4648faf31ddbe39835233cba5f69f869577eddacda55fde20354b5f099a637b9

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdm.exe
Size 6.6MB
Sample260731-s2nwvsxtc1
SHA256 4648faf31ddbe39835233cba5f69f869577eddacda55fde20354b5f099a637b9
MD5 f57f772fe88ed10cf80fb6f2a785f29b
SHA1 ca741a4ddbd4665d9df621d1f9d32b97d30451ac
SHA512 0c2f5b00d8d7988956c8c08e3c877530bb4ae808071ccc177d6da534f3a634041d010496955edf6922625c6d8c518f7625aa60b07d4ae9301b5e068a9c9fc993
SSDEEP 196608:8d92TlYbckURXNYKzogqQtAwKLD2HxaQF1uujtxf:8uTKckqYKMghyLqRBFUujn
TLSH
T15C66123FF28B613EE46A1A3539B2A210593B7A6165178C4296FCF44CCF691B01D3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
9	4644	cdm.tmp
16	4688	saBSI.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
4644	cdm.tmp
4360	saBSI.exe
4688	saBSI.exe
4780	installer.exe
2876	installer.exe
2952	servicehost.exe
5416	ServiceHost.exe
4632	UIHost.exe
2140	updater.exe

Loads dropped DLL 9 IoCs

pid	Process
4644	cdm.tmp
4688	saBSI.exe
2876	installer.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
4632	UIHost.exe
4632	UIHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 9 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\SOFTWARE\Avast Software\Avast	cdm.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	cdm.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	cdm.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	cdm.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	cdm.tmp
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\SOFTWARE\AVG\AV\Dir	cdm.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	cdm.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	cdm.tmp
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\SOFTWARE\AVAST Software\Avast	cdm.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-malicious-webpage-toast-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\wa-ui-install.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-ko-KR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticswpssetting.luc	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\eula-fr-CA.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_aws_apigateway_v1.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_timer.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-en-US.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.png	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\wa-res-shared-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailypingmetriccounter.luc	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_event_hub.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\auto-install-progress-fullscreen-ui.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\wa-res-shared-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-toggle-rebranding.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-hr-HR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\ux-pref-blue-laptop-dim.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-malicious-webpage-toast-fr-FR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-fr-FR.js	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\wa-res-install-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\wa-res-shared-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\mcafee_pc_install_icon2.png	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\eula-sv-SE.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-FR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-malicious-webpage-toast-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-ko-KR.js	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\wa-common.css	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\wa-res-shared-ko-KR.js	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\poppins-light.ttf	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\eula-el-GR.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\base_provider.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\clipboard.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\settingsdb.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\uithreadexithandler.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\dw-toast-img-2025.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-core.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\auto-install-progress-fullscreen-ui.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\microsoftedgewebview2setup.exe	installer.exe
File created	C:\Program Files\McAfee\Temp2822209501\jslang\wa-res-install-hr-HR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-nps-checklist.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_downchevron.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-nl-NL.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\dataset.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\smart_toasting\smart_toast_utils.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\custom-checkbox.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-de-DE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\spinner_large.gif	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdm.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4256-0-0x0000000000690000-0x0000000000779000-memory.dmp	innosetup
behavioral2/memory/4256-13-0x0000000000690000-0x0000000000779000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cdm.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	cdm.tmp

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\WSSDep.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	saBSI.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4644	cdm.tmp
4644	cdm.tmp
4644	cdm.tmp
4644	cdm.tmp
4644	cdm.tmp
4644	cdm.tmp
4644	cdm.tmp
4644	cdm.tmp
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4360	saBSI.exe
4688	saBSI.exe
4688	saBSI.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe
5416	ServiceHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4644	cdm.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4644	4256	cdm.exe	89
PID 4644 wrote to memory of 4360	4644	cdm.tmp	92
PID 4360 wrote to memory of 4688	4360	saBSI.exe	93
PID 4688 wrote to memory of 4780	4688	saBSI.exe	94
PID 4780 wrote to memory of 2876	4780	installer.exe	95
PID 5416 wrote to memory of 4632	5416	ServiceHost.exe	99
PID 5416 wrote to memory of 2140	5416	ServiceHost.exe	101

C:\Users\Admin\AppData\Local\Temp\cdm.exe
"C:\Users\Admin\AppData\Local\Temp\cdm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\is-E38F9JNPV5.tmp\cdm.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-E38F9JNPV5.tmp\cdm.tmp" /SL5="$400A0,5592098,893952,C:\Users\Admin\AppData\Local\Temp\cdm.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\prod0_extract\saBSI.exe
    "C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB InstallID=GnjW1demgLoXYvNmVqA2LVfcSQ5KdzfwKZUxxWORu6ogkcTeMJamuX5SWDql6pJ0ZBhTcTUxJrdUMO7PfL0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
      "C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true InstallID=GnjW1demgLoXYvNmVqA2LVfcSQ5KdzfwKZUxxWORu6ogkcTeMJamuX5SWDql6pJ0ZBhTcTUxJrdUMO7PfL0 saBsiVersion=4.1.1.865 CountryCode=GB /no_self_update
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
        
        "C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4780
      - C:\Program Files\McAfee\Temp2822209501\installer.exe
        
        "C:\Program Files\McAfee\Temp2822209501\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Modifies registry class
        
        PID:2876

C:\Program Files\McAfee\WebAdvisor\servicehost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
PID:2952

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4632
- C:\Program Files\McAfee\WebAdvisor\updater.exe
  "C:\Program Files\McAfee\WebAdvisor\updater.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

analyticsmanager.cab

Path C:\Program Files\McAfee\Temp2822209501\analyticsmanager.cab
Size 2.9MB
SHA256 49c13a3f53ba4c7c883b956cfeabd9991900cfaeb1999a904a94e97cfc2e2d55
MD5 7508d2b3448f2f67f8c4ca5a508e7a82
SHA1 468cabf758e9c802070b898fa6604cb570363839
SHA512 f1906d1aad8cb0f92cce88ab912f9f2823899c9a6398d835028ec2779711d1e277d1a3574d92543646060ad06c7a1ade0de4a9008077d9f7bfdeccdcf5f64793
SSDEEP 49152:NABYqsGZANvJ4LX5QAqO/4e3eXW15dL9Ad0S0GZwWlg5:NdqsHReQvOQeOXG5980wwWlg5
TLSH
T139D5331EDA36F8C3CE45F87FF7E4E1A0A236B2A34E713065508D940EC4452A78D65DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analyticstelemetry.cab

Path C:\Program Files\McAfee\Temp2822209501\analyticstelemetry.cab
Size 68KB
SHA256 eecdbd9faddab9759c5c155c4491991b1493e1f0fe10d7ab20e8262b9b8983ee
MD5 9fa7874de637f02cfff0502ddbc86c0c
SHA1 de295ba2de0b4efe66bb118889e340e54187bc06
SHA512 cdc2d53992eee83049bd5850432ffdd77a911ee48563b96d6f184b7e55d58e5098555d4780f7c6333a8d0f997c8d6eeb2b47bec28f3bdf00ba615dd6c887f29b
SSDEEP 768:GQkJgvdiK3RAlrLjk40Mlk6e7PSKvhLyolQJ4mL0YfPLhdUFh9fhelxiK+vrez7Z:oJA3ihLY/GJ2LvhPlQBPjufIITC7h
TLSH
T19563F2192578BD06FD428A94E1FA6122F17CBA956880E08BF4F81D481FC0F9177DF799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserhost.cab

Path C:\Program Files\McAfee\Temp2822209501\browserhost.cab
Size 2.1MB
SHA256 e03f350b2427446f2d667dd5113542072e172932caaaed84ebe7a7fe277bce3d
MD5 adc103d480ce94ccdc3552dddf328244
SHA1 91a0038433e2d3f7fdaa9667bc30bbd2f44d5f30
SHA512 47e4bddf35354ab30bae6ff468d84029aa08084cf7ab8450fac2a19ccef8d7ca1973ede07374d21c47d6ea7206b691b05dc9cc36001d4d4ff3add75dc3954cf5
SSDEEP 49152:w1jZYo2sXUGgGeQNVTrcfMTTEw+54/IQH3Y9ZG4j/0amWZI:mYo23LGfRXEWQQHKc4gH
TLSH
T166A53349D124B7C3328EF2A528B53B63415F9CD5DFB9C4C2239E7EA9AFD11123489B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserplugin.cab

Path C:\Program Files\McAfee\Temp2822209501\browserplugin.cab
Size 4.8MB
SHA256 a60f76ba0fa4c9aada04ec8fbc708f60b44e1b7dcbc0d0aa7fe5da1c8a8f2e1d
MD5 8f7f21741afe24ec005779e149596bdf
SHA1 8985cdd29c2630d9b49b592d675d5d3b87c1a17f
SHA512 8e89d875f300f83b252da8423018a0cf4be1659a1b147db13adb13d60491d73dd2eb92c2915224c87349f8d9c205cd34078980cedb3b92cba62a7a83a72c2d9a
SSDEEP 98304:hP1rx20xoUoRYyKXJT6me+cU7Zd94YoMVvtvQNUznnFu5U3T:hd1+cyKXRbe/U7ZgYNV1vMULFdD
TLSH
T1F03633FEC5879240D7095EB75BD0A93FC0697BBEF0E3A0690A9D6294722FB536211E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds_invoker.cab

Path C:\Program Files\McAfee\Temp2822209501\ds_invoker.cab
Size 4.0MB
SHA256 bb81825ef98bec8b8d8ce7c6370989f6e556ba09afa7bd7f913ef23ddc2e39c4
MD5 5f17fd315674d687daa6da837691a482
SHA1 9b6e0e27c76aa60a561e84dd094051fddd680f42
SHA512 309dd49a18b9bf6a75a818bdc1fbe4d20f0ef6c0f121c20025b27602315cc8f81083cac6c19daf8a1d998fc49b3376ec38e4e975609dd38796267aa2e8c5c296
SSDEEP 98304:vpWXMtxGdykTMeavLLmw5qB4t7rFPRX0UsC:vi2xuduvg41FPwC
TLSH
T1F8163304693F84D83C39C9977572CB39742A210A946EBF77B6A9DB1F13492C18CCE798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Program Files\McAfee\Temp2822209501\installer.exe
Size 2.9MB
SHA256 90df564f19ba530517cc756637ac3da492d5a891f6c6b90b9115034199e4a218
MD5 5c47c316a96d7874bafdaa2dfdf800bc
SHA1 45ba68806d8562364a0668fb277de07143f4b780
SHA512 633fde0d1bfac922b8c014a8711d0a5a5153f4c7bbec5fd730e85dd6d8ba7aa701d5203ce0ad024f30997c1c512e0cddc3efc33a452b9d451b830bdbe734d028
SSDEEP 49152:0slWWNwead6qjQuc5LjMKVAepHQGx1k/PeYGAuZbE:T7wetqjq5LjrVxwo1cJuZI
TLSH
T129D59F1BB2F640F6D876C074C942860BE7B2B41543705BEF1290566A6FB7AE00E7F729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l10n.cab

Path C:\Program Files\McAfee\Temp2822209501\l10n.cab
Size 226KB
SHA256 603b64cc017ca7b790794b178f2a021cc477ee2dc21fe8cd74cc3bf38ff0eaac
MD5 f265337b50ce5a2c1e41660d6e6288c9
SHA1 587fe2a17a6c106382c37a99a7176750b9e1bf37
SHA512 6a6f04dbe80a9925cea25b7bb7d30b6c5a43f8d3a92b7bf0e18608623a6daeda404e12540bad21d96daca6876b70a89f770793f3f68d47ed5a85501ce40dde74
SSDEEP 3072:I0Iqvrc4S7tioZRvf+GE3unA9KhmyfDOtBAM2P7fVQmJa5KkJH4UQ76Vq:6qDc4Sr/DEBoKz8VOpyUjq
TLSH
T1CF34BEE07E4EA6ADC811D35B92200930D187604ADFD9E9CBD36E028C6D6279E1D97F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicmodule.cab

Path C:\Program Files\McAfee\Temp2822209501\logicmodule.cab
Size 2.5MB
SHA256 41d6ed292ce554dec6fbd6fe10f86a965d3d352dcec89115ad4525c38aded01b
MD5 e0a1ef6799f3256c2d045c51df4f7d74
SHA1 1c22b3e4fe72f709236306057000cdda3445a99e
SHA512 e05963f4ed06bd3afae86d7c37f5044ca7890c84e67c7e7c826b4d08cfdfe9504c3b2c1e73a49a2a5f29855cc9aaa5673304619f3a0bdad5b6459d3d2b2b1136
SSDEEP 49152:syme/HXFBFbRuOFOaFPYnXsC86C3MJ36AaIBdv9FpdA205GKacxtaawElQj:jme/VBDFOqPCbpCAKAaIBdTjIQOEawOC
TLSH
T136C53327A260055169F1FCFECCE3F3F5E684129895FC0790B0DB6436432C6299D5AA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicscripts.cab

Path C:\Program Files\McAfee\Temp2822209501\logicscripts.cab
Size 70KB
SHA256 2c9761410287ed9f7ea682b67ec5451f5f8940af90591040897cc34c0b6478eb
MD5 186387ae406c0f9c02bc0972ab8bb032
SHA1 3e27ff9b726c0696c3b2c8f44cfa9e7cd227248c
SHA512 6efd6b560aaff45b2dbbdd87280a5905bf3d14bb813820ae9045d882ef26bc2eefe73e499ecf7d0242d8557795380761316375a85a1512a1bc9c970689cabe20
SSDEEP 1536:1PJrFwzQVlbhsrehJhZy9+axKtlzstUt8FkYECjPMg7OB:1xrcQLNsah5y9nxtGtmkYxMgiB
TLSH
T12C63F132A7389B46AF67E8F569D78013D8FD22C69CE4944B257C822D53C43913F9F0A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-mwb.cab

Path C:\Program Files\McAfee\Temp2822209501\mfw-mwb.cab
Size 20KB
SHA256 d8360cd2e9b0d477a138c3d722f617c16f4c11d0f80f27955c05823255de4a9c
MD5 a680eed9966e4126a2b06efb46dbc5d2
SHA1 bb7d6fa69307f3302a70a6de70920c4a2c868e43
SHA512 7f836877a2d56b814b4fdafb8d654a4b3493e8db6d84b2d51d112ce39fe5bb617f0f687d1088000fd8a71aba5d12ad2067f97549e64218f55e566dc1e3060447
SSDEEP 384:uI96UXzAefqktJqCt33SPuFE1Vf6ki29d1ikCtiy8RbmL4nNyao+3bM:uIUUXzAebztHSPu21Vi2PsA5ALb+A
TLSH
T19D92AEA208259803F987DE74B4D85522DC39E7867DE8E0DBA51982348BC03C33BDE5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-nps.cab

Path C:\Program Files\McAfee\Temp2822209501\mfw-nps.cab
Size 22KB
SHA256 be7d77686d57d5195ff3b66ec56b609bdd5a0a58191379fea61177e5fd7a0e9c
MD5 8ba0f6fd91c6c761cda467189546a402
SHA1 cac7b750b5c2f4fe7b26346059a45ab90069a94d
SHA512 d72618736d5a1bb1238805202533b35efec96fdaf814d64d2165e169fa5af7c8995ceeef3ed3df3f5e8e17abafda08796e83ab72763ab140efb6d99cec5d4fad
SSDEEP 384:IZpylT+4SAXbcAo7AtCTetUbkA6ki29d1ikI7o01y8RbmL4nNy8LEnc:EIlFy7AtseKIz2PsS015AL2p
TLSH
T183A2AFA398A00843FD579E31F4E0D9239DB2B196BAD5A5C2B265862C47C83523BCF19D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-webadvisor.cab

Path C:\Program Files\McAfee\Temp2822209501\mfw-webadvisor.cab
Size 584KB
SHA256 8fe56f234e5bd672039424bad70a0b1c3fe1970c9c4911cde87de1f7f9b2ab20
MD5 a7895e742664542f9499ed19f1c9a9e7
SHA1 e1b22cd4723bbff41632de82fe67b78cfb580221
SHA512 2a47d504ee2888a9b02ceb20ab977ce74fda2606d27a6c9cd7885816058f468fe5f1bab5e11c3338649917d64e350b157a4f4f37d98a639d1836d720dcdaf8c3
SSDEEP 12288:47oMYoc6rE+2EiFyT0/aEZRyi8NIKt0mOYdbazV3CnUL:47oMYdPREOyTeZRyi8NnCYde3CU
TLSH
T176D42327BC866514C82FC3F1F3EA2A307618A969E09059EFBB87DA7DD0153973253493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw.cab

Path C:\Program Files\McAfee\Temp2822209501\mfw.cab
Size 786KB
SHA256 2efca49c23e2d72807f9739b301c9b68d4899e825c8d33da200d9166246c3349
MD5 322777926ee96ad4350bdc5f1513d8e1
SHA1 b16976176f612914fbdb7d43d6e73664544c2a57
SHA512 38ecf836b3b84c857fe06343a4c169241539f3b4eab0dce7ffa538095c7848a4efa38adb71942635bd0595a24c7dd132331a6b54942d53578b4630ebe2eb16f7
SSDEEP 24576:KFRef/ULKTAL+FnGzV7wmE9C+IBUwj8S52:KbcUOg+FnGVwB9C7Rj8m2
TLSH
T16A053332BC940B00ED47512CBBAED1A5992D4BEF50F1524718F6E26DF307362A8E3997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resourcedll.cab

Path C:\Program Files\McAfee\Temp2822209501\resourcedll.cab
Size 37KB
SHA256 64d229e58494615c643d5c289c182fd58236b0f400376d129c51a5979dfa52c4
MD5 6e09ed71699ba1aa2743ceb43d9cf742
SHA1 d5dc5431643d2e74ee831a7090d11d97d3ad7988
SHA512 7ff032309fbb9287bfac258adefa54984c94bdc5f3e4fba32d723585a9ae54fc3c8d43d55979a258999cac0bfdc476e7939a694f417c1eca18b033ef895ea74b
SSDEEP 768:4TdiRm/gxO3jG2eRjiUO5HSNMOfAQ4jvQ+g2Psw5AL7:4nsO67RjG0Pbevdg7H
TLSH
T13E03E0A288245C47FE13AD3DE8D2CA278F315A85BCE9D4C372E581690FE435936B8359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicehost.cab

Path C:\Program Files\McAfee\Temp2822209501\servicehost.cab
Size 320KB
SHA256 c6405eedccc4ad152964701c6a816a71b7f4fc40d4da55da490a7bec156635d6
MD5 049113ce20522b784fb73cc02750b786
SHA1 6ac8587d7fee19196ab5ce1f137a5cd78045c690
SHA512 1720e63c675ecdde5f084950ab2932d86d1779aa9e255d9232353e17a6512991ef2171b5d5a94616fad22cb49f7ee2263b41d207792903d84be115ee095b5d9f
SSDEEP 6144:p8HflWi+LkcjyUY1jMH9DwKAKKvNcd1Smc4LDl6tYUxpZBM+Z5qpTyr4uml5:p8/lWZdQ1jc9DUZvNi1SmcI56q2rM+fM
TLSH
T1A8642316EC108C16E5A65FF3D0D70D4FAD18A7C325B5BED25393E8512E127860DE8E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingmanager.cab

Path C:\Program Files\McAfee\Temp2822209501\settingmanager.cab
Size 808KB
SHA256 70ff7b399d68f9e5d2f8aa2091ac3e2c9430d8c9aadbc35862e5662e4e0fbd37
MD5 9c75fa859642ae137adce7088ae49d34
SHA1 409679b7c0070f35f34cf66d0e9c249ddbd7b3e6
SHA512 29beea606678fc817cd27443a11cbdf914b990ad573e5c35eb1467f5686760ba8eb631a761c8299b72ad384ba92f644ead2b7c65b8b3081842241574f5be47ec
SSDEEP 12288:Wru4RDXbK8qJaYbUc+qe+q6ZcMzlT8cBye3Peifuj5+U/DVUcVqkBdf8iqTxAt6:WdXu80ou3KMzZ84PeimpUTkD8iq60
TLSH
T1CF05335D56882D83FB1B1D4ED0578016650AAC4B06E7C0D3FFA8CC4D7B99AE234B06AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskmanager.cab

Path C:\Program Files\McAfee\Temp2822209501\taskmanager.cab
Size 3.8MB
SHA256 ab461ec473d981a8d40a680045415ad27eb625fe09df350a2f9a33ff02642179
MD5 0c20a5a00da6c2fc9a9b085948970b83
SHA1 ee9f0bbf1df49a6b7c7fc70dcdb531309af81bfb
SHA512 0a7d07ce2bccdd9171fecbd486f4c6db8d3d055e5de1a1f652e4738a01b2e48eec044ff3939e3c92ee06e45b6ad06c41f204de2de426fd4744123d4c6f0ba29a
SSDEEP 98304:2px08sXRzH6l7xkt1KlO2zbSQJGQBcMNiW0r7FEA:24SUKQ2lJoMkW0rBEA
TLSH
T11A1633E061FE63B1CF843AE45FEA4B14AA2354E14625A34F2F6CE13DEFE12E1491C558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uihost.cab

Path C:\Program Files\McAfee\Temp2822209501\uihost.cab
Size 388KB
SHA256 43ff6a1169c4fe56ddb346db28c8ab75a1d1c8f3fa11ad3e6ff6c08b9dca1ed6
MD5 4cdaad411104e988d3f388a43a1d89af
SHA1 3f6dc619b9cd57044f9aa7e6ff74c79abc39eab9
SHA512 64b7e05f20c02391415e4a7b2609ca2c3576b97865a82e6b0b948a7f3e42c9f23fc2dea449939632840bbd2aa4f94a2aec8f8b2660fbd6bc23b8b0bc9a8a9da1
SSDEEP 12288:le2sWyUJFXu1xPvePHnX579cpF54ZE5QM7:lTyUjE1u9SpwZu
TLSH
T10D842212C1E1145CDCDB9F5D16A0148BCE7E1E69FC7BE58A02ADC229240BB5339CEDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uimanager.cab

Path C:\Program Files\McAfee\Temp2822209501\uimanager.cab
Size 4.9MB
SHA256 7a0b03a48cd54fb08a347cb4b35ab6b0394379a311d8f69f00902c6c17778af5
MD5 34de199a66b401b8a85869c770f06727
SHA1 03a2722b34f609e2c097a0b8feb016b531498b37
SHA512 55350e5c3299c3754fcaa16a454008d371b60ad241eae80e51636c193fa452d2db55ceba4638f3cb98777f28b7e997c273fc4ee479492fea1bda63cbcf89cb30
SSDEEP 98304:uTKMFJ7M7TB0giwF3HLSkDbC9eccpnznDaZJRheLqE+t7+Bu1+1:uTKyx+diSrhybcpDDarRhG5x1
TLSH
T1D236331CB235C4D8E5A1A7331BF780AB6FAF4DDC403B403E846B6C0DD6165AAC95DA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstaller.cab

Path C:\Program Files\McAfee\Temp2822209501\uninstaller.cab
Size 1.0MB
SHA256 7544a8d683201104a2be9a8bf6ca39b9ef594a88e4f15af6ee7ec769ff46c4d3
MD5 e9bc37f8d2f88efc4dced48cdb1bb610
SHA1 17295c823b61f54280d911f1a116da8efde9d2b5
SHA512 f0c4ca14775c7ded7e240bcec60a053d07fdb5b42cc7181cf52506e90149696a4459ed6d27a4c92440724e6154e2235b12fb741c1e75397f6ef92cc85998d5f2
SSDEEP 24576:HSbQxEF2UG9He5ae5c7em/2Lka+AF1JYIiiZeAmpbDBAtYqN:HSJQUGPuTqukaJFQITEAmdBAtYqN
TLSH
T1E23533870B111EB545AF56BB78A1E56BBC00F5CB2B3861DB3838E1828B3CB76770D585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.cab

Path C:\Program Files\McAfee\Temp2822209501\updater.cab
Size 991KB
SHA256 f9e934fec243f11a4ed70bb41f6fb548e3ea76ed5f87f9f232d668ccabd73669
MD5 bc39398e9dea4ba36dd7aea78734b6a3
SHA1 3b77740164fa5d84cbe7d9ae2bfd2da059364665
SHA512 c58c88845ad5016fa2eb7f00462b752d025840148f185f1daa2e2d8eeddb5437339d9104feecd6c7ba93b1f006df24b3bbbaf153c1f833b0892790c78075080b
SSDEEP 24576:thbRcPMSrHid19Ea8VNhStpealM9BW8mKoVlwFVJp0d:fRcP7C5R8VNhOpt8NoV2FLp0d
TLSH
T177253358A66FBBC12F8B153AAED3807981E4C383DA8DE4D35E2146019B1C397D6D0ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webadvisor.cab

Path C:\Program Files\McAfee\Temp2822209501\webadvisor.cab
Size 11KB
SHA256 840be70810912b2d5a9e1b00f9b79a45f58aeff296dacb0a2684dc71d975d881
MD5 eb49c71f9ae2b8c38854964c1ba898bc
SHA1 e2a37a218a4e1662740a7b51485537d318072f38
SHA512 b50822a73e2b95d7192017707a7319d9bf52d709eddf8a75a8642be1d9d3df96e86b3e0c870ad1673fa89f5386883835e3273e72f10cdf896957d01781718c07
SSDEEP 192:Xemq6kSDnicM9Lx76iiX0iIPJmYULc8pq8RuwdmL4pUQrNyz50SH:XXq6ki29d1ikBPJmty8RbmL4nNyz50U
TLSH
T10E325AA38C681843FE439DB5F0D4DA23AD72F2C529E5D0D37059C2551B883923BDE69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.cab

Path C:\Program Files\McAfee\Temp2822209501\wssdep.cab
Size 574KB
SHA256 cdf1578fda1bc72ee794e7941eb59aacf437ca1a10fc28d31061417141c2dc1d
MD5 b9db209c43752e49d1d9e4cee499a90b
SHA1 6fa7d1c8f31fc80c1a903569d61f7666cd45bc9a
SHA512 c580701d939b988e73f2a9864cea1ac31c9eed038335b3a2c680bfb7ad8bc18009fc17101a170c06d08236c527d03e6ab91643d86b9c2a0d10b65a81f7a7b20b
SSDEEP 12288:aaDCpBW6FloEq8tKDnqCOOrcv39TYko5E3eKfLC1Qplz17M4MUeJyl:PC6KlddtKDYKcv39To5EhLIQ7zZM4M2l
TLSH
T1E9C4231A18A09544DC37F2A1F8ECE3401D26FF8D62AAA4C7B54EDB0A1C057E39FDD592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsManager.dll

Path C:\Program Files\McAfee\WebAdvisor\AnalyticsManager.dll
Size 9.1MB
SHA256 c516729da3786a501304505496786275a4dada486f73a6a04a4baf8b5ecc7f78
MD5 4b5e7c5c68a4381cd70ce516f2e9beb9
SHA1 3f692428f5215cecab307bd8dae7f7c441959b43
SHA512 3dfdeb5d41931e6b541002137a7e1280349c0f3aeae26bd241788bf8c1c8bede96f22252b445a889e3ab91fed44820e49fe3b131ae7e6dde0b986bcd21b7a4f6
SSDEEP 98304:iFCP9WOmtt6+CMjbtw7J3KH7CCZWGi89zq307+YhzB:MC1Pmi+CMjRHCBG9GkvB
TLSH
T11EA67D43F6BA40E4C8FAC1388A576627FAB17C56473497EB0694562A0F33BF0A63D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataConfig.cab

Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
Size 80KB
SHA256 97222f121e384e0224e4cfcdd3174ad58af17e08d57025d88ca638b65bed72f5
MD5 65a5df132da1f7d3a607323a21f6dd35
SHA1 2cd3c265bdc9926c8e530378cc2a74b8c0b2b4f1
SHA512 ee60aa8326335b5c32594c087150577744c09baf789fb137ef9e47c17c3d372ca630a2ef726b1c586e5809ef6a27e3a7d602bf5b0fd2546b6b8ea682efa227cc
SSDEEP 1536:Rvhgkw9rdJqN0WLH5LiM+2q1/e7Ldmak5hfNGKB4Bk3ilpTEuFaW:Rv2kY/qjT5Lx+2q1Glma6hfWpTEu4W
TLSH
T17E8302E09A844406CF25CDF9F0DBBCAB5C7CD2551CF790C3616EAA96910E3906F892DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogicModule.dll

Path C:\Program Files\McAfee\WebAdvisor\LogicModule.dll
Size 7.8MB
SHA256 50177c8f81e7c7b925d34c87e55d95c788f8d9aaa8e3c17ae2e77ec1bb5bf4b0
MD5 ccff8d128deac977a74dc8803465d94b
SHA1 6b50bacb93c72f6387d96a73e50f93c50570fe5f
SHA512 5cc0959ab31aed4ac0af65c702789c9a64ee110ec88ad1548378b147f4bbfc889de14938837589ff71b0cc0ee606cc026a6b75300a335bd314b34469cbcb5f4f
SSDEEP 98304:jGF04fZWhw+sLNnlLDXFRTa/Ck/ALx5l/IspiIsTLfG:jGF0Iz++lLDXTPd/AsABK
TLSH
T18B866C47F6B610E5D8FAC1388A136227FAB1B8494730A7E747945A2A0F73BF0963D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

json.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\json.luc
Size 562B
SHA256 d92ebc8141223a52b17e3a6a0f7ecd7475762a80a84aa763dddf23c79f772efd
MD5 a67089488d2643eadba08ed209fcf08d
SHA1 0ef3996aa25d2b3500243d977ad5c66573b49ce5
SHA512 46d01eaeeb381f741e160f49d77a3ed77ba1c8d5d1665eaab20a823becf59e65c575521b00ac2e08fd0ffc67ad532fbe24d49b2cddbca9f46f5abcc1f9c9ffae
TLSH
T17CF0208C9444AEBA6EAE442788311720524C0CE4072202922E23BFE0994FC30AB3326C
MD5 SHA1 SHA512 TLSH

Submit Download

browserUtils.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\browserUtils.luc
Size 3KB
SHA256 b2b1531802b4b224e1fde0eb325deec10116f1a4ab90e6685623ad524a7c6e61
MD5 33839af1e32262782c2f2f5a5b1e8bb2
SHA1 7127802e0899aa77bd0cd2e98e0862c4879d9184
SHA512 0dba7171267cc3b30b7b11c657e899312be15e0fd0450e0fc278eeab821db1dd1b83bbf175229f200269070119ba92d299344fc4c37d3f2069be75f4c2e145d3
TLSH
T14D61220ADC0F5D34B760622FE2459B6A7F7CBD84233296725A97101F46419CAC28F75D
MD5 SHA1 SHA512 TLSH

Submit Download

common_utils.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\common_utils.luc
Size 6KB
SHA256 ce54a78a29396c45c54a3da2632e83e821a22d9e2772c0a1f144e203dd17b7b1
MD5 4c77fe077b0fadfefd5beece9e590168
SHA1 b195f37965cf5bea84ab8b67df086bdb466c518c
SHA512 8f1309e8cc8eaaab2ae27f00cfd5ad61126e0487af3265d08d90cf4913973c9d92423383a1eb41aa4217da97618287fa8a71cf3a6e2ca73794f3f3cb78bf466f
SSDEEP 96:zjx4bqxvjcsUvEBsF5e8yQLv13RBgoNevPg/lsvtmhYlX9VPCebt:zjx4bqpo80EcvpjNIPsCghYlX+ebt
TLSH
T110D193895F541E329B1203A78733AB61A330BE48AB31E7375AB2167D36423D2D61768D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stringUtils.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\stringUtils.luc
Size 381B
SHA256 2f5467bbc11683955db35feed608c72f7d5c189401297f0381468d640d903f81
MD5 d2c4b42c57a8617839a0fd5bba2166d3
SHA1 780adb3b3929866684eb573584e7c9b846c90b71
SHA512 fcee9cf8146c8bc316319bcc23ee8e783a7aef056e3924669fb4cda3cc64102cb49d4da2be96bc8cc1c04ae3d9623d68c5f3ccc0baeb0910a5deabc4bfffc074
TLSH
T13AE0680CAC247876D111AA17202A8A066AA2AF854963C37B825107B95A46C81CF6F11C
MD5 SHA1 SHA512 TLSH

Submit Download

win32helper.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\win32helper.luc
Size 29KB
SHA256 503da2cf3b6c3c44d3358193514888c3d26cc4c25dc198fe5239a14944e6dcfa
MD5 e0b6aab6281b294d0de1b018a224fa78
SHA1 b580e0ec5005ee830961d5234e05af8b0e1a4eaa
SHA512 993f8967487d0601bc1a799062f8db6f83471b4dd911147dc9f83b8468a933f165f973894589e5168b30cfc770372e54bd22369a3e39251a0ac5a3ab3fa8273a
SSDEEP 384:JX/CIGkba/ZqyBhyCTz5KamxnbxSHoiStiJ6UhfD07:Jfah5yAKaqboIiStiJ6sfD0
TLSH
T18AD2A68F8A4585F1B42F81121673AE061154B2673B64BD70388F92A41F1B60BFBFB6F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resource.dll

Path C:\Program Files\McAfee\WebAdvisor\Resource.dll
Size 26KB
SHA256 0eadff2d6fea95096942a6423f65314e7b61239f4bae4d25cf260e5b3f597ac0
MD5 5bc86841560e798eb0a50c7bbb80f793
SHA1 991cc8cd34704b710b9eacb0f2959191743b82e0
SHA512 99fb0d62efbfd7201efccfaf2b3e536af0267065be63c2467763d186afd15d8bd5764a12d0e44a32751c02401fed64d8e528827d28c6986676ae13396f7562a6
SSDEEP 384:8BhBT/W58RrB3M65lWHqXPDqbaP6ki29d1ik4u9y8RbmL4nNyMmN:mBr3M65mP2Psk95ALL
TLSH
T109C2C616E7ED9593F5B3AD3462F050912E77B8867CB0825E8D40892D7AB0740CFE4B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingManager.dll

Path C:\Program Files\McAfee\WebAdvisor\SettingManager.dll
Size 1.9MB
SHA256 4f7a959ff267f259065abe843b55fec0cad5813674563d784a057f16a88a9ab3
MD5 f3aa4f45da2c4b0e32c2380e0749974b
SHA1 090a78ab42a11c28c5d9a933017d0403d76a1c64
SHA512 602014f4c49a8f3cdd6e96c29a6291612c8cec26a7993ae37041c474a88dde43969e627ecf4ad145146353a16da578235b2c1884a6472ddff080cd6f78e37de8
SSDEEP 49152:jxYBI1JGky3eZgu2gIfesZA1Mp3w/e+pcv18j:9JGky3Dz5twWxY
TLSH
T100957D1BA3AA80B8DD66D2B8C9538917EBB2B445476057DB02E0469D2FB77F0063D33D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TaskManager.dll

Path C:\Program Files\McAfee\WebAdvisor\TaskManager.dll
Size 7.3MB
SHA256 2f1e98e8921b2acd8883b3984f0125334048088c71c347bf9a4c6d0f9da472b3
MD5 38574f9f5d4ab0417b8f2b68eb6f2559
SHA1 95bd3cf67ac903a57229a6f78cce9f0ab52cefb3
SHA512 4dd3da81a78899c98673b0d29c4499467b114d16a40e87385d0dfffea2f8887029ab49e199e2fbe2f010e232d79a27a51450a19cda8731dd6ca5bc0a921147b4
SSDEEP 98304:jYo2NmvWbRYGXbsTdrGMN1zKzHZGCueCGAICfh0J1YHmXAcEi9oo2zpX2Gw:jYo2NmvWbRYGXbsTp0zZBuxGI0XQw
TLSH
T14E766C03F6B650E1C8FBC1388A536127FAB1B8598330A7D746945A6A0F73BF0A63D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIHost.exe

Path C:\Program Files\McAfee\WebAdvisor\UIHost.exe
Size 1.1MB
SHA256 de118e06bfe5a0b2c76ad1fecda34b300f967370289d2aad46a6fb3784fdd921
MD5 1143eb281395ecc33a0cb3dc1e210477
SHA1 8a8ac55d346b388339d5078a1051bed823ee4944
SHA512 dace3fb1933d2c09fae14663c443ac7eb6df535f5fa94b37f1c83ffe7344a67f9f18626bde9eca13ed3190b163ee2afd2d90a12cf1660ef1accfe7abbe81d473
SSDEEP 12288:d7BcTpgFcH95MOQ81cklZH6T8AsEcvzYIwXxflFSJrb+y:VBWd95MwhV6T8ADKXEJeb3
TLSH
T1D4356C1BE69FC0F5DC76C1B4C9928516EAB2B40983206ADB02A055992FFB5F04E3D73D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIManager.dll

Path C:\Program Files\McAfee\WebAdvisor\UIManager.dll
Size 8.9MB
SHA256 78e3d26303b4b5593493649758b03fe48c4430c92bff020ed1df63d74900ba8a
MD5 1a1c0afbccd8c3b4087934455cdb6eb1
SHA1 b9498d15663c0621f03017ec0bcac22dee9508e1
SHA512 593d72ddb82212d652a72fb183a17d8b5d3bf595824e296a8b80aacf8907f35d23d2e507d5440e15bc6e986f29a4390ef384a5ba856107758c650bf6b2670f96
SSDEEP 98304:3knqviC41+8LDXYXah48mK25H7mkpHoTdCpFLu:iqa3Q8LDX495RloTU7y
TLSH
T11A966C47F6B610E5C8BAC138CA536127FEB278594330A7E746549A2A0F73BF0A63D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsEventsConfig.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsEventsConfig.luc
Size 12KB
SHA256 f746ab96028144b514141256d77e4d8adb26661223c93e8d4be7b9168dec9927
MD5 d20be65e060bf881b25eed4c26c433e0
SHA1 025880a5dfb4aa1d88c1048c9e950babe9b5ada3
SHA512 37c505ec1542c4a522dac267d82a724ef0d15066ea91887067ebdd5f81fb787c377bf9f04c24977e2de8ce82f9925e2d82df6b43b4415f5d1ee81f916e4e2d9f
SSDEEP 384:pn543s8UYOyEpwmOCgqecppK1jjml+g13i4g:pH8UYOyEyGec2q13zg
TLSH
T1C54285AA5F7E6A6DFEBFC2895AF006E409300986B0D015F687BD9D6401C35714FAA70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsTelemetryHandler.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsTelemetryHandler.luc
Size 2KB
SHA256 4cb50519493ca22895e8ebf433696c4e7082fee7e65e3a33bb5896d436d2969b
MD5 d36152059e5dcc48f46bfe6cd009777a
SHA1 7ffcb8f4d6ccb9764b960b2fac5d627625f5b1a6
SHA512 d506a7773056ecde03179e360f789b967b678a538f08e2e6cf610542af1e2b95a79531f1db2163e3bcce0761481fc21dc746988ad69d96e8ad86a2ff0eaf5afd
TLSH
T1BA416589F94C9485453A528FAB93DF05D3B4DFADB302C1A750823FBE4095234FAC32A9
MD5 SHA1 SHA512 TLSH

Submit Download

logic_loader.luc

Path C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc
Size 2KB
SHA256 d1211172e9b69b051962c843d03d38b3aa969ee40f921924e415e415c0ca99db
MD5 c34ff39b8ca074e0175c255f7821a59f
SHA1 2bf29d14ba9e2ec670fe9271db6e2002b4f03bfb
SHA512 7dde9d495285c753e5525069484904a9705ab7be00720ae586dfe8b4c8b6171261a7c660ee902b67e6b9fdd2f20b5344560a747db176799a82d8eb9fa6836914
TLSH
T1B851756786FC4F222E09D0E79B716D04B520A9CF28A10767D4AD46B420515AFFF713F6
MD5 SHA1 SHA512 TLSH

Submit Download

class.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\class.luc
Size 656B
SHA256 cb15db53ecd4ecfc1064470f56a0f647d724fd07aa13f3c34602bd14a6e78263
MD5 2d2cefae8c8a13e54aa72c0894ba4488
SHA1 13df2092780629c9ec3b644b03537f6710ae0535
SHA512 d21adc50dd38c692300b6e595a4125df5a5799141f0c68238585ce3bb0f027a3c2c219f6d5505288c7b54d34f2f0fd084d4bea9971523b8a00f921b21631a709
TLSH
T14BF0D36E11CC3113B41EC1550957BE519691DC124B37433F8236D16EDE3224D161FFC9
MD5 SHA1 SHA512 TLSH

Submit Download

dkjson.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\dkjson.luc
Size 9KB
SHA256 2df4214706d2c1540efe5588dda463ec14c39c66a2422f4da5454a83c1fdecfd
MD5 cf726605930e009b3ea1483dacef3bd8
SHA1 8217cad87fdb63a7cd72373a927f90369e4d6c32
SHA512 63d0c5f515e8a810a915240586996dcf594ccfd040d0dee8570704e37282cfe2cdf912b8a7fc11d0ed869fad1add9a9d30eb6648b0ed8e00c2729eab9cad2af1
SSDEEP 192:jWXBkgh/3g7O7qaNfEyc80vDGwVd4Wog1DYEZpQ7+hC+Tf8IkZ0Jk1H5WEA:ckgBGO7q8RcTvf7xNZUqkLO
TLSH
T1F122EA1F92C81B57753ED03A9A32CF34A6D05C1EFF124F4B612A96B2F55225C9B8638C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logger.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\logger.luc
Size 699B
SHA256 4916b0615d4ccc979967bcb76e5466506f28e48ddeb67a34f9f7f54616b613c1
MD5 a1a170d0a95c9a45e8e4c32a0d9b627c
SHA1 fd9e9506a71e673972a29821f350bc69e665b748
SHA512 e633cd3e7241886462e8cfd2fa7d4e4b4a284c035569048a6d2d987e4c150f86705712e6cff44f35851537088264d5dd973a8ed0c7173510d2bc7713dd864443
TLSH
T18301C00625BB201FD126D38E441477C6A974B8676301CB0E4606BFB206412D1DFEB3DC
MD5 SHA1 SHA512 TLSH

Submit Download

servicehost.exe

Path C:\Program Files\McAfee\WebAdvisor\servicehost.exe
Size 868KB
SHA256 a3a404f7c2465db3e2be2c5aa6556e2269650155a02235602cb07ad66008e93f
MD5 86570224bfecb98a6d535cee82d965ab
SHA1 4cd5c2ba5b5285908016df699d88e0099955050b
SHA512 9ca5dfba9c378008d1d7f2ad9d6d67399308f50095836821c76ee35021272f32c315e2bbe7d5f04afe63ef7808881ecad65bb41c03e052612be285b23b93acc7
SSDEEP 12288:MASdW7dPBRNxeH/PVxNM6I+1JrMkW0b+QZ2s6p2K:M/EfRNm1xNMV+L6FQZW
TLSH
T197158D2EA79C42FDD071D2B9C6425502FB72B80A536166CB47A049A93F7B6E04F7E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.dll

Path C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
Size 785KB
SHA256 26502c82c4e97d28b7ae9acb3072c426589a19adcdca7021efd7c12d627270e0
MD5 236a2e9c1f76555c4a60765e5e61f862
SHA1 1b9a40b7b1308ebfa7fac38e09b87de3463e56f0
SHA512 8ede6e7d09201a972cb13d88962d9d92ebfd70fd572cb113dd1161bb83f92a88f27b5eba199c7ebc4a577750a6923ab479e53c5201da7c126a6f62d921657de2
SSDEEP 12288:nSMUeSJFVwoykQGh5YHWSGBjfWeVoNEOPgdZJ:nSbRJFBykQ8YHWvFWeVKEOPgd
TLSH
T158056C1A7BAC41B5E1B7C17AC9578A1AF7B278151B319BCF0260826E1F377E50E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\ServiceHost.exe\log_00200057003F001D0006.txt
Size 298B
SHA256 f5a5f32e8b5ef7f1b1569aed56c0c736bcfd2228b292fa75ed8515534b8313f5
MD5 962980f61da6aa7312a4f84bdc7ffd3d
SHA1 d51dbe917c46bdedd085e0a7af97800ed3087af0
SHA512 63e915ffc7895e536a587b180a61a5dc8850624b1eab617ebc17af347a0218753680de17188e9cdca17744dfb17187088c5c4931b80f513bf38e00f433f369d7
TLSH
T10FE0CDA0229D82DB707684F293A741715C7D0100A388F53D205C550981DD82911FB191
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 2KB
SHA256 27ec0e27ac2ed6adcdb7971279a46ba94220e9929bf838472936cbd8ea6afcf2
MD5 ef3ebe9b47763507630334610f444a1d
SHA1 f5c231549e9da76c61c7c5ffc79d07f1a91ee3d6
SHA512 29812d1312c66ea38c37cdddb73d7b135fd55116583e53904f4b699d956b206cf290758ad448cce16823856c10a3049103b24dba29a0e1e7c399565494f4d569
TLSH
T10B51C60AAD9E1E3EB5D8CDB0ABD248BC24250710AD87FF11E8BD41C88125FDD91BD6E5
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 2KB
SHA256 56e0ff93522731453088c55b115ad03890177ffece56652db0f41a053004b953
MD5 15ad87e6fcefc583cf672d2aa31f84fa
SHA1 86723ececfd11551c270e2fdec1dc9c3aeb63fcc
SHA512 978a4b73cfd1762c6245d444bde1e6ee91b55161ca1be2c2706a34d75be912ff43127284bc1ee1ff6d7507c401f322a05073f33f04022400927abbe8b7458707
TLSH
T1E951C80AAD9E0E3EB5D8CDA0ABD244BC24250710AD8BFF11E8BD41C98125FDD91B96E5
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 3KB
SHA256 73dabf5ba5c328d40c10513521a5b571dfa742ff76c20f188704f41679327692
MD5 4e876d13cdf29917e3462fb5fcf46c8f
SHA1 ec3aeef98e6254eb0073c79e428d392f37da0d2c
SHA512 1231155c4b25d1a59e32755a1deb9354c723987d8155ae0e9536f721100910a5994539108bb1aa64a62a768d84117271ba165c29023a2d526edd9bae13b2137a
TLSH
T142810D0AAD9E0E3EB5D4CCB0ABD244BC24250710AD8BFF11F8BD41C98125FDD91BA6E5
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 4a1e6b61c8b5028d60ab2f2d26758acbe736cb82a6efa8b1de29d6a17930d63d
MD5 296ca7fbd1fb0a8b2b71e50acde818ac
SHA1 419ea20f89443b098f5ce5161532f3dc4397be4c
SHA512 d90251f9ab6ac24fac5aef119ba858cd6bd0815ef4c53d33fc15c1b3d3b5313f18f191a1fd7508225425a1516e9640f1adeeea8b79cdd99d4a73cc904f94855e
SSDEEP 96:Xopx/UEf443/98K+KEKUijZagIVVCYNcd+EUGZYW689CYgJW3d5SeS/SBOSOS4:Xopx/UEf443/98/1xYZagIVVCYNcd+EQ
TLSH
T1F7A11D0AAD9E0E3EB5D4CCB4ABD248BC24650710AD87FF11F4BD41C98125FDD91BA6E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 0662d58016814bd9e45d8ef55ff793b277592358ff3a8e9f4bed72ff36182668
MD5 4ef8545a6fdf655b34c43e7e6546937f
SHA1 fda4b5de879a0143794652bbe5b13ec0bac56f31
SHA512 aeb4fc8f4bde9f3aade7d639455407da6d603f5b074f791f69a9c8a6aba20fa295b3051782a19b2f9d7c657d904b2149eb64c69543cd3411bbdb1a653e605115
TLSH
T1EF2137057D9D857F76E6C8B1A2F540BC28250708AA8BFF27A07C11BC01E9DA915FA194
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00200057003F001D0006.txt
Size 570B
SHA256 36fb8fd9936b161c324ca4a14e370226244acf55a51937d31d8497b734960798
MD5 414382b6927a9af32bfa7efc4587bab4
SHA1 0aea1214dbfd57f2b6bf6f8aee01d0d55d40f53c
SHA512 e100fa038adff90d55397ec34f7cad5db7db3d5bf54062de23d2be7f208137342b3be08cb35e43deffa7acb8b06f77e2303bcc6818d815719d199e237259a14f
TLSH
T1CBF090157C1E2A7830FAD4A2F5C8A4FA7CCE8485C3A6F5B9552CD1AA1B9C936788F011
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
Size 34.2MB
SHA256 f4a3952c95be0f74297b3968341bdd63bbfb4913e058ee37eadf780ec85bed3d
MD5 f77b9cf39f8aac05da4824cc3e0264f2
SHA1 5bc98c868dda2f7f05b9bd23f30a38a643bef103
SHA512 87564e43e1e983138a73de15579569a3015146c0cf11017da391bbc542dfc1d2bc6c47397424d80c850745d66c9f7860e5567319a81784e40286867dbc2d6bf7
SSDEEP 786432:rE+0NSV6aoYG1P1W1quT0FKEKokVasR97bvxrua:gtNSV6aoYYPO0FLKotk9/xrp
TLSH
T16577331DA076C5E7D449857E7E615318E338386A03629BDFB39D901B6F77A820CBAF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
Size 1.5MB
SHA256 5ec42b168f2541dbb413d6f87aa5569470a2b0c6c574c3e655242461a4524763
MD5 7a1b6316d5d64a740b847d8261ea3e83
SHA1 e130deed179693218679e09f0eef6fb33c369146
SHA512 355f190eb5c83b14ea7ca19c901ff9124962a25f78ff03f1bc9f09387751f8def203e47f017ac0bd295c70ace8efbdc5f193d92d67207329aa1db4dbd0cc7183
SSDEEP 24576:8Vxe28BXUGuG2bjI+O5IRumwloSRB0nPUa6xDuC4d+bk+2miTwX/yQw01:8Vxeyk+tWoS/0PUa6xDv40bk+BiTwXF5
TLSH
T142757C133283C031EC6211B08969DFAB86ADB4345B6148DB67D06E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\servicehost.exe\log_00200057003F001D0006.txt
Size 3KB
SHA256 4cce60f4304d5ec372be1d224d5215539fd468189dfbed7539214c20dab8e9b0
MD5 ece7c165c71b2be7082df7b20fd7cfe4
SHA1 bf4d37861351635355e478a9f5111f134c217a57
SHA512 f7c327e55b9ce2d97dd8b4bf490d0f3ddff9db9d92844ea1b7d2344a934aaf28433e6a5bcfb78e554ca7a95066af19fc852121bb130acbc583649a05a324eaea
TLSH
T17C7149663B8B642D7027C2F1F2A2C2F4BAB19048574AFDB5912C051D8169F7633FF590
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\servicehost.exe\log_00200057003F001D0006.txt
Size 4KB
SHA256 65f7d12cc3a8330ec5979f2e009a3b1ccf33aabf44300bd8a07072dfbb813f63
MD5 5603ca38dfafebef7beff007c88f8105
SHA1 af03ddd58ee7ba5e95feb6a075b74eb46df8c6c8
SHA512 5dd22e0f571e3f23471e78b7d7f8c4a9e9f48e7d52cf15400648a636b6dfe979e61fb060dfed617c4ce36aa20c14fc4c8353d4716733a9fafd09c2d1bbd6a80f
SSDEEP 48:5lNLQwJTL9SKL2OSwLqJ7VLwSEqLaALDSnLRL4SwL8wEGYLTvLwUWwmA2FLwuhw4:bZG5PnJsPW2UUNmp6uumcVbG
TLSH
T1F0A13A663B8B646D7017C2F1F2A2C2F4B6B59048674EFD76912C051D8268F7632FF590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdm.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-E38F9JNPV5.tmp\cdm.tmp
Size 4.2MB
SHA256 07eea42af4d565d09ce6c8723211e96a835400060dc90e53a6bac21b2fd3da42
MD5 af498a69fb53fc1ad081c0c884e4822a
SHA1 b35902fd0a6b1acb19bfb3002f4c0c44a44bdbaa
SHA512 7523307016fd0b58208cf4bb3aba539866bf59d3f154a95084384ad78512fd76380187ad1fbe1ca86043fe0e7384c858174417e2e5d90c57e11921b5e36b7de5
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333PZ:7xuHjWfZIzeZ
TLSH
T177268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avast_One.png

Path C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\Avast_One.png
Size 42KB
SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
MD5 faff96fb8080a98bd1def3c4f9cce9c1
SHA1 466c66dfaed49d93dd7d8a1e42919a4f03613efa
SHA512 ad87ccc0bcb0115d5e7255935c5bd2b5eeb85b75f46206987d85f0f5e04afce054b0b3cee3d7577039db6ddbff1f0fdfdca657b7877376e4f97c80c5ed7514b7
SSDEEP 768:53E5YnNz2SLHvDYgWfGHV8L77Yy/oksC+x8+RfWpzrdYnsi2anUpMQb3HGJ2:536Ynl2SLrYHAWHDgEqCSskn0nqA
TLSH
T11613F1B8B8DE416DDDDED6B8FCE66FF564816437CC84D1EA800CB028518E784366636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WeatherZero.png

Path C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\WeatherZero.png
Size 29KB
SHA256 ab99cdb7d798cb7b7d8517584d546aa4ed54eca1b808de6d076710c8a400c8c4
MD5 9ac6287111cb2b272561781786c46cdd
SHA1 6b02f2307ec17d9325523af1d27a6cb386c8f543
SHA512 f998a4e0ce14b3898a72e0b8a3f7154fc87d2070badcfa98582e3b570ca83a562d5a0c95f999a4b396619db42ab6269a2bac47702597c5a2c37177441723d837
SSDEEP 768:Fk7fJC9WjOI1DaGmnitN039DODp56Ys+9S/IUM+:FktpB4FiQ3qd9S/BN
TLSH
T188D2D0381BFEE4C6EC67B874148F1F234A2B94BAC0D4E215F801969D1549E5EB58CDA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAdvisor.png

Path C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\WebAdvisor.png
Size 33KB
SHA256 494169cdd9c79eb4668378f770bfa55d4b140f23a682ff424441427dfab0ced2
MD5 db6c259cd7b58f2f7a3cca0c38834d0e
SHA1 046fd119fe163298324ddcd47df62fa8abcae169
SHA512 a5e8bb6dc4cae51d4ebbe5454d1b11bc511c69031db64eff089fb2f8f68665f4004f0f215b503f7630a56c995bbe9cf72e8744177e92447901773cc7e2d9fdbb
SSDEEP 768:ZH5cQCJvj3+2/C0clMzHBtHlRX6DVL8dT1DKSd:ZZPCJvj3rVcyzHBdls987DBd
TLSH
T1EDE2E056637B73B94E401FADAEF75A8FA9644282147F20B7EFA2D4027018E4CDF49807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\logo.png
Size 248KB
SHA256 8c5c80bbc6b0fdb367eab1253517d8b156c85545a2d37d1ee4b78f3041d9b5db
MD5 9cc8a637a7de5c9c101a3047c7fbbb33
SHA1 5e7b92e7ed3ca15d31a48ebe0297539368fff15c
SHA512 cf60556817dba2d7a39b72018f619b0dbea36fb227526943046b67d1ae501a96c838d6d5e3da64618592ac1e2fa14d4440baa91618aa66256f99ea2100a427b4
SSDEEP 3072:d9rAhuSnngAZK0u2vGWTbQ8VreGWVQx1RiiHs0dfo5yk5BRFOYfKa5ubF3/hlKHV:U/HJGWPQ2wV01RPQ5FoBJc+uHtjdhd3
TLSH
T13444122A9260C885D35201230725B4787F78264B7A1CACE6F5F77C1B4A0A67E2D86FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prod0.zip

Path C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\prod0.zip
Size 515KB
SHA256 cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
MD5 f68008b70822bd28c82d13a289deb418
SHA1 06abbe109ba6dfd4153d76cd65bfffae129c41d8
SHA512 fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253
SSDEEP 12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
TLSH
T1C8B4237E2323A734A201E7A425373B520A1E63C6733C15EB7EC1AB927D3053D76A456B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\prod0_extract\saBSI.exe
Size 1.1MB
SHA256 f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
MD5 143255618462a577de27286a272584e1
SHA1 efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA512 c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9
SSDEEP 24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
TLSH
T1D2458D317586C031E1A211B219F9EBA585ADB8359F7244CBB7C05F2ED930AD25E36F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prod1.zip

Path C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\prod1.zip
Size 5.9MB
SHA256 200e9bc4fcf2c6682ddc8c7f172a0d02befecd25ca882f66c6abc868a54b8975
MD5 7cc0288a2a8bbe014f9e344f3068c8f1
SHA1 eb47d401ae30a308dd66bdcafde06cdd35e25c94
SHA512 869f0a01ef0bcbbfc501c1786e14bffeaa2daaa00210c312874fc67a724c77ef61394bb5854b9a02af654cd045c4d39ae30d73f1b4ec8aa9e531dfeea1714476
SSDEEP 98304:ppxj2IwVGwxnd+P0fY8eHeM1euEuR+HW84l7mKN2Yjwov3I7qs4zLGGlFtSNNkoo:ppxZ7k00fxeHejFHW3l113I7d4zLGGTL
TLSH
T10A56335E3333C060535EAF822771BD151138AA7D6EDD78C48A39A37625F629E0FA470E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zbShieldUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\is-U8ATXEJVSQ.tmp\zbShieldUtils.dll
Size 2.0MB
SHA256 976d070339c1ecd80d0d2ded8f2c3fd1c6ec03f408053470f696066c2bb2b738
MD5 ea1aa2927ea58dfb8f57ae5f7dae0c74
SHA1 f1c1eca6070f82cd7c7918eeda144a207a53bb09
SHA512 20b10a4289bfaea9fe25bdeee636a07303799a78f0a732b65a182728bca9f48cf9802f32c833315e7d71a4816fcb9b7b09370c62867421824d554a87b6ea1559
SSDEEP 49152:y4yxp/wFOn9xRo3HVCEi2ynjsPAXkp4K0x8BFuchAFotKLIk:yJTwo93o3UEi2ynjs4Up4KI8BFucOE
TLSH
T103959E613556446FF21B12355A38B729F2BEA3700BF547C73ED4AA1C39334428E266AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwa4826.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwa4826.tmp
Size 135KB
SHA256 926061fc6a92079aa227cc2e426bd5b2130501422a95e6a8984f15f05dee2e70
MD5 32528f494643e0e05625d5a5b8e61263
SHA1 701eb330c5f29b2178c6196404f3bc53e297987e
SHA512 80979203400fde66bc2f5567c2cc5a60448b8336dca93b8ef7d2d77033a063a9c581b9acdb99f81c1affae5fe159f2b4bc74b842104ffbb05172cb4656ab561b
SSDEEP 3072:ppIo/Z/nT74FOGNcO7/exDn/1ISZ3kHoh3I42H01Vqx:ppb7tpssD/1IQ332H2Vqx
TLSH
T1FFD38D01B090C072E5BE19390864DF725B7EB874DF906DCB63A50B7A9E703C19E35A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwaB102.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwaB102.tmp
Size 173KB
SHA256 6dd62d41da015e4a1486a8866fcb28ac1209a552be8313dbd63e821cb46811c8
MD5 6e7f3a7401c7da1e60f5df4531738ab4
SHA1 fc6305ca9ae4023d45ca8d7e67304f59a8ed2aa7
SHA512 4f6984e41b17bfe78a8d27c6fae33b3a2f7d8db3479f73ce3a1d42782db7ee029bc44b77cdc3ebe0d046e72a613ccfe406748878d5002e947cfce266cf90af41
SSDEEP 3072:1WKqE1/0WjsAGX5Gn39yf19led13p9tyDTQrf:1J1MWoAGJqe1neftyP4f
TLSH
T15C045C1BB7A400BBE577D27888930A06F777781107609B9F03A4477A5F27790AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2876-346-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-643-0x00007FF6C8FD0000-0x00007FF6C8FE0000-memory.dmp

Download

memory/2876-305-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-308-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-307-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-340-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-331-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-337-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-335-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-345-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-351-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-350-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-349-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-348-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-347-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-306-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-344-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-390-0x00007FF67D3C0000-0x00007FF67D3D0000-memory.dmp

Download

memory/2876-551-0x00007FF669AD0000-0x00007FF669AE0000-memory.dmp

Download

memory/2876-491-0x00007FF6D9210000-0x00007FF6D9220000-memory.dmp

Download

memory/2876-490-0x00007FF6D9210000-0x00007FF6D9220000-memory.dmp

Download

memory/2876-459-0x00007FF67D3C0000-0x00007FF67D3D0000-memory.dmp

Download

memory/2876-460-0x00007FF67D3C0000-0x00007FF67D3D0000-memory.dmp

Download

memory/2876-364-0x00007FF6A75C0000-0x00007FF6A75D0000-memory.dmp

Download

memory/2876-503-0x00007FF6D9210000-0x00007FF6D9220000-memory.dmp

Download

memory/2876-493-0x00007FF6D9210000-0x00007FF6D9220000-memory.dmp

Download

memory/2876-489-0x00007FF6D9210000-0x00007FF6D9220000-memory.dmp

Download

memory/2876-487-0x00007FF6D9210000-0x00007FF6D9220000-memory.dmp

Download

memory/2876-368-0x00007FF6D9210000-0x00007FF6D9220000-memory.dmp

Download

memory/2876-343-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-342-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-621-0x00007FF6C8FD0000-0x00007FF6C8FE0000-memory.dmp

Download

memory/2876-628-0x00007FF6C8FD0000-0x00007FF6C8FE0000-memory.dmp

Download

memory/2876-722-0x00007FF67D3C0000-0x00007FF67D3D0000-memory.dmp

Download

memory/2876-619-0x00007FF6D9210000-0x00007FF6D9220000-memory.dmp

Download

memory/2876-618-0x00007FF6C8FD0000-0x00007FF6C8FE0000-memory.dmp

Download

memory/2876-562-0x00007FF6C8FD0000-0x00007FF6C8FE0000-memory.dmp

Download

memory/2876-316-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-557-0x00007FF6870C0000-0x00007FF6870D0000-memory.dmp

Download

memory/2876-723-0x00007FF67D3C0000-0x00007FF67D3D0000-memory.dmp

Download

memory/2876-744-0x00007FF6C8FD0000-0x00007FF6C8FE0000-memory.dmp

Download

memory/2876-736-0x00007FF6C8FD0000-0x00007FF6C8FE0000-memory.dmp

Download

memory/2876-745-0x00007FF6C8FD0000-0x00007FF6C8FE0000-memory.dmp

Download

memory/2876-1041-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-1042-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-317-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-328-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-319-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-320-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-326-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-322-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-324-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/2876-325-0x00007FF6C68A0000-0x00007FF6C68B0000-memory.dmp

Download

memory/4256-13-0x0000000000690000-0x0000000000779000-memory.dmp

Download

memory/4256-0-0x0000000000690000-0x0000000000779000-memory.dmp

Download

memory/4644-44-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-52-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-15-0x0000000001A70000-0x0000000001A71000-memory.dmp

Download

memory/4644-28-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-38-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-37-0x0000000000D30000-0x000000000117B000-memory.dmp

Download

memory/4644-43-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-42-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-29-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-35-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-34-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-6-0x0000000001A70000-0x0000000001A71000-memory.dmp

Download

memory/4644-14-0x0000000000D30000-0x000000000117B000-memory.dmp

Download

memory/4644-48-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-49-0x0000000006590000-0x00000000066D0000-memory.dmp

Download

memory/4644-51-0x0000000000D30000-0x000000000117B000-memory.dmp

Download

memory/4644-140-0x0000000000D30000-0x000000000117B000-memory.dmp

Download

memory/4644-97-0x0000000000D30000-0x000000000117B000-memory.dmp

Download

memory/4644-95-0x0000000006590000-0x00000000066D0000-memory.dmp

Download