47bec28f3bdf00ba615dd6c887f29b
SSDEEP 768:GQkJgvdiK3RAlrLjk40Mlk6e7PSKvhLyolQJ4mL0YfPLhdUFh9fhelxiK+vrez7Z:oJA3ihLY/GJ2LvhPlQBPjufIITC7h
TLSH
T19563F2192578BD06FD428A94E1FA6122F17CBA956880E08BF4F81D481FC0F9177DF799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserhost.cab

Path C:\Program Files\McAfee\Temp1769079241\browserhost.cab
Size 2.1MB
SHA256 e03f350b2427446f2d667dd5113542072e172932caaaed84ebe7a7fe277bce3d
MD5 adc103d480ce94ccdc3552dddf328244
SHA1 91a0038433e2d3f7fdaa9667bc30bbd2f44d5f30
SHA512 47e4bddf35354ab30bae6ff468d84029aa08084cf7ab8450fac2a19ccef8d7ca1973ede07374d21c47d6ea7206b691b05dc9cc36001d4d4ff3add75dc3954cf5
SSDEEP 49152:w1jZYo2sXUGgGeQNVTrcfMTTEw+54/IQH3Y9ZG4j/0amWZI:mYo23LGfRXEWQQHKc4gH
TLSH
T166A53349D124B7C3328EF2A528B53B63415F9CD5DFB9C4C2239E7EA9AFD11123489B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserplugin.cab

Path C:\Program Files\McAfee\Temp1769079241\browserplugin.cab
Size 4.8MB
SHA256 a60f76ba0fa4c9aada04ec8fbc708f60b44e1b7dcbc0d0aa7fe5da1c8a8f2e1d
MD5 8f7f21741afe24ec005779e149596bdf
SHA1 8985cdd29c2630d9b49b592d675d5d3b87c1a17f
SHA512 8e89d875f300f83b252da8423018a0cf4be1659a1b147db13adb13d60491d73dd2eb92c2915224c87349f8d9c205cd34078980cedb3b92cba62a7a83a72c2d9a
SSDEEP 98304:hP1rx20xoUoRYyKXJT6me+cU7Zd94YoMVvtvQNUznnFu5U3T:hd1+cyKXRbe/U7ZgYNV1vMULFdD
TLSH
T1F03633FEC5879240D7095EB75BD0A93FC0697BBEF0E3A0690A9D6294722FB536211E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds_invoker.cab

Path C:\Program Files\McAfee\Temp1769079241\ds_invoker.cab
Size 4.0MB
SHA256 bb81825ef98bec8b8d8ce7c6370989f6e556ba09afa7bd7f913ef23ddc2e39c4
MD5 5f17fd315674d687daa6da837691a482
SHA1 9b6e0e27c76aa60a561e84dd094051fddd680f42
SHA512 309dd49a18b9bf6a75a818bdc1fbe4d20f0ef6c0f121c20025b27602315cc8f81083cac6c19daf8a1d998fc49b3376ec38e4e975609dd38796267aa2e8c5c296
SSDEEP 98304:vpWXMtxGdykTMeavLLmw5qB4t7rFPRX0UsC:vi2xuduvg41FPwC
TLSH
T1F8163304693F84D83C39C9977572CB39742A210A946EBF77B6A9DB1F13492C18CCE798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Program Files\McAfee\Temp1769079241\installer.exe
Size 2.9MB
SHA256 90df564f19ba530517cc756637ac3da492d5a891f6c6b90b9115034199e4a218
MD5 5c47c316a96d7874bafdaa2dfdf800bc
SHA1 45ba68806d8562364a0668fb277de07143f4b780
SHA512 633fde0d1bfac922b8c014a8711d0a5a5153f4c7bbec5fd730e85dd6d8ba7aa701d5203ce0ad024f30997c1c512e0cddc3efc33a452b9d451b830bdbe734d028
SSDEEP 49152:0slWWNwead6qjQuc5LjMKVAepHQGx1k/PeYGAuZbE:T7wetqjq5LjrVxwo1cJuZI
TLSH
T129D59F1BB2F640F6D876C074C942860BE7B2B41543705BEF1290566A6FB7AE00E7F729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l10n.cab

Path C:\Program Files\McAfee\Temp1769079241\l10n.cab
Size 226KB
SHA256 603b64cc017ca7b790794b178f2a021cc477ee2dc21fe8cd74cc3bf38ff0eaac
MD5 f265337b50ce5a2c1e41660d6e6288c9
SHA1 587fe2a17a6c106382c37a99a7176750b9e1bf37
SHA512 6a6f04dbe80a9925cea25b7bb7d30b6c5a43f8d3a92b7bf0e18608623a6daeda404e12540bad21d96daca6876b70a89f770793f3f68d47ed5a85501ce40dde74
SSDEEP 3072:I0Iqvrc4S7tioZRvf+GE3unA9KhmyfDOtBAM2P7fVQmJa5KkJH4UQ76Vq:6qDc4Sr/DEBoKz8VOpyUjq
TLSH
T1CF34BEE07E4EA6ADC811D35B92200930D187604ADFD9E9CBD36E028C6D6279E1D97F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicmodule.cab

Path C:\Program Files\McAfee\Temp1769079241\logicmodule.cab
Size 2.5MB
SHA256 41d6ed292ce554dec6fbd6fe10f86a965d3d352dcec89115ad4525c38aded01b
MD5 e0a1ef6799f3256c2d045c51df4f7d74
SHA1 1c22b3e4fe72f709236306057000cdda3445a99e
SHA512 e05963f4ed06bd3afae86d7c37f5044ca7890c84e67c7e7c826b4d08cfdfe9504c3b2c1e73a49a2a5f29855cc9aaa5673304619f3a0bdad5b6459d3d2b2b1136
SSDEEP 49152:syme/HXFBFbRuOFOaFPYnXsC86C3MJ36AaIBdv9FpdA205GKacxtaawElQj:jme/VBDFOqPCbpCAKAaIBdTjIQOEawOC
TLSH
T136C53327A260055169F1FCFECCE3F3F5E684129895FC0790B0DB6436432C6299D5AA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicscripts.cab

Path C:\Program Files\McAfee\Temp1769079241\logicscripts.cab
Size 70KB
SHA256 2c9761410287ed9f7ea682b67ec5451f5f8940af90591040897cc34c0b6478eb
MD5 186387ae406c0f9c02bc0972ab8bb032
SHA1 3e27ff9b726c0696c3b2c8f44cfa9e7cd227248c
SHA512 6efd6b560aaff45b2dbbdd87280a5905bf3d14bb813820ae9045d882ef26bc2eefe73e499ecf7d0242d8557795380761316375a85a1512a1bc9c970689cabe20
SSDEEP 1536:1PJrFwzQVlbhsrehJhZy9+axKtlzstUt8FkYECjPMg7OB:1xrcQLNsah5y9nxtGtmkYxMgiB
TLSH
T12C63F132A7389B46AF67E8F569D78013D8FD22C69CE4944B257C822D53C43913F9F0A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-mwb.cab

Path C:\Program Files\McAfee\Temp1769079241\mfw-mwb.cab
Size 20KB
SHA256 d8360cd2e9b0d477a138c3d722f617c16f4c11d0f80f27955c05823255de4a9c
MD5 a680eed9966e4126a2b06efb46dbc5d2
SHA1 bb7d6fa69307f3302a70a6de70920c4a2c868e43
SHA512 7f836877a2d56b814b4fdafb8d654a4b3493e8db6d84b2d51d112ce39fe5bb617f0f687d1088000fd8a71aba5d12ad2067f97549e64218f55e566dc1e3060447
SSDEEP 384:uI96UXzAefqktJqCt33SPuFE1Vf6ki29d1ikCtiy8RbmL4nNyao+3bM:uIUUXzAebztHSPu21Vi2PsA5ALb+A
TLSH
T19D92AEA208259803F987DE74B4D85522DC39E7867DE8E0DBA51982348BC03C33BDE5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-nps.cab

Path C:\Program Files\McAfee\Temp1769079241\mfw-nps.cab
Size 22KB
SHA256 be7d77686d57d5195ff3b66ec56b609bdd5a0a58191379fea61177e5fd7a0e9c
MD5 8ba0f6fd91c6c761cda467189546a402
SHA1 cac7b750b5c2f4fe7b26346059a45ab90069a94d
SHA512 d72618736d5a1bb1238805202533b35efec96fdaf814d64d2165e169fa5af7c8995ceeef3ed3df3f5e8e17abafda08796e83ab72763ab140efb6d99cec5d4fad
SSDEEP 384:IZpylT+4SAXbcAo7AtCTetUbkA6ki29d1ikI7o01y8RbmL4nNy8LEnc:EIlFy7AtseKIz2PsS015AL2p
TLSH
T183A2AFA398A00843FD579E31F4E0D9239DB2B196BAD5A5C2B265862C47C83523BCF19D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-webadvisor.cab

Path C:\Program Files\McAfee\Temp1769079241\mfw-webadvisor.cab
Size 584KB
SHA256 8fe56f234e5bd672039424bad70a0b1c3fe1970c9c4911cde87de1f7f9b2ab20
MD5 a7895e742664542f9499ed19f1c9a9e7
SHA1 e1b22cd4723bbff41632de82fe67b78cfb580221
SHA512 2a47d504ee2888a9b02ceb20ab977ce74fda2606d27a6c9cd7885816058f468fe5f1bab5e11c3338649917d64e350b157a4f4f37d98a639d1836d720dcdaf8c3
SSDEEP 12288:47oMYoc6rE+2EiFyT0/aEZRyi8NIKt0mOYdbazV3CnUL:47oMYdPREOyTeZRyi8NnCYde3CU
TLSH
T176D42327BC866514C82FC3F1F3EA2A307618A969E09059EFBB87DA7DD0153973253493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw.cab

Path C:\Program Files\McAfee\Temp1769079241\mfw.cab
Size 786KB
SHA256 2efca49c23e2d72807f9739b301c9b68d4899e825c8d33da200d9166246c3349
MD5 322777926ee96ad4350bdc5f1513d8e1
SHA1 b16976176f612914fbdb7d43d6e73664544c2a57
SHA512 38ecf836b3b84c857fe06343a4c169241539f3b4eab0dce7ffa538095c7848a4efa38adb71942635bd0595a24c7dd132331a6b54942d53578b4630ebe2eb16f7
SSDEEP 24576:KFRef/ULKTAL+FnGzV7wmE9C+IBUwj8S52:KbcUOg+FnGVwB9C7Rj8m2
TLSH
T16A053332BC940B00ED47512CBBAED1A5992D4BEF50F1524718F6E26DF307362A8E3997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resourcedll.cab

Path C:\Program Files\McAfee\Temp1769079241\resourcedll.cab
Size 37KB
SHA256 64d229e58494615c643d5c289c182fd58236b0f400376d129c51a5979dfa52c4
MD5 6e09ed71699ba1aa2743ceb43d9cf742
SHA1 d5dc5431643d2e74ee831a7090d11d97d3ad7988
SHA512 7ff032309fbb9287bfac258adefa54984c94bdc5f3e4fba32d723585a9ae54fc3c8d43d55979a258999cac0bfdc476e7939a694f417c1eca18b033ef895ea74b
SSDEEP 768:4TdiRm/gxO3jG2eRjiUO5HSNMOfAQ4jvQ+g2Psw5AL7:4nsO67RjG0Pbevdg7H
TLSH
T13E03E0A288245C47FE13AD3DE8D2CA278F315A85BCE9D4C372E581690FE435936B8359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicehost.cab

Path C:\Program Files\McAfee\Temp1769079241\servicehost.cab
Size 320KB
SHA256 c6405eedccc4ad152964701c6a816a71b7f4fc40d4da55da490a7bec156635d6
MD5 049113ce20522b784fb73cc02750b786
SHA1 6ac8587d7fee19196ab5ce1f137a5cd78045c690
SHA512 1720e63c675ecdde5f084950ab2932d86d1779aa9e255d9232353e17a6512991ef2171b5d5a94616fad22cb49f7ee2263b41d207792903d84be115ee095b5d9f
SSDEEP 6144:p8HflWi+LkcjyUY1jMH9DwKAKKvNcd1Smc4LDl6tYUxpZBM+Z5qpTyr4uml5:p8/lWZdQ1jc9DUZvNi1SmcI56q2rM+fM
TLSH
T1A8642316EC108C16E5A65FF3D0D70D4FAD18A7C325B5BED25393E8512E127860DE8E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingmanager.cab

Path C:\Program Files\McAfee\Temp1769079241\settingmanager.cab
Size 808KB
SHA256 70ff7b399d68f9e5d2f8aa2091ac3e2c9430d8c9aadbc35862e5662e4e0fbd37
MD5 9c75fa859642ae137adce7088ae49d34
SHA1 409679b7c0070f35f34cf66d0e9c249ddbd7b3e6
SHA512 29beea606678fc817cd27443a11cbdf914b990ad573e5c35eb1467f5686760ba8eb631a761c8299b72ad384ba92f644ead2b7c65b8b3081842241574f5be47ec
SSDEEP 12288:Wru4RDXbK8qJaYbUc+qe+q6ZcMzlT8cBye3Peifuj5+U/DVUcVqkBdf8iqTxAt6:WdXu80ou3KMzZ84PeimpUTkD8iq60
TLSH
T1CF05335D56882D83FB1B1D4ED0578016650AAC4B06E7C0D3FFA8CC4D7B99AE234B06AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskmanager.cab

Path C:\Program Files\McAfee\Temp1769079241\taskmanager.cab
Size 3.8MB
SHA256 ab461ec473d981a8d40a680045415ad27eb625fe09df350a2f9a33ff02642179
MD5 0c20a5a00da6c2fc9a9b085948970b83
SHA1 ee9f0bbf1df49a6b7c7fc70dcdb531309af81bfb
SHA512 0a7d07ce2bccdd9171fecbd486f4c6db8d3d055e5de1a1f652e4738a01b2e48eec044ff3939e3c92ee06e45b6ad06c41f204de2de426fd4744123d4c6f0ba29a
SSDEEP 98304:2px08sXRzH6l7xkt1KlO2zbSQJGQBcMNiW0r7FEA:24SUKQ2lJoMkW0rBEA
TLSH
T11A1633E061FE63B1CF843AE45FEA4B14AA2354E14625A34F2F6CE13DEFE12E1491C558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uihost.cab

Path C:\Program Files\McAfee\Temp1769079241\uihost.cab
Size 388KB
SHA256 43ff6a1169c4fe56ddb346db28c8ab75a1d1c8f3fa11ad3e6ff6c08b9dca1ed6
MD5 4cdaad411104e988d3f388a43a1d89af
SHA1 3f6dc619b9cd57044f9aa7e6ff74c79abc39eab9
SHA512 64b7e05f20c02391415e4a7b2609ca2c3576b97865a82e6b0b948a7f3e42c9f23fc2dea449939632840bbd2aa4f94a2aec8f8b2660fbd6bc23b8b0bc9a8a9da1
SSDEEP 12288:le2sWyUJFXu1xPvePHnX579cpF54ZE5QM7:lTyUjE1u9SpwZu
TLSH
T10D842212C1E1145CDCDB9F5D16A0148BCE7E1E69FC7BE58A02ADC229240BB5339CEDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uimanager.cab

Path C:\Program Files\McAfee\Temp1769079241\uimanager.cab
Size 4.9MB
SHA256 7a0b03a48cd54fb08a347cb4b35ab6b0394379a311d8f69f00902c6c17778af5
MD5 34de199a66b401b8a85869c770f06727
SHA1 03a2722b34f609e2c097a0b8feb016b531498b37
SHA512 55350e5c3299c3754fcaa16a454008d371b60ad241eae80e51636c193fa452d2db55ceba4638f3cb98777f28b7e997c273fc4ee479492fea1bda63cbcf89cb30
SSDEEP 98304:uTKMFJ7M7TB0giwF3HLSkDbC9eccpnznDaZJRheLqE+t7+Bu1+1:uTKyx+diSrhybcpDDarRhG5x1
TLSH
T1D236331CB235C4D8E5A1A7331BF780AB6FAF4DDC403B403E846B6C0DD6165AAC95DA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstaller.cab

Path C:\Program Files\McAfee\Temp1769079241\uninstaller.cab
Size 1.0MB
SHA256 7544a8d683201104a2be9a8bf6ca39b9ef594a88e4f15af6ee7ec769ff46c4d3
MD5 e9bc37f8d2f88efc4dced48cdb1bb610
SHA1 17295c823b61f54280d911f1a116da8efde9d2b5
SHA512 f0c4ca14775c7ded7e240bcec60a053d07fdb5b42cc7181cf52506e90149696a4459ed6d27a4c92440724e6154e2235b12fb741c1e75397f6ef92cc85998d5f2
SSDEEP 24576:HSbQxEF2UG9He5ae5c7em/2Lka+AF1JYIiiZeAmpbDBAtYqN:HSJQUGPuTqukaJFQITEAmdBAtYqN
TLSH
T1E23533870B111EB545AF56BB78A1E56BBC00F5CB2B3861DB3838E1828B3CB76770D585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.cab

Path C:\Program Files\McAfee\Temp1769079241\updater.cab
Size 991KB
SHA256 f9e934fec243f11a4ed70bb41f6fb548e3ea76ed5f87f9f232d668ccabd73669
MD5 bc39398e9dea4ba36dd7aea78734b6a3
SHA1 3b77740164fa5d84cbe7d9ae2bfd2da059364665
SHA512 c58c88845ad5016fa2eb7f00462b752d025840148f185f1daa2e2d8eeddb5437339d9104feecd6c7ba93b1f006df24b3bbbaf153c1f833b0892790c78075080b
SSDEEP 24576:thbRcPMSrHid19Ea8VNhStpealM9BW8mKoVlwFVJp0d:fRcP7C5R8VNhOpt8NoV2FLp0d
TLSH
T177253358A66FBBC12F8B153AAED3807981E4C383DA8DE4D35E2146019B1C397D6D0ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webadvisor.cab

Path C:\Program Files\McAfee\Temp1769079241\webadvisor.cab
Size 11KB
SHA256 840be70810912b2d5a9e1b00f9b79a45f58aeff296dacb0a2684dc71d975d881
MD5 eb49c71f9ae2b8c38854964c1ba898bc
SHA1 e2a37a218a4e1662740a7b51485537d318072f38
SHA512 b50822a73e2b95d7192017707a7319d9bf52d709eddf8a75a8642be1d9d3df96e86b3e0c870ad1673fa89f5386883835e3273e72f10cdf896957d01781718c07
SSDEEP 192:Xemq6kSDnicM9Lx76iiX0iIPJmYULc8pq8RuwdmL4pUQrNyz50SH:XXq6ki29d1ikBPJmty8RbmL4nNyz50U
TLSH
T10E325AA38C681843FE439DB5F0D4DA23AD72F2C529E5D0D37059C2551B883923BDE69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.cab

Path C:\Program Files\McAfee\Temp1769079241\wssdep.cab
Size 574KB
SHA256 cdf1578fda1bc72ee794e7941eb59aacf437ca1a10fc28d31061417141c2dc1d
MD5 b9db209c43752e49d1d9e4cee499a90b
SHA1 6fa7d1c8f31fc80c1a903569d61f7666cd45bc9a
SHA512 c580701d939b988e73f2a9864cea1ac31c9eed038335b3a2c680bfb7ad8bc18009fc17101a170c06d08236c527d03e6ab91643d86b9c2a0d10b65a81f7a7b20b
SSDEEP 12288:aaDCpBW6FloEq8tKDnqCOOrcv39TYko5E3eKfLC1Qplz17M4MUeJyl:PC6KlddtKDYKcv39To5EhLIQ7zZM4M2l
TLSH
T1E9C4231A18A09544DC37F2A1F8ECE3401D26FF8D62AAA4C7B54EDB0A1C057E39FDD592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsManager.dll

Path C:\Program Files\McAfee\WebAdvisor\AnalyticsManager.dll
Size 9.1MB
SHA256 c516729da3786a501304505496786275a4dada486f73a6a04a4baf8b5ecc7f78
MD5 4b5e7c5c68a4381cd70ce516f2e9beb9
SHA1 3f692428f5215cecab307bd8dae7f7c441959b43
SHA512 3dfdeb5d41931e6b541002137a7e1280349c0f3aeae26bd241788bf8c1c8bede96f22252b445a889e3ab91fed44820e49fe3b131ae7e6dde0b986bcd21b7a4f6
SSDEEP 98304:iFCP9WOmtt6+CMjbtw7J3KH7CCZWGi89zq307+YhzB:MC1Pmi+CMjRHCBG9GkvB
TLSH
T11EA67D43F6BA40E4C8FAC1388A576627FAB17C56473497EB0694562A0F33BF0A63D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataConfig.cab

Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
Size 80KB
SHA256 97222f121e384e0224e4cfcdd3174ad58af17e08d57025d88ca638b65bed72f5
MD5 65a5df132da1f7d3a607323a21f6dd35
SHA1 2cd3c265bdc9926c8e530378cc2a74b8c0b2b4f1
SHA512 ee60aa8326335b5c32594c087150577744c09baf789fb137ef9e47c17c3d372ca630a2ef726b1c586e5809ef6a27e3a7d602bf5b0fd2546b6b8ea682efa227cc
SSDEEP 1536:Rvhgkw9rdJqN0WLH5LiM+2q1/e7Ldmak5hfNGKB4Bk3ilpTEuFaW:Rv2kY/qjT5Lx+2q1Glma6hfWpTEu4W
TLSH
T17E8302E09A844406CF25CDF9F0DBBCAB5C7CD2551CF790C3616EAA96910E3906F892DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingManager.dll

Path C:\Program Files\McAfee\WebAdvisor\SettingManager.dll
Size 1.9MB
SHA256 4f7a959ff267f259065abe843b55fec0cad5813674563d784a057f16a88a9ab3
MD5 f3aa4f45da2c4b0e32c2380e0749974b
SHA1 090a78ab42a11c28c5d9a933017d0403d76a1c64
SHA512 602014f4c49a8f3cdd6e96c29a6291612c8cec26a7993ae37041c474a88dde43969e627ecf4ad145146353a16da578235b2c1884a6472ddff080cd6f78e37de8
SSDEEP 49152:jxYBI1JGky3eZgu2gIfesZA1Mp3w/e+pcv18j:9JGky3Dz5twWxY
TLSH
T100957D1BA3AA80B8DD66D2B8C9538917EBB2B445476057DB02E0469D2FB77F0063D33D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsEventsConfig.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsEventsConfig.luc
Size 12KB
SHA256 f746ab96028144b514141256d77e4d8adb26661223c93e8d4be7b9168dec9927
MD5 d20be65e060bf881b25eed4c26c433e0
SHA1 025880a5dfb4aa1d88c1048c9e950babe9b5ada3
SHA512 37c505ec1542c4a522dac267d82a724ef0d15066ea91887067ebdd5f81fb787c377bf9f04c24977e2de8ce82f9925e2d82df6b43b4415f5d1ee81f916e4e2d9f
SSDEEP 384:pn543s8UYOyEpwmOCgqecppK1jjml+g13i4g:pH8UYOyEyGec2q13zg
TLSH
T1C54285AA5F7E6A6DFEBFC2895AF006E409300986B0D015F687BD9D6401C35714FAA70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsTelemetryHandler.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsTelemetryHandler.luc
Size 2KB
SHA256 4cb50519493ca22895e8ebf433696c4e7082fee7e65e3a33bb5896d436d2969b
MD5 d36152059e5dcc48f46bfe6cd009777a
SHA1 7ffcb8f4d6ccb9764b960b2fac5d627625f5b1a6
SHA512 d506a7773056ecde03179e360f789b967b678a538f08e2e6cf610542af1e2b95a79531f1db2163e3bcce0761481fc21dc746988ad69d96e8ad86a2ff0eaf5afd
TLSH
T1BA416589F94C9485453A528FAB93DF05D3B4DFADB302C1A750823FBE4095234FAC32A9
MD5 SHA1 SHA512 TLSH

Submit Download

class.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\class.luc
Size 656B
SHA256 cb15db53ecd4ecfc1064470f56a0f647d724fd07aa13f3c34602bd14a6e78263
MD5 2d2cefae8c8a13e54aa72c0894ba4488
SHA1 13df2092780629c9ec3b644b03537f6710ae0535
SHA512 d21adc50dd38c692300b6e595a4125df5a5799141f0c68238585ce3bb0f027a3c2c219f6d5505288c7b54d34f2f0fd084d4bea9971523b8a00f921b21631a709
TLSH
T14BF0D36E11CC3113B41EC1550957BE519691DC124B37433F8236D16EDE3224D161FFC9
MD5 SHA1 SHA512 TLSH

Submit Download

dkjson.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\dkjson.luc
Size 9KB
SHA256 2df4214706d2c1540efe5588dda463ec14c39c66a2422f4da5454a83c1fdecfd
MD5 cf726605930e009b3ea1483dacef3bd8
SHA1 8217cad87fdb63a7cd72373a927f90369e4d6c32
SHA512 63d0c5f515e8a810a915240586996dcf594ccfd040d0dee8570704e37282cfe2cdf912b8a7fc11d0ed869fad1add9a9d30eb6648b0ed8e00c2729eab9cad2af1
SSDEEP 192:jWXBkgh/3g7O7qaNfEyc80vDGwVd4Wog1DYEZpQ7+hC+Tf8IkZ0Jk1H5WEA:ckgBGO7q8RcTvf7xNZUqkLO
TLSH
T1F122EA1F92C81B57753ED03A9A32CF34A6D05C1EFF124F4B612A96B2F55225C9B8638C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logger.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\logger.luc
Size 699B
SHA256 4916b0615d4ccc979967bcb76e5466506f28e48ddeb67a34f9f7f54616b613c1
MD5 a1a170d0a95c9a45e8e4c32a0d9b627c
SHA1 fd9e9506a71e673972a29821f350bc69e665b748
SHA512 e633cd3e7241886462e8cfd2fa7d4e4b4a284c035569048a6d2d987e4c150f86705712e6cff44f35851537088264d5dd973a8ed0c7173510d2bc7713dd864443
TLSH
T18301C00625BB201FD126D38E441477C6A974B8676301CB0E4606BFB206412D1DFEB3DC
MD5 SHA1 SHA512 TLSH

Submit Download

servicehost.exe

Path C:\Program Files\McAfee\WebAdvisor\servicehost.exe
Size 868KB
SHA256 a3a404f7c2465db3e2be2c5aa6556e2269650155a02235602cb07ad66008e93f
MD5 86570224bfecb98a6d535cee82d965ab
SHA1 4cd5c2ba5b5285908016df699d88e0099955050b
SHA512 9ca5dfba9c378008d1d7f2ad9d6d67399308f50095836821c76ee35021272f32c315e2bbe7d5f04afe63ef7808881ecad65bb41c03e052612be285b23b93acc7
SSDEEP 12288:MASdW7dPBRNxeH/PVxNM6I+1JrMkW0b+QZ2s6p2K:M/EfRNm1xNMV+L6FQZW
TLSH
T197158D2EA79C42FDD071D2B9C6425502FB72B80A536166CB47A049A93F7B6E04F7E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.dll

Path C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
Size 785KB
SHA256 26502c82c4e97d28b7ae9acb3072c426589a19adcdca7021efd7c12d627270e0
MD5 236a2e9c1f76555c4a60765e5e61f862
SHA1 1b9a40b7b1308ebfa7fac38e09b87de3463e56f0
SHA512 8ede6e7d09201a972cb13d88962d9d92ebfd70fd572cb113dd1161bb83f92a88f27b5eba199c7ebc4a577750a6923ab479e53c5201da7c126a6f62d921657de2
SSDEEP 12288:nSMUeSJFVwoykQGh5YHWSGBjfWeVoNEOPgdZJ:nSbRJFBykQ8YHWvFWeVKEOPgd
TLSH
T158056C1A7BAC41B5E1B7C17AC9578A1AF7B278151B319BCF0260826E1F377E50E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 210a71a6210c693be20979e4dfb684dd28f12e787486d34675c53042a6de74a3
MD5 0f93827235140bfa751042a6623f35e9
SHA1 70bf4dcb8d5e60cb7ef16cc7eb9ac041d349d9ea
SHA512 cff89009ff4a5403f7c94a9b9451dfee4daeddb0c4f7166655a885cd1ced60716e9e8849c92e90a47a2782e649742341e3db2bc2ce3f621d23bdc9261718726a
TLSH
T15031A067278B280E701F8272E2F0C3B932F5A4D4575E6EB0552C1678C254FF622AF9C0
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 2KB
SHA256 063bf1cf723d12ab600624d3a5a8e3ba2c09f945e833d345c0d9797ab77eac52
MD5 ac12a751a8428b487536135a1c348f9b
SHA1 602cd53cf4b7021a6a405101d3ab5b9a1b657823
SHA512 1a4f3f04a3183f97960494a91aef5fe824c64447e9c105f5b45719c3c4420f82a4a95351c90c6689e171d2538bf2403bfb348ad9f1ab417489763d1ce5005ddc
TLSH
T18C4190A7278B241E741F8271E2F0C3B931F5A4D4575E6EB1652C0678C254FF622AFAC0
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 bbf13c72d4394dde461920d535f9d335b50f97418c1a5342f20b8b36b38f2044
MD5 fe6a23ea0b3c7c6c71d62881d7ae850e
SHA1 e3e19428c5b6b76f297d020302773a57bf584f05
SHA512 d10d4fa51997ced1c76c48f713d57e9a3bb59829f120ae1c0f6be201d5283498859994f37b167000ff00b9819eae1f5e79c54037d374803532563afa61fa76aa
SSDEEP 48:TKDLAGLHGL0xLrqLrGLPGLPnL+qL3qL3eKD8kQMLk+OScOD8bPLb/SSLoSaLOLUM:uPHw+Pxaxi6D/
TLSH
T1FB919397378B241E741F8271F2F082B931F5A5D4674A6E71652C07B8C254FF622ABAD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\ServiceHost.exe\log_00200057003F001D0006.txt
Size 4KB
SHA256 dc29f43fcea5ceb71751f0454f75fa967617047691967e6bc0621e87ea25d675
MD5 ab340349a79ca1a5ec42b1a818f63d4c
SHA1 b33d6ccfb8fe0888b945d9a60b63bc5402c19e91
SHA512 76debb93f8de8d77011022bc146903f08dd123cb67eef5ff795c44aa175d84ae716449c0180f4ee171765ed8fec3b82c3578e3146cf1a23c546fba47bc886a7b
SSDEEP 48:IbuLbwmLLhSpLuSTLkJ7mLlS0LaUL4YSBLDSLLRSJL8SrLpESeALAESmLkSnLJSY:8/L5c9//1cAD7Aq04sN0glq
TLSH
T16E9190A63B8B241E741B8271F2F0C2B976F5A0D4678E6D74652C07798258FF623AB5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 508B
SHA256 78c67bc4b5484db1f841d3a0e7384dba14a5f4f48cf069496865aededd0f6897
MD5 6837d9f2e25c8498e8e8972ac5ad8c81
SHA1 20005e379c037984912aab4a4b50978c3647e0cd
SHA512 af46e637f473e8f993706d75d554bc1da4f1c9c9ee8bd2ed0698711608782b3e3bbc064d434dc7ce0feca344d5b54e33bb1d9fa03f4eb17f281ff57afc51c05d
TLSH
T141F02E462D9D097EBED4CE7095F1647D0CE51750ACA7AF10B47C52D041457DD92346E1
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 28a4e7dd86be5eeb3d899fc100cc3dddf585d054d5ba61cc948c30a697ec2662
MD5 f50144b47aa160cda012a42c6338702b
SHA1 cfb75ece148bbfc5a267768b563b0318211400cb
SHA512 3b2fa0638caa09a94f9e722583eb339fde66e14a59d5242328fb19fd71e5753ca35c60464c0288958ec0219acd1e9d51522c32b236abf5bbbc9a239a1ac205c4
TLSH
T186312B4A2D9D0A3EBDC8CD709AF1547C09E52760BC97BF10B47C52E04145BDD92346E1
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 3KB
SHA256 4655f46cde319877cb46423bac750ecf27549a61fcc03ed97b4483531bd54a3b
MD5 6895ac1e6ec34438c1e6c95f1c229ae8
SHA1 8132b10b1c9ef57f573d114953a007f5090ca45a
SHA512 46e48e71a883ae9100e717dd06cc692f292abefa2a82e71f95160f11c3663566fc3e575d46d1a0e37be57f0451cb0fa709b1a7c71850fd473d3132d5efccb1af
TLSH
T10681390A2D9D0A3EBDD8CD74AAF1487C05E91790BC97EF10B8BC63E082457ED96346E1
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 5890eb2857d27156a6b48bb7a436d3afc51994d23c751a8d8f4dd3f82bc96b4d
MD5 97c3a9be601634ad4eaeb9abcbcaf6eb
SHA1 c6b3d198779aec109f10ff121e451deb124af5a5
SHA512 b945fe43250f0aa4ac88a7bf34c61863fc17ea7fb2c9f888ae5ddba4aa666e75e4bd1988328d939b2988ec7c2f10f786cd88fbb131035e85107093a8c6a2254a
SSDEEP 96:xw5FeFUFAweflNxUV7HsAA2rAFXr3NMfi2N1QMyK:xw5FeFUFAweflNxUV7HsAA2rAFXr3NMj
TLSH
T1AB91390A2D9D0A3EBDD8CD74AAF1487C05E91790BC97EF10B8BC63E082457ED96346E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00200057003F001D0006.txt
Size 570B
SHA256 966c461ff0354e6c64251eb71f4421d8d964db83a99416598e5551a3c707a37e
MD5 d56bbc35844c1dc472b0589f67d2c6df
SHA1 f8c5306767dbf02596aeec307d4628aee77c57d3
SHA512 2ab116b5dec57555b62fe58b02876da79ab8ad01e87b73e1fc9dc1bf7b9f7bcd9e4f0865819ddf04cc8693cc404cd40cf7582be6dea42d854e897241e7f170df
TLSH
T157F08B50FC1D3A0F34BED021F0E980B92CDD80C6C262947C322DD2E61B8967A7C0BC08
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
Size 34.2MB
SHA256 f4a3952c95be0f74297b3968341bdd63bbfb4913e058ee37eadf780ec85bed3d
MD5 f77b9cf39f8aac05da4824cc3e0264f2
SHA1 5bc98c868dda2f7f05b9bd23f30a38a643bef103
SHA512 87564e43e1e983138a73de15579569a3015146c0cf11017da391bbc542dfc1d2bc6c47397424d80c850745d66c9f7860e5567319a81784e40286867dbc2d6bf7
SSDEEP 786432:rE+0NSV6aoYG1P1W1quT0FKEKokVasR97bvxrua:gtNSV6aoYYPO0FLKotk9/xrp
TLSH
T16577331DA076C5E7D449857E7E615318E338386A03629BDFB39D901B6F77A820CBAF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
Size 1.5MB
SHA256 5ec42b168f2541dbb413d6f87aa5569470a2b0c6c574c3e655242461a4524763
MD5 7a1b6316d5d64a740b847d8261ea3e83
SHA1 e130deed179693218679e09f0eef6fb33c369146
SHA512 355f190eb5c83b14ea7ca19c901ff9124962a25f78ff03f1bc9f09387751f8def203e47f017ac0bd295c70ace8efbdc5f193d92d67207329aa1db4dbd0cc7183
SSDEEP 24576:8Vxe28BXUGuG2bjI+O5IRumwloSRB0nPUa6xDuC4d+bk+2miTwX/yQw01:8Vxeyk+tWoS/0PUa6xDv40bk+BiTwXF5
TLSH
T142757C133283C031EC6211B08969DFAB86ADB4345B6148DB67D06E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\servicehost.exe\log_00200057003F001D0006.txt
Size 298B
SHA256 d9123259fd892474bca8b1d4a305592fb7f272cb65bf5a57f0c66f301a69e89d
MD5 1f71957e93257b42af21df314c76b778
SHA1 00a98a154ba7a5b553a41e8eec678389411e80e9
SHA512 4df29b508ae56f3ae118eacd9bdf185b3db6fb96d2fec359694aa5169b3403648f0873cbbde52912ec18f00f7c887f694b4b0188242bf31e593649e23284255b
TLSH
T167E0CD60329D82CB357EC0B2A2F551734DEC214493A8BD3D205C665141CD49923EB1C2
MD5 SHA1 SHA512 TLSH

Submit Download

bitcomet_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-FK71PCK045.tmp\bitcomet_setup.tmp
Size 4.2MB
SHA256 389a9054e0ab0a2f3102a8302d68e973c65fc545aaf7b9fc73bf9022833ad1ce
MD5 5bdc2eb1ec88ea7f24a0d1f39865c4c6
SHA1 34b9c89599544fbf5a8fc25e6d6f8a40420eb23d
SHA512 bb59f843071b823c8909288dd1a6517e036d7b8b59a26df36ce5b2bd90cd6d89e5971066040f1e16587ef5f1e41bcb89ca6ad7851df3e4e7ce5bb0bfedcc33d4
SSDEEP 98304:iYU5hnuOajWwMPdCpepI3GrwrA+JM333JN:yxuHjWfZIzy
TLSH
T186268F03B388753EE4671A3A483FA284983F7E213A26CD4B6BF41D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avast_BRW.png

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\Avast_BRW.png
Size 29KB
SHA256 f29ab86815e8cd580dc0111196003d43396f75e1102ac40831d93282cea08617
MD5 055d7e5d449cb01dbd95a965d4266153
SHA1 a5ff3c3e04208ed2ba176cf754cd7d0a82cd4977
SHA512 ca090c35521f825ca691abbd4232d77c3348c59682db80fc0a624b4c548f7c7187cf6c4f2b27d9afcb69b1d3d02ac6c8e9bdb42c004cda47905b57941cc6f63b
SSDEEP 768:RjhdIa0LEXhRJC3Uu4geFZ0CTmYWvAUmh:RrIaFRru18bH3
TLSH
T133D2E0BFE5F9C86A4EE1323F5552092447B9F45FAE10D6EC195472888EF0C7C635488E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BitComet_2.21_setup.zip

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\BitComet_2.21_setup.zip
Size 37.6MB
SHA256 413231c1bad2f6bef9a20ab3a63db7de30dd08a9289a7bb290d2aac4b0047324
MD5 5160008dba7024d33f1086a7b59d3473
SHA1 cc0924c6c88db94021f0ad76a07444813d192004
SHA512 edef18edadd46e5470c1e764a372b13e8a8e57ce7870198ae556b518e2aaa83f2ed863209e78284b3baa07192d10c39b722d9aff04f24c45780ec48d79dd90e4
SSDEEP 786432:wPwloQrsSaoZBa0gQV0mWJjXP72thRjdLQMOIuAgXySTub2HAttUmPKmTw:BlwSakBDpm5J7P6tjjdLQMORny6i2Mt8
TLSH
T10D873394613D26CAD4C8A7629E02499CE68BA89C737FEF30C7025657AC356CDF9F3508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAdvisor.png

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\WebAdvisor.png
Size 33KB
SHA256 494169cdd9c79eb4668378f770bfa55d4b140f23a682ff424441427dfab0ced2
MD5 db6c259cd7b58f2f7a3cca0c38834d0e
SHA1 046fd119fe163298324ddcd47df62fa8abcae169
SHA512 a5e8bb6dc4cae51d4ebbe5454d1b11bc511c69031db64eff089fb2f8f68665f4004f0f215b503f7630a56c995bbe9cf72e8744177e92447901773cc7e2d9fdbb
SSDEEP 768:ZH5cQCJvj3+2/C0clMzHBtHlRX6DVL8dT1DKSd:ZZPCJvj3rVcyzHBdls987DBd
TLSH
T1EDE2E056637B73B94E401FADAEF75A8FA9644282147F20B7EFA2D4027018E4CDF49807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\logo.png
Size 7KB
SHA256 a0c2075d0fdb1b5274acdd5eba04a9b83cb1a53e5b065a7b65ca22172d56a56e
MD5 d80ae4d0826e3966beaf4e233c7ff045
SHA1 9425eea8c666f4d70bbde134f2ec009999dc1ba4
SHA512 9d7abedf79b564859d5caca45df9efb3301a02ac814d977dbcdd3b387f0f28490ef490f9ed0eefbd745127b805c172821d2ce6748308132b670644093054c32e
SSDEEP 192:8+Jbr/JM1FqBYs1jVeGpC9HK37qWyPC04RG:vJHRMzULjtYKLqZ63RG
TLSH
T1D9E19ED186AE04F598FD82E902807502C32DBD25E543CAC6F747F77EB66768041E52E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prod0.zip

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\prod0.zip
Size 515KB
SHA256 cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
MD5 f68008b70822bd28c82d13a289deb418
SHA1 06abbe109ba6dfd4153d76cd65bfffae129c41d8
SHA512 fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253
SSDEEP 12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
TLSH
T1C8B4237E2323A734A201E7A425373B520A1E63C6733C15EB7EC1AB927D3053D76A456B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\prod0_extract\saBSI.exe
Size 1.1MB
SHA256 f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
MD5 143255618462a577de27286a272584e1
SHA1 efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA512 c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9
SSDEEP 24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
TLSH
T1D2458D317586C031E1A211B219F9EBA585ADB8359F7244CBB7C05F2ED930AD25E36F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prod1.zip

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\prod1.zip
Size 6.8MB
SHA256 5464752690ebdf1b228e567296107c7cbe026469ef1ee3b4e0073d08a47c958c
MD5 e0db3da35d684700ca12fecca22537cf
SHA1 469fa84354ad51888d802cc27a4b0e47375e472f
SHA512 746b3ae44dab612dda031a985b52c8da93b322446deb0520526cd3bfeda456cd7d49b84f9b67fb64336e1c6d5afe03f3f84dea2cc3621d9a389aa08737152d45
SSDEEP 196608:cmOhkLwwcOy6sBuKjn3He0I1N8bUEWx1bmiGbD3g9Bdcyk:JOeL3y6sEK7XJLoDCN2Hcyk
TLSH
T1F266334D3EE5217DBE470C5CEE1422AB97904BAADDA2143232870ABC609DBD5127DC7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BitComet_2.21_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\prod_m_extract\BitComet_2.21_setup.exe
Size 37.7MB
SHA256 2bb0ac769fe8b75b1b1b8ca42fa55d29d94aaf68480611538dbb4395d05082d2
MD5 cf4791edd25d7accb547dc162631ac30
SHA1 88f91eeee20d719eb6ea46527c8c0eb79b4c23cc
SHA512 d0ef345e2c99bac75b85a6946f41c68d6b79feff0c69b2d35b8ab1d7f96b3e66009da873e1e25a82613fce65ab21c3ad68dd7f2517d2af748bd07701862838db
SSDEEP 786432:CZ8PoGNgaYQDpe+GO7kC8bNhLXqz5xBZvs6YKsmUvM0pURMVKt74e94aRZ:fPMaYSpp5glbvL6zjBZvs6YT3M8CMYL3
TLSH
T1BE873394212D268AD4C497329E42499CE68BAC5C737EEF31D7017B5ABC352CDF9B3608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zbShieldUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GT0K77NJI8.tmp\zbShieldUtils.dll
Size 2.0MB
SHA256 8aa3eca63350a70ca97f39867f842ddcbb153254f58c0e97fadbdb528e2cab79
MD5 cbdbbfbbca6093d9dc462a59ccea2713
SHA1 df6c46fc6116fa0c773d6939ead4d644dbd6097b
SHA512 f6284101dcc7450b472794df5080c914581ffe2542fc3e873eca4e47f5b4ef3c2985f46f8800326174a19961b40fa943724b85258a8dd0e99c58459d528af26b
SSDEEP 49152:YwyBp/wFOX9xRo3HVCEd2ynjsfAXBpAK0A8BFuXAFotKLCs:YRDwIN3o3UEd2ynjsoRpAK58BFucE
TLSH
T1B7959E613556446FF21B12355A38B729F2BEA3700BF547C73ED4AA1C39334428E266AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwa31B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwa31B0.tmp
Size 135KB
SHA256 926061fc6a92079aa227cc2e426bd5b2130501422a95e6a8984f15f05dee2e70
MD5 32528f494643e0e05625d5a5b8e61263
SHA1 701eb330c5f29b2178c6196404f3bc53e297987e
SHA512 80979203400fde66bc2f5567c2cc5a60448b8336dca93b8ef7d2d77033a063a9c581b9acdb99f81c1affae5fe159f2b4bc74b842104ffbb05172cb4656ab561b
SSDEEP 3072:ppIo/Z/nT74FOGNcO7/exDn/1ISZ3kHoh3I42H01Vqx:ppb7tpssD/1IQ332H2Vqx
TLSH
T1FFD38D01B090C072E5BE19390864DF725B7EB874DF906DCB63A50B7A9E703C19E35A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwa5AD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwa5AD3.tmp
Size 173KB
SHA256 6dd62d41da015e4a1486a8866fcb28ac1209a552be8313dbd63e821cb46811c8
MD5 6e7f3a7401c7da1e60f5df4531738ab4
SHA1 fc6305ca9ae4023d45ca8d7e67304f59a8ed2aa7
SHA512 4f6984e41b17bfe78a8d27c6fae33b3a2f7d8db3479f73ce3a1d42782db7ee029bc44b77cdc3ebe0d046e72a613ccfe406748878d5002e947cfce266cf90af41
SSDEEP 3072:1WKqE1/0WjsAGX5Gn39yf19led13p9tyDTQrf:1J1MWoAGJqe1neftyP4f
TLSH
T15C045C1BB7A400BBE577D27888930A06F777781107609B9F03A4477A5F27790AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BcNsisHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx5665.tmp\BcNsisHelper.dll
Size 3.1MB
SHA256 ca0222253ab4667e62d8954ac88463d6f5822826c5894ea5e4de0c687bdb19dd
MD5 652aa1c0400f2259fd262c28433ef0ca
SHA1 115867c83052046d12b27252129c32c3f5c18f4d
SHA512 73a944573f62185a155873d9b8dafc2144610feb7e342d14d60e005f3f6a7f8ec395a287d176a308971aaa21b851026b1ba500d3b6a15236564dfd12799a803e
SSDEEP 98304:yEyWp/rW6xmOscLWpzDVuzDn8HKF2UfoEvlzbTpY+:yKpccL1PF2Ufxba+
TLSH
T179E5AE623E908136E07F12705919F338E0AC69B84774C4E7779AFB1D39B24C3593AA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx5665.tmp\System.dll
Size 21KB
SHA256 42c54657b37cf6363421052c4673514860e33bd08cfaca42df00a4437821491b
MD5 e405c971fa29e1fd177e9a821a6369ef
SHA1 2682436b34daef998e15cb22e9d20c6268e6d611
SHA512 0ce48fe41a54bda427721751a73404d5828bd50a2ef6c98b4882c67d6f59cf6f1271257d1fb7b07d0d9190ee191f20bfdb947e340d829b042aaf9821264b10b6
SSDEEP 384:u8vJl97JeoxtN/r3z7YVMu4S+hX5w5k2mNDsSofousvNte:ueneoH3fY9UXyGheSoQueu
TLSH
T11FA28E638F2048F2F506DE3091DC672AEE7626859DD18D47BB6640C63E027E67F3835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-16-0x0000000000C00000-0x0000000000CF4000-memory.dmp

Download

memory/1232-0-0x0000000000C00000-0x0000000000CF4000-memory.dmp

Download

memory/3020-515-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-745-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-514-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-518-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-512-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-509-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-510-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-521-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-506-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-507-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-495-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-525-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-496-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-527-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-497-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-530-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-498-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-532-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-541-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-540-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-539-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-538-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-534-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-533-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-537-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-536-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-535-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-551-0x00007FF780270000-0x00007FF780280000-memory.dmp

Download

memory/3020-714-0x00007FF73FA60000-0x00007FF73FA70000-memory.dmp

Download

memory/3020-703-0x00007FF7617E0000-0x00007FF7617F0000-memory.dmp

Download

memory/3020-755-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-809-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-857-0x00007FF73FA60000-0x00007FF73FA70000-memory.dmp

Download

memory/3020-805-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-798-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-516-0x00007FF740C20000-0x00007FF740C30000-memory.dmp

Download

memory/3020-744-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-742-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-741-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-697-0x00007FF7617E0000-0x00007FF7617F0000-memory.dmp

Download

memory/3020-696-0x00007FF7617E0000-0x00007FF7617F0000-memory.dmp

Download

memory/3020-657-0x00007FF780270000-0x00007FF780280000-memory.dmp

Download

memory/3020-656-0x00007FF780270000-0x00007FF780280000-memory.dmp

Download

memory/3020-653-0x00007FF780270000-0x00007FF780280000-memory.dmp

Download

memory/3020-651-0x00007FF787670000-0x00007FF787680000-memory.dmp

Download

memory/3020-609-0x00007FF77FC90000-0x00007FF77FCA0000-memory.dmp

Download

memory/3020-598-0x00007FF77FC90000-0x00007FF77FCA0000-memory.dmp

Download

memory/3020-596-0x00007FF77FC90000-0x00007FF77FCA0000-memory.dmp

Download

memory/3020-581-0x00007FF780270000-0x00007FF780280000-memory.dmp

Download

memory/3020-580-0x00007FF780270000-0x00007FF780280000-memory.dmp

Download

memory/3020-600-0x00007FF77FC90000-0x00007FF77FCA0000-memory.dmp

Download

memory/6136-40-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-35-0x0000000000080000-0x00000000004CE000-memory.dmp

Download

memory/6136-91-0x0000000000080000-0x00000000004CE000-memory.dmp

Download

memory/6136-41-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-85-0x0000000000080000-0x00000000004CE000-memory.dmp

Download

memory/6136-63-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-46-0x0000000000080000-0x00000000004CE000-memory.dmp

Download

memory/6136-42-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-290-0x0000000000080000-0x00000000004CE000-memory.dmp

Download

memory/6136-326-0x0000000000080000-0x00000000004CE000-memory.dmp

Download

memory/6136-89-0x0000000000080000-0x00000000004CE000-memory.dmp

Download

memory/6136-36-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-33-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-32-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-27-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-26-0x00000000064D0000-0x0000000006610000-memory.dmp

Download

memory/6136-17-0x0000000000080000-0x00000000004CE000-memory.dmp

Download

memory/6136-18-0x0000000001660000-0x0000000001661000-memory.dmp

Download

memory/6136-6-0x0000000001660000-0x0000000001661000-memory.dmp

Download