213d843822c26fdd34c39db190b4194b2b5ebfdfbeb2d0fba9539719aa1d4662

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$R0NVS9R.exe
Size 6.6MB
Sample260804-nbkpasdl9s
SHA256 213d843822c26fdd34c39db190b4194b2b5ebfdfbeb2d0fba9539719aa1d4662
MD5 a01a7381cc1444d4f4b4bbf4746a21c5
SHA1 23f96ab560bbaba15bd2330f938fcbe3e140d072
SHA512 2eecb3a8be392e60bc9b3484959820bcaaa76b1fdc6af10178161c9997fc12dbf032dc589291b1df5c4afeb1d68eb0bf5b77948d536d287da47d6a170314308e
SSDEEP 196608:kr92TlYbckURXNYKzogqQtAwKLD2fxaQF1uujtxZ:kUTKckqYKMghyLqZBFUujx
TLSH
T11E66123FF28B613EE46A1A3539B6A210593B7A6164178C4296FCF44CCF651B01D3E78B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
6	5920	$R0NVS9R.tmp
20	2560	saBSI.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
5920	$R0NVS9R.tmp
5832	saBSI.exe
2560	saBSI.exe
4156	installer.exe
1624	installer.exe
5816	ServiceHost.exe
5828	servicehost.exe
1504	UIHost.exe
2828	updater.exe

Loads dropped DLL 10 IoCs

pid	Process
5920	$R0NVS9R.tmp
2560	saBSI.exe
1624	installer.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
1504	UIHost.exe
1504	UIHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 9 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\Avast Software\Avast	$R0NVS9R.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	$R0NVS9R.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\AVG\AV\Dir	$R0NVS9R.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	$R0NVS9R.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	$R0NVS9R.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	$R0NVS9R.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\AVAST Software\Avast	$R0NVS9R.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	$R0NVS9R.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	$R0NVS9R.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\smareputationcounter.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-da-DK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle-rebranding.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-it-IT.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\navigatedtoday.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\securesearchtoast.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dialog-balloon.css	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\balloon_safe_annotation.png	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\wa-utils.js	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\jslang\wa-res-shared-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check2.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\wa-ss-toast-auto-install-v2.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-cs-CZ.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\dialog-balloon-logo.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nl-NL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-malicious-webpage-toast-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-core.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-hu-HU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\wa_install_icon.png	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\jslang\eula-en-US.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-1.png	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_msgbus.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pl-PL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sr-Latn-CS.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pl-PL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-cs-CZ.js	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\jslang\wa-res-install-da-DK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon2.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-hu-HU.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\rules.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-toggle-rebranding.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-ko-KR.js	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\wa-install.html	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-de-DE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\browserplugin.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ko-KR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-fr-FR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-font.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\auto-install-progress-ui.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\samrecoverable.luc	installer.exe
File created	C:\Program Files\McAfee\Temp3741381483\jslang\wa-res-install-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_off.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\microsoftedgewebview2setup.exe	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\msspstatus.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\auto-install-progress-fullscreen-ui.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticseventsconfig.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\servicehost.exe	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\browserhost.exe	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-es-ES.js	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2020	cmd.exe
5964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$R0NVS9R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$R0NVS9R.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5248-1-0x0000000000B10000-0x0000000000BF9000-memory.dmp	innosetup
behavioral1/memory/5248-16-0x0000000000B10000-0x0000000000BF9000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	$R0NVS9R.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	$R0NVS9R.tmp

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\WSSDep.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	saBSI.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5920	$R0NVS9R.tmp
5920	$R0NVS9R.tmp
5920	$R0NVS9R.tmp
5920	$R0NVS9R.tmp
5920	$R0NVS9R.tmp
5920	$R0NVS9R.tmp
5920	$R0NVS9R.tmp
5920	$R0NVS9R.tmp
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
5832	saBSI.exe
2560	saBSI.exe
2560	saBSI.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe
5816	ServiceHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5920	$R0NVS9R.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 5920	5248	$R0NVS9R.exe	89
PID 5920 wrote to memory of 5832	5920	$R0NVS9R.tmp	92
PID 5832 wrote to memory of 2560	5832	saBSI.exe	93
PID 2560 wrote to memory of 4156	2560	saBSI.exe	94
PID 4156 wrote to memory of 1624	4156	installer.exe	95
PID 5816 wrote to memory of 1504	5816	ServiceHost.exe	100
PID 5816 wrote to memory of 2828	5816	ServiceHost.exe	101
PID 2828 wrote to memory of 5964	2828	updater.exe	102
PID 2828 wrote to memory of 2020	2828	updater.exe	104

C:\Users\Admin\AppData\Local\Temp\$R0NVS9R.exe
"C:\Users\Admin\AppData\Local\Temp\$R0NVS9R.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Users\Admin\AppData\Local\Temp\is-IDDQD0MWFP.tmp\$R0NVS9R.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IDDQD0MWFP.tmp\$R0NVS9R.tmp" /SL5="$4010A,5592098,893952,C:\Users\Admin\AppData\Local\Temp\$R0NVS9R.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\prod0_extract\saBSI.exe
    "C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB InstallID=GnjW1deoWtxwunDV1x5tCXGDLkRfsTZZRmSdzTbhNPD2bpBRufSulba3wD4dZi5P9lsGKBOlcLfELpaYtTY
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
      "C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true InstallID=GnjW1deoWtxwunDV1x5tCXGDLkRfsTZZRmSdzTbhNPD2bpBRufSulba3wD4dZi5P9lsGKBOlcLfELpaYtTY saBsiVersion=4.1.1.865 CountryCode=GB /no_self_update
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
        
        "C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4156
      - C:\Program Files\McAfee\Temp3741381483\installer.exe
        
        "C:\Program Files\McAfee\Temp3741381483\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Modifies registry class
        
        PID:1624

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1504
- C:\Program Files\McAfee\WebAdvisor\updater.exe
  "C:\Program Files\McAfee\WebAdvisor\updater.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )
    3⤵
    - Executes a command shell one-liner
    PID:5964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"
    3⤵
    - Executes a command shell one-liner
    PID:2020

C:\Program Files\McAfee\WebAdvisor\servicehost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

analyticsmanager.cab

Path C:\Program Files\McAfee\Temp3741381483\analyticsmanager.cab
Size 2.9MB
SHA256 49c13a3f53ba4c7c883b956cfeabd9991900cfaeb1999a904a94e97cfc2e2d55
MD5 7508d2b3448f2f67f8c4ca5a508e7a82
SHA1 468cabf758e9c802070b898fa6604cb570363839
SHA512 f1906d1aad8cb0f92cce88ab912f9f2823899c9a6398d835028ec2779711d1e277d1a3574d92543646060ad06c7a1ade0de4a9008077d9f7bfdeccdcf5f64793
SSDEEP 49152:NABYqsGZANvJ4LX5QAqO/4e3eXW15dL9Ad0S0GZwWlg5:NdqsHReQvOQeOXG5980wwWlg5
TLSH
T139D5331EDA36F8C3CE45F87FF7E4E1A0A236B2A34E713065508D940EC4452A78D65DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analyticstelemetry.cab

Path C:\Program Files\McAfee\Temp3741381483\analyticstelemetry.cab
Size 68KB
SHA256 eecdbd9faddab9759c5c155c4491991b1493e1f0fe10d7ab20e8262b9b8983ee
MD5 9fa7874de637f02cfff0502ddbc86c0c
SHA1 de295ba2de0b4efe66bb118889e340e54187bc06
SHA512 cdc2d53992eee83049bd5850432ffdd77a911ee48563b96d6f184b7e55d58e5098555d4780f7c6333a8d0f997c8d6eeb2b47bec28f3bdf00ba615dd6c887f29b
SSDEEP 768:GQkJgvdiK3RAlrLjk40Mlk6e7PSKvhLyolQJ4mL0YfPLhdUFh9fhelxiK+vrez7Z:oJA3ihLY/GJ2LvhPlQBPjufIITC7h
TLSH
T19563F2192578BD06FD428A94E1FA6122F17CBA956880E08BF4F81D481FC0F9177DF799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserhost.cab

Path C:\Program Files\McAfee\Temp3741381483\browserhost.cab
Size 2.1MB
SHA256 e03f350b2427446f2d667dd5113542072e172932caaaed84ebe7a7fe277bce3d
MD5 adc103d480ce94ccdc3552dddf328244
SHA1 91a0038433e2d3f7fdaa9667bc30bbd2f44d5f30
SHA512 47e4bddf35354ab30bae6ff468d84029aa08084cf7ab8450fac2a19ccef8d7ca1973ede07374d21c47d6ea7206b691b05dc9cc36001d4d4ff3add75dc3954cf5
SSDEEP 49152:w1jZYo2sXUGgGeQNVTrcfMTTEw+54/IQH3Y9ZG4j/0amWZI:mYo23LGfRXEWQQHKc4gH
TLSH
T166A53349D124B7C3328EF2A528B53B63415F9CD5DFB9C4C2239E7EA9AFD11123489B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserplugin.cab

Path C:\Program Files\McAfee\Temp3741381483\browserplugin.cab
Size 4.8MB
SHA256 a60f76ba0fa4c9aada04ec8fbc708f60b44e1b7dcbc0d0aa7fe5da1c8a8f2e1d
MD5 8f7f21741afe24ec005779e149596bdf
SHA1 8985cdd29c2630d9b49b592d675d5d3b87c1a17f
SHA512 8e89d875f300f83b252da8423018a0cf4be1659a1b147db13adb13d60491d73dd2eb92c2915224c87349f8d9c205cd34078980cedb3b92cba62a7a83a72c2d9a
SSDEEP 98304:hP1rx20xoUoRYyKXJT6me+cU7Zd94YoMVvtvQNUznnFu5U3T:hd1+cyKXRbe/U7ZgYNV1vMULFdD
TLSH
T1F03633FEC5879240D7095EB75BD0A93FC0697BBEF0E3A0690A9D6294722FB536211E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds_invoker.cab

Path C:\Program Files\McAfee\Temp3741381483\ds_invoker.cab
Size 4.0MB
SHA256 bb81825ef98bec8b8d8ce7c6370989f6e556ba09afa7bd7f913ef23ddc2e39c4
MD5 5f17fd315674d687daa6da837691a482
SHA1 9b6e0e27c76aa60a561e84dd094051fddd680f42
SHA512 309dd49a18b9bf6a75a818bdc1fbe4d20f0ef6c0f121c20025b27602315cc8f81083cac6c19daf8a1d998fc49b3376ec38e4e975609dd38796267aa2e8c5c296
SSDEEP 98304:vpWXMtxGdykTMeavLLmw5qB4t7rFPRX0UsC:vi2xuduvg41FPwC
TLSH
T1F8163304693F84D83C39C9977572CB39742A210A946EBF77B6A9DB1F13492C18CCE798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Program Files\McAfee\Temp3741381483\installer.exe
Size 2.9MB
SHA256 90df564f19ba530517cc756637ac3da492d5a891f6c6b90b9115034199e4a218
MD5 5c47c316a96d7874bafdaa2dfdf800bc
SHA1 45ba68806d8562364a0668fb277de07143f4b780
SHA512 633fde0d1bfac922b8c014a8711d0a5a5153f4c7bbec5fd730e85dd6d8ba7aa701d5203ce0ad024f30997c1c512e0cddc3efc33a452b9d451b830bdbe734d028
SSDEEP 49152:0slWWNwead6qjQuc5LjMKVAepHQGx1k/PeYGAuZbE:T7wetqjq5LjrVxwo1cJuZI
TLSH
T129D59F1BB2F640F6D876C074C942860BE7B2B41543705BEF1290566A6FB7AE00E7F729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l10n.cab

Path C:\Program Files\McAfee\Temp3741381483\l10n.cab
Size 226KB
SHA256 603b64cc017ca7b790794b178f2a021cc477ee2dc21fe8cd74cc3bf38ff0eaac
MD5 f265337b50ce5a2c1e41660d6e6288c9
SHA1 587fe2a17a6c106382c37a99a7176750b9e1bf37
SHA512 6a6f04dbe80a9925cea25b7bb7d30b6c5a43f8d3a92b7bf0e18608623a6daeda404e12540bad21d96daca6876b70a89f770793f3f68d47ed5a85501ce40dde74
SSDEEP 3072:I0Iqvrc4S7tioZRvf+GE3unA9KhmyfDOtBAM2P7fVQmJa5KkJH4UQ76Vq:6qDc4Sr/DEBoKz8VOpyUjq
TLSH
T1CF34BEE07E4EA6ADC811D35B92200930D187604ADFD9E9CBD36E028C6D6279E1D97F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicmodule.cab

Path C:\Program Files\McAfee\Temp3741381483\logicmodule.cab
Size 2.5MB
SHA256 41d6ed292ce554dec6fbd6fe10f86a965d3d352dcec89115ad4525c38aded01b
MD5 e0a1ef6799f3256c2d045c51df4f7d74
SHA1 1c22b3e4fe72f709236306057000cdda3445a99e
SHA512 e05963f4ed06bd3afae86d7c37f5044ca7890c84e67c7e7c826b4d08cfdfe9504c3b2c1e73a49a2a5f29855cc9aaa5673304619f3a0bdad5b6459d3d2b2b1136
SSDEEP 49152:syme/HXFBFbRuOFOaFPYnXsC86C3MJ36AaIBdv9FpdA205GKacxtaawElQj:jme/VBDFOqPCbpCAKAaIBdTjIQOEawOC
TLSH
T136C53327A260055169F1FCFECCE3F3F5E684129895FC0790B0DB6436432C6299D5AA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicscripts.cab

Path C:\Program Files\McAfee\Temp3741381483\logicscripts.cab
Size 70KB
SHA256 2c9761410287ed9f7ea682b67ec5451f5f8940af90591040897cc34c0b6478eb
MD5 186387ae406c0f9c02bc0972ab8bb032
SHA1 3e27ff9b726c0696c3b2c8f44cfa9e7cd227248c
SHA512 6efd6b560aaff45b2dbbdd87280a5905bf3d14bb813820ae9045d882ef26bc2eefe73e499ecf7d0242d8557795380761316375a85a1512a1bc9c970689cabe20
SSDEEP 1536:1PJrFwzQVlbhsrehJhZy9+axKtlzstUt8FkYECjPMg7OB:1xrcQLNsah5y9nxtGtmkYxMgiB
TLSH
T12C63F132A7389B46AF67E8F569D78013D8FD22C69CE4944B257C822D53C43913F9F0A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-mwb.cab

Path C:\Program Files\McAfee\Temp3741381483\mfw-mwb.cab
Size 20KB
SHA256 d8360cd2e9b0d477a138c3d722f617c16f4c11d0f80f27955c05823255de4a9c
MD5 a680eed9966e4126a2b06efb46dbc5d2
SHA1 bb7d6fa69307f3302a70a6de70920c4a2c868e43
SHA512 7f836877a2d56b814b4fdafb8d654a4b3493e8db6d84b2d51d112ce39fe5bb617f0f687d1088000fd8a71aba5d12ad2067f97549e64218f55e566dc1e3060447
SSDEEP 384:uI96UXzAefqktJqCt33SPuFE1Vf6ki29d1ikCtiy8RbmL4nNyao+3bM:uIUUXzAebztHSPu21Vi2PsA5ALb+A
TLSH
T19D92AEA208259803F987DE74B4D85522DC39E7867DE8E0DBA51982348BC03C33BDE5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-nps.cab

Path C:\Program Files\McAfee\Temp3741381483\mfw-nps.cab
Size 22KB
SHA256 be7d77686d57d5195ff3b66ec56b609bdd5a0a58191379fea61177e5fd7a0e9c
MD5 8ba0f6fd91c6c761cda467189546a402
SHA1 cac7b750b5c2f4fe7b26346059a45ab90069a94d
SHA512 d72618736d5a1bb1238805202533b35efec96fdaf814d64d2165e169fa5af7c8995ceeef3ed3df3f5e8e17abafda08796e83ab72763ab140efb6d99cec5d4fad
SSDEEP 384:IZpylT+4SAXbcAo7AtCTetUbkA6ki29d1ikI7o01y8RbmL4nNy8LEnc:EIlFy7AtseKIz2PsS015AL2p
TLSH
T183A2AFA398A00843FD579E31F4E0D9239DB2B196BAD5A5C2B265862C47C83523BCF19D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-webadvisor.cab

Path C:\Program Files\McAfee\Temp3741381483\mfw-webadvisor.cab
Size 584KB
SHA256 8fe56f234e5bd672039424bad70a0b1c3fe1970c9c4911cde87de1f7f9b2ab20
MD5 a7895e742664542f9499ed19f1c9a9e7
SHA1 e1b22cd4723bbff41632de82fe67b78cfb580221
SHA512 2a47d504ee2888a9b02ceb20ab977ce74fda2606d27a6c9cd7885816058f468fe5f1bab5e11c3338649917d64e350b157a4f4f37d98a639d1836d720dcdaf8c3
SSDEEP 12288:47oMYoc6rE+2EiFyT0/aEZRyi8NIKt0mOYdbazV3CnUL:47oMYdPREOyTeZRyi8NnCYde3CU
TLSH
T176D42327BC866514C82FC3F1F3EA2A307618A969E09059EFBB87DA7DD0153973253493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw.cab

Path C:\Program Files\McAfee\Temp3741381483\mfw.cab
Size 786KB
SHA256 2efca49c23e2d72807f9739b301c9b68d4899e825c8d33da200d9166246c3349
MD5 322777926ee96ad4350bdc5f1513d8e1
SHA1 b16976176f612914fbdb7d43d6e73664544c2a57
SHA512 38ecf836b3b84c857fe06343a4c169241539f3b4eab0dce7ffa538095c7848a4efa38adb71942635bd0595a24c7dd132331a6b54942d53578b4630ebe2eb16f7
SSDEEP 24576:KFRef/ULKTAL+FnGzV7wmE9C+IBUwj8S52:KbcUOg+FnGVwB9C7Rj8m2
TLSH
T16A053332BC940B00ED47512CBBAED1A5992D4BEF50F1524718F6E26DF307362A8E3997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resourcedll.cab

Path C:\Program Files\McAfee\Temp3741381483\resourcedll.cab
Size 37KB
SHA256 64d229e58494615c643d5c289c182fd58236b0f400376d129c51a5979dfa52c4
MD5 6e09ed71699ba1aa2743ceb43d9cf742
SHA1 d5dc5431643d2e74ee831a7090d11d97d3ad7988
SHA512 7ff032309fbb9287bfac258adefa54984c94bdc5f3e4fba32d723585a9ae54fc3c8d43d55979a258999cac0bfdc476e7939a694f417c1eca18b033ef895ea74b
SSDEEP 768:4TdiRm/gxO3jG2eRjiUO5HSNMOfAQ4jvQ+g2Psw5AL7:4nsO67RjG0Pbevdg7H
TLSH
T13E03E0A288245C47FE13AD3DE8D2CA278F315A85BCE9D4C372E581690FE435936B8359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicehost.cab

Path C:\Program Files\McAfee\Temp3741381483\servicehost.cab
Size 320KB
SHA256 c6405eedccc4ad152964701c6a816a71b7f4fc40d4da55da490a7bec156635d6
MD5 049113ce20522b784fb73cc02750b786
SHA1 6ac8587d7fee19196ab5ce1f137a5cd78045c690
SHA512 1720e63c675ecdde5f084950ab2932d86d1779aa9e255d9232353e17a6512991ef2171b5d5a94616fad22cb49f7ee2263b41d207792903d84be115ee095b5d9f
SSDEEP 6144:p8HflWi+LkcjyUY1jMH9DwKAKKvNcd1Smc4LDl6tYUxpZBM+Z5qpTyr4uml5:p8/lWZdQ1jc9DUZvNi1SmcI56q2rM+fM
TLSH
T1A8642316EC108C16E5A65FF3D0D70D4FAD18A7C325B5BED25393E8512E127860DE8E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingmanager.cab

Path C:\Program Files\McAfee\Temp3741381483\settingmanager.cab
Size 808KB
SHA256 70ff7b399d68f9e5d2f8aa2091ac3e2c9430d8c9aadbc35862e5662e4e0fbd37
MD5 9c75fa859642ae137adce7088ae49d34
SHA1 409679b7c0070f35f34cf66d0e9c249ddbd7b3e6
SHA512 29beea606678fc817cd27443a11cbdf914b990ad573e5c35eb1467f5686760ba8eb631a761c8299b72ad384ba92f644ead2b7c65b8b3081842241574f5be47ec
SSDEEP 12288:Wru4RDXbK8qJaYbUc+qe+q6ZcMzlT8cBye3Peifuj5+U/DVUcVqkBdf8iqTxAt6:WdXu80ou3KMzZ84PeimpUTkD8iq60
TLSH
T1CF05335D56882D83FB1B1D4ED0578016650AAC4B06E7C0D3FFA8CC4D7B99AE234B06AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskmanager.cab

Path C:\Program Files\McAfee\Temp3741381483\taskmanager.cab
Size 3.8MB
SHA256 ab461ec473d981a8d40a680045415ad27eb625fe09df350a2f9a33ff02642179
MD5 0c20a5a00da6c2fc9a9b085948970b83
SHA1 ee9f0bbf1df49a6b7c7fc70dcdb531309af81bfb
SHA512 0a7d07ce2bccdd9171fecbd486f4c6db8d3d055e5de1a1f652e4738a01b2e48eec044ff3939e3c92ee06e45b6ad06c41f204de2de426fd4744123d4c6f0ba29a
SSDEEP 98304:2px08sXRzH6l7xkt1KlO2zbSQJGQBcMNiW0r7FEA:24SUKQ2lJoMkW0rBEA
TLSH
T11A1633E061FE63B1CF843AE45FEA4B14AA2354E14625A34F2F6CE13DEFE12E1491C558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uihost.cab

Path C:\Program Files\McAfee\Temp3741381483\uihost.cab
Size 388KB
SHA256 43ff6a1169c4fe56ddb346db28c8ab75a1d1c8f3fa11ad3e6ff6c08b9dca1ed6
MD5 4cdaad411104e988d3f388a43a1d89af
SHA1 3f6dc619b9cd57044f9aa7e6ff74c79abc39eab9
SHA512 64b7e05f20c02391415e4a7b2609ca2c3576b97865a82e6b0b948a7f3e42c9f23fc2dea449939632840bbd2aa4f94a2aec8f8b2660fbd6bc23b8b0bc9a8a9da1
SSDEEP 12288:le2sWyUJFXu1xPvePHnX579cpF54ZE5QM7:lTyUjE1u9SpwZu
TLSH
T10D842212C1E1145CDCDB9F5D16A0148BCE7E1E69FC7BE58A02ADC229240BB5339CEDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uimanager.cab

Path C:\Program Files\McAfee\Temp3741381483\uimanager.cab
Size 4.9MB
SHA256 7a0b03a48cd54fb08a347cb4b35ab6b0394379a311d8f69f00902c6c17778af5
MD5 34de199a66b401b8a85869c770f06727
SHA1 03a2722b34f609e2c097a0b8feb016b531498b37
SHA512 55350e5c3299c3754fcaa16a454008d371b60ad241eae80e51636c193fa452d2db55ceba4638f3cb98777f28b7e997c273fc4ee479492fea1bda63cbcf89cb30
SSDEEP 98304:uTKMFJ7M7TB0giwF3HLSkDbC9eccpnznDaZJRheLqE+t7+Bu1+1:uTKyx+diSrhybcpDDarRhG5x1
TLSH
T1D236331CB235C4D8E5A1A7331BF780AB6FAF4DDC403B403E846B6C0DD6165AAC95DA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstaller.cab

Path C:\Program Files\McAfee\Temp3741381483\uninstaller.cab
Size 1.0MB
SHA256 7544a8d683201104a2be9a8bf6ca39b9ef594a88e4f15af6ee7ec769ff46c4d3
MD5 e9bc37f8d2f88efc4dced48cdb1bb610
SHA1 17295c823b61f54280d911f1a116da8efde9d2b5
SHA512 f0c4ca14775c7ded7e240bcec60a053d07fdb5b42cc7181cf52506e90149696a4459ed6d27a4c92440724e6154e2235b12fb741c1e75397f6ef92cc85998d5f2
SSDEEP 24576:HSbQxEF2UG9He5ae5c7em/2Lka+AF1JYIiiZeAmpbDBAtYqN:HSJQUGPuTqukaJFQITEAmdBAtYqN
TLSH
T1E23533870B111EB545AF56BB78A1E56BBC00F5CB2B3861DB3838E1828B3CB76770D585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.cab

Path C:\Program Files\McAfee\Temp3741381483\updater.cab
Size 991KB
SHA256 f9e934fec243f11a4ed70bb41f6fb548e3ea76ed5f87f9f232d668ccabd73669
MD5 bc39398e9dea4ba36dd7aea78734b6a3
SHA1 3b77740164fa5d84cbe7d9ae2bfd2da059364665
SHA512 c58c88845ad5016fa2eb7f00462b752d025840148f185f1daa2e2d8eeddb5437339d9104feecd6c7ba93b1f006df24b3bbbaf153c1f833b0892790c78075080b
SSDEEP 24576:thbRcPMSrHid19Ea8VNhStpealM9BW8mKoVlwFVJp0d:fRcP7C5R8VNhOpt8NoV2FLp0d
TLSH
T177253358A66FBBC12F8B153AAED3807981E4C383DA8DE4D35E2146019B1C397D6D0ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webadvisor.cab

Path C:\Program Files\McAfee\Temp3741381483\webadvisor.cab
Size 11KB
SHA256 840be70810912b2d5a9e1b00f9b79a45f58aeff296dacb0a2684dc71d975d881
MD5 eb49c71f9ae2b8c38854964c1ba898bc
SHA1 e2a37a218a4e1662740a7b51485537d318072f38
SHA512 b50822a73e2b95d7192017707a7319d9bf52d709eddf8a75a8642be1d9d3df96e86b3e0c870ad1673fa89f5386883835e3273e72f10cdf896957d01781718c07
SSDEEP 192:Xemq6kSDnicM9Lx76iiX0iIPJmYULc8pq8RuwdmL4pUQrNyz50SH:XXq6ki29d1ikBPJmty8RbmL4nNyz50U
TLSH
T10E325AA38C681843FE439DB5F0D4DA23AD72F2C529E5D0D37059C2551B883923BDE69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.cab

Path C:\Program Files\McAfee\Temp3741381483\wssdep.cab
Size 574KB
SHA256 cdf1578fda1bc72ee794e7941eb59aacf437ca1a10fc28d31061417141c2dc1d
MD5 b9db209c43752e49d1d9e4cee499a90b
SHA1 6fa7d1c8f31fc80c1a903569d61f7666cd45bc9a
SHA512 c580701d939b988e73f2a9864cea1ac31c9eed038335b3a2c680bfb7ad8bc18009fc17101a170c06d08236c527d03e6ab91643d86b9c2a0d10b65a81f7a7b20b
SSDEEP 12288:aaDCpBW6FloEq8tKDnqCOOrcv39TYko5E3eKfLC1Qplz17M4MUeJyl:PC6KlddtKDYKcv39To5EhLIQ7zZM4M2l
TLSH
T1E9C4231A18A09544DC37F2A1F8ECE3401D26FF8D62AAA4C7B54EDB0A1C057E39FDD592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsManager.dll

Path C:\Program Files\McAfee\WebAdvisor\AnalyticsManager.dll
Size 9.1MB
SHA256 c516729da3786a501304505496786275a4dada486f73a6a04a4baf8b5ecc7f78
MD5 4b5e7c5c68a4381cd70ce516f2e9beb9
SHA1 3f692428f5215cecab307bd8dae7f7c441959b43
SHA512 3dfdeb5d41931e6b541002137a7e1280349c0f3aeae26bd241788bf8c1c8bede96f22252b445a889e3ab91fed44820e49fe3b131ae7e6dde0b986bcd21b7a4f6
SSDEEP 98304:iFCP9WOmtt6+CMjbtw7J3KH7CCZWGi89zq307+YhzB:MC1Pmi+CMjRHCBG9GkvB
TLSH
T11EA67D43F6BA40E4C8FAC1388A576627FAB17C56473497EB0694562A0F33BF0A63D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataConfig.cab

Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
Size 80KB
SHA256 97222f121e384e0224e4cfcdd3174ad58af17e08d57025d88ca638b65bed72f5
MD5 65a5df132da1f7d3a607323a21f6dd35
SHA1 2cd3c265bdc9926c8e530378cc2a74b8c0b2b4f1
SHA512 ee60aa8326335b5c32594c087150577744c09baf789fb137ef9e47c17c3d372ca630a2ef726b1c586e5809ef6a27e3a7d602bf5b0fd2546b6b8ea682efa227cc
SSDEEP 1536:Rvhgkw9rdJqN0WLH5LiM+2q1/e7Ldmak5hfNGKB4Bk3ilpTEuFaW:Rv2kY/qjT5Lx+2q1Glma6hfWpTEu4W
TLSH
T17E8302E09A844406CF25CDF9F0DBBCAB5C7CD2551CF790C3616EAA96910E3906F892DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogicModule.dll

Path C:\Program Files\McAfee\WebAdvisor\LogicModule.dll
Size 7.8MB
SHA256 50177c8f81e7c7b925d34c87e55d95c788f8d9aaa8e3c17ae2e77ec1bb5bf4b0
MD5 ccff8d128deac977a74dc8803465d94b
SHA1 6b50bacb93c72f6387d96a73e50f93c50570fe5f
SHA512 5cc0959ab31aed4ac0af65c702789c9a64ee110ec88ad1548378b147f4bbfc889de14938837589ff71b0cc0ee606cc026a6b75300a335bd314b34469cbcb5f4f
SSDEEP 98304:jGF04fZWhw+sLNnlLDXFRTa/Ck/ALx5l/IspiIsTLfG:jGF0Iz++lLDXTPd/AsABK
TLSH
T18B866C47F6B610E5D8FAC1388A136227FAB1B8494730A7E747945A2A0F73BF0963D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

json.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\json.luc
Size 562B
SHA256 d92ebc8141223a52b17e3a6a0f7ecd7475762a80a84aa763dddf23c79f772efd
MD5 a67089488d2643eadba08ed209fcf08d
SHA1 0ef3996aa25d2b3500243d977ad5c66573b49ce5
SHA512 46d01eaeeb381f741e160f49d77a3ed77ba1c8d5d1665eaab20a823becf59e65c575521b00ac2e08fd0ffc67ad532fbe24d49b2cddbca9f46f5abcc1f9c9ffae
TLSH
T17CF0208C9444AEBA6EAE442788311720524C0CE4072202922E23BFE0994FC30AB3326C
MD5 SHA1 SHA512 TLSH

Submit Download

browserUtils.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\browserUtils.luc
Size 3KB
SHA256 b2b1531802b4b224e1fde0eb325deec10116f1a4ab90e6685623ad524a7c6e61
MD5 33839af1e32262782c2f2f5a5b1e8bb2
SHA1 7127802e0899aa77bd0cd2e98e0862c4879d9184
SHA512 0dba7171267cc3b30b7b11c657e899312be15e0fd0450e0fc278eeab821db1dd1b83bbf175229f200269070119ba92d299344fc4c37d3f2069be75f4c2e145d3
TLSH
T14D61220ADC0F5D34B760622FE2459B6A7F7CBD84233296725A97101F46419CAC28F75D
MD5 SHA1 SHA512 TLSH

Submit Download

stringUtils.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\stringUtils.luc
Size 381B
SHA256 2f5467bbc11683955db35feed608c72f7d5c189401297f0381468d640d903f81
MD5 d2c4b42c57a8617839a0fd5bba2166d3
SHA1 780adb3b3929866684eb573584e7c9b846c90b71
SHA512 fcee9cf8146c8bc316319bcc23ee8e783a7aef056e3924669fb4cda3cc64102cb49d4da2be96bc8cc1c04ae3d9623d68c5f3ccc0baeb0910a5deabc4bfffc074
TLSH
T13AE0680CAC247876D111AA17202A8A066AA2AF854963C37B825107B95A46C81CF6F11C
MD5 SHA1 SHA512 TLSH

Submit Download

win32helper.luc

Path C:\Program Files\McAfee\WebAdvisor\MFW\core\win32helper.luc
Size 29KB
SHA256 503da2cf3b6c3c44d3358193514888c3d26cc4c25dc198fe5239a14944e6dcfa
MD5 e0b6aab6281b294d0de1b018a224fa78
SHA1 b580e0ec5005ee830961d5234e05af8b0e1a4eaa
SHA512 993f8967487d0601bc1a799062f8db6f83471b4dd911147dc9f83b8468a933f165f973894589e5168b30cfc770372e54bd22369a3e39251a0ac5a3ab3fa8273a
SSDEEP 384:JX/CIGkba/ZqyBhyCTz5KamxnbxSHoiStiJ6UhfD07:Jfah5yAKaqboIiStiJ6sfD0
TLSH
T18AD2A68F8A4585F1B42F81121673AE061154B2673B64BD70388F92A41F1B60BFBFB6F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resource.dll

Path C:\Program Files\McAfee\WebAdvisor\Resource.dll
Size 26KB
SHA256 0eadff2d6fea95096942a6423f65314e7b61239f4bae4d25cf260e5b3f597ac0
MD5 5bc86841560e798eb0a50c7bbb80f793
SHA1 991cc8cd34704b710b9eacb0f2959191743b82e0
SHA512 99fb0d62efbfd7201efccfaf2b3e536af0267065be63c2467763d186afd15d8bd5764a12d0e44a32751c02401fed64d8e528827d28c6986676ae13396f7562a6
SSDEEP 384:8BhBT/W58RrB3M65lWHqXPDqbaP6ki29d1ik4u9y8RbmL4nNyMmN:mBr3M65mP2Psk95ALL
TLSH
T109C2C616E7ED9593F5B3AD3462F050912E77B8867CB0825E8D40892D7AB0740CFE4B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingManager.dll

Path C:\Program Files\McAfee\WebAdvisor\SettingManager.dll
Size 1.9MB
SHA256 4f7a959ff267f259065abe843b55fec0cad5813674563d784a057f16a88a9ab3
MD5 f3aa4f45da2c4b0e32c2380e0749974b
SHA1 090a78ab42a11c28c5d9a933017d0403d76a1c64
SHA512 602014f4c49a8f3cdd6e96c29a6291612c8cec26a7993ae37041c474a88dde43969e627ecf4ad145146353a16da578235b2c1884a6472ddff080cd6f78e37de8
SSDEEP 49152:jxYBI1JGky3eZgu2gIfesZA1Mp3w/e+pcv18j:9JGky3Dz5twWxY
TLSH
T100957D1BA3AA80B8DD66D2B8C9538917EBB2B445476057DB02E0469D2FB77F0063D33D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TaskManager.dll

Path C:\Program Files\McAfee\WebAdvisor\TaskManager.dll
Size 7.3MB
SHA256 2f1e98e8921b2acd8883b3984f0125334048088c71c347bf9a4c6d0f9da472b3
MD5 38574f9f5d4ab0417b8f2b68eb6f2559
SHA1 95bd3cf67ac903a57229a6f78cce9f0ab52cefb3
SHA512 4dd3da81a78899c98673b0d29c4499467b114d16a40e87385d0dfffea2f8887029ab49e199e2fbe2f010e232d79a27a51450a19cda8731dd6ca5bc0a921147b4
SSDEEP 98304:jYo2NmvWbRYGXbsTdrGMN1zKzHZGCueCGAICfh0J1YHmXAcEi9oo2zpX2Gw:jYo2NmvWbRYGXbsTp0zZBuxGI0XQw
TLSH
T14E766C03F6B650E1C8FBC1388A536127FAB1B8598330A7D746945A6A0F73BF0A63D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIHost.exe

Path C:\Program Files\McAfee\WebAdvisor\UIHost.exe
Size 1.1MB
SHA256 de118e06bfe5a0b2c76ad1fecda34b300f967370289d2aad46a6fb3784fdd921
MD5 1143eb281395ecc33a0cb3dc1e210477
SHA1 8a8ac55d346b388339d5078a1051bed823ee4944
SHA512 dace3fb1933d2c09fae14663c443ac7eb6df535f5fa94b37f1c83ffe7344a67f9f18626bde9eca13ed3190b163ee2afd2d90a12cf1660ef1accfe7abbe81d473
SSDEEP 12288:d7BcTpgFcH95MOQ81cklZH6T8AsEcvzYIwXxflFSJrb+y:VBWd95MwhV6T8ADKXEJeb3
TLSH
T1D4356C1BE69FC0F5DC76C1B4C9928516EAB2B40983206ADB02A055992FFB5F04E3D73D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIManager.dll

Path C:\Program Files\McAfee\WebAdvisor\UIManager.dll
Size 8.9MB
SHA256 78e3d26303b4b5593493649758b03fe48c4430c92bff020ed1df63d74900ba8a
MD5 1a1c0afbccd8c3b4087934455cdb6eb1
SHA1 b9498d15663c0621f03017ec0bcac22dee9508e1
SHA512 593d72ddb82212d652a72fb183a17d8b5d3bf595824e296a8b80aacf8907f35d23d2e507d5440e15bc6e986f29a4390ef384a5ba856107758c650bf6b2670f96
SSDEEP 98304:3knqviC41+8LDXYXah48mK25H7mkpHoTdCpFLu:iqa3Q8LDX495RloTU7y
TLSH
T11A966C47F6B610E5C8BAC138CA536127FEB278594330A7E746549A2A0F73BF0A63D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsEventsConfig.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsEventsConfig.luc
Size 12KB
SHA256 f746ab96028144b514141256d77e4d8adb26661223c93e8d4be7b9168dec9927
MD5 d20be65e060bf881b25eed4c26c433e0
SHA1 025880a5dfb4aa1d88c1048c9e950babe9b5ada3
SHA512 37c505ec1542c4a522dac267d82a724ef0d15066ea91887067ebdd5f81fb787c377bf9f04c24977e2de8ce82f9925e2d82df6b43b4415f5d1ee81f916e4e2d9f
SSDEEP 384:pn543s8UYOyEpwmOCgqecppK1jjml+g13i4g:pH8UYOyEyGec2q13zg
TLSH
T1C54285AA5F7E6A6DFEBFC2895AF006E409300986B0D015F687BD9D6401C35714FAA70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsTelemetryHandler.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsTelemetryHandler.luc
Size 2KB
SHA256 4cb50519493ca22895e8ebf433696c4e7082fee7e65e3a33bb5896d436d2969b
MD5 d36152059e5dcc48f46bfe6cd009777a
SHA1 7ffcb8f4d6ccb9764b960b2fac5d627625f5b1a6
SHA512 d506a7773056ecde03179e360f789b967b678a538f08e2e6cf610542af1e2b95a79531f1db2163e3bcce0761481fc21dc746988ad69d96e8ad86a2ff0eaf5afd
TLSH
T1BA416589F94C9485453A528FAB93DF05D3B4DFADB302C1A750823FBE4095234FAC32A9
MD5 SHA1 SHA512 TLSH

Submit Download

logic_loader.luc

Path C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc
Size 2KB
SHA256 d1211172e9b69b051962c843d03d38b3aa969ee40f921924e415e415c0ca99db
MD5 c34ff39b8ca074e0175c255f7821a59f
SHA1 2bf29d14ba9e2ec670fe9271db6e2002b4f03bfb
SHA512 7dde9d495285c753e5525069484904a9705ab7be00720ae586dfe8b4c8b6171261a7c660ee902b67e6b9fdd2f20b5344560a747db176799a82d8eb9fa6836914
TLSH
T1B851756786FC4F222E09D0E79B716D04B520A9CF28A10767D4AD46B420515AFFF713F6
MD5 SHA1 SHA512 TLSH

Submit Download

class.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\class.luc
Size 656B
SHA256 cb15db53ecd4ecfc1064470f56a0f647d724fd07aa13f3c34602bd14a6e78263
MD5 2d2cefae8c8a13e54aa72c0894ba4488
SHA1 13df2092780629c9ec3b644b03537f6710ae0535
SHA512 d21adc50dd38c692300b6e595a4125df5a5799141f0c68238585ce3bb0f027a3c2c219f6d5505288c7b54d34f2f0fd084d4bea9971523b8a00f921b21631a709
TLSH
T14BF0D36E11CC3113B41EC1550957BE519691DC124B37433F8236D16EDE3224D161FFC9
MD5 SHA1 SHA512 TLSH

Submit Download

dkjson.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\dkjson.luc
Size 9KB
SHA256 2df4214706d2c1540efe5588dda463ec14c39c66a2422f4da5454a83c1fdecfd
MD5 cf726605930e009b3ea1483dacef3bd8
SHA1 8217cad87fdb63a7cd72373a927f90369e4d6c32
SHA512 63d0c5f515e8a810a915240586996dcf594ccfd040d0dee8570704e37282cfe2cdf912b8a7fc11d0ed869fad1add9a9d30eb6648b0ed8e00c2729eab9cad2af1
SSDEEP 192:jWXBkgh/3g7O7qaNfEyc80vDGwVd4Wog1DYEZpQ7+hC+Tf8IkZ0Jk1H5WEA:ckgBGO7q8RcTvf7xNZUqkLO
TLSH
T1F122EA1F92C81B57753ED03A9A32CF34A6D05C1EFF124F4B612A96B2F55225C9B8638C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logger.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\logger.luc
Size 699B
SHA256 4916b0615d4ccc979967bcb76e5466506f28e48ddeb67a34f9f7f54616b613c1
MD5 a1a170d0a95c9a45e8e4c32a0d9b627c
SHA1 fd9e9506a71e673972a29821f350bc69e665b748
SHA512 e633cd3e7241886462e8cfd2fa7d4e4b4a284c035569048a6d2d987e4c150f86705712e6cff44f35851537088264d5dd973a8ed0c7173510d2bc7713dd864443
TLSH
T18301C00625BB201FD126D38E441477C6A974B8676301CB0E4606BFB206412D1DFEB3DC
MD5 SHA1 SHA512 TLSH

Submit Download

servicehost.exe

Path C:\Program Files\McAfee\WebAdvisor\servicehost.exe
Size 868KB
SHA256 a3a404f7c2465db3e2be2c5aa6556e2269650155a02235602cb07ad66008e93f
MD5 86570224bfecb98a6d535cee82d965ab
SHA1 4cd5c2ba5b5285908016df699d88e0099955050b
SHA512 9ca5dfba9c378008d1d7f2ad9d6d67399308f50095836821c76ee35021272f32c315e2bbe7d5f04afe63ef7808881ecad65bb41c03e052612be285b23b93acc7
SSDEEP 12288:MASdW7dPBRNxeH/PVxNM6I+1JrMkW0b+QZ2s6p2K:M/EfRNm1xNMV+L6FQZW
TLSH
T197158D2EA79C42FDD071D2B9C6425502FB72B80A536166CB47A049A93F7B6E04F7E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.dll

Path C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
Size 785KB
SHA256 26502c82c4e97d28b7ae9acb3072c426589a19adcdca7021efd7c12d627270e0
MD5 236a2e9c1f76555c4a60765e5e61f862
SHA1 1b9a40b7b1308ebfa7fac38e09b87de3463e56f0
SHA512 8ede6e7d09201a972cb13d88962d9d92ebfd70fd572cb113dd1161bb83f92a88f27b5eba199c7ebc4a577750a6923ab479e53c5201da7c126a6f62d921657de2
SSDEEP 12288:nSMUeSJFVwoykQGh5YHWSGBjfWeVoNEOPgdZJ:nSbRJFBykQ8YHWvFWeVKEOPgd
TLSH
T158056C1A7BAC41B5E1B7C17AC9578A1AF7B278151B319BCF0260826E1F377E50E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 8d76204635e79647497ba824a12a049e12d67836dc13d2792d8f0d80d3fe7ddd
MD5 f9e24644f1d9ade9a377d19497019f93
SHA1 57fa12da12af6f5b74709569f7fbb772c0df5a3a
SHA512 06aaea1c013565e5319ca18eb39e94fe83ddd6138074a63587eda9b1b7af66998b9323a54c0ad6ba8f6f28183487455a50c6bc98e1c63081f8d2888675d45327
TLSH
T156217D87BD5C852D75D1CC64B9E085389C322B50ED9BEF24787CB7D440085ECBA6A2A4
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 508B
SHA256 ce0d5b1a02c671d1d2149095d4ff847e086a890f2619943607a28c5aa7d9d7a3
MD5 46a32d83dcfb49d1b6e1e6ed49ddb42d
SHA1 ea610e146e14da2bc2ee1ee4c4ff79d1df546a81
SHA512 f071ad33f778e36babf4fb6593187e83641d78f30ae4ae722eec94101b5915f9a4458032457228458480e133db785d1144c4e408eaa10c822eb8da9acec4b461
TLSH
T142F05947AD9C497EB4E0DC20BED0843849231B10AD97EF24FC7DAAD041086DE82242E0
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 ec22913725149c87bf651b01e9788513b7d42a1c5ca748b370d310fb4a4f3643
MD5 564b65b183b93af9a95ae6fde2ace091
SHA1 7d55b45c9dbdc3df5d16f92c98c51fc231112abd
SHA512 287aa6fe0492bd953e0ff82e3e6932f2514232167c6e0c4f97925ba7466dcc8cb1c5acd168df4cec650bc4eb2ee06196187a5eb112a6ac8d20778dd687047084
SSDEEP 24:kXFznFAFBVhV7FeSFfFfV8gFsFvFsVS/F4FpFlValSF7FgFhVFKF0FrXFQVf+XF3:zmb52G/ic
TLSH
T14691484BAD9C497EB5D0CC70BAD188784D721B10AD97EF24BCBDB6D0811D6EC92346E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 20e6e0a16853dbfbdb82d18d80397d668ca16126c828f79aea65ec2b96a5cd05
MD5 ae393c15cb790a90236fe0b12b870ba8
SHA1 136ed1ab9c0c07bfd92d13e37d76048bb4acb257
SHA512 5cac368d38fc82fff81ca064f98e786e5fcb9980b043d980fa0d95cb8e3807b9eb5221d95824b521196596f4006a1bc43ee50bfa6a2900882c5bf7703e2db5fe
TLSH
T1CE21CC87BD5CC56D71B2C8B2F1B8C0786C325B44AA9BDF2D793CB3E6000C9983699098
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00200057003F001D0006.txt
Size 570B
SHA256 be589ff7ec893e36dad5241a66e7f14857d81c1f86523afd572f09764969f208
MD5 6eff1c9e10b3802d0154f75afc2e5f9d
SHA1 010e29318c78063eee2c9be224959468dc4526a5
SHA512 ffa3b81e812e1505e3ef28cb0937b57533e378b5e187e29481d50cf6978f5aa18139a10fba811c8061a82870a1cc3afe4aef1498db67a1f4e7487f34aed4f0f5
TLSH
T157F02256BC0EE68C30B2D062F1E8C0B18DCF9A848266C67C1928F6E227981347A8B401
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
Size 34.2MB
SHA256 f4a3952c95be0f74297b3968341bdd63bbfb4913e058ee37eadf780ec85bed3d
MD5 f77b9cf39f8aac05da4824cc3e0264f2
SHA1 5bc98c868dda2f7f05b9bd23f30a38a643bef103
SHA512 87564e43e1e983138a73de15579569a3015146c0cf11017da391bbc542dfc1d2bc6c47397424d80c850745d66c9f7860e5567319a81784e40286867dbc2d6bf7
SSDEEP 786432:rE+0NSV6aoYG1P1W1quT0FKEKokVasR97bvxrua:gtNSV6aoYYPO0FLKotk9/xrp
TLSH
T16577331DA076C5E7D449857E7E615318E338386A03629BDFB39D901B6F77A820CBAF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
Size 1.5MB
SHA256 5ec42b168f2541dbb413d6f87aa5569470a2b0c6c574c3e655242461a4524763
MD5 7a1b6316d5d64a740b847d8261ea3e83
SHA1 e130deed179693218679e09f0eef6fb33c369146
SHA512 355f190eb5c83b14ea7ca19c901ff9124962a25f78ff03f1bc9f09387751f8def203e47f017ac0bd295c70ace8efbdc5f193d92d67207329aa1db4dbd0cc7183
SSDEEP 24576:8Vxe28BXUGuG2bjI+O5IRumwloSRB0nPUa6xDuC4d+bk+2miTwX/yQw01:8Vxeyk+tWoS/0PUa6xDv40bk+BiTwXF5
TLSH
T142757C133283C031EC6211B08969DFAB86ADB4345B6148DB67D06E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\servicehost.exe\log_00200057003F001D0006.txt
Size 298B
SHA256 0a1475197fe0f1c0da2ea113190d5cc84b98d27eb2aa200fa9a39b9bd86f4c27
MD5 e6442769d68e87e00ef7bce046455cbf
SHA1 e81c1f2f40740cadf3f7cf6e148fe909b66bd2b2
SHA512 7802bfcc42f3b177dc1364721c7c9f3ce4417e8e76620ebb6637536041032fb8f5d2ad998162f85cd1a51381cafbdea64766ab8ffd9f31e2d60dd15220ba7519
TLSH
T1EAE0CDF1669CC2CD1072C073B36682318C653700939CF73C345CFAA241CD42813EB185
MD5 SHA1 SHA512 TLSH

Submit Download

$R0NVS9R.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-IDDQD0MWFP.tmp\$R0NVS9R.tmp
Size 4.2MB
SHA256 07eea42af4d565d09ce6c8723211e96a835400060dc90e53a6bac21b2fd3da42
MD5 af498a69fb53fc1ad081c0c884e4822a
SHA1 b35902fd0a6b1acb19bfb3002f4c0c44a44bdbaa
SHA512 7523307016fd0b58208cf4bb3aba539866bf59d3f154a95084384ad78512fd76380187ad1fbe1ca86043fe0e7384c858174417e2e5d90c57e11921b5e36b7de5
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333PZ:7xuHjWfZIzeZ
TLSH
T177268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avast_One.png

Path C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\Avast_One.png
Size 42KB
SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
MD5 faff96fb8080a98bd1def3c4f9cce9c1
SHA1 466c66dfaed49d93dd7d8a1e42919a4f03613efa
SHA512 ad87ccc0bcb0115d5e7255935c5bd2b5eeb85b75f46206987d85f0f5e04afce054b0b3cee3d7577039db6ddbff1f0fdfdca657b7877376e4f97c80c5ed7514b7
SSDEEP 768:53E5YnNz2SLHvDYgWfGHV8L77Yy/oksC+x8+RfWpzrdYnsi2anUpMQb3HGJ2:536Ynl2SLrYHAWHDgEqCSskn0nqA
TLSH
T11613F1B8B8DE416DDDDED6B8FCE66FF564816437CC84D1EA800CB028518E784366636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WeatherZero.png

Path C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\WeatherZero.png
Size 29KB
SHA256 ab99cdb7d798cb7b7d8517584d546aa4ed54eca1b808de6d076710c8a400c8c4
MD5 9ac6287111cb2b272561781786c46cdd
SHA1 6b02f2307ec17d9325523af1d27a6cb386c8f543
SHA512 f998a4e0ce14b3898a72e0b8a3f7154fc87d2070badcfa98582e3b570ca83a562d5a0c95f999a4b396619db42ab6269a2bac47702597c5a2c37177441723d837
SSDEEP 768:Fk7fJC9WjOI1DaGmnitN039DODp56Ys+9S/IUM+:FktpB4FiQ3qd9S/BN
TLSH
T188D2D0381BFEE4C6EC67B874148F1F234A2B94BAC0D4E215F801969D1549E5EB58CDA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAdvisor.png

Path C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\WebAdvisor.png
Size 47KB
SHA256 0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
MD5 4cfff8dc30d353cd3d215fd3a5dbac24
SHA1 0f4f73f0dddc75f3506e026ef53c45c6fafbc87e
SHA512 9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139
SSDEEP 768:RtwR1Dy4rQznr1GYfvLn6froelhVNSyCPtSOeVlTTqYueg:zwR1DybhPwhvSyClSOk/geg
TLSH
T18623F1618E36D41ED38BE69B1F1D9824277AF197F59C1673866879230C039ADCC1DCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\logo.png
Size 248KB
SHA256 8c5c80bbc6b0fdb367eab1253517d8b156c85545a2d37d1ee4b78f3041d9b5db
MD5 9cc8a637a7de5c9c101a3047c7fbbb33
SHA1 5e7b92e7ed3ca15d31a48ebe0297539368fff15c
SHA512 cf60556817dba2d7a39b72018f619b0dbea36fb227526943046b67d1ae501a96c838d6d5e3da64618592ac1e2fa14d4440baa91618aa66256f99ea2100a427b4
SSDEEP 3072:d9rAhuSnngAZK0u2vGWTbQ8VreGWVQx1RiiHs0dfo5yk5BRFOYfKa5ubF3/hlKHV:U/HJGWPQ2wV01RPQ5FoBJc+uHtjdhd3
TLSH
T13444122A9260C885D35201230725B4787F78264B7A1CACE6F5F77C1B4A0A67E2D86FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prod0.zip

Path C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\prod0.zip
Size 515KB
SHA256 cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
MD5 f68008b70822bd28c82d13a289deb418
SHA1 06abbe109ba6dfd4153d76cd65bfffae129c41d8
SHA512 fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253
SSDEEP 12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
TLSH
T1C8B4237E2323A734A201E7A425373B520A1E63C6733C15EB7EC1AB927D3053D76A456B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saBSI.exe

Path C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\prod0_extract\saBSI.exe
Size 1.1MB
SHA256 f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
MD5 143255618462a577de27286a272584e1
SHA1 efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA512 c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9
SSDEEP 24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
TLSH
T1D2458D317586C031E1A211B219F9EBA585ADB8359F7244CBB7C05F2ED930AD25E36F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prod1.zip

Path C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\prod1.zip
Size 5.9MB
SHA256 200e9bc4fcf2c6682ddc8c7f172a0d02befecd25ca882f66c6abc868a54b8975
MD5 7cc0288a2a8bbe014f9e344f3068c8f1
SHA1 eb47d401ae30a308dd66bdcafde06cdd35e25c94
SHA512 869f0a01ef0bcbbfc501c1786e14bffeaa2daaa00210c312874fc67a724c77ef61394bb5854b9a02af654cd045c4d39ae30d73f1b4ec8aa9e531dfeea1714476
SSDEEP 98304:ppxj2IwVGwxnd+P0fY8eHeM1euEuR+HW84l7mKN2Yjwov3I7qs4zLGGlFtSNNkoo:ppxZ7k00fxeHejFHW3l113I7d4zLGGTL
TLSH
T10A56335E3333C060535EAF822771BD151138AA7D6EDD78C48A39A37625F629E0FA470E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zbShieldUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\is-VBDK1LBT46.tmp\zbShieldUtils.dll
Size 2.0MB
SHA256 976d070339c1ecd80d0d2ded8f2c3fd1c6ec03f408053470f696066c2bb2b738
MD5 ea1aa2927ea58dfb8f57ae5f7dae0c74
SHA1 f1c1eca6070f82cd7c7918eeda144a207a53bb09
SHA512 20b10a4289bfaea9fe25bdeee636a07303799a78f0a732b65a182728bca9f48cf9802f32c833315e7d71a4816fcb9b7b09370c62867421824d554a87b6ea1559
SSDEEP 49152:y4yxp/wFOn9xRo3HVCEi2ynjsPAXkp4K0x8BFuchAFotKLIk:yJTwo93o3UEi2ynjs4Up4KI8BFucOE
TLSH
T103959E613556446FF21B12355A38B729F2BEA3700BF547C73ED4AA1C39334428E266AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwa7958.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwa7958.tmp
Size 135KB
SHA256 926061fc6a92079aa227cc2e426bd5b2130501422a95e6a8984f15f05dee2e70
MD5 32528f494643e0e05625d5a5b8e61263
SHA1 701eb330c5f29b2178c6196404f3bc53e297987e
SHA512 80979203400fde66bc2f5567c2cc5a60448b8336dca93b8ef7d2d77033a063a9c581b9acdb99f81c1affae5fe159f2b4bc74b842104ffbb05172cb4656ab561b
SSDEEP 3072:ppIo/Z/nT74FOGNcO7/exDn/1ISZ3kHoh3I42H01Vqx:ppb7tpssD/1IQ332H2Vqx
TLSH
T1FFD38D01B090C072E5BE19390864DF725B7EB874DF906DCB63A50B7A9E703C19E35A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwaA3C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwaA3C3.tmp
Size 173KB
SHA256 6dd62d41da015e4a1486a8866fcb28ac1209a552be8313dbd63e821cb46811c8
MD5 6e7f3a7401c7da1e60f5df4531738ab4
SHA1 fc6305ca9ae4023d45ca8d7e67304f59a8ed2aa7
SHA512 4f6984e41b17bfe78a8d27c6fae33b3a2f7d8db3479f73ce3a1d42782db7ee029bc44b77cdc3ebe0d046e72a613ccfe406748878d5002e947cfce266cf90af41
SSDEEP 3072:1WKqE1/0WjsAGX5Gn39yf19led13p9tyDTQrf:1J1MWoAGJqe1neftyP4f
TLSH
T15C045C1BB7A400BBE577D27888930A06F777781107609B9F03A4477A5F27790AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-322-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-584-0x00007FF622AD0000-0x00007FF622AE0000-memory.dmp

Download

memory/1624-318-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-303-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-304-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-292-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-306-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-324-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-307-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-309-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-311-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-327-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-330-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-334-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-333-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-332-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-331-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-340-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-341-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-436-0x00007FF622AD0000-0x00007FF622AE0000-memory.dmp

Download

memory/1624-389-0x00007FF622AD0000-0x00007FF622AE0000-memory.dmp

Download

memory/1624-339-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-338-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-337-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-336-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-335-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-329-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-359-0x00007FF659B20000-0x00007FF659B30000-memory.dmp

Download

memory/1624-536-0x00007FF660FF0000-0x00007FF661000000-memory.dmp

Download

memory/1624-434-0x00007FF622AD0000-0x00007FF622AE0000-memory.dmp

Download

memory/1624-411-0x00007FF660FF0000-0x00007FF661000000-memory.dmp

Download

memory/1624-445-0x00007FF634C40000-0x00007FF634C50000-memory.dmp

Download

memory/1624-473-0x00007FF61C230000-0x00007FF61C240000-memory.dmp

Download

memory/1624-480-0x00007FF634C40000-0x00007FF634C50000-memory.dmp

Download

memory/1624-479-0x00007FF634C40000-0x00007FF634C50000-memory.dmp

Download

memory/1624-641-0x00007FF660FF0000-0x00007FF661000000-memory.dmp

Download

memory/1624-620-0x00007FF660FF0000-0x00007FF661000000-memory.dmp

Download

memory/1624-315-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-572-0x00007FF622AD0000-0x00007FF622AE0000-memory.dmp

Download

memory/1624-561-0x00007FF622AD0000-0x00007FF622AE0000-memory.dmp

Download

memory/1624-554-0x00007FF660FF0000-0x00007FF661000000-memory.dmp

Download

memory/1624-541-0x00007FF660FF0000-0x00007FF661000000-memory.dmp

Download

memory/1624-539-0x00007FF660FF0000-0x00007FF661000000-memory.dmp

Download

memory/1624-538-0x00007FF660FF0000-0x00007FF661000000-memory.dmp

Download

memory/1624-529-0x00007FF622AD0000-0x00007FF622AE0000-memory.dmp

Download

memory/1624-495-0x00007FF621590000-0x00007FF6215A0000-memory.dmp

Download

memory/1624-489-0x00007FF621590000-0x00007FF6215A0000-memory.dmp

Download

memory/1624-488-0x00007FF621590000-0x00007FF6215A0000-memory.dmp

Download

memory/1624-312-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-313-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-294-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-295-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/1624-293-0x00007FF61B3B0000-0x00007FF61B3C0000-memory.dmp

Download

memory/5248-1-0x0000000000B10000-0x0000000000BF9000-memory.dmp

Download

memory/5248-16-0x0000000000B10000-0x0000000000BF9000-memory.dmp

Download

memory/5920-42-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-37-0x0000000000E80000-0x00000000012CB000-memory.dmp

Download

memory/5920-51-0x0000000000E80000-0x00000000012CB000-memory.dmp

Download

memory/5920-52-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-49-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-48-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-44-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-43-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-96-0x0000000000E80000-0x00000000012CB000-memory.dmp

Download

memory/5920-97-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-38-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-35-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-34-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-29-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-28-0x0000000006730000-0x0000000006870000-memory.dmp

Download

memory/5920-17-0x0000000000E80000-0x00000000012CB000-memory.dmp

Download

memory/5920-110-0x0000000000E80000-0x00000000012CB000-memory.dmp

Download

memory/5920-18-0x0000000001A20000-0x0000000001A21000-memory.dmp

Download

memory/5920-6-0x0000000001A20000-0x0000000001A21000-memory.dmp

Download