Edit tour

Windows Analysis Report
wechat-3.9.7-installer_ae-GFz1.exe

Overview

General Information

Sample name:	wechat-3.9.7-installer_ae-GFz1.exe
Analysis ID:	1450567
MD5:	c9db32520878a90f367b284f5f765ab7
SHA1:	e59b03e0dfe13054a30eb68a04b0cd7cc0456e1a
SHA256:	5dc9eafb99e68c0ef77d151ea645736d19393fffc3e01d9dbb073584893b99a4
Infos:

Detection

PureLog Stealer

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	52
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Creates an autostart registry key pointing to binary in C:\Windows

Drops large PE files

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs Task Scheduler Managed Wrapper

Reads the Security eventlog

Reads the System eventlog

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Yara detected Generic Downloader

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables driver privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Registers a DLL

Sample file is different than original file name gathered from version info

Searches the installation path of Mozilla Firefox

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potentially Suspicious Rundll32 Activity

Sigma detected: Suspicious Rundll32 Setupapi.dll Activity

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

query blbeacon for getting browser version

Classification

Process Tree

System is w10x64

wechat-3.9.7-installer_ae-GFz1.exe (PID: 6496 cmdline: "C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe" MD5: C9DB32520878A90F367B284F5F765AB7)

wechat-3.9.7-installer_ae-GFz1.tmp (PID: 6540 cmdline: "C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp" /SL5="$1040C,837551,832512,C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe" MD5: 053B158842578C53DB20AD6835B8658B)

component0.exe (PID: 7068 cmdline: "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240601224314&is_silent=true&oc=ZB_RAV_Cross_Solo_Soft&p=fa70&a=100&b=&se=true" -i MD5: DDFFAA966C03DC4BEF4DCB947DCC474B)

cldwur4x.exe (PID: 2640 cmdline: "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent MD5: 6C0F8BF824E17C2F0DDFF150D8DC7488)

RAVEndPointProtection-installer.exe (PID: 6024 cmdline: "C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent MD5: 31CB221ABD09084BF10C8D6ACF976A21)

rsSyncSvc.exe (PID: 3608 cmdline: "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10 MD5: 3068531529196A5F3C9CB369B8A6A37F)

conhost.exe (PID: 6252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 3344 cmdline: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf MD5: EF3179D498793BF4234F708D3BE28633)

runonce.exe (PID: 3588 cmdline: "C:\Windows\system32\runonce.exe" -r MD5: 9ADEF025B168447C1E8514D919CB5DC0)

grpconv.exe (PID: 2308 cmdline: "C:\Windows\System32\grpconv.exe" -o MD5: 8531882ACC33CB4BDC11B305A01581CE)

wevtutil.exe (PID: 2668 cmdline: "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml MD5: 1AAE26BD68B911D0420626A27070EB8D)

conhost.exe (PID: 5608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fltMC.exe (PID: 916 cmdline: "fltmc.exe" load rsKernelEngine MD5: 6AB08CADCE7DF971A043DCD1257D7374)

conhost.exe (PID: 2304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wevtutil.exe (PID: 1440 cmdline: "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml MD5: 1AAE26BD68B911D0420626A27070EB8D)

conhost.exe (PID: 3584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rsWSC.exe (PID: 3844 cmdline: "C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i MD5: D8021F3B7E9C952B7EC33B929183E8EF)

rsClientSvc.exe (PID: 1892 cmdline: "C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i MD5: 9170244A34CB903FC5DFBE4159DB6F16)

conhost.exe (PID: 564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rsEngineSvc.exe (PID: 6200 cmdline: "C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i MD5: D8053B9FDBDBB3E32CF583AACB29D1EE)

saBSI.exe (PID: 4856 cmdline: "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US MD5: 143255618462A577DE27286A272584E1)

installer.exe (PID: 3020 cmdline: "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade MD5: 58B8915D4281DB10762AF30EAF315C9E)

installer.exe (PID: 6380 cmdline: "C:\Program Files\McAfee\Temp3475153614\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade MD5: B2B02A72E98408C9E0EBD5036BD7A092)

regsvr32.exe (PID: 2176 cmdline: regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 1988 cmdline: /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 2252 cmdline: regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 6536 cmdline: regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 6656 cmdline: /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 6568 cmdline: regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

WerFault.exe (PID: 6032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6268 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rsSyncSvc.exe (PID: 2212 cmdline: "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10 MD5: 3068531529196A5F3C9CB369B8A6A37F)

Uninstall.exe (PID: 6196 cmdline: "C:\Program Files\ReasonLabs\EPP\Uninstall.exe" /auto-repair=RavStub MD5: 6C0F8BF824E17C2F0DDFF150D8DC7488)

Uninstall.exe (PID: 6416 cmdline: "C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe" /auto-repair=RavStub MD5: 6C0F8BF824E17C2F0DDFF150D8DC7488)

RAVEndPointProtection-installer.exe (PID: 3512 cmdline: "C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe" /auto-repair=RavStub MD5: 31CB221ABD09084BF10C8D6ACF976A21)

svchost.exe (PID: 6832 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 6952 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6540 -ip 6540 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6072 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6540 -ip 6540 MD5: C31336C1EFC2CCB44B4326EA793040F2)

servicehost.exe (PID: 6560 cmdline: "C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe" MD5: AF384AA87E3D70F7A687C5C60DA2FB7F)

uihost.exe (PID: 3428 cmdline: "C:\Program Files\McAfee\WebAdvisor\UIHost.exe" MD5: D1BEFCFE26C5C2132BDABBF332306004)

rsWSC.exe (PID: 3588 cmdline: "C:\Program Files\ReasonLabs\EPP\rsWSC.exe" MD5: D8021F3B7E9C952B7EC33B929183E8EF)

rsClientSvc.exe (PID: 5548 cmdline: "C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" MD5: 9170244A34CB903FC5DFBE4159DB6F16)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ATY5CJG3\rsServiceController.DLL	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsWSC.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\mc.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsLogger.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\UDOOGFD5\rsAtom.DLL	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsTime.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\KRK4DVBJ\rsJSON.DLL	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnAccess.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Camera.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsHelper.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsDatabase.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsServiceController.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsRemediation.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Performance.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsLogger.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsDatabase.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsDatabase.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsWSCClient.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsBridge.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsTime.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.JSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ZMMW8FDC\rsLogger.DLL	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Needle.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\InstallerLib.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.Proxy.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 68 entries

Memory Dumps

Source	Rule	Description	Author
0000002D.00000002.2437605904.000002BC41312000.00000002.00000001.01000000.00000034.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.2807618602.00000220FE912000.00000002.00000001.01000000.00000038.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000023.00000000.2377819043.0000013169FE2000.00000002.00000001.01000000.00000023.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.2541457093.00000220952CF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002D.00000002.2437311674.000002BC412D2000.00000002.00000001.01000000.00000033.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.2813307929.00000220FEB02000.00000002.00000001.01000000.00000039.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002D.00000000.2419994897.000002BC3F702000.00000002.00000001.01000000.00000030.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002D.00000002.2437962183.000002BC413EF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.2506176810.000002208072E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002D.00000002.2445270867.000002BC5A9D2000.00000002.00000001.01000000.00000035.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000003.2030874846.000000000274A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000003.2035288824.0000000002746000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.2814717721.00000220FEB42000.00000002.00000001.01000000.0000003A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.RAVEndPointProtection-installer.exe.220957eb6d0.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
45.0.rsEngineSvc.exe.2bc3f700000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
45.2.rsEngineSvc.exe.2bc412d0000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.RAVEndPointProtection-installer.exe.220feb40000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.RAVEndPointProtection-installer.exe.220fe910000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.RAVEndPointProtection-installer.exe.220feb00000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
35.0.rsWSC.exe.13169fe0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
45.2.rsEngineSvc.exe.2bc41310000.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.RAVEndPointProtection-installer.exe.220957eb6d0.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
45.2.rsEngineSvc.exe.2bc5a9d0000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: grpconv -o, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\rundll32.exe, ProcessId: 3344, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv

Sigma detected: Potentially Suspicious Rundll32 Activity

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf, CommandLine: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf, CommandLine|base64offset|contains: [HZ, Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent, ParentImage: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe, ParentProcessId: 6024, ParentProcessName: RAVEndPointProtection-installer.exe, ProcessCommandLine: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf, ProcessId: 3344, ProcessName: rundll32.exe

Sigma detected: Suspicious Rundll32 Setupapi.dll Activity

Source: Process started

Author: Konstantin Grishchenko, oscd.community: Data: Command: "C:\Windows\system32\runonce.exe" -r, CommandLine: "C:\Windows\system32\runonce.exe" -r, CommandLine|base64offset|contains: , Image: C:\Windows\System32\runonce.exe, NewProcessName: C:\Windows\System32\runonce.exe, OriginalFileName: C:\Windows\System32\runonce.exe, ParentCommandLine: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 3344, ParentProcessName: rundll32.exe, ProcessCommandLine: "C:\Windows\system32\runonce.exe" -r, ProcessId: 3588, ProcessName: runonce.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 6832, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: wechat-3.9.7-installer_ae-GFz1.exe

Virustotal: Detection: 20%

Perma Link

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_008214F0 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CryptMsgGetParam,CertFreeCRLContext,CertFreeCRLContext,	6_2_008214F0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_008217A0 CryptQueryObject,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CryptQueryObject,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,	6_2_008217A0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007D5870 GetCurrentProcessId,GetCurrentThreadId,CreateFileW,CreateFileW,CreateFileW,CreateFileW,CreateFileW,CreateFileW,UuidCreate,UuidCreate,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	6_2_007D5870
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007D6220 GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,	6_2_007D6220
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0080E610 CryptMsgClose,	6_2_0080E610
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007D67B0 GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,	6_2_007D67B0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0080EB60 CryptQueryObject,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptQueryObject,CryptMsgClose,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,	6_2_0080EB60
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0080F150 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CertFreeCRLContext,	6_2_0080F150
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0080F3C0 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CertGetNameStringW,CertGetNameStringW,CertGetCertificateChain,CertFreeCertificateChain,CertFreeCertificateChain,CertVerifyCertificateChainPolicy,CertFreeCertificateChain,CertFreeCRLContext,CertFreeCRLContext,	6_2_0080F3C0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396914A0 CryptQueryObject,GetLastError,CryptMsgGetParam,GetLastError,LocalAlloc,CryptMsgGetParam,GetLastError,CertFindCertificateInStore,GetLastError,CertGetNameStringW,CertGetNameStringW,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,	9_2_00007FF6396914A0

Compliance

Uses 32bit PE files

Source: wechat-3.9.7-installer_ae-GFz1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Window detected: HYPERLINK "https://risecodes.com/terms" Terms of UseHYPERLINK "https://risecodes.com/privacy" Privacy PolicyHYPERLINK "https://hello.softonic.com/terms-of-use" End User License AgreementHYPERLINK "https://hello.softonic.com/privacy-policy" Privacy PolicyThis will download WeChat to your computer click "Next" to continue.Welcome to WeChat Download Manager&NextCancel

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\uninstall.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\chrome_100_percent.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\chrome_200_percent.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\icudtl.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\LICENSE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\LICENSES.chromium.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\af.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\am.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ar.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\bg.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\bn.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ca.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\cs.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\da.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\de.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\el.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\en-GB.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\en-US.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\es-419.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\es.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\et.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fa.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fi.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fil.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\gu.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\he.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hi.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hu.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\id.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\it.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ja.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\kn.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ko.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\lt.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\lv.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ml.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\mr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ms.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\nb.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\nl.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pl.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pt-BR.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pt-PT.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ro.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ru.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sk.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sl.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sv.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sw.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ta.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\te.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\th.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\tr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\uk.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ur.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\vi.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\zh-CN.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\zh-TW.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar.sig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\snapshot_blob.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\v8_context_snapshot.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader_icd.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\d3dcompiler_47.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libEGL.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libGLESv2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vulkan-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ReasonLabs-EPP.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ARM64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam\rselam.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam\rsElam.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\manifest.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsHelper.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\SecurityProductInformation.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Signatures.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.sig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\manifest.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\WhiteList.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\amd64\KernelTraceControl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\amd64\msdia140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ARM64\KernelTraceControl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ARM64\msdia140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ARM64\rsYara-ARM64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\BouncyCastle.Crypto.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Dia2Lib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\KernelTraceControl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\msdia140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Dia2Lib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.FastSerialization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Win32.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\OSExtensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRSvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.JSON.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\SQLite.Interop.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.AppContext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Concurrent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.NonGeneric.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Specialized.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.EventBasedAsync.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.TypeConverter.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Console.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Data.Common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Data.SQLite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Contracts.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Debug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.FileVersionInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Process.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.StackTrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.TextWriterTraceListener.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tools.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.TraceSource.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tracing.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Drawing.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Dynamic.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Calendars.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.ZipFile.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.DriveInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Watcher.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.IsolatedStorage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.MemoryMappedFiles.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Pipes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.UnmanagedMemoryStream.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Expressions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Parallel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Queryable.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Http.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NameResolution.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NetworkInformation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Ping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Requests.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Security.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Sockets.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebHeaderCollection.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.Client.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ObjectModel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Reader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.ResourceManager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Writer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.Unsafe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.VisualC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Handles.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Numerics.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Formatters.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Json.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Xml.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Claims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Algorithms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Csp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Encoding.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.X509Certificates.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Principal.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.SecureString.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.RegularExpressions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Overlapped.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.Parallel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Thread.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.ThreadPool.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Timer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ValueTuple.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.ReaderWriter.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlSerializer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.XDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\TraceReloggerLib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\x64\SQLite.Interop.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\InstallerLib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\mc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Bcl.HashCode.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.FastSerialization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.Tracing.TraceEvent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Registry.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\NAudio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\netstandard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsAssistant.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsAtom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsBridge.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsBuild.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsDatabase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Application.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Needle.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Performance.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Camera.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnAccess.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.Proxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsFrame.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsJSON.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsLitmus.A.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsLitmus.S.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsLogger.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsPerformance.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsServiceController.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsTime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsWSCClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\SQLite.Interop.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.AppContext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Collections.Concurrent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Collections.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Collections.NonGeneric.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Collections.Specialized.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.EventBasedAsync.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.TypeConverter.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Console.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Data.Common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Data.SQLite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Contracts.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Debug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.FileVersionInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Process.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.StackTrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TextWriterTraceListener.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tools.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TraceSource.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tracing.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.DirectoryServices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Drawing.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Dynamic.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Globalization.Calendars.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Globalization.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.Compression.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.Compression.ZipFile.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.DriveInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Watcher.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.IsolatedStorage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.MemoryMappedFiles.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.Pipes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.UnmanagedMemoryStream.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Linq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Linq.Expressions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Linq.Parallel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Linq.Queryable.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Http.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.NameResolution.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.NetworkInformation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Ping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Requests.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Security.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Sockets.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.WebHeaderCollection.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.Client.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ObjectModel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Reflection.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Reflection.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Reflection.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Resources.Reader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Resources.ResourceManager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Resources.Writer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.Unsafe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.VisualC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Handles.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Numerics.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Formatters.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Json.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Xml.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.AccessControl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Claims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Algorithms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Csp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Encoding.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.X509Certificates.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Principal.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Principal.Windows.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.SecureString.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Text.RegularExpressions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Overlapped.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.Parallel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Thread.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.ThreadPool.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Timer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ValueTuple.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.ReaderWriter.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XmlDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XmlSerializer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.XDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\TraceReloggerLib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\EPP.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\7z64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\ext_x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\lz4_x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsCamFilter020502.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsJournal-x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsYara-x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\SQLite.Interop.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\uninstall.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EDR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EDR\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EDR\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ReasonLabs-EPP.7z
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\amd64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ARM64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\EDR
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\EDR\amd64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\EDR\x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\evntdrv.xml
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\rselam.cat
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\rsElam.inf
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\manifest.json
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsClient.Protection.Microphone.dll.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsEngine.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsEngineSvc.exe.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsExtensionHost.exe.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsHelper.exe.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsRemediation.exe.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\SecurityProductInformation.ini
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\Signatures.dat
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.sig
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\manifest.json
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\WhiteList.dat
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\x64\rsKernelEngine.inf
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\analyticsmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\analyticstelemetry.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\balloon_safe_annotation.png
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\browserhost.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\browserplugin.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\downloadscan.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\eventmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\icon_complete.png
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\icon_failed.png
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\icon_laptop.png
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\jquery-1.9.0.min.js
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\l10n.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\logicmodule.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\logicscripts.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\lookupmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\main_close_large.png

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP

Jump to behavior

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RAVEndPointProtection-installer.exe.log	Jump to behavior
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	File created: C:\Program Files\ReasonLabs\EPP\InstallUtil.InstallLog
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	File created: C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-cs-CZ.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-da-DK.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-de-DE.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-el-GR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-en-US.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-es-ES.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-es-MX.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-fi-FI.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-fr-CA.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-fr-FR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-hr-HR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-hu-HU.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-it-IT.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-ja-JP.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-ko-KR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-nb-NO.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-nl-NL.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-pl-PL.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-pt-BR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-pt-PT.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-ru-RU.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-sk-SK.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-sr-Latn-CS.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-sv-SE.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-tr-TR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-zh-CN.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-zh-TW.txt

PE / OLE file has a valid certificate

Source: wechat-3.9.7-installer_ae-GFz1.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: wechat-3.9.7-installer_ae-GFz1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: rsAtom.pdb source: cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2814717721.00000220FEB42000.00000002.00000001.01000000.0000003A.sdmp, Uninstall.exe, 0000000D.00000003.2030874846.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\ServiceHost.pdbu source: installer.exe, 00000015.00000003.2279804803.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsWSC.pdb source: rsWSC.exe, 00000023.00000000.2377819043.0000013169FE2000.00000002.00000001.01000000.00000023.sdmp, rsWSC.exe, 00000023.00000002.2391526354.00000131000A0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\SettingManager.pdb source: installer.exe, 00000015.00000003.2284950546.000001EE50616000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\WebAdvisor-accesslib-caller_main@2\Build\x64\Release\caller_dll.pdb source: installer.exe, 00000015.00000000.2184712865.00007FF7F5BD2000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\rsStubActivator\rsStubActivator\rsStubActivator\obj\Release\net462\rsStubActivator.pdb source: component0.exe, 00000003.00000000.1901418219.0000022CF9882000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: rsTime.pdb source: cldwur4x.exe, 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2035288824.0000000002746000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdbGCTL source: installer.exe, 00000015.00000003.2275014753.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\BrowserHost.pdbe source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\LogicModule.pdb source: installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\non_system\code\WebAdvisor-ISGIS\build\x64\Release\Installer.pdb$ source: installer.exe, 00000012.00000002.2429013846.00007FF62C89B000.00000002.00000001.01000000.0000001A.sdmp, installer.exe, 00000012.00000000.2140165890.00007FF62C89B000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdb source: installer.exe, 00000015.00000003.2275014753.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\RavStub\obj\Release\RavStub.pdb source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb< source: cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, rsSyncSvc.exe, 00000009.00000002.1991906507.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 00000009.00000000.1989460441.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 0000000B.00000000.1991099416.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 0000000B.00000002.2881117473.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, Uninstall.exe, 0000000D.00000003.2036725160.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\x64\Release\ArchiveUtility.pdb source: cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2017575775.000000000274C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\ServiceHost.pdb source: installer.exe, 00000015.00000003.2279804803.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsJSON.pdbHG source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsServiceController.pdb source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\TaskManager.pdb source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\rsStubLib\obj\Release\rsStubLib.pdb source: cldwur4x.exe, 00000007.00000003.1947303929.0000000002756000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2806047428.00000220FE8D2000.00000002.00000001.01000000.00000037.sdmp, Uninstall.exe, 0000000D.00000003.2034651192.0000000002745000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\TaskManager.pdb{ source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdbSHA256 source: cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2816590508.00000220FEBF2000.00000002.00000001.01000000.0000003B.sdmp, Uninstall.exe, 0000000D.00000003.2018820324.000000000274C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\BrowserHost.pdb source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\non_system\code\WebAdvisor-ISGIS\build\x64\Release\Installer.pdb source: installer.exe, 00000012.00000002.2429013846.00007FF62C89B000.00000002.00000001.01000000.0000001A.sdmp, installer.exe, 00000012.00000000.2140165890.00007FF62C89B000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\UIHost.pdb source: installer.exe, 00000015.00000003.2297053110.000001EE5049E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsDatabase.pdb source: cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2029522577.0000000002749000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 00000006.00000000.1925610612.000000000087E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\Installer.pdb source: installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\LookupManager.pdb source: installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\WATaskManager.pdb] source: servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb@ source: cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb source: cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsLogger.pdb source: cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2807618602.00000220FE912000.00000002.00000001.01000000.00000038.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208072E000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\UIHost.pdbu source: installer.exe, 00000015.00000003.2297053110.000001EE5049E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb source: cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2816590508.00000220FEBF2000.00000002.00000001.01000000.0000003B.sdmp, Uninstall.exe, 0000000D.00000003.2018820324.000000000274C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\EventManager.pdb source: installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsJSON.pdb source: cldwur4x.exe, 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2813307929.00000220FEB02000.00000002.00000001.01000000.00000039.sdmp, Uninstall.exe, 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb source: cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, rsSyncSvc.exe, 00000009.00000002.1991906507.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 00000009.00000000.1989460441.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 0000000B.00000000.1991099416.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 0000000B.00000002.2881117473.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, Uninstall.exe, 0000000D.00000003.2036725160.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsLogger.pdbx source: cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2807618602.00000220FE912000.00000002.00000001.01000000.00000038.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208072E000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\AnalyticsManager.pdb source: installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\LookupManager.pdbG source: installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\WATaskManager.pdb source: servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp

Spreading

Creates COM task schedule object (often to register a task for autostart)

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	7_2_00405C4D
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_0040689E FindFirstFileW,FindClose,	7_2_0040689E
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_00402930 FindFirstFileW,	7_2_00402930
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	12_2_00405C4D
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_0040689E FindFirstFileW,FindClose,	12_2_0040689E
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_00402930 FindFirstFileW,	12_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	13_2_00405C4D
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_0040689E FindFirstFileW,FindClose,	13_2_0040689E
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_00402930 FindFirstFileW,	13_2_00402930

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, type: DROPPED

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.89.179.12 13.89.179.12

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 9_2_00007FF63969FAA0 URLDownloadToFileA,

9_2_00007FF63969FAA0

Source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://%u.%u.%u.%uhttps://%%=?=?&/invalid
Source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp, servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1%
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080131000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220802AB000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABF56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com
Source: rsWSC.exe, 00000023.00000002.2399301928.000001316C7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: rsWSC.exe, 00000023.00000002.2399301928.000001316C7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: rsWSC.exe, 00000023.00000002.2399301928.000001316C7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.di
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2123262523.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2123357289.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135461095.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134846945.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133059757.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2265476089.000001EE4FBF6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2194448368.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2237382180.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2282895132.000001EE4FC04000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2193246767.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241871701.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2233615654.000001EE4FC02000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2205120374.000001EE4FBF7000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2201944985.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2286889085.000001EE4FC06000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2289188082.000001EE4FC04000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2281619071.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2286349170.000001EE4FC06000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2252740253.000001EE4FC00000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2205207739.000001EE4FBFC000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2284001971.000001EE4FC07000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2276194710.000001EE4FBF5000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2191940595.000001EE4FBFC000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2253740323.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrusted
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947303929.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2794260712.000002209BEB0000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2017575775.000000000274C000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2034651192.0000000002745000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2506624754.000000000599C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138023335.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2472403485.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2505936389.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135261217.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2506806509.00000000059DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: installer.exe, 00000015.00000003.2292325560.000001EE4FC0B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2293179625.000001EE4FC00000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2291864796.000001EE4FC0A000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2293382960.000001EE4FC06000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2291494417.000001EE4FC07000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2293130187.000001EE4FBF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA25?9
Source: installer.exe, 00000015.00000003.2188340891.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2187273099.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedR
Source: installer.exe, 00000015.00000003.2301150634.000001EE4FC04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.cr
Source: installer.exe, 00000015.00000003.2219969551.000001EE4FC1A000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2220262135.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABF9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdn.reasonsecurity.com
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx
Source: servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx000Z
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx3
Source: servicehost.exe, 00000025.00000003.2389230555.0000012830346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxQ
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxX
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxZ
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxd
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxm
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxnalPl
Source: servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxq
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx~.w
Source: rsWSC.exe, 00000023.00000002.2399301928.000001316C7CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: installer.exe, 00000015.00000003.2242621140.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2240714489.000001EE4FC1A000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241770693.000001EE4FC12000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2240251199.000001EE4FC1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gl
Source: installer.exe, 00000015.00000003.2205861065.000001EE4FC1A000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2203579464.000001EE4FC1A000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2204062389.000001EE4FC12000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2204948508.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codP
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2290004891.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2234210490.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300820263.000001EE4FC10000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2292906319.000001EE4E346000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FC19000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2253380848.000001EE4E343000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2261006075.000001EE4FBB6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2280349808.000001EE4E350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138227025.0000000005645000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138227025.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137286489.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2290004891.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2214701595.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300820263.000001EE4FC10000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2292906319.000001EE4E346000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FC19000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: servicehost.exe, 00000025.00000003.2448406106.00000130318B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: servicehost.exe, 00000025.00000003.2448406106.00000130318B5000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2450748310.00000128310AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: rsWSC.exe, 00000023.00000002.2398788699.000001316C750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rsWSC.exe, 00000023.00000002.2396723546.000001316C38B000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2398588354.000001316C560000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t
Source: rsWSC.exe, 00000023.00000002.2398788699.000001316C750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: rsWSC.exe, 00000023.00000002.2398788699.000001316C750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: rsWSC.exe, 00000023.00000002.2399645841.000001316C80F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: rsWSC.exe, 00000023.00000002.2396723546.000001316C380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: installer.exe, 00000015.00000003.2274352631.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2274869646.000001EE4FBF6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2273783818.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertA
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2123262523.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2123357289.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135461095.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134846945.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133059757.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947303929.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2794260712.000002209BEB0000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2017575775.000000000274C000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2034651192.0000000002745000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: installer.exe, 00000015.00000003.2235787126.000001EE4FBFC000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2235706676.000001EE4FBFA000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2236080063.000001EE4FC02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA40
Source: installer.exe, 00000015.00000003.2208815228.000001EE4FBFA000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2209181233.000001EE4FBFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA409
Source: installer.exe, 00000015.00000003.2186791041.000001EE4FBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeSt
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2506624754.000000000599C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138023335.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2472403485.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2505936389.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135261217.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2506806509.00000000059DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Uninstall.exe, 0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2290004891.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2234210490.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2214701595.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2215589067.000001EE4FBF7000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300820263.000001EE4FC10000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2211444795.000001EE4FBF7000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2188621378.000001EE4FC0C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2292906319.000001EE4E346000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FC19000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2253380848.000001EE4E343000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2261006075.000001EE4FBB6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2238066985.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2280349808.000001EE4E350000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2260816379.000001EE4E34B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2262550015.000001EE4FBB6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300890272.000001EE4FC06000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2265315112.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2275164985.000001EE4E359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: installer.exe, 00000015.00000003.2203387093.000001EE4FC1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.r
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947303929.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2794260712.000002209BEB0000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2017575775.000000000274C000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2034651192.0000000002745000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: rsWSC.exe, 00000023.00000002.2396723546.000001316C38B000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2398588354.000001316C560000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2396723546.000001316C380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rsWSC.exe, 00000023.00000002.2394688885.000001316A204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enx
Source: component0.exe, 00000003.00000002.2859609295.0000022C800AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://d14mh4uvqj4iiz.cloudfront.net
Source: RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABF9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://d2zcbe2x5jnnru.cloudfront.net
Source: rsWSC.exe, 00000023.00000002.2396723546.000001316C380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://home.mcafee.com/
Source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://home.mcafee.com/SaveEulaTrackingDetailsHost:
Source: cldwur4x.exe, 00000007.00000000.1936764730.000000000040A000.00000008.00000001.01000000.0000000F.sdmp, cldwur4x.exe, 00000007.00000002.2854568957.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, Uninstall.exe, 0000000C.00000000.2006547741.000000000040A000.00000008.00000001.01000000.00000013.sdmp, Uninstall.exe, 0000000C.00000002.2011545321.000000000040A000.00000004.00000001.01000000.00000013.sdmp, Uninstall.exe, 0000000D.00000002.2877853412.000000000040A000.00000004.00000001.01000000.00000015.sdmp, Uninstall.exe, 0000000D.00000000.2010907065.000000000040A000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: installer.exe, 00000015.00000003.2295074056.000001EE4E345000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2296750219.000001EE4E345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digic
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947303929.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2794260712.000002209BEB0000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2017575775.000000000274C000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2034651192.0000000002745000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2123262523.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2123357289.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135461095.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134846945.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133059757.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2506624754.000000000599C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138023335.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2472403485.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2505936389.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135261217.00000000058C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2506806509.00000000059DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: installer.exe, 00000015.00000003.2203387093.000001EE4FC1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2290004891.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2234210490.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300820263.000001EE4FC10000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2292906319.000001EE4E346000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FC19000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2253380848.000001EE4E343000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2261006075.000001EE4FBB6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2280349808.000001EE4E350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138227025.0000000005645000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138227025.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137286489.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2290004891.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2234210490.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2214701595.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300820263.000001EE4FC10000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2292906319.000001EE4E346000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FC19000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: servicehost.exe, 00000025.00000003.2448406106.00000130318B5000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2450748310.00000128310AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: servicehost.exe, 00000025.00000003.2448406106.00000130318B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: installer.exe, 00000015.00000003.2291792213.000001EE4FBB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.comp
Source: rsWSC.exe, 00000023.00000002.2396723546.000001316C38B000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2398588354.000001316C560000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcess
Source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: component0.exe, 00000003.00000002.2859609295.0000022C80091000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: saBSI.exe, 00000006.00000003.2131438015.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/
Source: saBSI.exe, 00000006.00000003.2131438015.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2290004891.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2234210490.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300820263.000001EE4FC10000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2292906319.000001EE4E346000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FC19000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2253380848.000001EE4E343000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2261006075.000001EE4FBB6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2280349808.000001EE4E350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138227025.0000000005645000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138227025.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137286489.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2290004891.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2234210490.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2214701595.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300820263.000001EE4FC10000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2292906319.000001EE4E346000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FC19000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: servicehost.exe, 00000025.00000003.2448406106.00000130318B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: component0.exe, 00000003.00000002.2859609295.0000022C800AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://shield.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080131000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220802AB000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABF56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://track.analytics-data.io
Source: rsWSC.exe, 00000023.00000002.2399301928.000001316C7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: rsWSC.exe, 00000023.00000002.2399301928.000001316C7CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: rsWSC.exe, 00000023.00000002.2398490791.000001316C47E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: rsWSC.exe, 00000023.00000002.2399510309.000001316C802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947303929.0000000002756000.00000004.00000020.00020000.00000000.sdmp, cldwur4x.exe, 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2794260712.000002209BEB0000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2017575775.000000000274C000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2034651192.0000000002745000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1629559307.00000000025B0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.2236295126.000000000225A000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.0000000002420000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1638609190.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: rsWSC.exe, 00000023.00000002.2399301928.000001316C7D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: servicehost.exe, 00000025.00000003.2396094556.0000012830FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mcafee.com
Source: rsWSC.exe, 00000023.00000002.2398788699.000001316C750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: http://www.siteadvisor.com/favicon.ico
Source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.siteadvisor.com/favicon.icoF59B2EC8-1D34-435D-B539-435BA415D1B6aapocclcgogkmnckokdopfmhon
Source: installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.siteadvisor.com/favicon.icoMcAfeebepbmhgboaologfdajaanbcjmnhjmhfnapdfllckaahabafndbhieahi
Source: installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.siteadvisor.com/favicon.icoblpcfgokakmgnkcojhhkbfbldkacnbeobepbmhgboaologfdajaanbcjmnhjmh
Source: servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: http://www.siteadvisor.com/favicon.icomanifest.json
Source: rsWSC.exe, 00000023.00000002.2399645841.000001316C80F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll1.3.1
Source: installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: https://.servicebus.windows.net/&se=&skn=Failed
Source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp, servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://127.0.0.1%
Source: saBSI.exe, 00000006.00000003.1950985232.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486026799.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2078584756.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/f
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/m
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486026799.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2078584756.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/record
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/record8
Source: saBSI.exe, 00000006.00000003.2078584756.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordB
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordE
Source: saBSI.exe, 00000006.00000003.1950985232.0000000002E5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordM
Source: saBSI.exe, 00000006.00000003.1950985232.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordZ
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/record
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordtribution
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.come
Source: saBSI.exe, 00000006.00000000.1925610612.000000000087E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/r
Source: servicehost.exe, 00000025.00000002.2915694125.0000013042600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.application/jsontransport_api_endpoint
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.qa.apis.mcafee.com
Source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.qa.apis.mcafee.comhttps://analytics.apis.mcafee.com&skn=Failed
Source: installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: https://analytics.qa.apis.mcafee.comhttps://analytics.apis.mcafee.comContent-Type:
Source: RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABF9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.reasonsecuX
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080131000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABB7C000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABF9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080131000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABB7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.reasonsecurity.com/rav-dist/packages/ReasonLabs-EPP-x64-v5.30.4.7z
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcafee&type=E280CH91088G0&p=
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcafee&type=E280CH91088G0&p=R
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcafee&type=E500CH91088G0&p=
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcafee&type=E580CH91088G0&p=
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcafee&type=E580CH91088G0&p=L
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcasa&type=E110CH91088G0&p=
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcasa&type=E110CH91088G0&p=:
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcasa&type=E170CH91088G0&p=
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcasa&type=E180CH91088G0&p=
Source: servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?fr=mcasa&type=E180CH91088G0&p=#
Source: servicehost.exe, 00000025.00000003.2822435756.0000013031927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/gossip/gossip-ch-partner?output=fxjson&appid=mca&source=yahoo_mcafe
Source: installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore/detail/mcafee%C2%AE-secure-search/enppghjcblldgigemljohkgpcompnjg
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com/v
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com/v1
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com/v1/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com/v1/g
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com/v1/ge
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com/v1/get
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://comipass.reasonsecurity.com/v1/getX
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecurity.com/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config-beta.reasonsecurity.com/X
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecurity.com/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://config.reasonsecurity.com/X
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cu1pehnswad01.servicebus.windows.net/wadp32h02/messages?timeout=60&api-version=2014-01b
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2224394122.0000000005441000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695566836.0000000000A56000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1991743876.0000000005440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1629559307.00000000025B0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.0000000002420000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1638609190.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2215944559.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2217967515.000000000366D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.png
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.png-&w
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.pngQ;
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.pngp&
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.pngqF
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.00000000024B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip0fQ
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipSOR
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipSORD
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/WebAdvisor/images/880/update2/EN.png
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/f/WebAdvisor/images/880/update2/EN.pngO
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1629559307.00000000025B0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.0000000002420000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1638609190.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2215944559.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.00000000024F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/o
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000074ED000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2215944559.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/zbd
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/zbd-8
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.000000000254A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/zbd.
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.000000000254A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/zbdY
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/zbdpA
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net/zbds_A
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net:443/zbd
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d2dbdb0phbn9qb.cloudfront.net:443/zbd9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080131000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABB7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://electron-shell.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABB7C000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://electron-shell.reasonsecurity.com/v1.4.2/ReasonLabs-v1.4.2.7z
Source: cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2816590508.00000220FEBF2000.00000002.00000001.01000000.0000003B.sdmp, Uninstall.exe, 0000000D.00000003.2018820324.000000000274C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dahall/taskscheduler
Source: cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2029522577.0000000002749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2029522577.0000000002749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.000000000757B000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC9000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2215944559.0000000003656000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gsf-fl.softonic.com/361/738/abda546ab2fc780789a74d376a5f1f4ceb/WeChatSetup.exe?Expires=17171
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.0000000005360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hello.softonic.com/privacy-policy
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hello.softonic.com/privacy-policyion
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.0000000005360000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hello.softonic.com/terms-of-use
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hello.softonic.com/terms-of-use304bf58efb17b6130391c6f350bd5b200f_ARCHITECTURE
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mW
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafe)
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/R
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Ro
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Root
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Root/
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Root/AboutUs.aYl
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?i
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?id=
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC9000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?id=eula
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafeef
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafz
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.sftcdn.net/images/t_app-icon-s
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000000.1628880938.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecurity.co
Source: Uninstall.exe, 0000000D.00000003.2034651192.0000000002745000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecurity.comX
Source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/platform/packages/essential?utm_source=rav_uninstall&utm_medium=home_website_
Source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/platform/products/rav/privacy-policy?utm_source=rav_antivirus_installer
Source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/platform/products/rav/terms?utm_source=rav_antivirus_installer
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.0000000005395000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policies
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesm/rsSt
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2224394122.0000000005441000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1991743876.0000000005440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesm/rsStj
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiest.net/f/RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.png
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiest.net/f/WebAdvisor/images/880/update2/EN.pngO
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.0000000005395000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/rav_online_security_policies
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/rav_online_security_policieseV0
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/rav_online_security_policieses
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/rav_online_security_policiestmlV_Bisli_Logo_bcg_V2/DOTPS-588/EN.png
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/rav_online_security_policiestmlr.pngupdate2/EN.png
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000074F7000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2215944559.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://risecodes.com/privacy
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000074F7000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2215944559.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://risecodes.com/terms
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://risecodes.com/terms/
Source: servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/
Source: servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/%
Source: saBSI.exe, 00000006.00000003.2028162188.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/&
Source: saBSI.exe, 00000006.00000003.2028162188.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2015414132.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/C
Source: servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/CC
Source: servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/EB
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/p
Source: servicehost.exe, 00000025.00000003.2450748310.00000128310AD000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2821510973.0000013041DCD000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2453464846.00000128310AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/
Source: saBSI.exe	String found in binary or memory: https://sadownload.mcafee.com/products/SA/
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979261516.0000000002ED5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1964522174.0000000002ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml/
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979261516.0000000002ED5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1964522174.0000000002ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml/
Source: saBSI.exe, 00000006.00000003.1979176506.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_Distribut
Source: saBSI.exe, 00000006.00000003.1979144528.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2001482393.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979245095.0000000002EF0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979316837.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml
Source: saBSI.exe, 00000006.00000003.1979297592.00000000055C4000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1978994671.00000000055C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml/
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xmlM
Source: saBSI.exe, 00000006.00000003.1979144528.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979245095.0000000002EF0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979316837.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml
Source: saBSI.exe, 00000006.00000003.1979297592.00000000055C4000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1978994671.00000000055C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml/
Source: saBSI.exe, 00000006.00000003.1979176506.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486026799.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xmlalue=
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002E5C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979261516.0000000002ED5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2001482393.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1964522174.0000000002ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml
Source: saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml/
Source: saBSI.exe, 00000006.00000003.2001482393.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xmlv
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979261516.0000000002ED5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1964522174.0000000002ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/
Source: saBSI.exe, 00000006.00000003.2486133896.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2122780803.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2485866665.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979261516.0000000002ED5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2015109896.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2027977822.00000000055C5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131499733.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2015221625.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2028162188.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2015414132.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053115287.00000000055C5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1964522174.0000000002ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml
Source: saBSI.exe, 00000006.00000003.2015109896.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2473044728.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137581289.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053470694.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2485441210.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2027977822.00000000055DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml/
Source: saBSI.exe, 00000006.00000003.2028162188.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2015414132.0000000002EF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xmlg
Source: saBSI.exe, saBSI.exe, 00000006.00000000.1925610612.000000000087E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000006.00000003.1950985232.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_main.xml
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979261516.0000000002ED5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1964522174.0000000002ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml/
Source: saBSI.exe, 00000006.00000000.1925610612.000000000087E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/UPDATER_VERSIONaffidosplatSELF_UPDATE_ALLOWEDMAIN_XMLSTORE
Source: saBSI.exe, saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonIFIER=I
Source: servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonP4
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonPath=C:
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsontoItXP11
Source: saBSI.exe, 00000006.00000003.2486133896.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2122780803.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2485866665.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2015109896.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2027977822.00000000055C5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131499733.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053115287.00000000055C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi
Source: saBSI.exe, 00000006.00000003.2015109896.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2473044728.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137581289.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053470694.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2485441210.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2027977822.00000000055DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979261516.0000000002ED5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1964522174.0000000002ED3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1979176506.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2486237341.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml/
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/binary
Source: saBSI.exe, 00000006.00000003.2123144495.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/898/
Source: saBSI.exe, 00000006.00000003.2123144495.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/pc/partner_custom_bsi.xml
Source: saBSI.exe, 00000006.00000003.2123144495.0000000002EEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/update/post_install.xml
Source: servicehost.exe, 00000025.00000003.2396094556.0000012830FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/WebAdvisor/Win/update_product.xml
Source: servicehost.exe, 00000025.00000003.2822435756.0000013031927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/WebAdvisor/Win/update_product.xmlser_protection_score).
Source: servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/WebAdvisor/Win/update_product_dataConfig.xml
Source: servicehost.exe, 00000025.00000003.2389558951.000001283035F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2389558951.000001283035F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa(
Source: saBSI.exe, 00000006.00000003.2486133896.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2122780803.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2485866665.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2015109896.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2027977822.00000000055C5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131499733.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053115287.00000000055C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary
Source: saBSI.exe, 00000006.00000003.2015109896.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2473044728.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137581289.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053470694.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2485441210.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2027977822.00000000055DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary/
Source: saBSI.exe, 00000006.00000003.2053785665.00000000055FE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2122780803.00000000055FD000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2078411123.00000000055FD000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053115287.00000000055FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa/v1/pc/partner_custom_vars.xml
Source: servicehost.exe, 00000025.00000003.2395302436.0000012830F6A000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2394364010.0000012830F6A000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2915403088.0000013041E64000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2396094556.0000012830F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa/win/ca/update.xml
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa6
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saB
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saP
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saR=
Source: saBSI.exe, 00000006.00000000.1925610612.000000000087E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saUPDATER_URLupdater.exeWebAdvisor_Updaterheron_hostthreat.ap
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2389558951.000001283035F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saY0
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sadows_
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sallowedFl
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sallowedal
Source: installer.exe, 00000015.00000003.2284950546.000001EE50616000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279804803.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp, installer.exe, 00000015.00000003.2297053110.000001EE5049E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saupdater.exeWebAdvisor_Updaterthreat.api.mcafee.comheron_tok
Source: servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saurnalpoc
Source: servicehost.exe, 00000025.00000003.2822435756.0000013031927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com:443/products/WebAdvisor/Win/update_product_dataConfig.xml
Source: servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: rsWSC.exe, 00000023.00000002.2396723546.000001316C38B000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2398588354.000001316C560000.00000004.00000020.00020000.00000000.sdmp, rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/R
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/Re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/Rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/Reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/Reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/Reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonL
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLa
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLab
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-D
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-DN
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-DNS
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-DNS-
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-DNS-setup.exe?id=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-V
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VP
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-s
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-se
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-set
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.e
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.ex
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?o
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oi
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=2
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&d
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dt
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=t
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=tr
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=tru
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&p
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&pt
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&i
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&id
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&id=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.co
Source: component0.exe, 00000003.00000002.2859609295.0000022C8009E000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/R
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/Re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/Rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/Reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/Reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/Reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonL
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLa
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLab
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-D
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DN
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-s
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-se
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-set
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.e
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.ex
Source: component0.exe, 00000003.00000000.1901418219.0000022CF9882000.00000002.00000001.01000000.0000000B.sdmp, component0.exe, 00000003.00000002.2859609295.0000022C80001000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.exe
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.exe?
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.exe?i
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.exe?id
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.exe?id=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-E
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EP
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-s
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-se
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-set
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-setu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-setup
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-setup.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-setup.e
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-setup.ex
Source: component0.exe, 00000003.00000000.1901418219.0000022CF9882000.00000002.00000001.01000000.0000000B.sdmp, component0.exe, 00000003.00000002.2859609295.0000022C80001000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-setup.exe
Source: component0.exe, 00000003.00000002.2859609295.0000022C8009E000.00000004.00000800.00020000.00000000.sdmp, component0.exe, 00000003.00000002.2859609295.0000022C80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-setup.exe?dui=9e146be9-c76a-4720-bcdb-53011b87bd06&
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-EPP-setup.exeX
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-V
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VP
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-s
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-se
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-set
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.e
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.ex
Source: component0.exe, 00000003.00000000.1901418219.0000022CF9882000.00000002.00000001.01000000.0000000B.sdmp, component0.exe, 00000003.00000002.2859609295.0000022C80001000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?o
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oi
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=2
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&d
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dt
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=t
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=tr
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=tru
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&p
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&pt
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&i
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&id
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&id=
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC9000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exe
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exe130391c6f350bd5b200f(
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exeges/880/update2/EN.pngs
Source: component0.exe, 00000003.00000002.2859609295.0000022C80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com:443/ReasonLabs-EPP-setup.exe?dui=9e146be9-c76a-4720-bcdb-53011b87b
Source: cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://system.data.sqlite.org/
Source: cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://system.data.sqlite.org/X
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.a
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.an
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.ana
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.anal
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analy
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABF88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analyt
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analyti
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytic
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-d
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-da
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-dat
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.i
Source: RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.io
Source: RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.io(
Source: RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.io/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.io/X
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.ioX
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.ioYTD2bje3MpZmRHfvPqjEhgac5rqRkvTdeZLa&4?y
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud-beta.reasonsecurity.comX
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ud.reasonsecurity.comX
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/
Source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/live
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/u
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/up
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/upd
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/upda
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/updat
Source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/update
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/updateX
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.r
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.re
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.rea
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reas
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reaso
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reason
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasons
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonse
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsec
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecu
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecur
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecuri
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurit
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220800BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/
Source: rsSyncSvc.exe, 0000000B.00000002.2876299769.0000018992E00000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/live
Source: rsSyncSvc.exe, 0000000B.00000002.2876299769.0000018992E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/live-bn:ReasonLabs-dt:10
Source: rsSyncSvc.exe, 00000009.00000002.1991678784.0000026D93EFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/live-dt:10
Source: rsSyncSvc.exe, 00000009.00000002.1991678784.0000026D93EFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/liveP2
Source: rsSyncSvc.exe, 0000000B.00000002.2876299769.0000018992E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/livelivedll
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/u
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/up
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/upd
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/upda
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/updat
Source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/update
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/updateX
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000075B4000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000075C2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://wechat.en.softonic.com&Filename=WeChatSetup.exe
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.00000000024EB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://wechat.en.softonic.com&Filename=WeChatSetup.exeLINK
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wechat.en.softonic.com&Filename=WeChatSetup.exec.com&Filename=WeChatSetup.exe
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.00000000024EB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://wechat.en.softonic.com&Filename=WeChatSetup.exel
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.00000000024CD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://wechat.en.softonic.com/
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2212930638.0000000002551000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://wechat.en.softonic.comA
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/eD
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/eula-avast-consumer-produc
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/eula-avast-consumer-products
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/eula-avast-consumer-productsC
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/pr
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/pri
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/privacy-policy
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avg.com/ww-en/eula
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avg.com/ww-en/privacy
Source: rsWSC.exe, 00000023.00000002.2399510309.000001316C802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: rsWSC.exe, 00000023.00000002.2399510309.000001316C802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.forbes.com/sites/forbestechcouncil/2022/07/13/why-do-hacks-happen-four-ubiquitous-motiva
Source: installer.exe, 00000015.00000003.2283460924.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2281619071.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.glo.
Source: installer.exe, 00000015.00000003.2287899474.000001EE4FC06000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2287714016.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/reposI=
Source: installer.exe, 00000015.00000003.2257662101.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1924914911.00000000053FB000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1925856309.00000000050D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2133543794.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138227025.0000000005645000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134635690.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131010474.0000000005607000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2136998310.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134588942.0000000005881000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137550371.000000000591D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2135654827.0000000005646000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2138227025.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137286489.0000000005687000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2134797695.0000000005646000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2290004891.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2234210490.000001EE4FC2B000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2214701595.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300820263.000001EE4FC10000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2292906319.000001EE4E346000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2283460924.000001EE4FC19000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: https://www.google.com/search?q=%s
Source: installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=%sSoftware
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000026F0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000000.1636976723.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/c7
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/co
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/con
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consI
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consu
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consum
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000075F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consume
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2217967515.000000000366D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/e
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2217967515.000000000366D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/p
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/polic
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/global/R
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC9000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2261224459.000001EE5049A000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2261434562.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/global/legal.html
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/globp
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000075E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/l
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000075E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/le
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2217967515.000000000366D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html0391c6
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A82000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html7
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlOC;
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html_B
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlz;
Source: installer.exe, 00000012.00000003.2182206269.000002236E0C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/nl-nl/policy/legal.html
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.html
Source: servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlL
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlR
Source: servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlT1
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlX
Source: servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlhttp://cac
Source: saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlj
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlq
Source: regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlu
Source: installer.exe, 00000012.00000003.2182206269.000002236E0C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/legal
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.opera.com/he/eula/computers
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.opera.com/he/privacy
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.c
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.co
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.com
Source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.com/
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.com/X
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000026F0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000000.1636976723.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps
Source: installer.exe, 00000015.00000003.2249551185.000001EE4E34C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2249328069.000001EE50496000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.siteadvisor.com/ff/install
Source: installer.exe, 00000015.00000003.2279051517.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2200549679.000001EE4FBF9000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2300890272.000001EE4FC06000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2265476089.000001EE4FBF6000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2194448368.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2237382180.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2282895132.000001EE4FC04000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2193246767.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241871701.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2233615654.000001EE4FC02000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2205120374.000001EE4FBF7000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2201944985.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2286889085.000001EE4FC06000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2289188082.000001EE4FC04000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2281619071.000001EE4FBF3000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2286349170.000001EE4FC06000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2252740253.000001EE4FC00000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2205207739.000001EE4FBFC000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2284001971.000001EE4FC07000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2276194710.000001EE4FBF5000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2191940595.000001EE4FBFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwwssdep.cabsitory/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe

Code function: 7_2_00405705 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

7_2_00405705

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\rselam.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\elam\rselam.cat	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe

File dropped: C:\Program Files\McAfee\Temp3475153614\jslang\eula-en-US.txt -> encryption key for your account secure because without them you may lose access to your data. you are solely responsible and liable for any activity that occurs under your account, including by anyone who uses your account. if there is any unauthorized use or access to your account, you must let us know immediately. we are not responsible for any loss caused by unauthorized use of or access to your account; however, you may be liable for any losses we or others suffer because of the unauthorized use. we do not have access to master passwords and cannot recover your encrypted data if you forget the master password for any password management feature or product. we offer both free and premium versions of our password and identity management software, and the free versions limit the maximum number of unique accounts (such as a website or application login) that you can store. if you have downloaded a premium version of the software at no cost during a promotion, then when the promotional period ends you will not

Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1 (copy) entropy: 7.99597518735	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1.zip (copy) entropy: 7.99597518735	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe entropy: 7.99268446314	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ReasonLabs-EPP.7z entropy: 7.99998386038	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Users\user\AppData\Local\Temp\electron.7z entropy: 7.99999530372	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources.pak entropy: 7.99555496455	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\analyticsmanager.cab entropy: 7.99966205396	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\browserhost.cab entropy: 7.99940458789	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\browserplugin.cab entropy: 7.99921375745	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\downloadscan.cab entropy: 7.99971567747	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\eventmanager.cab entropy: 7.99961026418	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\logicmodule.cab entropy: 7.99963027056	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\lookupmanager.cab entropy: 7.99940721056	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\mfw-webadvisor.cab entropy: 7.99749591242	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\mfw.cab entropy: 7.99504677769	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\servicehost.cab entropy: 7.99683451054	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\settingmanager.cab entropy: 7.99942430965	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\taskmanager.cab entropy: 7.9996376975	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\uihost.cab entropy: 7.99722395671	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\uimanager.cab entropy: 7.99950321932	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\uninstaller.cab entropy: 7.99937886305	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\updater.cab entropy: 7.99943711138	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\wataskmanager.cab entropy: 7.99986130185	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\wssdep.cab entropy: 7.9988485709	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	File created: C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi entropy: 7.99707344308	Jump to dropped file

System Summary

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

File dump: rsAppUI.exe.8.dr 166021264

Jump to dropped file

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007D6220: GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,

6_2_007D6220

Contains functionality to delete services

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 9_2_00007FF639694BB0 RegCreateKeyExW,RegCloseKey,OutputDebugStringW,OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherW,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

9_2_00007FF639694BB0

Contains functionality to launch a process as a different user

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 9_2_00007FF6396BE4D0 WTSGetActiveConsoleSessionId,ProcessIdToSessionId,OpenProcess,OpenProcessToken,CloseHandle,GetLastError,DuplicateTokenEx,CloseHandle,CreateProcessAsUserW,CloseHandle,WaitForSingleObject,CloseHandle,GetLastError,CloseHandle,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

9_2_00007FF6396BE4D0

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	7_2_0040351C
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	12_2_0040351C
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	13_2_0040351C

Creates driver files

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

File created: C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys

Jump to behavior

Creates files inside the driver directory

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

File created: C:\Windows\system32\drivers\rsCamFilter020502.sys

Jump to behavior

Creates files inside the system directory

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\system32\drivers\rsCamFilter020502.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\system32\drivers\rsKernelEngine.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\system32\drivers\rsElam.sys	Jump to behavior

Detected potential crypto function

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007D4F50	6_2_007D4F50
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007D8FB0	6_2_007D8FB0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007D70D9	6_2_007D70D9
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007D5110	6_2_007D5110
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007DF110	6_2_007DF110
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007F73B0	6_2_007F73B0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0080D540	6_2_0080D540
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00811840	6_2_00811840
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007F3AC0	6_2_007F3AC0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0080FFE0	6_2_0080FFE0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00808190	6_2_00808190
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_008183A0	6_2_008183A0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0080A540	6_2_0080A540
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007BA610	6_2_007BA610
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00858609	6_2_00858609
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00820660	6_2_00820660
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_008147C0	6_2_008147C0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_008128A0	6_2_008128A0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_008668E0	6_2_008668E0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00860992	6_2_00860992
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00840919	6_2_00840919
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00860AB2	6_2_00860AB2
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007B2B00	6_2_007B2B00
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00840B4B	6_2_00840B4B
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00840DB0	6_2_00840DB0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0083ADD0	6_2_0083ADD0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00816D43	6_2_00816D43
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007E8EA0	6_2_007E8EA0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007BCF40	6_2_007BCF40
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0080F150	6_2_0080F150
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007FD2C0	6_2_007FD2C0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0084933A	6_2_0084933A
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0084B340	6_2_0084B340
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_008514AF	6_2_008514AF
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0081B4F0	6_2_0081B4F0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007B5400	6_2_007B5400
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00817602	6_2_00817602
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007BF830	6_2_007BF830
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0085D8E0	6_2_0085D8E0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0084390B	6_2_0084390B
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00813A30	6_2_00813A30
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007EFB40	6_2_007EFB40
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007E3C50	6_2_007E3C50
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007DBCB0	6_2_007DBCB0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_007B7D10	6_2_007B7D10
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_00406C5F	7_2_00406C5F
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Code function: 8_2_00007FFD9B9F6C04	8_2_00007FFD9B9F6C04
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396971C0	9_2_00007FF6396971C0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639694BB0	9_2_00007FF639694BB0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FC334	9_2_00007FF6396FC334
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396A7B30	9_2_00007FF6396A7B30
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639706314	9_2_00007FF639706314
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396992F0	9_2_00007FF6396992F0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396C6AD0	9_2_00007FF6396C6AD0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FA1B0	9_2_00007FF6396FA1B0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396B5990	9_2_00007FF6396B5990
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396BC990	9_2_00007FF6396BC990
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396F9990	9_2_00007FF6396F9990
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6397111E8	9_2_00007FF6397111E8
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63971D1EC	9_2_00007FF63971D1EC
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396C2960	9_2_00007FF6396C2960
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396B4140	9_2_00007FF6396B4140
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63971F188	9_2_00007FF63971F188
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63970D18C	9_2_00007FF63970D18C
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396A89D0	9_2_00007FF6396A89D0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FB4A0	9_2_00007FF6396FB4A0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396BE4D0	9_2_00007FF6396BE4D0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FA3B4	9_2_00007FF6396FA3B4
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396F9B94	9_2_00007FF6396F9B94
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FCB70	9_2_00007FF6396FCB70
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396EE430	9_2_00007FF6396EE430
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63971F6D4	9_2_00007FF63971F6D4
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396A3660	9_2_00007FF6396A3660
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63969F6E0	9_2_00007FF63969F6E0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396F9DA0	9_2_00007FF6396F9DA0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6397165D4	9_2_00007FF6397165D4
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639710D54	9_2_00007FF639710D54
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63969B5E0	9_2_00007FF63969B5E0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6397040B0	9_2_00007FF6397040B0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63969A080	9_2_00007FF63969A080
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639706934	9_2_00007FF639706934
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639716850	9_2_00007FF639716850
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FB108	9_2_00007FF6396FB108
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639711868	9_2_00007FF639711868
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639712870	9_2_00007FF639712870
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63970AFBC	9_2_00007FF63970AFBC
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396F9FA4	9_2_00007FF6396F9FA4
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639706180	9_2_00007FF639706180
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FC76C	9_2_00007FF6396FC76C
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF63970E024	9_2_00007FF63970E024
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FB824	9_2_00007FF6396FB824
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF639709F80	9_2_00007FF639709F80
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_00406C5F	12_2_00406C5F
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_00406C5F	13_2_00406C5F
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_6B431BFF	13_2_6B431BFF

Enables driver privileges

Source: C:\Windows\System32\fltMC.exe

Process token adjusted: Load Driver

Enables security privileges

Source: C:\Windows\System32\wevtutil.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: String function: 00007FF639693810 appears 34 times
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: String function: 00007FF6396AE250 appears 58 times
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: String function: 00007FF639691DB0 appears 68 times
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: String function: 00854231 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: String function: 007C1BE0 appears 67 times
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: String function: 00838E31 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: String function: 00839600 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: String function: 008385BF appears 56 times
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: String function: 007F8650 appears 192 times
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: String function: 00838713 appears 374 times
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: String function: 00838DFE appears 111 times

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6540 -ip 6540

PE file contains executable resources (Code or Archives)

Source: wechat-3.9.7-installer_ae-GFz1.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: installer.exe.6.dr	Static PE information: Resource name: PAYLOAD type: Microsoft Cabinet archive data, many, 28097920 bytes, 132 files, at 0x2c +A "analyticsmanager.cab" +A "analyticstelemetry.cab", number 1, 988 datablocks, 0x1 compression

Sample file is different than original file name gathered from version info

Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000029E8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs wechat-3.9.7-installer_ae-GFz1.exe
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.2236295126.0000000002318000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs wechat-3.9.7-installer_ae-GFz1.exe
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs wechat-3.9.7-installer_ae-GFz1.exe
Source: wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000000.1629154676.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs wechat-3.9.7-installer_ae-GFz1.exe

Searches the installation path of Mozilla Firefox

Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\118.0.1 (x64 en-US)\Main Install Directory

Uses 32bit PE files

Source: wechat-3.9.7-installer_ae-GFz1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

query blbeacon for getting browser version

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version			Jump to behavior
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Key value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon version

Source: RAVEndPointProtection-installer.exe.7.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal48.rans.troj.spyw.evad.winEXE@78/1890@0/21

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	7_2_0040351C
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	12_2_0040351C
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	13_2_0040351C

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe

Code function: 7_2_004049B1 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

7_2_004049B1

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: OutputDebugStringW,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,ChangeServiceConfig2W,StartServiceW,CloseServiceHandle,CloseServiceHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,OutputDebugStringW,RegisterServiceCtrlHandlerExW,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,CreateEventW,OutputDebugStringW,GetLastError,SetServiceStatus,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,WaitForSingleObject,OutputDebugStringW,OutputDebugStringW,CloseHandle,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,OutputDebugStringW,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,SetEvent,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

9_2_00007FF6396971C0

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007C4C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

6_2_007C4C8E

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007C5C1E CoCreateInstance,OleRun,

6_2_007C5C1E

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007E5318 GetModuleHandleW,FindResourceW,LoadResource,LockResource,std::ios_base::_Ios_base_dtor,GetModuleHandleW,GetProcAddress,GetCurrentProcess,Concurrency::cancel_current_task,Concurrency::cancel_current_task,SysFreeString,SysFreeString,

6_2_007E5318

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 9_2_00007FF6396971C0 OutputDebugStringW,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,ChangeServiceConfig2W,StartServiceW,CloseServiceHandle,CloseServiceHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,OutputDebugStringW,RegisterServiceCtrlHandlerExW,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,CreateEventW,OutputDebugStringW,GetLastError,SetServiceStatus,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,WaitForSingleObject,OutputDebugStringW,OutputDebugStringW,CloseHandle,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,OutputDebugStringW,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,SetEvent,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

9_2_00007FF6396971C0

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

9_2_00007FF639694BB0

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

File created: C:\Program Files\ReasonLabs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\_rsStubExecute
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Mutant created: NULL
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6540
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6252:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3584:120:WilError_03

Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe

File created: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp

Jump to behavior

Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE (Name='rsAppUI.exe' OR Name='ReasonLabs.exe') AND CommandLine Like '%EPP%'
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ParentProcessId FROM Win32_Process WHERE ProcessId = 6024
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE (Name='rsAppUI.exe' OR Name='ReasonLabs.exe') AND CommandLine Like '%EPP%'
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE (Name='rsAppUI.exe' OR Name='ReasonLabs.exe') AND CommandLine Like '%ReasonEDR%'
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%klekeajafkkpokaofllcadenjdckhinm%'
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%{4ED1F68A-5463-4931-9384-8FFF5ED91D92}%'
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%fheoggkfdfchfphceeifdbepaooicaho%'
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%{4ED1F68A-5463-4931-9384-8FFF5ED91D92}%'
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%{4ED1F68A-5463-4931-9384-8FFF5ED91D92}%'
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%{4ED1F68A-5463-4931-9384-8FFF5ED91D92}%'
Source: C:\Program Files\McAfee\WebAdvisor\uihost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%{4ED1F68A-5463-4931-9384-8FFF5ED91D92}%'
Source: C:\Program Files\McAfee\WebAdvisor\uihost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%fdhgeoginicibhagdmblfikbgbkahibd%'

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf

Source: installer.exe, 00000015.00000003.2284950546.000001EE50616000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO ParentChild VALUES(?, ?, ?);
Source: installer.exe, 00000015.00000003.2288937766.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2196277192.000001EE50499000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2284950546.000001EE50493000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2213293775.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: installer.exe, 00000015.00000003.2284950546.000001EE50616000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM ParentChild;DELETE FROM Settings WHERE ParentID=?;Settings_INDEX_PID_NAMEUPDATE Settings SET SettingName = ? WHERE ParentID = ? AND SettingName = ?;SettingsUPDATE Settings SET SettingType=?, Setting=? WHERE ParentID=? AND SettingName=?;ParentChildINSERT INTO Settings VALUES(?, ?, ?, ?);
Source: installer.exe, 00000015.00000003.2284950546.000001EE50616000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE ParentChild SET Name = ? WHERE ParentID = ? AND Name = ?;
Source: installer.exe, 00000015.00000003.2284950546.000001EE50616000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE Settings(ParentID INT, SettingName VARCHAR(40), SettingType INT, Setting BLOB);DELETE FROM ParentChild WHERE ParentID=?;
Source: installer.exe, 00000015.00000003.2288937766.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2196277192.000001EE50499000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2284950546.000001EE50493000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2213293775.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: installer.exe, 00000015.00000003.2284950546.000001EE50616000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM Settings;CREATE INDEX Settings_INDEX_PID_NAME ON Settings (ParentID ASC, SettingName ASC);

Source: wechat-3.9.7-installer_ae-GFz1.exe

Virustotal: Detection: 20%

Source: cldwur4x.exe	String found in binary or memory: "C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\cldwur4x.ex
Source: Uninstall.exe	String found in binary or memory: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\nsmA848.tmp\
Source: Uninstall.exe	String found in binary or memory: "C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\nsmA848.tmp
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-cs-CZ.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-da-DK.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-en-US.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-es-ES.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-es-MX.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-de-DE.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-el-GR.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-hr-HR.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-hu-HU.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-it-IT.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-fi-FI.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-fr-CA.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-fr-FR.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-nb-NO.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-nl-NL.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-pl-PL.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-ja-JP.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-ko-KR.js
Source: installer.exe	String found in binary or memory: wa-install.css
Source: installer.exe	String found in binary or memory: wa-install.html
Source: installer.exe	String found in binary or memory: wa-ui-install.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-sk-SK.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-sr-Latn-CS.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-pt-BR.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-pt-PT.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-ru-RU.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-zh-TW.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-sv-SE.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-tr-TR.js
Source: installer.exe	String found in binary or memory: jslang\wa-res-install-zh-CN.js

Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe

File read: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe "C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe"
Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp "C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp" /SL5="$1040C,837551,832512,C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240601224314&is_silent=true&oc=ZB_RAV_Cross_Solo_Soft&p=fa70&a=100&b=&se=true" -i
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process created: C:\Users\user\AppData\Local\Temp\cldwur4x.exe "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Process created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe "C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
Source: unknown	Process created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe "C:\Program Files\ReasonLabs\EPP\Uninstall.exe" /auto-repair=RavStub
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Process created: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe "C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe" /auto-repair=RavStub
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6540 -ip 6540
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Process created: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe "C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe" /auto-repair=RavStub
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6540 -ip 6540
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Process created: C:\Program Files\McAfee\Temp3475153614\installer.exe "C:\Program Files\McAfee\Temp3475153614\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\runonce.exe "C:\Windows\system32\runonce.exe" -r
Source: C:\Windows\System32\runonce.exe	Process created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml
Source: C:\Windows\System32\wevtutil.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\fltMC.exe "fltmc.exe" load rsKernelEngine
Source: C:\Windows\System32\fltMC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml
Source: C:\Windows\System32\wevtutil.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsWSC.exe "C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Source: unknown	Process created: C:\Program Files\McAfee\WebAdvisor\servicehost.exe "C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
Source: unknown	Process created: C:\Program Files\ReasonLabs\EPP\rsWSC.exe "C:\Program Files\ReasonLabs\EPP\rsWSC.exe"
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process created: C:\Program Files\McAfee\WebAdvisor\uihost.exe "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe "C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i
Source: C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe "C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe "C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i
Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp "C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp" /SL5="$1040C,837551,832512,C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240601224314&is_silent=true&oc=ZB_RAV_Cross_Solo_Soft&p=fa70&a=100&b=&se=true" -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process created: C:\Users\user\AppData\Local\Temp\cldwur4x.exe "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Process created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe "C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\fltMC.exe "fltmc.exe" load rsKernelEngine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsWSC.exe "C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe "C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe "C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Process created: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe "C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe" /auto-repair=RavStub
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Process created: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe "C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe" /auto-repair=RavStub
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6540 -ip 6540
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6540 -ip 6540
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Process created: C:\Program Files\McAfee\Temp3475153614\installer.exe "C:\Program Files\McAfee\Temp3475153614\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\runonce.exe "C:\Windows\system32\runonce.exe" -r
Source: C:\Windows\System32\runonce.exe	Process created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process created: C:\Program Files\McAfee\WebAdvisor\uihost.exe "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process created: unknown unknown
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process created: unknown unknown
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: zipfldr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: apphelp.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: version.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: urlmon.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: powrprof.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: winhttp.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: iertutil.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: srvcli.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: netutils.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: umpdc.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: version.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: urlmon.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: powrprof.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: winhttp.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: iertutil.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: srvcli.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: netutils.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: umpdc.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: userenv.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: apphelp.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: propsys.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: oleacc.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: version.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: shfolder.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: wldp.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: profapi.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: apphelp.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: winhttp.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: userenv.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: msasn1.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: wldp.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: profapi.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: winsta.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: cabinet.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: gpapi.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: webio.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: mswsock.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: winnsi.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: sspicli.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: schannel.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: version.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\runonce.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\runonce.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\runonce.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\runonce.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\runonce.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\runonce.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\runonce.exe	Section loaded: windows.staterepositoryps.dll

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

File written: C:\Program Files\ReasonLabs\EPP\SecurityProductInformation.ini

Jump to behavior

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Automated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Automated click: Accept

Uses Rich Edit Controls

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\uninstall.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\chrome_100_percent.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\chrome_200_percent.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\icudtl.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\LICENSE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\LICENSES.chromium.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\af.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\am.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ar.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\bg.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\bn.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ca.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\cs.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\da.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\de.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\el.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\en-GB.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\en-US.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\es-419.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\es.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\et.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fa.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fi.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fil.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\gu.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\he.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hi.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hu.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\id.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\it.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ja.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\kn.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ko.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\lt.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\lv.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ml.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\mr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ms.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\nb.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\nl.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pl.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pt-BR.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pt-PT.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ro.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ru.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sk.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sl.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sv.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sw.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ta.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\te.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\th.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\tr.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\uk.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ur.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\vi.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\zh-CN.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\zh-TW.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources.pak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar.sig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\snapshot_blob.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\v8_context_snapshot.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader_icd.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\d3dcompiler_47.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libEGL.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libGLESv2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vulkan-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ReasonLabs-EPP.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ARM64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam\rselam.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam\rsElam.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\manifest.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsHelper.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\SecurityProductInformation.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Signatures.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.sig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\manifest.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\WhiteList.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\amd64\KernelTraceControl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\amd64\msdia140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ARM64\KernelTraceControl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ARM64\msdia140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ARM64\rsYara-ARM64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\BouncyCastle.Crypto.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Dia2Lib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\KernelTraceControl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\msdia140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Dia2Lib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.FastSerialization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Win32.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\OSExtensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRSvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.JSON.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\SQLite.Interop.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.AppContext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Concurrent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.NonGeneric.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Specialized.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.EventBasedAsync.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.TypeConverter.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Console.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Data.Common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Data.SQLite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Contracts.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Debug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.FileVersionInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Process.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.StackTrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.TextWriterTraceListener.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tools.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.TraceSource.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tracing.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Drawing.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Dynamic.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Calendars.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.ZipFile.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.DriveInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Watcher.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.IsolatedStorage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.MemoryMappedFiles.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Pipes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.UnmanagedMemoryStream.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Expressions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Parallel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Queryable.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Http.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NameResolution.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NetworkInformation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Ping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Requests.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Security.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Sockets.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebHeaderCollection.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.Client.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ObjectModel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Reader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.ResourceManager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Writer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.Unsafe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.VisualC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Handles.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Numerics.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Formatters.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Json.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Xml.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Claims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Algorithms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Csp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Encoding.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.X509Certificates.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Principal.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.SecureString.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.RegularExpressions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Overlapped.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.Parallel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Thread.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.ThreadPool.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Timer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.ValueTuple.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.ReaderWriter.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlSerializer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.XDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\TraceReloggerLib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\EDR\x64\SQLite.Interop.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\InstallerLib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\mc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Bcl.HashCode.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.FastSerialization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.Tracing.TraceEvent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Registry.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\NAudio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\netstandard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsAssistant.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsAtom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsBridge.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsBuild.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsDatabase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Application.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Needle.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Performance.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Camera.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnAccess.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.Proxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsFrame.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsJSON.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsLitmus.A.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsLitmus.S.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsLogger.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsPerformance.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsServiceController.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsTime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\rsWSCClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\SQLite.Interop.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.AppContext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Collections.Concurrent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Collections.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Collections.NonGeneric.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Collections.Specialized.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.EventBasedAsync.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.TypeConverter.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Console.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Data.Common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Data.SQLite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Contracts.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Debug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.FileVersionInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Process.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.StackTrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TextWriterTraceListener.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tools.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TraceSource.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tracing.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.DirectoryServices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Drawing.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Dynamic.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Globalization.Calendars.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Globalization.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.Compression.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.Compression.ZipFile.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.DriveInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Watcher.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.IsolatedStorage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.MemoryMappedFiles.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.Pipes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.IO.UnmanagedMemoryStream.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Linq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Linq.Expressions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Linq.Parallel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Linq.Queryable.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Http.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.NameResolution.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.NetworkInformation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Ping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Requests.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Security.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.Sockets.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.WebHeaderCollection.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.Client.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ObjectModel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Reflection.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Reflection.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Reflection.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Resources.Reader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Resources.ResourceManager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Resources.Writer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.Unsafe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.VisualC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Handles.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Numerics.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Formatters.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Json.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Xml.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.AccessControl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Claims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Algorithms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Csp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Encoding.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Primitives.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.X509Certificates.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Principal.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.Principal.Windows.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Security.SecureString.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.Extensions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Text.RegularExpressions.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Overlapped.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.Parallel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Thread.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.ThreadPool.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Threading.Timer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.ValueTuple.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.ReaderWriter.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XmlDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XmlSerializer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.XDocument.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\TraceReloggerLib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ui\EPP.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\7z64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\ext_x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\lz4_x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsCamFilter020502.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsJournal-x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\rsYara-x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\x64\SQLite.Interop.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\uninstall.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EDR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EDR\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EDR\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\ReasonLabs-EPP.7z
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\amd64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ARM64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\EDR
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\EDR\amd64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\EDR\x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\x64
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\evntdrv.xml
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\rselam.cat
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\rsElam.inf
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\manifest.json
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsClient.Protection.Microphone.dll.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsEngine.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsEngineSvc.exe.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsExtensionHost.exe.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsHelper.exe.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\rsRemediation.exe.config
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\SecurityProductInformation.ini
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\Signatures.dat
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.sig
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\manifest.json
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\WhiteList.dat
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\133617854419739262\x64\rsKernelEngine.inf
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\analyticsmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\analyticstelemetry.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\balloon_safe_annotation.png
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\browserhost.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\browserplugin.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\downloadscan.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\eventmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\icon_complete.png
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\icon_failed.png
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\icon_laptop.png
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\jquery-1.9.0.min.js
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\l10n.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\logicmodule.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\logicscripts.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\lookupmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Directory created: C:\Program Files\McAfee\Temp3475153614\main_close_large.png

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP

Jump to behavior

PE / OLE file has a valid certificate

Source: wechat-3.9.7-installer_ae-GFz1.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: wechat-3.9.7-installer_ae-GFz1.exe

Static file information: File size 1771256 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: wechat-3.9.7-installer_ae-GFz1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: rsAtom.pdb source: cldwur4x.exe, 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2814717721.00000220FEB42000.00000002.00000001.01000000.0000003A.sdmp, Uninstall.exe, 0000000D.00000003.2030874846.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\ServiceHost.pdbu source: installer.exe, 00000015.00000003.2279804803.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsWSC.pdb source: rsWSC.exe, 00000023.00000000.2377819043.0000013169FE2000.00000002.00000001.01000000.00000023.sdmp, rsWSC.exe, 00000023.00000002.2391526354.00000131000A0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\SettingManager.pdb source: installer.exe, 00000015.00000003.2284950546.000001EE50616000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\WebAdvisor-accesslib-caller_main@2\Build\x64\Release\caller_dll.pdb source: installer.exe, 00000015.00000000.2184712865.00007FF7F5BD2000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\rsStubActivator\rsStubActivator\rsStubActivator\obj\Release\net462\rsStubActivator.pdb source: component0.exe, 00000003.00000000.1901418219.0000022CF9882000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: rsTime.pdb source: cldwur4x.exe, 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2035288824.0000000002746000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdbGCTL source: installer.exe, 00000015.00000003.2275014753.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\BrowserHost.pdbe source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\LogicModule.pdb source: installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\non_system\code\WebAdvisor-ISGIS\build\x64\Release\Installer.pdb$ source: installer.exe, 00000012.00000002.2429013846.00007FF62C89B000.00000002.00000001.01000000.0000001A.sdmp, installer.exe, 00000012.00000000.2140165890.00007FF62C89B000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdb source: installer.exe, 00000015.00000003.2275014753.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\RavStub\obj\Release\RavStub.pdb source: cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb< source: cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, rsSyncSvc.exe, 00000009.00000002.1991906507.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 00000009.00000000.1989460441.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 0000000B.00000000.1991099416.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 0000000B.00000002.2881117473.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, Uninstall.exe, 0000000D.00000003.2036725160.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\x64\Release\ArchiveUtility.pdb source: cldwur4x.exe, 00000007.00000003.1941104405.000000000275F000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2017575775.000000000274C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\ServiceHost.pdb source: installer.exe, 00000015.00000003.2279804803.000001EE5049C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsJSON.pdbHG source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsServiceController.pdb source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\TaskManager.pdb source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\rsStubLib\obj\Release\rsStubLib.pdb source: cldwur4x.exe, 00000007.00000003.1947303929.0000000002756000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2806047428.00000220FE8D2000.00000002.00000001.01000000.00000037.sdmp, Uninstall.exe, 0000000D.00000003.2034651192.0000000002745000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\TaskManager.pdb{ source: installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdbSHA256 source: cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2816590508.00000220FEBF2000.00000002.00000001.01000000.0000003B.sdmp, Uninstall.exe, 0000000D.00000003.2018820324.000000000274C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\BrowserHost.pdb source: installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\non_system\code\WebAdvisor-ISGIS\build\x64\Release\Installer.pdb source: installer.exe, 00000012.00000002.2429013846.00007FF62C89B000.00000002.00000001.01000000.0000001A.sdmp, installer.exe, 00000012.00000000.2140165890.00007FF62C89B000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\UIHost.pdb source: installer.exe, 00000015.00000003.2297053110.000001EE5049E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsDatabase.pdb source: cldwur4x.exe, 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: cldwur4x.exe, 00000007.00000003.1944063171.000000000275A000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2029522577.0000000002749000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 00000006.00000000.1925610612.000000000087E000.00000002.00000001.01000000.0000000D.sdmp, saBSI.exe, 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\Installer.pdb source: installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\LookupManager.pdb source: installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\WATaskManager.pdb] source: servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb@ source: cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb source: cldwur4x.exe, 00000007.00000003.1943453787.000000000275B000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2027474805.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsLogger.pdb source: cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2807618602.00000220FE912000.00000002.00000001.01000000.00000038.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208072E000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\UIHost.pdbu source: installer.exe, 00000015.00000003.2297053110.000001EE5049E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb source: cldwur4x.exe, 00000007.00000003.1942704932.000000000275B000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2816590508.00000220FEBF2000.00000002.00000001.01000000.0000003B.sdmp, Uninstall.exe, 0000000D.00000003.2018820324.000000000274C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\EventManager.pdb source: installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsJSON.pdb source: cldwur4x.exe, 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208056A000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2813307929.00000220FEB02000.00000002.00000001.01000000.00000039.sdmp, Uninstall.exe, 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb source: cldwur4x.exe, 00000007.00000003.1948992026.000000000275D000.00000004.00000020.00020000.00000000.sdmp, rsSyncSvc.exe, 00000009.00000002.1991906507.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 00000009.00000000.1989460441.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 0000000B.00000000.1991099416.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, rsSyncSvc.exe, 0000000B.00000002.2881117473.00007FF639727000.00000002.00000001.01000000.00000012.sdmp, Uninstall.exe, 0000000D.00000003.2036725160.0000000002744000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsLogger.pdbx source: cldwur4x.exe, 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2807618602.00000220FE912000.00000002.00000001.01000000.00000038.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208072E000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\AnalyticsManager.pdb source: installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\LookupManager.pdbG source: installer.exe, 00000015.00000003.2256518886.000001EE504BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\x64\Release\WATaskManager.pdb source: servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp

Data Obfuscation

Binary contains a suspicious time stamp

Source: is-77RM8.tmp.1.dr

Static PE information: 0xA024B15D [Sat Feb 20 18:01:01 2055 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_00802B30 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,GetLastError,

6_2_00802B30

PE file contains an invalid checksum

Source: wechat-3.9.7-installer_ae-GFz1.tmp.0.dr	Static PE information: real checksum: 0x31e124 should be: 0x3174f1
Source: System.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x39be
Source: wechat-3.9.7-installer_ae-GFz1.exe	Static PE information: real checksum: 0x1b5901 should be: 0x1b3740
Source: cldwur4x.exe.3.dr	Static PE information: real checksum: 0x1e9d3e should be: 0x1ec0ef
Source: is-77RM8.tmp.1.dr	Static PE information: real checksum: 0x15863 should be: 0x185c5

PE file contains sections with non-standard names

Source: wechat-3.9.7-installer_ae-GFz1.exe	Static PE information: section name: .didata
Source: wechat-3.9.7-installer_ae-GFz1.tmp.0.dr	Static PE information: section name: .didata
Source: saBSI.exe.1.dr	Static PE information: section name: .didat
Source: installer.exe.6.dr	Static PE information: section name: _RDATA
Source: ArchiveUtilityx64.dll.7.dr	Static PE information: section name: _RDATA

Registers a DLL

Source: C:\Program Files\McAfee\Temp3475153614\installer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Code function: 1_2_0019C457 push ecx; retf	1_2_0019C458
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Code function: 1_2_0019BD6C push eax; ret	1_2_0019BD6D
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00838DDB push ecx; ret	6_2_00838DEE
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00867CFD push ecx; ret	6_2_00867D12
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_6B4330C0 push eax; ret	13_2_6B4330EE

Source: RAVEndPointProtection-installer.exe.7.dr

Static PE information: section name: .text entropy: 7.672717019783964

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Data.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\NAudio.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ru-RU\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Xml.XPath.XDocument.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hr-HR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.WebSockets.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.InteropServices.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Security.SecureString.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Threading.Tasks.Parallel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Collections.NonGeneric.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ARM64\KernelTraceControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Text.RegularExpressions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Resources.Reader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.Tracing.TraceEvent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.Pipes.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Globalization.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Threading.ThreadPool.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Requests.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sl\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\rsEngine.Utilities.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Security.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Principal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0 (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\da-DK\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Collections.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.Sockets.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\x64\rsYara-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsServiceController.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8CEF.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\vi-VN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fil-PH\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Security.Principal.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Http.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Xml.XmlSerializer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.ObjectModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ATY5CJG3\rsServiceController.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.DirectoryServices.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Globalization.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tr-TR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.NameResolution.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	File created: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\BouncyCastle.Crypto.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Linq.Queryable.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Contracts.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\x64\rsJournal-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\OSExtensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\th-TH\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsLitmus.A.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.CompilerServices.VisualC.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\nl-NL\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Claims.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Console.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Tools.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.ComponentModel.TypeConverter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.Compression.ZipFile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\TraceReloggerLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Collections.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pl-PL\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\TraceReloggerLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\el-GR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Encoding.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.Compression.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sk-SK\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt-PT\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ko-KR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-TW\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Dynamic.Runtime.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\x64\lz4_x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\System32\drivers\rsKernelEngine.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Threading.Tasks.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hi-IN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Reflection.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	File created: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.AppContext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Dia2Lib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsHelper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsSyncSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ZMMW8FDC\rsLogger.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.Http.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.Ping.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.ComponentModel.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Reflection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ARM64\msdia140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\amd64\vcruntime140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\is-77RM8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\SQLite.Interop.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Microsoft.Bcl.HashCode.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsPerformance.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.ComponentModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\nb-NO\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Globalization.Calendars.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsBridge.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsFrame.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.Principal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Formatters.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ARM64\rsYara-ARM64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Threading.Timer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.FastSerialization.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\rsAtom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Xml.ReaderWriter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Tracing.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\amd64\KernelTraceControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\System32\drivers\rsElam.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\netstandard.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.CompilerServices.Unsafe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Threading.Overlapped.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Csp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsLitmus.S.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\Uninstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ro-RO\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Linq.Parallel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Application.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.ObjectModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.MemoryMappedFiles.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\rsJSON.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Algorithms.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\System32\drivers\rsCamFilter020502.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.DriveInfo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Reflection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\cs-CZ\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Security.Claims.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Drawing.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\x64\7z64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\KernelTraceControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.AppContext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\KRK4DVBJ\rsJSON.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.AppContext.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sl-SI\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Threading.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\amd64\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\de-DE\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.WebHeaderCollection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.InteropServices.RuntimeInformation.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.NetworkInformation.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\netstandard.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\TraceReloggerLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-CN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ui\EPP.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	File created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Process.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.WebSockets.Client.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\amd64\msdia140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Reflection.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Linq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.Watcher.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Resources.ResourceManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.X509Certificates.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\x64\SQLite.Interop.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Data.SQLite.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\rsEngine.JSON.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.Numerics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Ping.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Data.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\id-ID\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Globalization.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.ObjectModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.Http.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\rsEngine.Loggers.Application.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.UnmanagedMemoryStream.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.Requests.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Linq.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Threading.Thread.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\UDOOGFD5\rsAtom.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.TextWriterTraceListener.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\amd64\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\rsEDRLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\it-IT\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\K0L2UM4E\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.TraceSource.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsAssistant.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hu-HU\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.Compression.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.Ping.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\Microsoft.Win32.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Linq.Expressions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.FastSerialization.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Data.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt-BR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.IO.IsolatedStorage.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Xml.XPath.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Text.Encoding.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Security.Claims.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.FileVersionInfo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Xml.XDocument.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.Security.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sv-SE\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.Requests.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\amd64\msdia140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\Dia2Lib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ja-JP\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\InstallerLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\es-ES\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.FastSerialization.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.ComponentModel.EventBasedAsync.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Xml.XmlDocument.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\x64\rsCamFilter020502.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.ValueTuple.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Console.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Threading.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnAccess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsWSCClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Console.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Collections.Specialized.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Needle.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\x64\ext_x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\mc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsBuild.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fi-FI\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.Proxy.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\amd64\msdia140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Debug.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Text.Encoding.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.Handles.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Collections.Concurrent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Performance.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\Dia2Lib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Net.Security.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\amd64\KernelTraceControl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.StackTrace.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Camera.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\OSExtensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fr-FR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.JSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\System.Resources.Writer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EDR\rsEngine.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Handles.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\System32\drivers\rsKernelEngine.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\System32\drivers\rsElam.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Windows\System32\drivers\rsCamFilter020502.sys	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RAVEndPointProtection-installer.exe.log	Jump to behavior
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	File created: C:\Program Files\ReasonLabs\EPP\InstallUtil.InstallLog
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	File created: C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	File created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-cs-CZ.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-da-DK.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-de-DE.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-el-GR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-en-US.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-es-ES.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-es-MX.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-fi-FI.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-fr-CA.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-fr-FR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-hr-HR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-hu-HU.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-it-IT.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-ja-JP.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-ko-KR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-nb-NO.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-nl-NL.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-pl-PL.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-pt-BR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-pt-PT.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-ru-RU.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-sk-SK.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-sr-Latn-CS.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-sv-SE.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-tr-TR.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-zh-CN.txt
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	File created: C:\Program Files\McAfee\Temp3475153614\jslang\eula-zh-TW.txt

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\System32\rundll32.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv

Installs Task Scheduler Managed Wrapper

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	File created: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	File created: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\Microsoft.Win32.TaskScheduler.dll

Creates or modifies windows services

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rsCamFilter020502

Jump to behavior

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

9_2_00007FF6396971C0

Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

File opened: C:\Program Files\ReasonLabs\EPP\Uninstall.exe:Zone.Identifier read attributes | delete

Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007F0540 EnterCriticalSection,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LeaveCriticalSection,

6_2_007F0540

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\McAfee
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\McAfee\WebAdvisor\uihost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\McAfee\WebAdvisor\uihost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Stores large binary data to the registry

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\grpconv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\grpconv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\grpconv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\grpconv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Memory allocated: 22CF9D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Memory allocated: 22CFB530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Memory allocated: 220FC780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Memory allocated: 220FE210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Memory allocated: 1DCAA250000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Memory allocated: 1DCC3A60000 memory reserve \| memory write watch
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Memory allocated: 1316A340000 memory reserve \| memory write watch
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Memory allocated: 1316BCC0000 memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 13031420000 memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 12831140000 memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 12831160000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 130319A0000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 130319E0000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 13031A80000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 13041C70000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 13042530000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 13042620000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Memory allocated: 13042720000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Memory allocated: 25A57270000 memory reserve \| memory write watch
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Memory allocated: 25A6F7F0000 memory reserve \| memory write watch
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Memory allocated: 2BC3FA90000 memory reserve \| memory write watch
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Memory allocated: 2BC593A0000 memory reserve \| memory write watch

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007C4C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

6_2_007C4C8E

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Window / User API: threadDelayed 4562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Window / User API: threadDelayed 5184	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Window / User API: threadDelayed 3892
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Window / User API: threadDelayed 5873
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Window / User API: threadDelayed 392

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Data.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\NAudio.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\taskmanager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ru-RU\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Xml.XPath.XDocument.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.WebSockets.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hr-HR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\fr-FR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.InteropServices.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\el-GR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\hi-IN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Security.SecureString.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Threading.Tasks.Parallel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Collections.NonGeneric.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\ARM64\KernelTraceControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Text.RegularExpressions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ko-KR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Resources.Reader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\amd64\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.Tracing.TraceEvent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.Pipes.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Globalization.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Threading.ThreadPool.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Requests.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sl\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\rsEngine.Utilities.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Security.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Principal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\it-IT\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\da-DK\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\133617854419739262\amd64\KernelTraceControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Collections.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.Sockets.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\x64\rsYara-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\nl-NL\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsServiceController.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8CEF.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\vi-VN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fil-PH\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Security.Principal.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\zh-TW\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\da-DK\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Http.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Xml.XmlSerializer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ATY5CJG3\rsServiceController.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.ObjectModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.DirectoryServices.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Globalization.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\sk-SK\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tr-TR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.NameResolution.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\sv-SE\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\BouncyCastle.Crypto.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\133617854419739262\ARM64\KernelTraceControl.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrA818.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Linq.Queryable.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Contracts.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\x64\rsJournal-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\zh-CN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\OSExtensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\tr-TR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\th-TH\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsLitmus.A.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.CompilerServices.VisualC.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\nl-NL\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Claims.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Tools.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Console.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.Compression.ZipFile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.ComponentModel.TypeConverter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\TraceReloggerLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Collections.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pl-PL\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\TraceReloggerLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\el-GR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Encoding.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\th-TH\RavStub.resources.dll	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\x64\downloadscan.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.Compression.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sk-SK\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\fi-FI\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt-PT\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ko-KR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-TW\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Dynamic.Runtime.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\x64\lz4_x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\rsKernelEngine.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\fil-PH\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Threading.Tasks.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hi-IN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\vi-VN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Reflection.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\sl-SI\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.AppContext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\Dia2Lib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\de-DE\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsHelper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ru-RU\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ZMMW8FDC\rsLogger.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.Http.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.Ping.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.ComponentModel.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Reflection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\ARM64\msdia140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\amd64\vcruntime140_1.dll (copy)	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\uimanager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\SQLite.Interop.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\Microsoft.Bcl.HashCode.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsPerformance.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.ComponentModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ja-JP\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\nb-NO\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Globalization.Calendars.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsBridge.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsFrame.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.Principal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Formatters.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\ARM64\rsYara-ARM64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Threading.Timer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Xml.ReaderWriter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\rsAtom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.FastSerialization.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libGLESv2.dll	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\logicmodule.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Tracing.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\amd64\KernelTraceControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\rsElam.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\netstandard.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.CompilerServices.Unsafe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Threading.Overlapped.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Csp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsLitmus.S.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\Uninstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ro-RO\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Linq.Parallel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\win32\wssdep.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Application.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\es-ES\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.ObjectModel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.MemoryMappedFiles.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\rsJSON.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Algorithms.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\rsCamFilter020502.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiA9AF.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.DriveInfo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Reflection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\cs-CZ\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Security.Claims.dll (copy)	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\lookupmanager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\Temp3475153614\resource.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Drawing.Primitives.dll (copy)	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\win32\downloadscan.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\x64\7z64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\amd64\KernelTraceControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.AppContext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\KRK4DVBJ\rsJSON.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.AppContext.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sl-SI\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Threading.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\amd64\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pt\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\de-DE\RavStub.resources.dll	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\uninstaller.exe	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\settingmanager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.WebHeaderCollection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.InteropServices.RuntimeInformation.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.NetworkInformation.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\netstandard.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\TraceReloggerLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-CN\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\ui\EPP.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Process.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.WebSockets.Client.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\amd64\msdia140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Reflection.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Linq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.Watcher.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.X509Certificates.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Resources.ResourceManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\x64\SQLite.Interop.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Data.SQLite.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\id-ID\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\rsEngine.JSON.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.Numerics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Ping.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Data.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\id-ID\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\hu-HU\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Globalization.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.ObjectModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pt-BR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.Http.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Net.Requests.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\rsEngine.Loggers.Application.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.UnmanagedMemoryStream.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Threading.Thread.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Linq.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\UDOOGFD5\rsAtom.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.TextWriterTraceListener.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\amd64\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mwaED6D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\rsEDRLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\K0L2UM4E\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.TraceSource.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\it-IT\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\cs-CZ\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsAssistant.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hu-HU\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.Compression.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\nb-NO\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\Microsoft.Win32.Primitives.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Linq.Expressions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.Ping.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pl-PL\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.FastSerialization.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Data.Common.dll (copy)	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\browserhost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt-BR\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.IO.IsolatedStorage.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Xml.XPath.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Text.Encoding.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Security.Claims.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Diagnostics.FileVersionInfo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Xml.XDocument.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.Security.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sv-SE\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Net.Requests.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\amd64\msdia140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\Dia2Lib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ja-JP\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\133617854419739262\amd64\msdia140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\InstallerLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\es-ES\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.FastSerialization.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\sl\RavStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe	Dropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\analyticsmanager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.Xml.XmlDocument.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.ComponentModel.EventBasedAsync.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\x64\rsCamFilter020502.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EDR\System.ValueTuple.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Console.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Primitives.dll	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

API coverage: 4.7 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp TID: 6688	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp TID: 6708	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe TID: 6572	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe TID: 5660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe TID: 1312	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe TID: 4080	Thread sleep count: 4562 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe TID: 4080	Thread sleep count: 5184 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe TID: 4228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe TID: 6876	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe TID: 6876	Thread sleep time: -37815825351104557s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe TID: 4828	Thread sleep count: 3892 > 30
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe TID: 4828	Thread sleep count: 5873 > 30
Source: C:\Program Files\McAfee\Temp3475153614\installer.exe TID: 1220	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe TID: 6164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe TID: 6712	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe TID: 280	Thread sleep count: 392 > 30
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe TID: 6324	Thread sleep count: 105 > 30
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe TID: 3844	Thread sleep time: -922337203685477s >= -30000s

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File Volume queried: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp FullSizeInformation			Jump to behavior
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	7_2_00405C4D
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_0040689E FindFirstFileW,FindClose,	7_2_0040689E
Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	Code function: 7_2_00402930 FindFirstFileW,	7_2_00402930
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	12_2_00405C4D
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_0040689E FindFirstFileW,FindClose,	12_2_0040689E
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 12_2_00402930 FindFirstFileW,	12_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	13_2_00405C4D
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_0040689E FindFirstFileW,FindClose,	13_2_0040689E
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	Code function: 13_2_00402930 FindFirstFileW,	13_2_00402930

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_00822782 VirtualQuery,GetSystemInfo,

6_2_00822782

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp	Jump to behavior

Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.b
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2808401651.00000220FE99F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: https://images.sftcdn.net/images/t_app-icon-s,f_jpg,w_100,c_scale/p/ef5b43e0-99eb-11e6-8b29-00163ec9f5fa/324590374/wechat-logo.pngc\",\"4\":\"Softonic_DLM\",\"5\":\"\",\"18\":\"\",\"19\":\"\",\"21\":\"\",\"22\":\"\",\"6\":\"1\",\"7\":\"2.40.0.8866\",\"15\":0,\"22\":\"\",\"10\":1}"}oftonic.com/privacy-policy","ctu":"https://hello.softonic.com/terms-of-use","cl":"https://images.sftcdn.net/images/t_app-icon-s,f_jpg,w_100,c_scale/p/ef5b43e0-99eb-11e6-8b29-00163ec9f5fa/324590374/wechat-logo.png","ch":"SEM\|EN_UK_DSA\|paid","ca":"v5.83","cf":"wechat-3.9.7-installer.exe","cpi":"","cps":"","cd":"","cpr":"","cpp":"","cfl":"Shlishi21May10","cj":"+1","cb":"ch","cod":"","ctp":"","cep":""},"f":{"m":2,"x":"2024-11-06T02:42:14.602Z","a":"fa70","d":"46"},"o":[{"ad":{"n":"","f":"ZB_RAV_Cross_Solo_Soft","o":"RAV_Cross"},"ps":{"i":"RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.png","dn":"RAV Antivirus","u":"https://shield.reasonsecurity.com/rsStubActivator.exe","p":"-ip:\"dui={userid}&dit={sessionid}&is_silent=true&oc={of}&p={pubid}&a=100&b={ispb}&se=true\" -i","r":["ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cmdu":[{"utr":"HKEY_CLASSES_ROOT","
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -Microsoft Hyper-V Guest Infrastructure Driver
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !Microsoft Hyper-V Virtual PCI Bus
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[p
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Microsoft Hyper-V Generation Counter
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1950985232.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.1941298641.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000002.2500277987.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Driver
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Microsoft Hyper-V VHDPMEM BTT Filter
Source: RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %Microsoft Hyper-V Storage Accelerator
Source: component0.exe, 00000003.00000002.2865632923.0000022CF9A42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2{"v":"0.1","l":"US","i":{"cu":"https://gsf-fl.softonic.com/361/738/abda546ab2fc780789a74d376a5f1f4ceb/WeChatSetup.exe?Expires=1717169192&Signature=a1b2e1fb37cfd75df9c990a1d13923f9be834f58&url=https://wechat.en.softonic.com&Filename=WeChatSetup.exe","ct":"WeChat","cp":"https://hello.softonic.com/privacy-policy","ctu":"https://hello.softonic.com/terms-of-use","cl":"https://images.sftcdn.net/images/t_app-icon-s,f_jpg,w_100,c_scale/p/ef5b43e0-99eb-11e6-8b29-00163ec9f5fa/324590374/wechat-logo.png","ch":"SEM\|EN_UK_DSA\|paid","ca":"v5.83","cf":"wechat-3.9.7-installer.exe","cpi":"","cps":"","cd":"","cpr":"","cpp":"","cfl":"Shlishi21May10","cj":"+1","cb":"ch","cod":"","ctp":"","cep":""},"f":{"m":2,"x":"2024-11-06T02:42:14.602Z","a":"fa70","d":"46"},"o":[{"ad":{"n":"","f":"ZB_RAV_Cross_Solo_Soft","o":"RAV_Cross"},"ps":{"i":"RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.png","dn":"RAV Antivirus","u":"https://shield.reasonsecurity.com/rsStubActivator.exe","p":"-ip:\"dui={userid}&dit={sessionid}&is_silent=true&oc={of}&p={pubid}&a=100&b={ispb}&se=true\" -i","r":["ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cmdu":[{"utr":"HKEY_CLASSES_ROOT","utk":"ReasonPersistentStorage","utvn":"AvUninstallTime","utvt":"SZ","umd":30,"utms":true}],"cp":"https://reasonlabs.com/rav_online_security_policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":250,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntiviru

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe	API call chain: ExitProcess graph end node
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Process queried: DebugPort

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_008570B4 IsDebuggerPresent,OutputDebugStringW,

6_2_008570B4

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007D5110 RegOpenKeyExW,RegQueryValueExW,SetLastError,RegCloseKey,RegCloseKey,GetLastError,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,LoadLibraryExW,GetLastError,

6_2_007D5110

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007C4C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

6_2_007C4C8E

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_00867BC0 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

6_2_00867BC0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_00802B30 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,GetLastError,

6_2_00802B30

Contains functionality to read the PEB

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0084E8FE mov eax, dword ptr fs:[00000030h]	6_2_0084E8FE
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00857CAE mov eax, dword ptr fs:[00000030h]	6_2_00857CAE
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00857CF2 mov eax, dword ptr fs:[00000030h]	6_2_00857CF2
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00857C6A mov eax, dword ptr fs:[00000030h]	6_2_00857C6A
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00857D23 mov eax, dword ptr fs:[00000030h]	6_2_00857D23

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_007C463F GetProcessHeap,

6_2_007C463F

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Process token adjusted: Debug
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process token adjusted: Debug
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Process token adjusted: Debug
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Process token adjusted: Debug
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Process token adjusted: Debug
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00839018 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00839018
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_008393F2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_008393F2
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_0083D453 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0083D453
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: 6_2_00839586 SetUnhandledExceptionFilter,	6_2_00839586
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396F2A10 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF6396F2A10
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 9_2_00007FF6396FE3BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF6396FE3BC

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240601224314&is_silent=true&oc=ZB_RAV_Cross_Solo_Soft&p=fa70&a=100&b=&se=true" -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Process created: C:\Users\user\AppData\Local\Temp\cldwur4x.exe "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\fltMC.exe "fltmc.exe" load rsKernelEngine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsWSC.exe "C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe "C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe "C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6540 -ip 6540
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6540 -ip 6540
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064
Source: C:\Windows\System32\runonce.exe	Process created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process created: unknown unknown
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	Process created: unknown unknown

Source: runonce.exe, 0000001A.00000002.2358861262.0000024B029F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ndows Progman Group Converterh$

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_00839215 cpuid

6_2_00839215

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: GetLocaleInfoW,	6_2_008545DA
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: EnumSystemLocalesW,	6_2_0085C9ED
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: EnumSystemLocalesW,	6_2_0085C907
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: EnumSystemLocalesW,	6_2_0085C952
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_0085CA80
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: GetLocaleInfoW,	6_2_0085CCE0
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_0085CE06
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_0085CFDB
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: GetLocaleInfoW,	6_2_0085CF0C
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: GetLocaleInfoEx,	6_2_00837E28
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe	Code function: EnumSystemLocalesW,	6_2_00853F6D
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoW,	9_2_00007FF639710258
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoEx,	9_2_00007FF6396F1AEC
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	9_2_00007FF63971C1B8
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00007FF63971CA1C
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: _invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetLocaleInfoEx,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	9_2_00007FF6396A89D0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: EnumSystemLocalesW,	9_2_00007FF63970FCC0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoEx,_invalid_parameter_noinfo_noreturn,	9_2_00007FF6396A9C90
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: EnumSystemLocalesW,	9_2_00007FF63971C514
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00007FF63971CC00
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoEx,_invalid_parameter_noinfo_noreturn,	9_2_00007FF6396BFC30
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: EnumSystemLocalesW,	9_2_00007FF63971C5E4

Queries the product ID of Windows

Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\mainlogo.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\RAV_Cross.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\WebAdvisor.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsStubLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsLogger.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsJSON.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsAtom.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\Microsoft.Win32.TaskScheduler.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\733c2c1e\00b6d669_67a7da01\rsStubLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsJSON.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\6b65cc86\2a1aa49d_96b4da01\rsJSON.DLL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsLogger.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\536788ce\da05b09d_96b4da01\rsLogger.DLL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsAtom.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\dca1e082\b570f89c_96b4da01\rsAtom.DLL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsServiceController.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\72fcb629\63f1bb9d_96b4da01\rsServiceController.DLL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsStubLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsLogger.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsJSON.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsAtom.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsWSC.exe VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsWSC.exe VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Application.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\System.Net.Http.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe	Queries volume information: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.dll VolumeInformation

Queries time zone information

Source: C:\Windows\System32\runonce.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Code function: 6_2_00854619 GetSystemTimeAsFileTime,

6_2_00854619

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 9_2_00007FF6397165D4 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

9_2_00007FF6397165D4

Source: C:\Users\user\AppData\Local\Temp\cldwur4x.exe

Code function: 7_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

7_2_0040351C

Source: C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds / modifies Windows certificates

Source: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220957eb6d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.rsEngineSvc.exe.2bc3f700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.rsEngineSvc.exe.2bc412d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220feb40000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220fe910000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220feb00000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.rsWSC.exe.13169fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.rsEngineSvc.exe.2bc41310000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220957eb6d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.rsEngineSvc.exe.2bc5a9d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000002.2437605904.000002BC41312000.00000002.00000001.01000000.00000034.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2807618602.00000220FE912000.00000002.00000001.01000000.00000038.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.2377819043.0000013169FE2000.00000002.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2541457093.00000220952CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2437311674.000002BC412D2000.00000002.00000001.01000000.00000033.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2813307929.00000220FEB02000.00000002.00000001.01000000.00000039.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.2419994897.000002BC3F702000.00000002.00000001.01000000.00000030.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2437962183.000002BC413EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2506176810.000002208072E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2445270867.000002BC5A9D2000.00000002.00000001.01000000.00000035.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2030874846.000000000274A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2035288824.0000000002746000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2814717721.00000220FEB42000.00000002.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ATY5CJG3\rsServiceController.DLL, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\mc.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsLogger.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\UDOOGFD5\rsAtom.DLL, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\KRK4DVBJ\rsJSON.DLL, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnAccess.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Camera.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsServiceController.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Performance.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsLogger.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsWSCClient.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsBridge.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.JSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ZMMW8FDC\rsLogger.DLL, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Needle.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\InstallerLib.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.Proxy.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Program Files\McAfee\WebAdvisor\uihost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe	File opened: C:\Users\user\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220957eb6d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.0.rsEngineSvc.exe.2bc3f700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.rsEngineSvc.exe.2bc412d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220feb40000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220fe910000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220feb00000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.rsWSC.exe.13169fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.rsEngineSvc.exe.2bc41310000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RAVEndPointProtection-installer.exe.220957eb6d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.rsEngineSvc.exe.2bc5a9d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000002.2437605904.000002BC41312000.00000002.00000001.01000000.00000034.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2807618602.00000220FE912000.00000002.00000001.01000000.00000038.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.2377819043.0000013169FE2000.00000002.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2541457093.00000220952CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2437311674.000002BC412D2000.00000002.00000001.01000000.00000033.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2813307929.00000220FEB02000.00000002.00000001.01000000.00000039.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.2419994897.000002BC3F702000.00000002.00000001.01000000.00000030.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2437962183.000002BC413EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2506176810.000002208072E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2445270867.000002BC5A9D2000.00000002.00000001.01000000.00000035.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2030874846.000000000274A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2035288824.0000000002746000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2814717721.00000220FEB42000.00000002.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ATY5CJG3\rsServiceController.DLL, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\mc.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsLogger.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\UDOOGFD5\rsAtom.DLL, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\KRK4DVBJ\rsJSON.DLL, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnAccess.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Camera.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsServiceController.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Performance.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsLogger.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsWSCClient.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsBridge.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.JSON.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ZMMW8FDC\rsLogger.DLL, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Needle.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\InstallerLib.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.Proxy.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
1 Software	Acquire Infrastructure	1 Valid Accounts	11 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	21 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	4 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	2 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	58 System Information Discovery	SMB/Windows Admin Shares	1 Data from Local System	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	34 Windows Service	11 Access Token Manipulation	2 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	1 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	12 Service Execution	11 Scheduled Task/Job	34 Windows Service	1 Timestomp	LSA Secrets	61 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	11 Registry Run Keys / Startup Folder	12 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	51 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Scheduled Task/Job	43 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	51 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Regsvr32	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood
Identify Business Tempo	Botnet	Hardware Additions	Python	Hypervisor	Process Injection	1 Rundll32	Credential API Hooking	Domain Groups	Exploitation of Remote Services	Remote Email Collection	External Proxy	Transfer Data to Cloud Account	Reflection Amplification

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
wechat-3.9.7-installer_ae-GFz1.exe	12%	ReversingLabs
wechat-3.9.7-installer_ae-GFz1.exe	20%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files\McAfee\Temp3475153614\installer.exe	0%	ReversingLabs
C:\Program Files\McAfee\Temp3475153614\installer.exe	0%	Virustotal	Browse
C:\Program Files\McAfee\Temp3475153614\resource.dll	0%	ReversingLabs
C:\Program Files\McAfee\Temp3475153614\resource.dll	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\d3dcompiler_47.dll	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\d3dcompiler_47.dll	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\ffmpeg.dll	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\ffmpeg.dll	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libEGL.dll	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libEGL.dll	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libGLESv2.dll	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libGLESv2.dll	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader.dll	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader.dll	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vulkan-1.dll	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vulkan-1.dll	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\EDR\Dia2Lib.dll (copy)	0%	ReversingLabs
C:\Program Files\ReasonLabs\EDR\Dia2Lib.dll (copy)	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.FastSerialization.dll (copy)	0%	ReversingLabs
C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.FastSerialization.dll (copy)	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll (copy)	0%	ReversingLabs
C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll (copy)	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\EDR\Microsoft.Win32.Primitives.dll (copy)	0%	ReversingLabs
C:\Program Files\ReasonLabs\EDR\Microsoft.Win32.Primitives.dll (copy)	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\EDR\OSExtensions.dll (copy)	0%	ReversingLabs
C:\Program Files\ReasonLabs\EDR\OSExtensions.dll (copy)	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\EDR\SQLite.Interop.dll (copy)	0%	ReversingLabs
C:\Program Files\ReasonLabs\EDR\SQLite.Interop.dll (copy)	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\EDR\System.AppContext.dll (copy)	0%	ReversingLabs
C:\Program Files\ReasonLabs\EDR\System.AppContext.dll (copy)	0%	Virustotal	Browse
C:\Program Files\ReasonLabs\EDR\System.Collections.Concurrent.dll (copy)	0%	ReversingLabs
C:\Program Files\ReasonLabs\EDR\System.Collections.Concurrent.dll (copy)	0%	Virustotal	Browse

Name	Source	Malicious
https://shield.reasonsecurity.com/ReasonLabs-DNS-se	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-s	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://www.reasonsecurity.	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://config.r	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://logziop.reasonsec	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=tr	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.datacontract.org	rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.ex	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://ud-beta.reasonsecurity	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://config.reaso	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&p	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://ud-beta.reasonsecurit	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
http://www.chambersign.org1	rsWSC.exe, 00000023.00000002.2399301928.000001316C7CF000.00000004.00000020.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/en-us/p	wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	false
https://shield-dev.reas	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/search?fr=mcasa&type=E170CH91088G0&p=	servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://track.analytics-data.	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	rsWSC.exe, 00000023.00000002.2399301928.000001316C7D3000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.ssc.lt/root-c/cacrl.crl0	rsWSC.exe, 00000023.00000002.2399645841.000001316C80F000.00000004.00000020.00020000.00000000.sdmp	false
https://update-beta.reasonsecurity.com/v2/	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/search?fr=mcafee&type=E580CH91088G0&p=	servicehost.exe, 00000025.00000003.2452440832.0000013031838000.00000004.00000020.00020000.00000000.sdmp	false
https://comipass.reasonsecurity	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://update-beta.reasonsecurity	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://www.reasonsecurity.c	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://sadownload.mcafee.com/products/sa/bsi/win/binary/	saBSI.exe, 00000006.00000003.2015109896.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2473044728.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2137581289.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053470694.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2485441210.00000000055DF000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2027977822.00000000055DF000.00000004.00000020.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/v/wa-how.htmlR	regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/Re	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.datacontract.org/2004/07/System.ServiceProcess	rsWSC.exe, 00000023.00000002.2391526354.0000013100113000.00000004.00000800.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oi	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://update.reasonse	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://track.analytics	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://update-beta.rea	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://wechat.en.softonic.com&Filename=WeChatSetup.exe	wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000075B4000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000075C2000.00000004.00001000.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/v/wa-how.htmlL	servicehost.exe, 00000025.00000002.2896923575.000001283100D000.00000004.00000020.00020000.00000000.sdmp	false
https://logziop.reasonsecurity.c	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://www.innosetup.com/	wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1631925978.00000000026F0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.exe, 00000000.00000003.1635080518.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000000.1636976723.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false
https://shield.reasonsecur	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-VPN-setup	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	false
https://reasonlabs.com/platform/packages/essential?utm_source=rav_uninstall&utm_medium=home_website_	cldwur4x.exe, 00000007.00000003.1940299909.0000000002752000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000000.1974700588.00000220FC4D2000.00000002.00000001.01000000.00000011.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.000002208002B000.00000004.00000800.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	false
https://sadownload.mcafee.com/CC	servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	false
https://update-beta.reasonsecurity.	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-VPN-setu	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://track.analytic	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/v/wa-how.htmlq	regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	false
https://www.mcafee.com/consu	wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	false
https://update.reaso	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/Rea	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonse	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://update-beta.re	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://config-beta.r	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/v/wa-how.htmlj	saBSI.exe, 00000006.00000002.2500277987.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp	false
https://d2dbdb0phbn9qb.cloudfront.net/f/RAV/images/ZB_RAV_Bisli_Logo_bcg_V2/DOTPS-588/EN.pngp&	wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&pt	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://config.rea	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://update-beta.reasonsecur	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://www.reasonsecurity.com/X	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://update.reasonsecurity.com/	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-DNS-setup.e	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/favicon.ico	installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2213293775.000001EE50606000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2190170982.000001EE50498000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2241432639.000001EE505DA000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	false
https://config.re	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://update-beta.reason	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/v/wa-how.htmlX	regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&i	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-DNS-setu	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://ud.rea	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://update.reasonsecurity.com/v2/upd	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://d2dbdb0phbn9qb.cloudfront.net/zbd	wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2221871373.00000000053D2000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2227889874.00000000074ED000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2215944559.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	false
https://update.reasonsecurity.com/v2/up	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://update.reasons	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield-dev.reasonsecurity.com/ReasonLabs-VPN-set	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://ud.reas	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://config-beta.reasonsecuri	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://electron-shell.reasonsecurity.com	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080131000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABB7C000.00000004.00000800.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/en-us/policy/legal.htmlz;	wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/en-us/policy/legal.html7	wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000002.2210584480.0000000000A82000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695379542.0000000000A68000.00000004.00000020.00020000.00000000.sdmp	false
https://update.reasonsecurity.com/v2/	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://update.reasonsecurity.com/v2/live	rsSyncSvc.exe, 0000000B.00000002.2876299769.0000018992E00000.00000004.00000020.00020000.00000000.sdmp, Uninstall.exe, 0000000D.00000003.2015136920.0000000002742000.00000004.00000020.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000011.00000002.2893798547.000001DCABA8B000.00000004.00000800.00020000.00000000.sdmp	false
https://ud.r	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://config.reasonsecurity.	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://sadownload.mcafee.com/products/saY0	servicehost.exe, 00000025.00000002.2893559599.0000012830357000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000003.2389558951.000001283035F000.00000004.00000020.00020000.00000000.sdmp	false
https://sadownload.mcafee.com/EB	servicehost.exe, 00000025.00000002.2914529753.0000013041D64000.00000004.00000020.00020000.00000000.sdmp	false
https://sadownload.mcafee.com/products/SA/v1/bsi	saBSI.exe, 00000006.00000003.2486133896.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2122780803.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2485866665.00000000055C0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2015109896.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2027977822.00000000055C5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2131499733.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000006.00000003.2053115287.00000000055C5000.00000004.00000020.00020000.00000000.sdmp	false
https://www.mcafee.com/consumer/v/wa-how.htmlu	regsvr32.exe, 00000026.00000003.2384519087.0000000002ACF000.00000004.00000020.00020000.00000000.sdmp	false
https://.servicebus.windows.net/&se=&skn=Failed	installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp	false
https://www.google.com/search?q=%s	installer.exe, 00000015.00000003.2196277192.000001EE50555000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000025.00000002.2918576300.00007FFDEF5D6000.00000002.00000001.01000000.00000032.sdmp	false
http://home.mcafee.com/SaveEulaTrackingDetailsHost:	installer.exe, 00000015.00000003.2288937766.000001EE50574000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp	false
https://config-beta.reaso	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://www.mcafee.com/consum	wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1732786492.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp, wechat-3.9.7-installer_ae-GFz1.tmp, 00000001.00000003.1695287864.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp	false
https://update.reason	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonL	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp, RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://shield.reasonsecurity.com/ReasonLabs-VPN-setup.exe?oip=26&dta=true&ptl=7&i	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.0000022080622000.00000004.00000800.00020000.00000000.sdmp	false
https://ud.reasonsecurity.c	RAVEndPointProtection-installer.exe, 00000008.00000002.2506176810.00000220805C9000.00000004.00000800.00020000.00000000.sdmp	false
https://analytics.qa.apis.mcafee.comhttps://analytics.apis.mcafee.comContent-Type:	installer.exe, 00000015.00000000.2183633089.00007FF7F5B46000.00000002.00000001.01000000.0000001B.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
44.240.167.6	unknown	United States	16509	AMAZON-02US	false
2.16.164.104	unknown	European Union	20940	AKAMAI-ASN1EU	false
18.66.102.77	unknown	United States	3	MIT-GATEWAYSUS	false
3.214.3.211	unknown	United States	14618	AMAZON-AESUS	false
13.89.179.12	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.22.242.105	unknown	European Union	20940	AKAMAI-ASN1EU	false
151.101.1.91	unknown	United States	54113	FASTLYUS	false
20.42.65.92	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.21.226	unknown	United States	13335	CLOUDFLARENETUS	false
13.224.189.78	unknown	United States	16509	AMAZON-02US	false
18.172.112.22	unknown	United States	3	MIT-GATEWAYSUS	false
13.226.184.70	unknown	United States	16509	AMAZON-02US	false
104.102.41.70	unknown	United States	16625	AKAMAI-ASUS	false
2.16.164.48	unknown	European Union	20940	AKAMAI-ASN1EU	false
199.232.194.133	unknown	United States	54113	FASTLYUS	false
52.88.235.102	unknown	United States	16509	AMAZON-02US	false
44.206.168.227	unknown	United States	14618	AMAZON-AESUS	false
2.23.65.62	unknown	European Union	16625	AKAMAI-ASUS	false
104.124.11.8	unknown	United States	20940	AKAMAI-ASN1EU	false
18.66.121.153	unknown	United States	3	MIT-GATEWAYSUS	false
13.35.58.90	unknown	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1450567
Start date and time:	2024-06-02 04:41:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wechat-3.9.7-installer_ae-GFz1.exe
Detection:	MAL
Classification:	mal48.rans.troj.spyw.evad.winEXE@78/1890@0/21
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 56% Number of executed functions: 125 Number of non-executed functions: 151
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
Execution Graph export aborted for target component0.exe, PID 7068 because it is empty
Execution Graph export aborted for target installer.exe, PID 3020 because there are no executed function
Execution Graph export aborted for target wechat-3.9.7-installer_ae-GFz1.tmp, PID 6540 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
03:42:45	Task Scheduler	Run new task: EPPHealthCheck path: C:\Program Files\ReasonLabs\EPP\Uninstall.exe s>/auto-repair=RavStub
22:42:14	API Interceptor	8x Sleep call for process: wechat-3.9.7-installer_ae-GFz1.tmp modified
22:42:43	API Interceptor	17845x Sleep call for process: RAVEndPointProtection-installer.exe modified
22:43:00	API Interceptor	2x Sleep call for process: WerFault.exe modified
22:43:24	API Interceptor	11x Sleep call for process: servicehost.exe modified
22:43:25	API Interceptor	1x Sleep call for process: rsWSC.exe modified
22:43:27	API Interceptor	1x Sleep call for process: installer.exe modified
22:44:10	API Interceptor	1x Sleep call for process: component0.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
2.16.164.104	https://www-visacom-sg.wgmspu93576.workers.dev/	Get hash	malicious	Unknown	Browse
	http://iykdkk.pages.dev/	Get hash	malicious	Unknown	Browse
	http://www.imt.niu.edu/ipdb3n4m.azodusexz?ccyWVKqcc00VXcyKGjcccWgctcB5J7kxlrcbbb5m======	Get hash	malicious	Phisher	Browse
13.89.179.12	lgX7lgUL1w.exe	Get hash	malicious	Neoreklami, PureLog Stealer, SmokeLoader	Browse
	WebReport_safe_certified_2024.zip	Get hash	malicious	Unknown	Browse
	cpprest141_2_10.dll	Get hash	malicious	Unknown	Browse
	DbfauspePu.exe	Get hash	malicious	Neoreklami	Browse
	file.exe	Get hash	malicious	Neoreklami	Browse
	mFXWSY6SE8.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc	Browse
	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	OneLaunch - EarthView3D_3o3f1.exe	Get hash	malicious	Unknown	Browse
	Mp7cjtN6To.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	s8veIRIGWR.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	J5QZtYKm.posh.ps1	Get hash	malicious	Unknown	Browse	52.72.49.79
	https://violation-support-460106ta-01apc3.netlify.app/id.html/	Get hash	malicious	Unknown	Browse	54.163.161.109
	https://cloud-12-2.pages.dev/	Get hash	malicious	Unknown	Browse	18.232.36.154
	https://2ly.link/1yIYR	Get hash	malicious	Unknown	Browse	52.202.28.55
	https://famous66-cascaron-d57a98-vd656.netlify.app/dev.html/	Get hash	malicious	Unknown	Browse	52.55.149.163
	https://8w3wzy4q.pages.dev/	Get hash	malicious	Unknown	Browse	34.238.183.222
	http://support-team-460106ta-04aeo12.netlify.app/form.html	Get hash	malicious	Unknown	Browse	54.163.161.109
	https://aphike-team-12056847-6aq5hd5.netlify.app/review_case_id4964-atfd-48xd.html/	Get hash	malicious	Unknown	Browse	34.238.34.141
	https://capitalist-enterprise-1ad087.netlify.app/id.html/	Get hash	malicious	Unknown	Browse	54.163.161.109
	https://support-team-460106ta-04aeo12.netlify.app/id.html/	Get hash	malicious	Unknown	Browse	52.55.149.163
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://2ly.link/1yIYR	Get hash	malicious	Unknown	Browse	13.107.246.45
	AS-2023-CS.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.67
	t4p0nt07.x86.elf	Get hash	malicious	Mirai	Browse	40.89.20.31
	wQsdlAeKOF.elf	Get hash	malicious	Mirai	Browse	20.124.38.232
	xVZShu82Pj.elf	Get hash	malicious	Mirai	Browse	104.147.78.151
	C7QZHqCV7n.elf	Get hash	malicious	Unknown	Browse	20.64.77.238
	91x5iCFuf7.elf	Get hash	malicious	Mirai	Browse	104.214.224.255
	ACKpfvO313.elf	Get hash	malicious	Mirai	Browse	40.82.61.188
	vh9HOxBJJN.elf	Get hash	malicious	Mirai	Browse	40.71.92.212
	3Lf408k9mg.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	40.85.218.2
AMAZON-02US	https://mysteryminte18.vercel.app/	Get hash	malicious	Unknown	Browse	3.71.155.187
	https://mystery-mintr29.vercel.app/	Get hash	malicious	Unknown	Browse	18.194.32.216
	https://mysteryopen31.vercel.app/	Get hash	malicious	Unknown	Browse	76.76.21.22
	https://violation-support-460106ta-01apc3.netlify.app/id.html/	Get hash	malicious	Unknown	Browse	18.239.69.105
	https://cloud-12-2.pages.dev/	Get hash	malicious	Unknown	Browse	3.161.118.108
	https://dana-id-co.wwbnits.com/claiim.dana.kagett/	Get hash	malicious	Unknown	Browse	108.138.199.86
	https://mysterynftes6.vercel.app/	Get hash	malicious	Unknown	Browse	76.76.21.98
	https://2ly.link/1yIYR	Get hash	malicious	Unknown	Browse	18.239.94.3
	https://pub-0cc0980a246e413285127dab939f7379.r2.dev/index.html	Get hash	malicious	Unknown	Browse	18.192.94.96
	https://pub-ddd7a9690be64fcc90b63dcf4c9f234a.r2.dev/index.html	Get hash	malicious	Unknown	Browse	3.70.101.28
AKAMAI-ASN1EU	Quarantined Messages.zip	Get hash	malicious	HTMLPhisher	Browse	172.233.128.220
	http://1009.liqing-71.workers.dev/	Get hash	malicious	Unknown	Browse	2.19.96.161
	http://tora.jzturn.workers.dev/	Get hash	malicious	Unknown	Browse	2.19.96.186
	http://cless.kichan.eu.org/	Get hash	malicious	Unknown	Browse	2.19.96.218
	http://usai.bawoowang.workers.dev/	Get hash	malicious	Unknown	Browse	2.19.96.201
	http://pi.eleonore-huyue.workers.dev/	Get hash	malicious	Unknown	Browse	2.19.96.240
	http://worker-silent-bird.wrytd.workers.dev/	Get hash	malicious	Unknown	Browse	23.213.161.196
	http://worker-shy-dew.wrytd.workers.dev/	Get hash	malicious	Unknown	Browse	23.213.161.208
	http://ink-01.72xod8ipxg.eu.org/	Get hash	malicious	Unknown	Browse	2.19.96.240
	http://tmagic.powerinside.win/	Get hash	malicious	Unknown	Browse	2.19.96.186
MIT-GATEWAYSUS	https://famous66-cascaron-d57a98-vd656.netlify.app/dev.html/	Get hash	malicious	Unknown	Browse	18.66.27.49
	https://auth-ttrezor-startt.webflow.io/	Get hash	malicious	Unknown	Browse	18.164.52.41
	https://capitalist-enterprise-1ad087.netlify.app/id.html/	Get hash	malicious	Unknown	Browse	18.66.27.49
	https://support-team-460106ta-04aeo12.netlify.app/id.html/	Get hash	malicious	Unknown	Browse	18.165.183.100
	https://capitalist-enterprise-1ad087.netlify.app/form.html	Get hash	malicious	Unknown	Browse	18.66.27.49
	t4p0nt07.arm.elf	Get hash	malicious	Unknown	Browse	19.130.43.219
	t9lNEiD3ui.elf	Get hash	malicious	Mirai	Browse	19.162.241.239
	G7b98y6IWj.elf	Get hash	malicious	Mirai	Browse	19.143.140.126
	https://download2.easeus.com/installer_rss_new.php	Get hash	malicious	Unknown	Browse	18.172.112.4
	https://track.cornzself.com/bad38662-656e-4aa6-ae91-6bf2d0472a97?%7Bvar1%7D=txt1&%7Bvar2%7D=mz&%7Bvar3%7D=19189907751	Get hash	malicious	Unknown	Browse	18.172.112.25

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1819745 bytes, 2 files, at 0x44 +A "\analyticsmanager.dll" +A "\analyticsmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 165 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1841185
Entropy (8bit):	7.999662053959488
Encrypted:	true
SSDEEP:	24576:FOsg7Dhv2QFuRRPqdHuBwjBmqc80nm+1b1wMSDl6DGk62Gi1dYlJetT0lIwg6jwx:16hvi3+TCUdkZ1dYOtT0lIwf59SX
MD5:	DC4E5A62F9C5B04C8D3D20DB961371F5
SHA1:	12FB6AC6D3722A8BCE60F77CA808E5959DE95E02
SHA-256:	F43F800D8D85D7C5AF3BBFA5B2EA13D183BE8E8AD57F7A7FA4475BF603A693E9
SHA-512:	C684D5C877045855DF3CEFFA525DFFBC53D55B3559D1DCA19E10C586F2DB7085CB395A6F933ECCF8F2248E6338DCBAD294B54014F1BEFB6B2534879413AA3531
Malicious:	true
Reputation:	unknown
Preview:	MSCF....a.......D...........................a....S....................R........X\t .\analyticsmanager.dll.......R....Xnt .\analyticsmanager.manifest....Q.+..[...0 H....@d.5.....Vo..zc...T..b.....X.Q.g..i.3 m..L...kw7.n}.i..n.....v......Zi.3....+.83+.>.....7..g.._.g.f....@,,..y...@P.dx.Y...m/u.28...3..6.z..mKE..\..#....Z,.i.-$8.i....&.e.A..@....:!.A........N......A..).(."0............r...g]b$....8.Z..C........rC.h.<Y.......^.>..z...../...d.R......~.....}...o>..... .zw.q.k...u.........j.ucu.....^U.-...n..+..1sou..&.U.&9R...&...x.N...?ul..$....P.R....P..I...'..^.I_.?...T.b...b.QO...wo.S.]...S,..L[pY=.7.eK....{.S.3.o..v.........'...6P.nE..K_..$..{o.....,..$d_.X=..X......?..\|..u...%...BHs..?..q.4.&{5v^E.;.....%..W...d+.m^.P.....\|...*._....}.j.-.......v.tlg..D......N....x..C.l!...n\|.........\|:.,.i.[.[.~......g.6}l...6l......w.....#...............>[4;.c.d.k.................>.b....PN...Z.....i{MNS.'....{O.v.z...../...7...gk.k4].3....9.....e6..[._..

C:\Program Files\McAfee\Temp3475153614\analyticstelemetry.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 38576 bytes, 54 files, at 0x44 +A "\analyticstelemetry.manifest" +A "\context\analyticscontextconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	60016
Entropy (8bit):	7.90865352678138
Encrypted:	false
SSDEEP:	1536:uAfuvZkkVyMIzWiF4/7hUJNbfOkk4iXMxlC7MxKu:j8DHs4/7hUJNa/4hC+
MD5:	1D8F7C95A72A600B371E819B678BE0F0
SHA1:	7D544961DEE72463F43AFE8FDADD7A5BBB14A75F
SHA-256:	27F810A794170A97E430DC29A26169DEC6BCEA373EE000785AC089CAC058770A
SHA-512:	95987DD1F3E2DE393C9F5C201B89FE4A24D6581D7A036AD5124D5D9CCB9DF76ADA28DFF504F87BB6ABCB1B1D7A4832FB57E4204E6E5C9A882BFC823E7F3189A3
Malicious:	false
Reputation:	unknown
Preview:	MSCF............D...........6....................S..................Z..........X\|t .\analyticstelemetry.manifest.e...Z......X.p .\context\analyticscontextconfig.luc._..........X.p .\context\analyticswpssetting.luc............X.p .\context\analyticswsswps.luc.....:#.....X.p .\context\browserinformation.luc.0...H6.....X.p .\context\browserversion.luc.....x:.....X.p .\context\contexthandler.luc......<.....X.p .\context\externalutilityfunction.luc......?.....X.p .\context\featuretrackingfeature.luc......Z.....X.p .\context\hashedmachineid.luc.....9^.....X.p .\context\msspstatus.luc.O....f.....X.p .\context\samrecoverable.luc.....Yi.....X.p .\context\sequencenumber.luc.R...ak.....X.p .\context\subscriptionexpirydate.luc.R....m.....X.p .\context\subscriptionstatus.luc......r.....X.p .\context\subscriptiontype.luc.Y....t.....X.p .\context\suitestatus.luc.....xw.....X.p .\context\wpssubscriptionexpirydate.luc.F...Py.....X.p .\context\wpssubscriptionstatus.luc.@....{.....X.p .\context\wpssubscr

C:\Program Files\McAfee\Temp3475153614\balloon_safe_annotation.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3166
Entropy (8bit):	7.890916051269147
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODx7FspC:bSDZ/I09Da01l+gmkyTt6Hk8nT3KC
MD5:	2048DF489A12C4C9E2341BEF42883205
SHA1:	281863D9F8B8D4D0DAD62E66E35F5C96CA0155FD
SHA-256:	DDA74B071B5869A22B327633D9641F1340EC5B913359BB389C34C44A6DB579A5
SHA-512:	815FC1E3A2E623FEA3B13AA2BCB3895FF9DDB2A7A05E1633C83D3F647EC4A4050AF0670ED01CABA47F02A920BF6AD84191B0B03EAD1E45105DD20D302D00CCE2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files\McAfee\Temp3475153614\browserhost.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1212826 bytes, 8 files, at 0x44 +A "\browserhost.exe" +A "\browserhost.manifest", flags 0x4, number 1, extra bytes 20 in head, 114 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1234266
Entropy (8bit):	7.9994045878869215
Encrypted:	true
SSDEEP:	24576:Nyv4qVR0sKStjMsKu2r4xm6cH5Y+IE5jhuSoPhDNh8O11+dVQ:Njq70ItjMu2Uf6O1qjsIdVQ
MD5:	EF297EE03D8EA0240A1821BCACCC1BB1
SHA1:	01825EE74143242054E399D7DCD89C1E2EDB692E
SHA-256:	B0004747C1DA4EE30F93065BDDDA1E471338F07024D06E912CDF281333F7A0F3
SHA-512:	AC13A462E29B015990E2511EEC9D8A3B6E224666B815A746294039296832A2699EA0F666B1A41EFBE84FE145F213DF297624CA69FEC5F41533C247C289D3CB8D
Malicious:	true
Reputation:	unknown
Preview:	MSCF............D................................S..............r...._8........Xmt .\browserhost.exe..-..._8....Xyt .\browserhost.manifest.f...&.8....X.e .\edge.com.mcafee.webadvisor.json.e.....8....X.e .\edge.com.mcafee.webadvisor_v2.json......8....X.e .\webadvisor.mcafee.chrome.extension.json.L.....8....X.e .\webadvisor.mcafee.firefox.extension.json......8....X.e .\webadvisor_v2.mcafee.chrome.extension.json.K.....8....X.e .\webadvisor_v2.mcafee.firefox.extension.json........[...C ....P.. "....y.m.~...m^jym.y-.jy,My-Mym]8m]y,M)y,L%y-M8-]9,]9,\.8,.)4"D4VDxfX......{......ko..$.....#`.1e......H.m...+...s5...5.V.Q..T...R...M^M...er..N..R(..+ (D..W.J@../.3`@. M.@P...A.....BC.5eVFE...x..r.9.].A.P.Z[E..H}...@...X......cY....Gx.xy..._[6./.>w..,.sz.M...e;x..,......H....sG..;Ps.17....<.1....+.........~x.c.........x..n.N..{..M%........._?.B.....\4^..:#.r{...}w.o....pI.......]..x..{=.I..h....x2')..;..7/.kw\.....GG...w..T.\.,..xq..k.....}.....E>.{#....[:...;...j..

C:\Program Files\McAfee\Temp3475153614\browserplugin.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 5067375 bytes, 2 files, at 0x44 +A "\browserplugin.manifest" +A "\e10ssaffplg.xpi", flags 0x4, number 1, extra bytes 20 in head, 183 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	5088815
Entropy (8bit):	7.999213757451378
Encrypted:	true
SSDEEP:	98304:tPHFmpsj52dThuYOyYoURVZJpQmNqNRVgxrXB+xzcf/FvFWz+hN4WDQcg7j:t/FmSj4qjRVZnVNqNRVuUoftv0mS
MD5:	3AFC7A2ED10D7804EE588A669A154AB2
SHA1:	B5CC1D0EB51E389FD5C49A0FF354CA576E402F7D
SHA-256:	F7F7C0FABE6D53A3E09AEB38648302523CDAE1EFB427205661C5567257156313
SHA-512:	B3D4770CB4F9C7CA98F2D655DC7BFEAC06E49CABF6934A043C92E9B8959994CAE55006190E88F9684DD747E26A060DE80C38B922A15A0F03D0325F2915F23C34
Malicious:	true
Reputation:	unknown
Preview:	MSCF....oRM.....D...........................oRM..S.............................Xyt .\browserplugin.manifest.xU[........X.t .\e10ssaffplg.xpi...[..Z..[................D..]..qwwwwwpw.P.....\p.].....U.........6....u.b.N....7..K.. .q.)'.......Z.'O.@.._2..0...fH;..J..R..q2TSN.....o....(............5D.U.5.{d.y...:....U...T.U.."(...5....?..1e..l.K.c..LM......-.4..))..!...P..=...,+.....k.CG..+...i'.m+...L. ....31-/,....._....,..-.4....-.a...U.57.~cG^l..%.@.o....L.............._&......_.5.Yt....ou.U..Vb>..9....D.....$...O.)...G.:............)%.?z.....Z}.].~....Q.$.............L..3....r.....x.......c...z..?..../U........5vf.v......_.........._.E.....k.....u.a..y..Jz...f..w'.C..b.......2...kc\.\..0......._.0.....Lc.K?...!.........4.v....k....6{./....?..$.lj.Y....c......3ef..?...........y.u.um.i..i}qq...e.....l.K...R....q..g.........T.GG.JH......l,..2.0~,~.1.,-...Z....[........+.}.....m?......X....~....4..g....y.._{.........j....Q.....zR`\.s,-+...........y.

C:\Program Files\McAfee\Temp3475153614\downloadscan.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 2248913 bytes, 3 files, at 0x44 +A "\downloadscan.manifest" +A "\win32\downloadscan.dll", flags 0x4, number 1, extra bytes 20 in head, 200 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2270353
Entropy (8bit):	7.999715677469091
Encrypted:	true
SSDEEP:	49152:IGbgpm9nY7/XxnELz/lBCWi6NBl5hQpOECpWDXjtU19Rxyash:IGP6XxA/BdNBThQpOE7m1dyH
MD5:	830597A39C23A1D6234EF1EB5F9476E2
SHA1:	EBB05CFB80DA8A6D95B4123833F6B7F0C9230328
SHA-256:	DCE5DC71A095B82388B5945DDBDFED67A25686DF0E89A3EF64681EB6A85743DA
SHA-512:	7AA363FFBB13CBF35DB4DA3CA5C56588CAB5737B8EACEA273BA0F94C7014C849F0F080B6FDFA7A72D4981AF6F4FC3AEC9C5B173E0A744C9B28CD597B8C7784ED
Malicious:	true
Reputation:	unknown
Preview:	MSCF.....P".....D............................P"..S.............................Xwt .\downloadscan.manifest...........X't .\win32\downloadscan.dll..5.......Xmt .\x64\downloadscan.dll.8t..`...[.... h,...@C.5..P.......?.".Cj...4.#O.Z?q.S.0O..Z.~2.5.]-.O\L.<2J2>.J....E..n....M..u.i...&.[.......0..w....w...y..l...@.U...%\..bommo.cs...........2..s%......t..Y...nA_..@.9'.4.T@...9..2.z&..............]Y...?..\...,..4y.d..J.\..x!A....$.^1.0...2^.v'.H.X.#S...f....5.T.*.\p.....%;...[.[....b..fm.z.7.'n......>..x.f.7.......+...}.\|.OM..p.q...\4.Ku......[..a...\|.qaYw.3..~8q_.d...q.-_...~..2.G...=.^.]..Ox.X.b..../...RMI.+\|.....x.6... O.,..[.._\|.x..g..../....?.........._....?...b_+..9.q.#..........%....$n.7....._.>......r..vg....?.co.......G\|.7.yU.&c..-.n..3..S.@S...xH.......D.~.......Z...&.i.'.+._........_t...k...e..=Y9......>....]..?N...w.G....!.g............>qv...M..._.......G}..o.?.....o}I.O.m.}.......=wq..V.-`J.O.7.`_.7e....J.._.........L....\|7\|

C:\Program Files\McAfee\Temp3475153614\eventmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1557599 bytes, 2 files, at 0x44 +A "\eventmanager.dll" +A "\eventmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 138 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1579039
Entropy (8bit):	7.999610264182365
Encrypted:	true
SSDEEP:	49152:qMTFDcJsiPtsp4inLHHEQmlAwNES4qshrV:qMTFD4a4iLEQmlhNb2h
MD5:	4D640A7698CE8A63BE145717D1384BB7
SHA1:	2ABA5A5D24B66CB49DA317311B8A531F993A170F
SHA-256:	DE0B3DE2AF79A643E4B7712563A486786F470574792AB2E655AEEB20686AC116
SHA-512:	F268C6CF2C638CA16AAFA26C2DA8CF7822C0FF2415D56DF31EA91A2D79380012EF388E7A67BE508C4F5F5A2F6D54E3C4CA3EE26EE7C4AEB576C69FFFC49BE25B
Malicious:	true
Reputation:	unknown
Preview:	MSCF...._.......D..........................._....S....................D........Xmt .\eventmanager.dll.......D....Xrt .\eventmanager.manifest.c+.5j+..[...5 H....@..4.......K......K.:.rQ.M..\....v.....,.:..f.[.].nN;:...tM.S:.:....:....u............{=.v.g........5... ....442..Z.R:.$V.2cg..j.f..n.o..el..H.>..SSj.kAAj.#[.l..H-(.mb..&...A.!........................H........+.9.>....O..K?.rY.#...tT.D#.W...B.......2Gen.H...:'...f.g..5=...U.]...?....~.v.un.^.\|...7a......\|....7x.[...V^....t.v\s....un.8.......u~7.c...>.......c.R.../.........n;GF......i.;;{.J.y....r......v..;........@.......t............K...2...~.M.,ZGO.w]fe.z..EYg.,...~bOkj......^Z.L..>k..............C..'I./Kts....;../p2..z..........#...m-...S..fv....v._..;j.w.Fh.o.=...j......9.....p.M..g.j..........h2...t..r.O.Z..>....].......y.H...v...o.[.g......{..oA.T..}2T.a.X..L3.?..M.C......;...;..../....7...q.....o..b...sBW..6....+.7;.~C.;8....a....s5#..3]...V..U.m.-r..c.h.z#....t.G...a

C:\Program Files\McAfee\Temp3475153614\icon_complete.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3219
Entropy (8bit):	7.7127647052020425
Encrypted:	false
SSDEEP:	96:ek20QaOtG6FvySCYWm8yAxvU+LblYFv2tct:eQQaOwhS8m8yH+flLtct
MD5:	4A09448B224F83F4E6D36AEC9FF4DA1E
SHA1:	CC42250CAF610210EFF2904B1A08630A0888AB2F
SHA-256:	911215D1ADA8D78A33F6ED9A3740A0652BE74EFA34ED22AE569D143F9B3B5040
SHA-512:	390587FA96D17112CA7EC1ADFE2BA103FE39E980A35A2D4C7A3B6BCF4DE9E95B200DDCEE3C4B6C34899DE51F20F9635D41259558C77CF24279D26264DA953E2B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEF9F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFAF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEF7F71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEF8F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d.8.....IDATx..kL.W.....Z(....h5>J....T,...4U...h.I..&~...`..hc......"h.. X.....m...Q....%...........'..ta.

C:\Program Files\McAfee\Temp3475153614\icon_failed.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3390
Entropy (8bit):	7.74331289225542
Encrypted:	false
SSDEEP:	96:ek2J8fBtCIc5eJXe1TDiotN45Myx7n6v9+j0ZH:e98fB8vcJqVUtx+9+j0p
MD5:	AEE9C26A50511C3E4196C28662BCE665
SHA1:	ADF6DA6EE3EAAD88E8EF1C9C07505AEFFDE89B57
SHA-256:	0E2904A557F79BCE71A47BFB03E49FA9C5B54C7855017B54143EA2214501BFE6
SHA-512:	F90AA520FD9308C502B857C4425BF6CF6E12C401EA4B538534E58655448232CF797AA9A9BA60B0932DBAFC28EE925D22BED6740DF82BB02C5C99EF851389F783
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEFDF71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFEF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFBF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEFCF71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..*.....IDATx..klTU...v..--/5.<.J...."F.aD.HQ4..(...j.P.a...?T ..F...........5..... ..jU..Q#.V(.]g...w.g.n.$.m

C:\Program Files\McAfee\Temp3475153614\icon_laptop.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 100 x 73, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.072392857408681
Encrypted:	false
SSDEEP:	24:YQ1hepWwjx82lY2T3JbVvdgqud1oUUyJ3Vnf//XPtGiLBVa470GoqF0ynT6/at8a:YuccNn2Vw7znJ3BvPtnLW5qF0yTUa6fC
MD5:	4D3A0258CF71A406CB7669FBE3FBEB2E
SHA1:	0811273369EADF2604DB3C53426F85FE74B785E4
SHA-256:	C156050A5D788BAD7D8F36482072B44A23F502F23C5F9198F6EB1EB066765DEE
SHA-512:	837A275BC63DD19F5F8553E056C5EAF257D530A54E0EC386BB28B0A515CA58929E3464612C30D9E7034ACF7473119E03B00EBAB26B220391330FEF12BC087973
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...d...I............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:3EBDD818F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:3EBDD819F71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFFF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDF00F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..}....UIDATx..K.Q..sj-HT...X..t.Z.P.A$...v...._.-]DAkG....#.B....dr.(..@.*......-y.......<H.......{..^.\NA\|h..

C:\Program Files\McAfee\Temp3475153614\installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2990000
Entropy (8bit):	6.51169381697672
Encrypted:	false
SSDEEP:	49152:qZODnkJSBApMNBe65LjwmeKxTQDAPwazuZbdQ:uTSBHBe65LjwfKFsKuZ6
MD5:	B2B02A72E98408C9E0EBD5036BD7A092
SHA1:	6D95B41EE0B8D6445E8D52048B4013AFAF78109C
SHA-256:	B2C1AD8AF3439BC7458130400BD213DD3DB5AEE8F49E295027C97B11DBE6BF58
SHA-512:	B74AFA38D91F41B0FFD445999905D6A2F2A88BD796B0CED6C55DB10DE62C7EE468CC27E94F701BCA59CFA6819B22869CE33193446CEC0DB69ECCEC1DFE85654F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........\1.h2b.h2b.h2b..1c.h2b..7cMh2b0.6c.h2b0.1c.h2b0.7c.h2bS.7c.h2b..7c.h2b..6c.h2b..3c.h2b.h2b.h2b^.6c.h2b.h3b.j2b..;c.h2b..2c.h2b...b.h2b.h.b.h2b..0c.h2bRich.h2b................PE..d....~>f.........."....$.f...".......8.........@..............................-.......-...`........................................... .$..... ......0$.8h....".8K....,.......-.........p.......................(...p...@..................... ......................text...nd.......f.................. ..`.rdata..J............j..............@..@.data...t.... !.......!.............@....pdata..8K...."..L....!.............@..@.didat........$.......".............@..._RDATA..\.... $.......".............@..@.rsrc...8h...0$..j....".............@..@.reloc........-..0...R,.............@..B................................................................................................................

C:\Program Files\McAfee\Temp3475153614\jquery-1.9.0.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	ASCII text, with very long lines (32132), with CRLF line terminators
Category:	dropped
Size (bytes):	93205
Entropy (8bit):	5.288204890649224
Encrypted:	false
SSDEEP:	1536:fYcvR3VhH37Ha7EmakRhIHASkCDy08otU6myJXXxMZyYk0AjrzCqlKDo9YhnaTdT:fY8MaW2c+UELKUqnAdiW
MD5:	43A2DD1096DAAAD91A40C9C9AA026DCC
SHA1:	FA185F0ADE30817D20EC16EF71647832765403A9
SHA-256:	E22BCF04CD56AB92742DF9D02E4BB460A378C7E1FD58B2EB3972E989983A540C
SHA-512:	531002C093133D5253C6869DEB92230CFE851B223CC9F23F5F91306AED3FBA9FDD2CC516335E361B5C362A2AAF2571633F7812678E9BD99AB9716ACFC73469F2
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v1.9.0 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license /(function(e,t){"use strict";function n(e){var t=e.length,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===n\|\|"function"!==n&&(0===t\|\|"number"==typeof t&&t>0&&t-1 in e)}function r(e){var t=Tt[e]={};return st.each(e.match(lt)\|\|[],function(e,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]&&s;if(f&&c[f]&&(i\|\|c[f].data)\|\|!u\|\|r!==t)return f\|\|(l?e[s]=f=K.pop()\|\|st.guid++:f=s),c[f]\|\|(c[f]={},l\|\|(c[f].toJSON=st.noop)),("object"==typeof n\|\|"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.extend(c[f].data,n)),o=c[f],i\|\|(o.data\|\|(o.data={}),o=o.data),r!==t&&(o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].data)){st.isArray(t)?t=t.concat(

C:\Program Files\McAfee\Temp3475153614\jslang\eula-cs-CZ.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2374), with CRLF line terminators
Category:	dropped
Size (bytes):	74892
Entropy (8bit):	3.810713515135319
Encrypted:	false
SSDEEP:	1536:MtrgKi7KxT98/9UIBtIFbxb6EFNBRV25JWavzs87n37ebyUDfIjGv:hs91bzNx0JWGsiUDwy
MD5:	1B9315871686DAD6605594BF62598D65
SHA1:	F77F3B4EC5DCF958462B30565A30493752448836
SHA-256:	CF035D6E4292EA8F4F99363F5C92665D480E9A0CC53B1ABDFEDA29AE4F1708D4
SHA-512:	860696F6D2268F320E9D3719DB21F0F2E5A8D9BD7EEDAB81FB9B2E33637F3857F082029FF4EF3C888CB77DD11C648543413AA70265B3885C8F07A7D16C8E47CE
Malicious:	false
Reputation:	unknown
Preview:	..L.i.c.e.n...n... .s.m.l.o.u.v.a. .n.a. .b.e.z.p.e...n.o.s.t.n... .s.o.f.t.w.a.r.e. .I.n.t.e.l.........D...k.u.j.e.m.e. .z.a. .v.y.u.~.i.t... .b.e.z.p.e...n.o.s.t.n...h.o. .s.o.f.t.w.a.r.u. .a. .s.l.u.~.e.b. .s.p.o.l.e...n.o.s.t.i. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .(.d...l.e. .j.e.n. .. S.o.f.t.w.a.r.e.. ).,. .k.t.e.r... .p.o.s.k.y.t.u.j.e. .j.e.j... .s.t.o.p.r.o.c.e.n.t.n... .v.l.a.s.t.n...n... .d.c.e.Y.i.n... .s.p.o.l.e...n.o.s.t. .M.c.A.f.e.e... .T.o.t.o. .j.e. .p.r...v.n... .u.j.e.d.n...n... .m.e.z.i. .v...m.i. .a. .n.a.a... .s.p.o.l.e...n.o.s.t..... .I.n.s.t.a.l.a.c... .n.e.b.o. .p.o.u.~.i.t...m. .S.o.f.t.w.a.r.u. .v.y.j.a.d.Y.u.j.e.t.e. .s.o.u.h.l.a.s. .s. .p.o.d.m...n.k.a.m.i. .u.j.e.d.n...n...,. .p.r.o.t.o. .s.i. .j.e. .p.e...l.i.v... .p.Y.e...t...t.e... .........T.a.t.o. .s.m.l.o.u.v.a. .n.a. .b.e.z.p.e...n.o.s.t.n... .S.o.f.t.w.a.r.e. .I.n.t.e.l. .(.d...l.e. .j.e.n. .. S.m.l.o.u.v.a.. ). .u.p.r.a.v.u.j.e. .v.a.a.e. .p.r...v.a. .k. .p.o.u.~.i.t... .S.o.f.t.w.a.r.u.,. .j.e.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-da-DK.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2582), with CRLF line terminators
Category:	dropped
Size (bytes):	91776
Entropy (8bit):	3.4529510483598287
Encrypted:	false
SSDEEP:	768:nVNCGgfhrLJT5kmiYjC8DZ9p7WmTg5MSItM7Q1cTm/diaa8mwQUIqetIHi7M6X6R:nVNCGgfhpTziY2Ol7FtD0aa8mWe9+PuM
MD5:	8C5BBFF937D23FB94766574F7DADA009
SHA1:	00FFB6B097530704E0742866322BC7637CDDDF7A
SHA-256:	222DC9A05ABE46B8B698D35F27B47D5DF34ABA63FF9EF539196A4DD69EB94B1C
SHA-512:	574A96F146F3BA2C9460D22497521871E512DBA6CB5913FB316364DF3694E1CC9851CED00AF17C3156026F60CB816EFA9CF05D982C04C90D0A59EB55208CD347
Malicious:	false
Reputation:	unknown
Preview:	..L.i.c.e.n.s.a.f.t.a.l.e. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.k.,. .f.o.r.d.i. .d.u. .b.r.u.g.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.s. .s.o.f.t.w.a.r.e. .o.g. .t.j.e.n.e.s.t.e.r. .(.".S.o.f.t.w.a.r.e.n.".).,. .d.e.r. .l.e.v.e.r.e.s. .a.f. .M.c.A.f.e.e.,. .s.o.m. .e.r. .e.t. .h.e.l.e.j.e.t. .d.a.t.t.e.r.s.e.l.s.k.a.b. .a.f. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .D.e.t.t.e. .e.r. .e.n. .j.u.r.i.d.i.s.k. .a.f.t.a.l.e. .m.e.l.l.e.m. .o.s. .. .i.n.s.t.a.l.l.a.t.i.o.n. .e.l.l.e.r. .o.p.r.e.t.t.e.l.s.e. .a.f. .a.d.g.a.n.g. .t.i.l. .v.o.r.e.s. .S.o.f.t.w.a.r.e. .b.e.t.y.d.e.r.,. .a.t. .d.u. .a.c.c.e.p.t.e.r.e.r. .d.i.s.s.e. .v.i.l.k...r.,. .s... .d.u. .b.e.d.e.s. .l...s.e. .d.e.m. .o.m.h.y.g.g.e.l.i.g.t... .........I. .d.e.n.n.e. .l.i.c.e.n.s.a.f.t.a.l.e. .f.r.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".A.f.t.a.l.e.n.".). .g.e.n.n.e.m.g...s. .d.i.n.e. .r.e.t.t.i.g.h.e.d.e.r. .t.i.l. .a.t. .b.r.u.g.e. .S.o.f.t.w.a.r.e.n.,. .b.e.g.r...n.s.n.i.n.g.e.r. .f.o.r. .d.e.n.n.e. .b.r.u.g.,. .v.o.r.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-de-DE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (3216), with CRLF line terminators
Category:	dropped
Size (bytes):	104206
Entropy (8bit):	3.4915396500324105
Encrypted:	false
SSDEEP:	3072:Sw8jufxOksgk9WB2s9JIEwSKjKmDwwy0U6QVMsaXSTLgaP3FGt:FahQVk
MD5:	47DE4A9A5028CC8773F0E3F0CFAB6B27
SHA1:	F893FED5B974359FD10207D55EB1C577E134C688
SHA-256:	852EDBCAFFF1009097B0F58B8066B639CEDC2AE29B8E613975F1785DD174A35B
SHA-512:	C034ADA19F85C58C65CBBB971A05BB9390D631207E8A8E92FDA8B434EDCF3A8395BD51C82B774CED7D9C8BD0DF21E2DD308DFE3DBDD2308D0597C407E1DE3852
Malicious:	false
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.z.e.n.z.v.e.r.t.r.a.g.........V.i.e.l.e.n. .D.a.n.k.,. .d.a.s.s. .S.i.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .S.o.f.t.w.a.r.e. .u.n.d. .D.i.e.n.s.t.e. .(.. S.o.f.t.w.a.r.e.. ). .n.u.t.z.e.n.,. .d.i.e. .v.o.n. .M.c.A.f.e.e.,. .e.i.n.e.r. .h.u.n.d.e.r.t.p.r.o.z.e.n.t.i.g.e.n. .T.o.c.h.t.e.r.g.e.s.e.l.l.s.c.h.a.f.t. .v.o.n. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.,. .b.e.r.e.i.t.g.e.s.t.e.l.l.t. .w.e.r.d.e.n... .D.i.e.s. .i.s.t. .e.i.n. .r.e.c.h.t.s.k.r...f.t.i.g.e.r. .V.e.r.t.r.a.g. .z.w.i.s.c.h.e.n. .u.n.s.. m.i.t. .d.e.r. .I.n.s.t.a.l.l.a.t.i.o.n. .o.d.e.r. .d.e.m. .Z.u.g.r.i.f.f. .a.u.f. .u.n.s.e.r.e. .S.o.f.t.w.a.r.e. .s.t.i.m.m.e.n. .S.i.e. .d.i.e.s.e.n. .B.e.d.i.n.g.u.n.g.e.n. .z.u... .L.e.s.e.n. .S.i.e. .s.i.e. .d.e.s.h.a.l.b. .b.i.t.t.e. .a.u.f.m.e.r.k.s.a.m. .d.u.r.c.h... .........D.i.e.s.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.z.e.n.z.v.e.r.t.r.a.g. .(.. V.e.r.t.r.a.g.. ). .u.m.f.a.s.s.t. .I.h.r.e. .R.e.c.h.t.e. .z.u.r. .N.u.t.z.u.n.g. .d.e.r. .S.o.f.t.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-el-GR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2776), with CRLF line terminators
Category:	dropped
Size (bytes):	103714
Entropy (8bit):	4.0545031462892975
Encrypted:	false
SSDEEP:	3072:7NPKnckk7Va7/ZYluLyBO/mw5rMpNVjX7MYeFz8cq:lKB5rMdX4/a
MD5:	49005DF4EF7EDD0ABF3F210A3C97294F
SHA1:	8B77E18651221CC685871253D8014C05FD232D45
SHA-256:	F88995A0F9C30A5329C779CE2053A01EB98A3E01D37D83643051232B2A6B008F
SHA-512:	284B4CA0617BE51EA0FE5D14285747916A33BD875681F0FD5B26417CF27CE1B1516F2D56D1CA3CC6825E05AAC3A81AA40DF9CCB4647101A44AAC7CAC8B54EFB8
Malicious:	false
Reputation:	unknown
Preview:	................ ............. ............. ..................... ....... ................... .I.n.t.e.l. .S.e.c.u.r.i.t.y............... ......................... ....... ............................. ................... ....... ................... .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. ................... ).,. ....... ............... ... .M.c.A.f.e.e.,. ....... ....................... ..................... ................... ....... .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... ... ............... ................. ....... ............. ................. ............... ..... ......... ....... .......... .. ....................... ... ..................... ....... ..................... ....... ....................... ....... ..................... ..... ......... ................. ...........,. ................. ....... ....................... ..... ......... ................... ....................... ........... ............... ............... ............. ............. .....................

C:\Program Files\McAfee\Temp3475153614\jslang\eula-en-US.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2456), with CRLF line terminators
Category:	dropped
Size (bytes):	85990
Entropy (8bit):	3.4531387024147993
Encrypted:	false
SSDEEP:	1536:/F7Fw4sT8hXmsqSrobeIT6f9BMaR4EYtI7F5T:aoj
MD5:	4A06F74178E2992E9B7D04173DD91109
SHA1:	0A5B11C47C53CFAAFF14D4E7A41F71B8BF199C43
SHA-256:	889C1FCF347CD3B4647A4221BD3ECB00139047146BF331F6F7D39D0889846BFF
SHA-512:	4B6D2A5B227B9B5F49BA382AF9F8D5F99F917D5F9B9AFF9CAF7C242C1932CD549A3881886BCD4CD481A11B1ABBF90002FC1243D33AF90FE0A8E747B8B81D84F2
Malicious:	true
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t.........T.h.a.n.k. .y.o.u. .f.o.r. .u.s.i.n.g. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .s.o.f.t.w.a.r.e. .a.n.d. .s.e.r.v.i.c.e.s. .(.. S.o.f.t.w.a.r.e.. ).,. .p.r.o.v.i.d.e.d. .b.y. .M.c.A.f.e.e.,. .a. .w.h.o.l.l.y. .o.w.n.e.d. .s.u.b.s.i.d.i.a.r.y. .o.f. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .T.h.i.s. .i.s. .a. .l.e.g.a.l. .a.g.r.e.e.m.e.n.t. .b.e.t.w.e.e.n. .u.s.. i.n.s.t.a.l.l.i.n.g. .o.r. .a.c.c.e.s.s.i.n.g. .o.u.r. .S.o.f.t.w.a.r.e. .m.e.a.n.s. .y.o.u. .a.r.e. .a.g.r.e.e.i.n.g. .t.o. .t.h.e.s.e. .t.e.r.m.s.,. .s.o. .p.l.e.a.s.e. .r.e.a.d. .t.h.e.m. .c.a.r.e.f.u.l.l.y... .........T.h.i.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t. .(.. A.g.r.e.e.m.e.n.t.. ). .c.o.v.e.r.s. .y.o.u.r. .r.i.g.h.t.s. .t.o. .u.s.e. .t.h.e. .S.o.f.t.w.a.r.e.,. .r.e.s.t.r.i.c.t.i.o.n.s. .o.n. .t.h.a.t. .u.s.e.,. .o.u.r. .r.i.g.h.t. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .r.e.n.e.w. .a.n.d. .c.h.a.r.g.e. .y.o.u. .f.o.r. .p.a.i.d. .v.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-es-ES.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2904), with CRLF line terminators
Category:	dropped
Size (bytes):	100834
Entropy (8bit):	3.4283715559489414
Encrypted:	false
SSDEEP:	768:JgO+5MfF+qvVWjB19FUUl2whazC7vT/yFjaX5Q9+5SYALxacixm44ri7qYdZ+vQC:Jg/5R9WPzzC3cix5kzYdZ+vQNQOVw
MD5:	754394A04D86F573885F7688DFE8CD60
SHA1:	32C4A2018F5B273A8EE7FFBE53F3D9256DC4A45D
SHA-256:	5CDCA8FA283715CC1E2E28BCA58DE90F2FFA72BD4D066847451776E1EAF75E30
SHA-512:	5D399346FD22246E75AF40568386CB26D147F26E1B921F048D1E2916CCF6455C5614B6C5A9B12620F7F017982FB2E1468D19E51AD115DCB77E4367A36389B2AF
Malicious:	false
Reputation:	unknown
Preview:	..A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.c.i.a.s. .p.o.r. .u.t.i.l.i.z.a.r. .l.o.s. .s.e.r.v.i.c.i.o.s. .y. .e.l. .s.o.f.t.w.a.r.e. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ).,. .s.u.m.i.n.i.s.t.r.a.d.o.s. .p.o.r. .M.c.A.f.e.e.,. .u.n.a. .f.i.l.i.a.l. .p.a.r.t.i.c.i.p.a.d.a. .p.l.e.n.a.m.e.n.t.e. .p.o.r. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .e.s. .u.n. .a.c.u.e.r.d.o. .l.e.g.a.l. .e.n.t.r.e. .n.o.s.o.t.r.o.s... .A.l. .i.n.s.t.a.l.a.r. .o. .a.c.c.e.d.e.r. .a. .n.u.e.s.t.r.o. .S.o.f.t.w.a.r.e. .i.n.d.i.c.a. .u.s.t.e.d. .q.u.e. .a.c.e.p.t.a. .l.o.s. .p.r.e.s.e.n.t.e.s. .t...r.m.i.n.o.s.,. .p.o.r. .l.o. .t.a.n.t.o.,. .l.e. .r.o.g.a.m.o.s. .q.u.e. .l.o.s. .l.e.a. .c.o.n. .a.t.e.n.c.i...n... .........E.l. .p.r.e.s.e.n.t.e. .A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.e.l. . .. A.c.u.e.r.d.o.. ). .e.s.t.a.b.l.e.c.e. .c.u...l.e.s. .s.o.n. .s.u.s. .d.e.r.e.c.h.o.s. .d.e. .u.s.o. .d.e.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-es-MX.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2904), with CRLF line terminators
Category:	dropped
Size (bytes):	100834
Entropy (8bit):	3.427920166965757
Encrypted:	false
SSDEEP:	768:JgO+5MfF+qvVWjB19FUUl2whazC7vT/yFjaX5Q9+5SYALxacixm44ri7qYdZ+vQR:Jg/5R9WPzzC3cix5kzYdZ+vQNQOh
MD5:	5C60E15388686B4BA7E50549EE54AD82
SHA1:	D123CD4250F2375BB9C2671E82AC56BE6ECF2E42
SHA-256:	E890EADBDC04E2B394CF45FAEDBF14AF7A9A3AAE24DD7C522A31C5C6AB89EC85
SHA-512:	76E8B71C2C7EF7109FE66061CF959A10568BFEA28614E42BFF36C6EE3BFCA6DEAD76905DDE2B1F63E88154C90EC4796054DFFB7D1824836070B55AE48DF4A40C
Malicious:	false
Reputation:	unknown
Preview:	..A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.c.i.a.s. .p.o.r. .u.t.i.l.i.z.a.r. .l.o.s. .s.e.r.v.i.c.i.o.s. .y. .e.l. .s.o.f.t.w.a.r.e. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ).,. .s.u.m.i.n.i.s.t.r.a.d.o.s. .p.o.r. .M.c.A.f.e.e.,. .u.n.a. .f.i.l.i.a.l. .p.a.r.t.i.c.i.p.a.d.a. .p.l.e.n.a.m.e.n.t.e. .p.o.r. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .e.s. .u.n. .a.c.u.e.r.d.o. .l.e.g.a.l. .e.n.t.r.e. .n.o.s.o.t.r.o.s... .A.l. .i.n.s.t.a.l.a.r. .o. .a.c.c.e.d.e.r. .a. .n.u.e.s.t.r.o. .S.o.f.t.w.a.r.e. .i.n.d.i.c.a. .u.s.t.e.d. .q.u.e. .a.c.e.p.t.a. .l.o.s. .p.r.e.s.e.n.t.e.s. .t...r.m.i.n.o.s.,. .p.o.r. .l.o. .t.a.n.t.o.,. .l.e. .r.o.g.a.m.o.s. .q.u.e. .l.o.s. .l.e.a. .c.o.n. .a.t.e.n.c.i...n... .........E.l. .p.r.e.s.e.n.t.e. .A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.e.l. . .. A.c.u.e.r.d.o.. ). .e.s.t.a.b.l.e.c.e. .c.u...l.e.s. .s.o.n. .s.u.s. .d.e.r.e.c.h.o.s. .d.e. .u.s.o. .d.e.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-fi-FI.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2621), with CRLF line terminators
Category:	dropped
Size (bytes):	90558
Entropy (8bit):	3.4503164395314267
Encrypted:	false
SSDEEP:	1536:HE2oXLv8VtIG4O4mPf5lC66AlB1Fd+NlLVlbH2ZuWUh/C:Hl4gtI24cf5c6J7l8vWUhq
MD5:	A716B62741817D4D26020F468FFB7534
SHA1:	ABCDEFC5B36D27D9598E338DA69BF9DFCDDC056E
SHA-256:	3D339578F7E356B688545BC411F380E40ED630807792DDCAEE685C15418824BF
SHA-512:	FFFBE8399EBDE086E206466A10DD4005C0A714CC678B8E9A94914C4B95E65724D7C1F83ABECA92AEF8D0F181791E86AF3127C9B92D44B27EB5186674980796CE
Malicious:	false
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .k...y.t.t...o.i.k.e.u.s.s.o.p.i.m.u.s.........K.i.i.t.o.s.,. .e.t.t... .v.a.l.i.t.s.i.t. .I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .o.h.j.e.l.m.i.s.t.o.n. .j.a. .p.a.l.v.e.l.u.t. .(.. o.h.j.e.l.m.i.s.t.o.. ).,. .j.o.t.k.a. .t.a.r.j.o.a.a. .M.c.A.f.e.e.,. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.i.n. .k.o.k.o.n.a.a.n. .o.m.i.s.t.a.m.a. .t.y.t...r.y.h.t.i..... .T...m... .o.n. .l.a.i.l.l.i.n.e.n. .s.o.p.i.m.u.s. .m.e.i.d...n. .j.a. .k...y.t.t...j...n. .v...l.i.l.l..... .A.s.e.n.t.a.m.a.l.l.a. .t.a.i. .k...y.t.t...m...l.l... .o.h.j.e.l.m.i.s.t.o.a.m.m.e. .s.i.t.o.u.d.u.t. .n...i.h.i.n. .e.h.t.o.i.h.i.n.,. .j.o.t.e.n. .o.n. .t...r.k.e.....,. .e.t.t... .l.u.e.t. .n.e. .h.u.o.l.e.l.l.i.s.e.s.t.i... .........T...m... .I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .k...y.t.t...o.i.k.e.u.s.s.o.p.i.m.u.s. .(.. s.o.p.i.m.u.s.. ). .p.i.t..... .s.i.s...l.l.....n. .k...y.t.t...j...n. .o.i.k.e.u.d.e.t. .o.h.j.e.l.m.i.s.t.o.n. .k...y.t.t.....n.,. .t...t... .k...y.t.t..... .k.o.s.k.e.v.a.t. .r.a.j.o.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-fr-CA.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2833), with CRLF line terminators
Category:	dropped
Size (bytes):	100074
Entropy (8bit):	3.457122276211369
Encrypted:	false
SSDEEP:	768:YUojrJ1ucLHrQIvVQXrsE2Kd6kPu1dTNjOy+psORpT6koBWT7qO6H5U8mSwE9Nel:YwrsE2KdYmfwqjlK2BZVqCChcw07
MD5:	DCAF9463D1F1CDE4CBFA44763B3F1A99
SHA1:	D91A06AD028D5ADCE2AB7CF6DEFCE41EB39105C5
SHA-256:	7DE90793769D6736D71D1B1D7FEF464340E0F940FAE3A4EF3A758885FE8601C4
SHA-512:	43C517F708631436631BE5983D1241BE0D80BBE1E29707AE021F97E0C87DDE003517901A2EEB2964AA4A2DC56A1AF5755C1FF58ED9007DA53F854D2C93643283
Malicious:	false
Reputation:	unknown
Preview:	..C.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........M.e.r.c.i. .d.'.u.t.i.l.i.s.e.r. .l.e. .l.o.g.i.c.i.e.l. .e.t. .l.e.s. .s.e.r.v.i.c.e.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....L.o.g.i.c.i.e.l.....). .f.o.u.r.n.i.s. .p.a.r. .M.c.A.f.e.e.,. .u.n.e. .f.i.l.i.a.l.e. .e.n. .p.r.o.p.r.i...t... .e.x.c.l.u.s.i.v.e. .d.'.I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .L.e. .p.r...s.e.n.t. .d.o.c.u.m.e.n.t. .e.s.t. .u.n. .a.c.c.o.r.d. .j.u.r.i.d.i.q.u.e. .c.o.n.c.l.u. .e.n.t.r.e. .v.o.u.s. .e.t. .n.o.u.s... .E.n. .i.n.s.t.a.l.l.a.n.t. .o.u. .e.n. .a.c.c...d.a.n.t. ... .n.o.t.r.e. .L.o.g.i.c.i.e.l.,. .v.o.u.s. .a.c.c.e.p.t.e.z. .l.e.s. .p.r...s.e.n.t.e.s. .c.o.n.d.i.t.i.o.n.s... .V.e.u.i.l.l.e.z. .d.o.n.c. .l.e.s. .l.i.r.e. .a.t.t.e.n.t.i.v.e.m.e.n.t... .........L.e. .p.r...s.e.n.t. .C.o.n.t.r.a.t. .d.e. .L.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....C.o.n.t.r.a.t.....). .p.o.r.t.e. .s.u.r. .v.o.s. .d.r.o.i.t.s. .d.'.u.t.i.l.i.s.e.r. .l.e. .L.o.g.i.c.i.e.l.,. .l.e.s. .r.e.s.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-fr-FR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2833), with CRLF line terminators
Category:	dropped
Size (bytes):	100074
Entropy (8bit):	3.4567077131647905
Encrypted:	false
SSDEEP:	768:YUojrJ1ucLHrQIvVQXrsE2Kd6kPu1dTNjOy+psORpT6koBWT7qO6H5U8mSwE9Ne1:YwrsE2KdYmfwqjlK2BZVqCChcw0L
MD5:	04ADF4B20F60B043644E672AB51C2615
SHA1:	13A3225B2B10956CEF4FA7ABD754783674FA498D
SHA-256:	5A02665D84996472728159DF56ABA89EBCFCCEDAB9DB02F84932BF1753024D8A
SHA-512:	5C5C4ED67566C9087891CFFF1150F7C396DDE4D4B934A137B2134A65C0491AD4AF1C87841717454940464D2BEBB112ACB896850BC508B952C33EFC12AD38277B
Malicious:	false
Reputation:	unknown
Preview:	..C.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........M.e.r.c.i. .d.'.u.t.i.l.i.s.e.r. .l.e. .l.o.g.i.c.i.e.l. .e.t. .l.e.s. .s.e.r.v.i.c.e.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....L.o.g.i.c.i.e.l.....). .f.o.u.r.n.i.s. .p.a.r. .M.c.A.f.e.e.,. .u.n.e. .f.i.l.i.a.l.e. .e.n. .p.r.o.p.r.i...t... .e.x.c.l.u.s.i.v.e. .d.'.I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .L.e. .p.r...s.e.n.t. .d.o.c.u.m.e.n.t. .e.s.t. .u.n. .a.c.c.o.r.d. .j.u.r.i.d.i.q.u.e. .c.o.n.c.l.u. .e.n.t.r.e. .v.o.u.s. .e.t. .n.o.u.s... .E.n. .i.n.s.t.a.l.l.a.n.t. .o.u. .e.n. .a.c.c...d.a.n.t. ... .n.o.t.r.e. .L.o.g.i.c.i.e.l.,. .v.o.u.s. .a.c.c.e.p.t.e.z. .l.e.s. .p.r...s.e.n.t.e.s. .c.o.n.d.i.t.i.o.n.s... .V.e.u.i.l.l.e.z. .d.o.n.c. .l.e.s. .l.i.r.e. .a.t.t.e.n.t.i.v.e.m.e.n.t... .........L.e. .p.r...s.e.n.t. .C.o.n.t.r.a.t. .d.e. .L.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....C.o.n.t.r.a.t.....). .p.o.r.t.e. .s.u.r. .v.o.s. .d.r.o.i.t.s. .d.'.u.t.i.l.i.s.e.r. .l.e. .L.o.g.i.c.i.e.l.,. .l.e.s. .r.e.s.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-hr-HR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2677), with CRLF line terminators
Category:	dropped
Size (bytes):	87744
Entropy (8bit):	3.587800662613001
Encrypted:	false
SSDEEP:	1536:4D5AY14mQom+cQuoy8H5Zo3ij63ydrXxYM+gDUC5lBvt4UgmsiyePIOKw:3jelDB1vp
MD5:	A4E57915C2C7EB22C7B090DEC283C942
SHA1:	81B7210C5B7A0CD5024E85ECE752D19A53D22405
SHA-256:	9F48CC92B9A3078BDFF8BCA3A23CB1A4AB583D6FE810C6768CEC6062B6FEA233
SHA-512:	C5EFE3D756D7BB7EE83DBAEFF48AB080E0258D21E244B5809960498F40C47931A66A6E29C1ED16630D9E43BCD7476CA4B1B53CD6B148785AA88718F377456E2E
Malicious:	false
Reputation:	unknown
Preview:	..L.i.c.e.n.c.n.i. .u.g.o.v.o.r. .z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........H.v.a.l.a. .a.t.o. .k.o.r.i.s.t.i.t.e. .s.o.f.t.v.e.r. .i. .u.s.l.u.g.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.v.e.r.".).,. .k.o.j.i. .i.s.p.o.r.u...u.j.e. .M.c.A.f.e.e.,. .p.o.d.r.u.~.n.i.c.a. .u. .p.o.t.p.u.n.o.m. .v.l.a.s.n.i.a.t.v.u. .t.v.r.t.k.e. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .O.v.o. .j.e. .p.r.a.v.n.i. .u.g.o.v.o.r. .i.z.m.e...u. .n.a.s.. i.n.s.t.a.l.i.r.a.n.j.e. .i.l.i. .p.r.i.s.t.u.p. .n.a.a.e.m. .S.o.f.t.v.e.r.u. .z.n.a...i. .d.a. .s.e. .s.l.a.~.e.t.e. .s. .n.j.e.g.o.v.i.m. .u.v.j.e.t.i.m.a.,. .p.a. .v.a.s. .m.o.l.i.m.o. .d.a. .i.h. .p.a.~.l.j.i.v.o. .p.r.o...i.t.a.t.e... .........O.v.a.j. .L.i.c.e.n.c.n.i. .u.g.o.v.o.r. .z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".U.g.o.v.o.r.".). .o.b.u.h.v.a...a. .v.a.a.e. .p.r.a.v.o. .n.a. .k.o.r.i.a.t.e.n.j.e. .S.o.f.t.v.e.r.a.,. .o.g.r.a.n.i...e.n.j.a. .u. .n.j.e.g.o.v.o.m. .k.o.r.i.a.t.e.n.j.u.,. .n.a.a.e. .p.r.a.v.o. .n.a. .a.u.t.o.m.a.t.s.k.o. .o.b.n.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-hu-HU.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2782), with CRLF line terminators
Category:	dropped
Size (bytes):	98690
Entropy (8bit):	3.6855988336178376
Encrypted:	false
SSDEEP:	3072:3+Y5qMxXdv62/0ojFC0hQY+eUbM5wbg6u+sWOvm1SeWN3CBw4bZKMoBwAbCxpI1c:zsGDmMeh
MD5:	55DB321C0E473CE5FC63DC9F0D2EA03B
SHA1:	02D409AAF735344C1C0AB2578BB0C8A123DFFD29
SHA-256:	30BBB221B85BBC75D860417B9E714D3149A80330AF2FD770EB384C5294F5AE9A
SHA-512:	909E37F2E857E3B88A5CA9A885FD1B6BB034D33BA6751E8D3AA2B86BE4728A5D294E6933822DB9EE9AA96C2790685510C2A77796EDC8AA891A4907D0ED365F9D
Malicious:	false
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s.........K...s.z...n.j...k.,. .h.o.g.y. .a.z. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .t.e.l.j.e.s. .t.u.l.a.j.d.o.n... .l.e...n.y.v...l.l.a.l.a.t.a.,. .a. .M.c.A.f.e.e. ...l.t.a.l. .k...n...l.t. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .s.z.o.f.t.v.e.r.t. ...s. .s.z.o.l.g...l.t.a.t...s.o.k.a.t. .(.. S.z.o.f.t.v.e.r.. ). .h.a.s.z.n...l.j.a... .E.z. .a. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s. .e.g.y. .k...z...t.t...n.k. .l...t.r.e.j...t.t. .j.o.g.i. .m.e.g...l.l.a.p.o.d...s. .. .a. .S.z.o.f.t.v.e.r...n.k. .t.e.l.e.p...t...s.e. .v.a.g.y. .a. .S.z.o.f.t.v.e.r...n.k.h...z. .v.a.l... .h.o.z.z...f...r...s. .a.z.t. .j.e.l.e.n.t.i.,. .h.o.g.y. ...n. .e.g.y.e.t...r.t. .a. .s.z.e.r.z.Q.d...s.b.e.n. .f.o.g.l.a.l.t. .f.e.l.t...t.e.l.e.k.k.e.l.,. .e.z...r.t. .o.l.v.a.s.s.a. .e.l. .f.i.g.y.e.l.m.e.s.e.n. .a.z.o.k.a.t... .........A.z. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s. .(.. S.z.e.r.z.Q.d...s.. ). .a. .S.z.o.f.t.v.e.r. .h.a.s.z.n...l.a.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-it-IT.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2974), with CRLF line terminators
Category:	dropped
Size (bytes):	103642
Entropy (8bit):	3.4105471735867425
Encrypted:	false
SSDEEP:	768:D+piF3I9T9qL1rEINLBC7LcfZJJSMqHDYCebssNKlU8rmjVHJkItVdM1OrzjH:6/c16yjdM1OT
MD5:	97E26EC75E79439EB860C4B80C723E06
SHA1:	62A5797FE4A004F54FB2102362C5F07B5CE42B57
SHA-256:	BC90C94905FB951F6E63074BAA25A3DA6C0D5627B82DBECC9474B84AACAB20E0
SHA-512:	CBC66ADEF8EA1DD0E75122CEFB805E51999F287301D2332532E089D450B2580302E20832B230EDAF01661794F873051C30FD4BD232AF7EB4CA482ED45B1EAF56
Malicious:	false
Reputation:	unknown
Preview:	..C.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.z.i.e. .p.e.r. .a.v.e.r. .s.c.e.l.t.o. .d.i. .u.t.i.l.i.z.z.a.r.e. .i. .s.o.f.t.w.a.r.e. .e. .i. .s.e.r.v.i.z.i. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.w.a.r.e.".). .f.o.r.n.i.t.i. .d.a. .M.c.A.f.e.e.,. .c.o.n.s.o.c.i.a.t.a. .i.n.t.e.r.a.m.e.n.t.e. .c.o.n.t.r.o.l.l.a.t.a. .d.i. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .I.l. .p.r.e.s.e.n.t.e. .d.o.c.u.m.e.n.t.o. .c.o.s.t.i.t.u.i.s.c.e. .u.n. .c.o.n.t.r.a.t.t.o. .l.e.g.a.l.e. .t.r.a. .n.o.i. .e. .l.'.u.t.e.n.t.e... .L.'.i.n.s.t.a.l.l.a.z.i.o.n.e. .o. .l.'.a.c.c.e.s.s.o. .a.i. .n.o.s.t.r.i. .S.o.f.t.w.a.r.e. .i.m.p.l.i.c.a. .l.'.a.c.c.e.t.t.a.z.i.o.n.e. .d.i. .q.u.e.s.t.i. .t.e.r.m.i.n.i. .d.a. .p.a.r.t.e. .d.e.l.l.'.u.t.e.n.t.e.,. .c.h.e. .p.e.r.t.a.n.t.o. ... .t.e.n.u.t.o. .a. .l.e.g.g.e.r.l.i. .c.o.n. .a.t.t.e.n.z.i.o.n.e... .........I.l. .p.r.e.s.e.n.t.e. .c.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".C.o.n.t.r.a.t.t.o.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-ja-JP.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1234), with CRLF line terminators
Category:	dropped
Size (bytes):	41412
Entropy (8bit):	5.771046464477923
Encrypted:	false
SSDEEP:	768:8bY257pwJE0xJUhghf/3Gkojyef4ktbfR/KSCDpKIb5MhOI:8E257OJE0ighfSyKtbfxapg
MD5:	0E8C2883A37D702CE30B938931A1C803
SHA1:	F8DA867E6FA20C274F7CF2F8F7E16538EE201CB6
SHA-256:	B8BA7129D3C757DD5CA34E933A99D429C0AE9C0310396E138688DA32567875F1
SHA-512:	779A41B1A35EDE8BF312DBEEE93601F3F7F6981CBFB6FCC6E5162F8B8E26ECD847F4E58955B045C5912B175A049F58567D21DD7F8E93417EECFB21F384C5A6E5
Malicious:	false
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. ..O(u1...QY.}........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .n0hQM..Q.P[.O>yg0B0.0 .M.c.A.f.e.e.L0.c.OY0.0 .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..0.0.0.0.0.0J0.0s0.0.0.0.0...0.0.0.0.0.0.0.0...0)R(uD0_0`0M0B0.0L0h0F0T0V0D0~0Y0.0 .,gQY.}o0J0.[.ih0S_>yh0n0..k0.}P}U0.0.0.l.vj0QY.}g0Y0.0J0.[.io0.0S_>yn0.0.0.0.0.0.0.0.0.0.0.0.0.0~0_0o0]0.0k0.0.0.0.0Y0.0S0h0k0.0.0.0,gQY.}n0ag.Nk0.T.aW0_0h0.0j0U0.0~0Y0n0g0.0,gQY.}.0.0O0J0...0O0`0U0D0.0 .........S0n0 .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..O(u1...QY.}.f...0,gQY.}.0..o0.0J0.[.in0.0.0.0.0.0.0.O(u)j.0.O(u6RP..0.0.0.0.0.0.0n0.g.Q.0.0.0.0.0~0_0o0_j...0..R.vk0.f.eJ0.0s0...Y0.0S_>yn0)j)R.0J0.0s0S_>yh0J0.[.in0..k0zv.uY0.0.S..'`n0B0.0.}.Nn0.N..k0.[Y0.0J0.[.in0.T.ak0d0D0f0....W0f0D0~0Y0.0 ....j0.0,gQY.}h0h0.0k0J0.[.ik0i.(uU0.0.0.0S_>yn0.0.0.0.0.0.0k0..Y0.0.X.f..h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.j.a.p.a.n.e.s.e./.i.n.d.e.x...h.t.m....0+T.0...Rag.Nx0n0.0.0.0L0+T~0.0f0D0~0Y0.0 ..T.Vyr.gn0ag.No0,gQY.}

C:\Program Files\McAfee\Temp3475153614\jslang\eula-ko-KR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1439), with CRLF line terminators
Category:	dropped
Size (bytes):	46328
Entropy (8bit):	5.585862126035491
Encrypted:	false
SSDEEP:	768:iLBTRAz/+e7qDm/7QgTt2Bk6baOLFureI5mIxFRlKi3l+:iLnAz/+e+DmzQgZ2BdblJsSi3l+
MD5:	DCB88E6EF1827D9FCEBED9656334DA6A
SHA1:	0DF4492E59C7DFCECBCE9156B239C262FA130804
SHA-256:	AA104F1DEA724768B459DC307473CBA10C97E854EAFBA0E5D5909C262459D39B
SHA-512:	A733F75D035644B620A4F42502EE727FD2114AE29D5853253B5610934EFCC0EB20B947AC5975E0F38DEAB2989E09D92CA37B5F7887AD38ECD78454E8F0EFFC13
Malicious:	false
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .\|.t. ... ..}.........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.X. ...a. .... .....x. .M.c.A.f.e.e..... .....X.. .I.n.t.e.l. .S.e.c.u.r.i.t.y. ......... ... ...D...(.t.X. .. ......... ).\|. .....t. ...T... .....i..... .t..@. .....@. ...... ...t.X. ..... ..}...... .....X. .........\|. .$.X.X.p... .a.8...X.. ...@. .t. ..}. .}..... ..X.X.. ...t...\.,. .}...D. ...X. .J... .}.<...0. ......... .........t. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .\|.t. ... ..}.(.t.X. .. .}.. ).@. ......... ..... .....,. ......... .....X. ...\. .p.t.,. .........X. . .. .....t.. .0..... ...t. ....<.\. ..}.D. .1...X.. ......... ...a.D. ...l.`. ... .... .....X. .....,. ...... .....@. ...... ...t... .....`. ... .... .....X. ...... ...\. ...X.X. ..X. .....D. ........ .t. .8...... ...X.... ........ .t. ..... ..}.D. .l.1.X.. .\. .....x. ....\. ..... ..}. .}...(...:. ...x.......8. .H..8.,. .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-nb-NO.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2743), with CRLF line terminators
Category:	dropped
Size (bytes):	84476
Entropy (8bit):	3.447091163501246
Encrypted:	false
SSDEEP:	1536:fvk22xFWKEjm1iM70NJnqNiGAsX0MRKQ/s+p6jdIuRMPNGZJq7ALa/jcuqqRp5Q9:fvk22xFWKEjm1iM70NJnqNiGAsX0MRKn
MD5:	6A75473F6F49A47956F107BA3E5E0EB5
SHA1:	7A67B9D8F607E7FF2300B3BA85C096E576A5F9F3
SHA-256:	6973C59317714C26CBE12CA55F592C8085687B80E5FA8B7DD02512570D95E8F7
SHA-512:	491EB933A374440C5AEE77694C4700DCA658CD1863FB0DD0763C350843CB5EAA94EC21CD55716A1C0165A6E75E3F5313BACB378C81B4D18F0A2894B8FE3B34CC
Malicious:	false
Reputation:	unknown
Preview:	..L.i.s.e.n.s.a.v.t.a.l.e. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.k.k. .f.o.r. .a.t. .d.u. .b.r.u.k.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.s. .p.r.o.g.r.a.m.v.a.r.e. .o.g. .t.j.e.n.e.s.t.e.r. .(.".p.r.o.g.r.a.m.m.e.t.).,. .l.e.v.e.r.t. .a.v. .M.c.A.f.e.e.,. .e.t. .h.e.l.e.i.d. .d.a.t.t.e.r.s.e.l.s.k.a.p. .a.v. .I.n.t.e.r. .C.o.r.p.o.r.a.t.i.o.n... .D.e.t.t.e. .e.r. .e.n. .j.u.r.i.d.i.s.k. .a.v.t.a.l.e. .m.e.l.l.o.m. .o.s.s. .. .i.n.s.t.a.l.l.a.s.j.o.n. .e.l.l.e.r. .b.r.u.k. .a.v. .v...r. .p.r.o.g.r.a.m.v.a.r.e. .b.e.t.y.r. .a.t. .d.u. .g.o.d.t.a.r. .d.i.s.s.e. .v.i.l.k...r.e.n.e.,. .s... .l.e.s. .d.e.m. .n...y.e... .........D.e.n.n.e. .l.i.s.e.n.s.a.v.t.a.l.e.n. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".a.v.t.a.l.e.n.".). .d.e.k.k.e.r. .d.i.n. .r.e.t.t. .t.i.l. ... .b.e.n.y.t.t.e. .p.r.o.g.r.a.m.v.a.r.e.n.,. .b.e.g.r.e.n.s.n.i.n.g.e.r. .p... .d.e.n.n.e. .b.r.u.k.e.n.,. .v...r. .r.e.t.t. .t.i.l. .a.u.t.o.m.a.t.i.s.k. .f.o.r.n.y.e.l.s.e. .o.g. .t.a. .b.e.t.a.l.t. .f.o.r. .b.e.t.a.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-nl-NL.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2801), with CRLF line terminators
Category:	dropped
Size (bytes):	100578
Entropy (8bit):	3.442188256938267
Encrypted:	false
SSDEEP:	3072:OQ/9KbnOOfNlk/R5OVUR5Oh/RKe/HEUnOZVOsf6jzytJpjIzGeQRV22n3sT58jQ5:U
MD5:	FC3A3FFA0E15C963C5B3DA827AA071A7
SHA1:	5113286D53F488BCAB46D63A4FED520F4372B10D
SHA-256:	F7573E6027619EEAB9BD84EB1BBD01107F1689125922341F26C14152123FD3A4
SHA-512:	6B3CCBD8F7CCA459220DFF114180E1ED887507625E3616FDB0C0567012DE271A859567CF0DD230B84AA0F21696C4CB3AAE017BB52F3A246CDF7D4DE0AC895735
Malicious:	false
Reputation:	unknown
Preview:	..L.i.c.e.n.t.i.e.o.v.e.r.e.e.n.k.o.m.s.t. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........D.a.n.k. .u. .v.o.o.r. .h.e.t. .g.e.b.r.u.i.k. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y.-.s.o.f.t.w.a.r.e. .e.n. .-.d.i.e.n.s.t.e.n. .(.'.S.o.f.t.w.a.r.e.'.).,. .a.a.n.g.e.b.o.d.e.n. .d.o.o.r. .M.c.A.f.e.e.,. .e.e.n. .v.o.l.l.e.d.i.g.e. .d.o.c.h.t.e.r.o.n.d.e.r.n.e.m.i.n.g. .v.a.n. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .D.i.t. .i.s. .e.e.n. .j.u.r.i.d.i.s.c.h.e. .o.v.e.r.e.e.n.k.o.m.s.t. .t.u.s.s.e.n. .o.n.s... .D.o.o.r. .o.n.z.e. .S.o.f.t.w.a.r.e. .t.e. .i.n.s.t.a.l.l.e.r.e.n. .e.n. .t.e. .o.p.e.n.e.n.,. .g.e.e.f.t. .u. .a.a.n. .d.a.t. .u. .a.k.k.o.o.r.d. .g.a.a.t. .m.e.t. .d.e.z.e. .v.o.o.r.w.a.a.r.d.e.n... .L.e.e.s. .z.e. .d.u.s. .z.o.r.g.v.u.l.d.i.g... .........D.e.z.e. .L.i.c.e.n.t.i.e.o.v.e.r.e.e.n.k.o.m.s.t. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.'.O.v.e.r.e.e.n.k.o.m.s.t.'.). .b.e.s.c.h.r.i.j.f.t. .u.w. .r.e.c.h.t.e.n. .o.m. .d.e. .S.o.f.t.w.a.r.e. .t.e. .g.e.b.r.u.i.k.e.n.,. .d.e. .b.e.p.e.r.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-pl-PL.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2967), with CRLF line terminators
Category:	dropped
Size (bytes):	101850
Entropy (8bit):	3.7338612836897473
Encrypted:	false
SSDEEP:	1536:dnEmLzXswPaPfzO8liJQIKQ42HzLMH7scwS3/80GIrKQ+QE:ayXeQ
MD5:	A845A7917FAF964E30A60DEC1E217EDA
SHA1:	D2D1A6E56C8076F1CD53E30F989529B18E17B647
SHA-256:	B28EAE059A07E2123443A114230F397B5909EDBF3CCA70DA61078EE86B03605C
SHA-512:	A87840D34AE8E45034118008FA17397A07C02447A9986A481685F06CE547ECAEF404C4A8A1638520D2121C79332F72FA5E73C5F3C48BC4711C38DD9821F80FC2
Malicious:	false
Reputation:	unknown
Preview:	..U.m.o.w.a. .l.i.c.e.n.c.y.j.n.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........D.z.i...k.u.j.e.m.y. .z.a. .k.o.r.z.y.s.t.a.n.i.e. .z. .o.p.r.o.g.r.a.m.o.w.a.n.i.a. .i. .u.s.B.u.g. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.z.w.a.n.y.c.h. .d.a.l.e.j. .. O.p.r.o.g.r.a.m.o.w.a.n.i.e.m.. ). .o.f.e.r.o.w.a.n.y.c.h. .p.r.z.e.z. .M.c.A.f.e.e.,. .s.p...B.k... .z.a.l.e.\|.n...,. .k.t...r.e.j. .w.y.B...c.z.n.y.m. .w.B.a.[.c.i.c.i.e.l.e.m. .j.e.s.t. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .N.i.n.i.e.j.s.z.y. .d.o.k.u.m.e.n.t. .s.t.a.n.o.w.i. .u.m.o.w... .p.r.a.w.n... .m.i...d.z.y. .n.a.m.i. .a. .U.\|.y.t.k.o.w.n.i.k.i.e.m. .. .z.a.i.n.s.t.a.l.o.w.a.n.i.e. .n.a.s.z.e.g.o. .O.p.r.o.g.r.a.m.o.w.a.n.i.a. .l.u.b. .u.z.y.s.k.a.n.i.e. .d.o. .n.i.e.g.o. .d.o.s.t...p.u. .j.e.s.t. .r...w.n.o.z.n.a.c.z.n.e. .z. .z.a.a.k.c.e.p.t.o.w.a.n.i.e.m. .n.i.n.i.e.j.s.z.y.c.h. .w.a.r.u.n.k...w.,. .w. .z.w.i...z.k.u. .z. .c.z.y.m. .p.r.o.s.i.m.y. .o. .u.w.a.\|.n.e. .z.a.p.o.z.n.a.n.i.e. .s.i... .z. .t.r.e.[.c.i... .d.o.k.u.m.e.n.t.u... ...

C:\Program Files\McAfee\Temp3475153614\jslang\eula-pt-BR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2603), with CRLF line terminators
Category:	dropped
Size (bytes):	91306
Entropy (8bit):	3.465143388203298
Encrypted:	false
SSDEEP:	768:f8Wc1lp2b6cXQJ6rHcTCGXPF3zzhTOJpy0WlLyd5S+tKIbTw3ZurbNlar+wHmCYt:f7HceS+3bTrb/R6mdyqpn
MD5:	107FD20D8AE47521C2DCF1F005825221
SHA1:	FA351607321B95751351641A8D4C9FFDFF33C791
SHA-256:	CDB8BC4542BC489A36E57AB41A4659D6772E5E53E1CD935B698DE85E62734B67
SHA-512:	5BFB2CC991E311490640AAE70E007B12408BAA0620E1C722102817939E7A2FD263D9A4F974570F2763B95045A8465FED4163AE5E27826B6091BE5EA0EE58546F
Malicious:	false
Reputation:	unknown
Preview:	..C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........A.g.r.a.d.e.c.e.m.o.s. .p.o.r. .u.t.i.l.i.z.a.r. .o. .s.o.f.t.w.a.r.e. .e. .o.s. .s.e.r.v.i...o.s. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.w.a.r.e.".).,. .f.o.r.n.e.c.i.d.o. .p.e.l.a. .M.c.A.f.e.e.,. .u.m.a. .s.u.b.s.i.d.i...r.i.a. .i.n.t.e.g.r.a.l. .d.a. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. ... .u.m. .c.o.n.t.r.a.t.o. .l.e.g.a.l. .e.n.t.r.e. .n...s.:. .a.o. .i.n.s.t.a.l.a.r. .o.u. .a.c.e.s.s.a.r. .n.o.s.s.o. .S.o.f.t.w.a.r.e.,. .s.i.g.n.i.f.i.c.a. .a. .s.u.a. .c.o.n.c.o.r.d...n.c.i.a. .c.o.m. .e.s.t.e.s. .t.e.r.m.o.s.,. .d.e. .f.o.r.m.a. .q.u.e. .v.o.c... .d.e.v.e. .l...-.l.o.s. .c.o.m. .a. .m...x.i.m.a. .a.t.e.n.....o... .........E.s.t.e. .C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".C.o.n.t.r.a.t.o.".). .c.o.b.r.e. .s.e.u.s. .d.i.r.e.i.t.o.s. .d.e. .u.t.i.l.i.z.a.....o. .d.o. .S.o.f.t.w.a.r.e.,. .r.e.s.t.r.i.....e.s. .a. .e.s.s.e. .u.s.o.,. .o. .

C:\Program Files\McAfee\Temp3475153614\jslang\eula-pt-PT.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2536), with CRLF line terminators
Category:	dropped
Size (bytes):	96486
Entropy (8bit):	3.4740376449378534
Encrypted:	false
SSDEEP:	1536:GfDawY1TqufUqhbQGb0jiATGoeQmiBKTVIsFdN:2DetT
MD5:	8B69144F30459FA2C9013BD939EDF1EC
SHA1:	BE4E972789A84EAF288E4DB277F10B6C9D53C1A2
SHA-256:	2C26A802A1237FE53CF8E27A4B85AFEB18F0F478DC9234101004D8980F936F13
SHA-512:	F57A8CD3A76C69EB0FAAA51CF2B4D840FBD19F4557D70295264095D95A4C56303068FED2090A95E12F5DD5ADCA30BDDF3AC3254E636A592965FD685CCDB740AE
Malicious:	false
Reputation:	unknown
Preview:	..C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........O.b.r.i.g.a.d.o. .p.o.r. .u.t.i.l.i.z.a.r. .o. .s.o.f.t.w.a.r.e. .e. .o.s. .s.e.r.v.i...o.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ). .f.o.r.n.e.c.i.d.o.s. .p.e.l.a. .M.c.A.f.e.e.,. .u.m.a. .s.u.b.s.i.d.i...r.i.a. .t.o.t.a.l.m.e.n.t.e. .d.e.t.i.d.a. .p.e.l.a. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .d.o.c.u.m.e.n.t.o. .c.o.n.s.i.s.t.e. .n.u.m. .c.o.n.t.r.a.t.o. .l.e.g.a.l. .e.n.t.r.e. .a.m.b.a.s. .a.s. .p.a.r.t.e.s.. a.o. .i.n.s.t.a.l.a.r. .o.u. .a.o. .a.c.e.d.e.r. .a.o. .n.o.s.s.o. .S.o.f.t.w.a.r.e. .e.s.t... .a. .c.o.n.c.o.r.d.a.r. .c.o.m. .o.s. .p.r.e.s.e.n.t.e.s. .t.e.r.m.o.s.,. .p.o.r. .i.s.s.o.,. .l.e.i.a.-.o.s. .a.t.e.n.t.a.m.e.n.t.e... .........O. .p.r.e.s.e.n.t.e. .C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. C.o.n.t.r.a.t.o.. ). .i.n.c.l.u.i. .o.s. .s.e.u.s. .d.i.r.e.i.t.o.s. .d.e. .u.t.i.l.i.z.a.....o. .d.o. .S.o.f.t.w.a.r.e.,. .r.e.s.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-ru-RU.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2934), with CRLF line terminators
Category:	dropped
Size (bytes):	105274
Entropy (8bit):	3.9251282338166447
Encrypted:	false
SSDEEP:	768:Zrlkl/OV57V/gTNKukdeCNCaM2sJCX7Zh7Ft7yvFsknxFFNZ6AJTaFkke2bnMBqZ:JfRpOEZhc8LSQ0PnmEY
MD5:	C6D01D39C252AF92DC219430A3D95BBE
SHA1:	3836792C1DBACD45BF90BE886F05B4EAC6895FC3
SHA-256:	BA1EC14255D71CC9DD6FCCC15D709F185DAE8C0950602DBA8F17EFC76AC78E12
SHA-512:	CF7EC0D821390837D0F9B18985FD4E2FD3DF7793F51DE4111DCB23EBC433753835127FBF3237A6DE1A1770EFF3B5410295FA3B9DCBDAC480BBC5C1749201907F
Malicious:	false
Reputation:	unknown
Preview:	....8.F.5.=.7.8.>.=.=.>.5. .A.>.3.;.0.H.5.=.8.5. .4.;.O. .?.@.>.3.@.0.<.<.=.>.3.>. .>.1.5.A.?.5.G.5.=.8.O. .I.n.t.e.l. .S.e.c.u.r.i.t.y...........;.0.3.>.4.0.@.8.<. ...0.A. .7.0. .8.A.?.>.;.L.7.>.2.0.=.8.5. .?.@.>.3.@.0.<.<.=.>.3.>. .>.1.5.A.?.5.G.5.=.8.O. .8. .A.;.C.6.1. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(."...@.>.3.@.0.<.<.=.>.5. .>.1.5.A.?.5.G.5.=.8.5.".).,. .?.@.5.4.>.A.B.0.2.;.O.5.<.K.E. .:.>.<.?.0.=.8.5.9. .M.c.A.f.e.e. .. .4.>.G.5.@.=.5.9. .:.>.<.?.0.=.8.5.9.,. .=.0.E.>.4.O.I.5.9.A.O. .2. .?.>.;.=.>.9. .A.>.1.A.B.2.5.=.=.>.A.B.8. .:.>.@.?.>.@.0.F.8.8. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... ...0.=.=.K.9. .4.>.:.C.<.5.=.B. .?.@.5.4.A.B.0.2.;.O.5.B. .N.@.8.4.8.G.5.A.:.>.5. .A.>.3.;.0.H.5.=.8.5. .<.5.6.4.C. .=.0.<.8... .#.A.B.0.=.>.2.:.0. .8.;.8. .4.>.A.B.C.?. .:. .=.0.H.5.<.C. ...@.>.3.@.0.<.<.=.>.<.C. .>.1.5.A.?.5.G.5.=.8.N. .>.1.>.7.=.0.G.0.N.B. ...0.H.5. .A.>.3.;.0.A.8.5. .A. .C.A.;.>.2.8.O.<.8. .M.B.>.3.>. .A.>.3.;.0.H.5.=.8.O.,. .?.>.M.B.>.<.C. .2.=.8.<.0.B.5.;.L.=.>. .>.7.=.0.:.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-sk-SK.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2701), with CRLF line terminators
Category:	dropped
Size (bytes):	89572
Entropy (8bit):	3.734010092620597
Encrypted:	false
SSDEEP:	1536:plH9miYwq9hpeKK283X97rpcvXctx1qDQDupSMeylm5Wq0FGQueLS9FpSzvFgxSG:pPfqU7AcD1/DmDqOrS9FpkXvaGOtdZ
MD5:	99613E0D33F2FBD4B8BDAF4AAA3114BA
SHA1:	EB3CEB8C86E9CB1D8EB96AA102430D9C4764AF44
SHA-256:	13FFE33FCFB7BFEFDD2BDBAB10B1912C38E26B912D088B134568FA38B8667432
SHA-512:	147476729468D9B895DFEAEAEE4FCC3C5AE00C6743279BC5EA508D6F1D935B19FAD19831BC818AFDBCB3816F326E600FA2FA87DF5F264DB811189B06326A7995
Malicious:	false
Reputation:	unknown
Preview:	..L.i.c.e.n...n... .z.m.l.u.v.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y...........a.k.u.j.e.m.e. .v...m. .z.a. .p.o.u.~...v.a.n.i.e. .s.o.f.t.v...r.u. .a. .s.l.u.~.i.e.b. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.v...r.. ).,. .p.o.s.k.y.t.o.v.a.n...c.h. .s.p.o.l.o...n.o.s.e.o.u. .M.c.A.f.e.e.,. .k.t.o.r... .j.e. .d.c...r.s.k.o.u. .s.p.o.l.o...n.o.s.e.o.u. ...p.l.n.e. .v.l.a.s.t.n.e.n.o.u. .s.p.o.l.o...n.o.s.e.o.u. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .T.o.t.o. .j.e. .p.r...v.n.a. .z.m.l.u.v.a. .m.e.d.z.i. .n.a.m.i. .. .i.n.a.t.a.l...c.i.o.u. .a.l.e.b.o. .p.r...s.t.u.p.o.v.a.n...m. .k. .n...a.m.u. .S.o.f.t.v...r.u. .s...h.l.a.s...t.e. .s. .t...m.i.t.o. .p.o.d.m.i.e.n.k.a.m.i.,. .t.a.k.~.e. .s.i. .i.c.h.,. .p.r.o.s...m.,. .p.o.z.o.r.n.e. .p.r.e.....t.a.j.t.e... .........T...t.o. .L.i.c.e.n...n... .z.m.l.u.v.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(...a.l.e.j. .l.e.n. .. Z.m.l.u.v.a.. ). .s.a. .v.z.e.a.h.u.j.e. .n.a. .v.a.a.e. .p.r...v.a. .n.a. .p.o.u.~...v.a.n.i.e. .S.o.f.t.v...r.u.,. .o.b.m.e.d.z.e.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-sr-Latn-CS.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2634), with CRLF line terminators
Category:	dropped
Size (bytes):	88356
Entropy (8bit):	3.577381104662905
Encrypted:	false
SSDEEP:	1536:1PXzqxuAlAEnb93roW/JxeTYZ9/sn7/87/FXoQEHVX/Z0S/j+r:dWVkTmR1z
MD5:	E661E2D55D72790EDA534B1221786646
SHA1:	E867F0D1D683AB0F95166D79CAD3356DE50DFA61
SHA-256:	25DF842F87773BD1B3CA62081368723DC7489056AB322A2C00C9F86BB8B712A7
SHA-512:	80329098878CE56540CB9B5C32EBDC652ECB92F0F09C2D70F56FC1292F2C0BCE869FC5F00C9C540D2912E569BA8B2FE088724484CC99E247F34B60909C271A33
Malicious:	false
Reputation:	unknown
Preview:	..U.g.o.v.o.r. .o. .l.i.c.e.n.c.i.r.a.n.j.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........H.v.a.l.a. .v.a.m. .a.t.o. .k.o.r.i.s.t.i.t.e. .s.o.f.t.v.e.r. .i. .u.s.l.u.g.e. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.v.e.r.. ).,. .k.o.j.i. .o.b.e.z.b.e...u.j.e. .k.o.m.p.a.n.i.j.a. .M.c.A.f.e.e.,. .p.o.d.r.u.~.n.i.c.a. .u. .p.o.t.p.u.n.o.m. .v.l.a.s.n.i.a.t.v.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .O.v.o. .j.e. .p.r.a.v.n.i. .u.g.o.v.o.r. .i.z.m.e...u. .n.a.s. .. .i.n.s.t.a.l.i.r.a.n.j.e. .n.a.a.e.g. .S.o.f.t.v.e.r.a. .i.l.i. .p.r.i.s.t.u.p.a.n.j.e. .n.j.e.m.u. .z.n.a...i. .d.a. .p.r.i.h.v.a.t.a.t.e. .o.v.e. .u.s.l.o.v.e.,. .p.a. .i.h. .s.t.o.g.a. .p.a.~.l.j.i.v.o. .p.r.o...i.t.a.j.t.e... .........O.v.a.j. .U.g.o.v.o.r. .o. .l.i.c.e.n.c.i.r.a.n.j.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. U.g.o.v.o.r.. ). .p.o.k.r.i.v.a. .v.a.a.a. .p.r.a.v.a. .d.a. .k.o.r.i.s.t.i.t.e. .S.o.f.t.v.e.r.,. .o.g.r.a.n.i...e.n.j.a. .t.o.g. .k.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-sv-SE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2632), with CRLF line terminators
Category:	dropped
Size (bytes):	89704
Entropy (8bit):	3.503741042960555
Encrypted:	false
SSDEEP:	768:dcFeHhjwanoMWVOjxKI+psB/YgpnuIbVGmJVJ:WFCwKWsQgpB
MD5:	886136D39A6F98C692DFDAA121E4C584
SHA1:	57F7421A863C6035F67396D7D51166E5348ABCBE
SHA-256:	7ABE26D94557839A373B33C7C75AC2CDD9BF8E86CE4E38069BD54B54F084C064
SHA-512:	50B27989CD64448ED69F666A760D4BA92AA082F8B87D6D5F27A9A12A805075FC72AA9BBA1E75CDFBB61752E5BE2E89C50975123796D0BBE25938FF9A5687D7D7
Malicious:	false
Reputation:	unknown
Preview:	..L.i.c.e.n.s.a.v.t.a.l. .f...r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.c.k. .f...r. .a.t.t. .d.u. .a.n.v...n.d.e.r. .p.r.o.g.r.a.m.v.a.r.a.n. .o.c.h. .t.j...n.s.t.e.r.n.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. P.r.o.g.r.a.m.v.a.r.a.n.. ). .f.r...n. .M.c.A.f.e.e.,. .e.t.t. .h.e.l...g.t. .d.o.t.t.e.r.b.o.l.a.g. .t.i.l.l. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .N...r. .d.u. .i.n.s.t.a.l.l.e.r.a.r. .e.l.l.e.r. .a.n.v...n.d.e.r. .P.r.o.g.r.a.m.v.a.r.a.n. .g.o.d.k...n.n.e.r. .d.u. .a.u.t.o.m.a.t.i.s.k.t. .v.i.l.l.k.o.r.e.n.,. .s... .l...s. .n.o.g.a. .i.g.e.n.o.m. .d.e.m. .f...r.s.t... .D.e.t.t.a. ...r. .e.t.t. .b.i.n.d.a.n.d.e. .j.u.r.i.d.i.s.k.t. .a.v.t.a.l. .o.s.s. .e.m.e.l.l.a.n... .........D.e.t.t.a. .L.i.c.e.n.s.a.v.t.a.l. .f...r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. A.v.t.a.l.e.t.. ). .r.e.g.l.e.r.a.r. .d.i.n.a. .r...t.t.i.g.h.e.t.e.r. .i. .s.a.m.b.a.n.d. .m.e.d. .a.n.v...n.d.n.i.n.g. .a.v. .P.r.o.g.r.a.m.v.a.r.a.n.,. .e.v.e.n.t.u.e.l.l.a. .b.e.g.r...n.s.n.i.n.g.a.r. .i. .a.n.v...n.d.n.i.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-tr-TR.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (2527), with CRLF line terminators
Category:	dropped
Size (bytes):	89572
Entropy (8bit):	3.7627210068202963
Encrypted:	false
SSDEEP:	1536:U4WLetFwU8STnnWH0I9fkl7+JaRtbJHGdnC2vJfPI9n9AkllkhZBYziG/xJd8oSq:UjLetFwbSTnnWH0IdkN+JaRt0dnC2xIj
MD5:	2217F74E9F003671ADBAC8D055A3F1F6
SHA1:	499507CE8750430BFD25A4C0E381BA3ECBF96C1E
SHA-256:	0E0456C078979F26655ABAF50CD574F419A7D90C2EEC543C998850FA67C7D6D5
SHA-512:	E643605997587CD9D70FD9973BEBC8FEF19DAF5D0FBBE7A4A6CE2EC57AC01D12DD618471B918F26561E7BFBF69FD886620B8A94A65B3EF0D1078C0BEA49F4ED1
Malicious:	false
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.s.a.n.s. .S...z.l.e._.m.e.s.i.........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.. 1.n. .y...z.d.e. .y...z. .i._.t.i.r.a.k.i. .o.l.a.n. .M.c.A.f.e.e. .t.a.r.a.f.1.n.d.a.n. .s.a...l.a.n.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .y.a.z.1.l.1.m.1. .v.e. .h.i.z.m.e.t.l.e.r.i.n.i. .(.. Y.a.z.1.l.1.m.. ). .k.u.l.l.a.n.d.1...1.n.1.z. .i...i.n. .t.e._.e.k.k...r. .e.d.e.r.i.z... .Y.a.z.1.l.1.m.1.m.1.z.1.n. .k.u.r.m.a.n.1.z. .v.e.y.a. .Y.a.z.1.l.1.m.1.m.1.z.a. .e.r.i._.i.m. .s.a...l.a.m.a.n.1.z. .a.r.a.m.1.z.d.a.k.i. .b.u. .y.a.s.a.l. .s...z.l.e._.m.e.n.i.n. .i.l.g.i.l.i. .h...k...m.l.e.r.i.n.i. .k.a.b.u.l. .e.t.t.i...i.n.i.z. .a.n.l.a.m.1.n.a. .g.e.l.e.c.e...i.n.d.e.n.,. .l...t.f.e.n. .b.u.n.l.a.r.1. .d.i.k.k.a.t.l.i.c.e. .o.k.u.y.u.n... .........0._.b.u. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.s.a.n.s. .S...z.l.e._.m.e.s.i. .(.. S...z.l.e._.m.e.. ). .Y.a.z.1.l.1.m.1.n. .k.u.l.l.a.n.1.l.m.a.s.1.n.a. .i.l.i._.k.i.n. .h.a.k.l.a.r.1.n.1.z.1.,. .s...z. .k.o.n.u.s.u. .k.u.l.l.a.n.1.m.

C:\Program Files\McAfee\Temp3475153614\jslang\eula-zh-CN.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (873), with CRLF line terminators
Category:	dropped
Size (bytes):	27048
Entropy (8bit):	6.793562820451332
Encrypted:	false
SSDEEP:	384:dGlhiqpYn3S6kZ5pZsM1SDo9P0VSpjzjW+EpgLDR5CCaGdYZ:dWDuIVZsM19DjzjW+EpgLN5qvZ
MD5:	539DA3E7EFA61CA003036C47AE564299
SHA1:	A98283530200B44530B6E4B1C0308EF591A69EBF
SHA-256:	CB5F9B4A083F41817BC4E1A211DE842DA0FEBB0EA8BB1610873F67602F3B0886
SHA-512:	C4FB6DC6F0A206DC838211A5D603B68B1B52FB8B064BCA9757D279A2E622710390246C5B86D1DE0523855F77D7C9BDD378C16A2DC79F5CAD87554933D22A3C5A
Malicious:	false
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. ....SOS...........a"..`.O(u1u .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. ..vhQD.P[lQ.S .M.c.A.f.e.e. ..c.O.v .I.n.t.e.l. .S.e.c.u.r.i.t.y. .o..N.T.g.R... o..N. ...0 ../f.`.N.b.NKN...v.l._OS.....[..b....b.N.v. o..N. ..sSh.:y.`.T.a..Nag>k...Vdk...N.~.....0 .........,g .I.n.t.e.l. .S.e.c.u.r.i.t.y. ....SOS..... OS... ...m.v.`.O(u. o..N. .vCg)R.0.O(uP.6R.0.b.N.R.~..v^1\. o..N. .v.N9.Hr,g.b.R...T.`6e9..vCg)R...N.S.`.T.a....N...Q.b.NKN...S...N.u.v.NUO.N...0 .,gOS...S+T.b.N.v...y.X.fI{D..Rag>k.v...c .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.c.h.i.n.e.s.e.-.s.i.m.p.l.i.f.i.e.d./.i.n.d.e.x...h.t.m.).....Nag>k._.....v^qQ.T.g.b..(u.N.`.v,g.l._OS...0 ..V.[/.0W:Syr.[.vag>kMO.NOS...v.g.T.Nag.0 ..........Y.g.`g.n .1.8. ..\...l.g.`.v6r.k.b.v.b.N...N.N._{.HQ.c.S,gOS..v^.Nh..`.{.t. o..N. ...v.T.a...`.N._.O(u. o..N. .b.T.b.N.c.O.`.vN.N.Oo`.0 .........1......c.S,gOS...T.O9e .. .US.Q. .c.S. .c...b.[.. o..N. ..sSh.:y.`.eag.N.T.a.S,g

C:\Program Files\McAfee\Temp3475153614\jslang\eula-zh-TW.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (904), with CRLF line terminators
Category:	dropped
Size (bytes):	27300
Entropy (8bit):	6.852662061965087
Encrypted:	false
SSDEEP:	768:RLcNdFNy9pQbexWBTeP5s8FmxoFfEgQSPsxFHMOKQZgTmLL/ytmq/u:Rcf6w3BKx/hagQSPsxtKjTmr
MD5:	68A5B67741DE8DEED325B78080114401
SHA1:	9492DE10E97CF26D410C5EF294AE675A1FC46A31
SHA-256:	7DFC20D3C1FEAA6E7B2E1A46C9A9724592C9095D29C552194DFCB47333C7BA6F
SHA-512:	1004215B3A5CB46B411745ECC5550F9C323187D09EBCD6109FBDF6725E02F3E4C70DC56640C52174FB8488FEF646C246D0BC1E143BCDF94593C75A27929D2CDA
Malicious:	false
Reputation:	unknown
Preview:	..I.n.t.e.l. .S.e.c.u.r.i.t.y. ..c.k.T.}.........a...`.O(u1u .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .hs.P[lQ.S .M.c.A.f.e.e. ..c.O.v .I.n.t.e.l. .S.e.c.u.r.i.t.y. ......g.R...0...0...0 .../f.`...b.PKN...v.l._.T.} .. ..[..bX[.S.b.P.v.0...0..sSh.:y.`.T.a...N.h>k...Vdk..N0}.....0 .........,g .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..c.k.T.}...0.T.}.0...m..`.O(u.0...0.v.k)R.0.O(uP.6R.0.b.P..R.~..&N1\.0...0.v.N..Hr,g.b.R...T.`6e...v.k)R...N.S.`.T.a..N..N...zl.b.PKN...S.."u.u.v.NUO-rp..0 ..b.P.].S.b.b.P.v...y.kr..fI{D..R.h>k.v#.P} .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.c.h.i.n.e.s.e.-.t.r.a.d.i.t.i.o.n.a.l./.i.n.d.e.x...h.t.m.)......N.h>k._.....&NqQ.T.i.bi.(u.e.`.v,g.l._.T.}.0 ..W.[/.0W@Syr.[.v.h>kMO.e.T.}.v.g._.N.h.0 ..........Y.g.`*g.n .1.8. .rk...l.g.`.v6r.k.b.vw..N...N.P._..HQ.c.S,g.T.}&N.Nh..`.{.t.0...0...v.T.a...`.N..AQ1..O(u.0...0.b.T.b.P.c.O.`.v.P.N....0 .........1......c.S,g.T.}.T.O9e .. ..c.N.0.c.S.0.c...b.[..0...0..sSh.:y.`!q.h

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-cs-CZ.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2553
Entropy (8bit):	5.583055926564366
Encrypted:	false
SSDEEP:	48:3HNBDTz+QdnA/jlE7Nijs371IguQgUlKKGgDlpfkPlC0RbglexOX0wJUGl3nuEIL:3th+y0+7Nks3pIg3lKelpfUlC0lglOOE
MD5:	6F83220FFBC9D63142D4BD9110251A12
SHA1:	86B092B384CFF8FEB359D3280605CE948FAC551F
SHA-256:	B7C6FF5D419680C94636E4ECE120773D7A686BD85F6C1E34047DAC7B082DCEFF
SHA-512:	6677ECFDEBB15C24746405CB4F3CD4FCB3D2384CB8EE36BDE8B8F21FA778AABB9113513E887FAC5D3F015CB3A8BA7D8DC8E8649F1DFBB6C7062FD00A111510DE
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licen.n. smlouva",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "P.e.etl(a) jsem si licen.n. smlouvu a souhlas.m s n..",.. //{0} - Company name.. THANK_YOU: "D.kujeme, .e jste si vybrali aplikaci {0}.",.. INSTALL: "Nainstalovat",.. CANCEL: "Zru.it",.. RETRY: "Zkusit znovu",.. //{0} - Product name.. PROGRESS_TITLE: "Aplikace {0} poskytuje rady ohledn. va.. bezpe.nosti kdekoli na internetu.",.. PROGRESS_SUBTITLE: "Prob.h. instalace...",.. COMPLETE_TITLE: "V.born.! Aplikace byla nainstalov.na a bude v.m poskytovat rady ohledn. bezpe.nosti na internetu.",.. COMPLETE_SUBTITLE: "V.e je p.ipraveno.",.. COMPLETE_LAUNCH: "Otev..t prohl..e.",.. ERROR_OS_REQUIREMENTS: "V instalaci nelze pokra.ovat, proto.e opera.n. syst.m nespl.uje minim.ln. po.adavky na syst.m. Aktualizujte ho a zkuste to znovu.",.. ERROR_BROWSER_REQUIREMENTS: "V instalaci nelze pokra.ovat, proto.e prohl..

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-da-DK.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2347
Entropy (8bit):	5.344633797507811
Encrypted:	false
SSDEEP:	48:37b55gOog4oPO9iEY+0f0t9IcvuZ1Mv9gfdmBnoaljshJdoJ+vOZZOsOhRss1oza:37jG4f0vI6y1K9gf4lszQ/sfKzMVsLCV
MD5:	5D07DB299A2147852EF5D0AEB0C4D4EB
SHA1:	AB661CBB76C33B6D7D2696B2F500645872FB75BD
SHA-256:	945E06BC7ECB665E16CBD613025AEA13A0F03CBB3EB97C6928822E53666811BA
SHA-512:	43CFEDC839AD7F439597E758AF709810715EC8DBDA7607007D1E6F56CF4189F57DF36ACA608BD85626605C02306BB2889C46E47436D03BEBCC66DE631185B64D
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licensaftale",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jeg har l.st og er indforst.et med licensaftalen",.. //{0} - Company name.. THANK_YOU: "Tak, fordi du valgte {0}",.. INSTALL: "Installer",.. CANCEL: "Annuller",.. RETRY: "Pr.v igen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} er din personlige sikkerhedsr.dgiver, uanset hvor du f.rdes p. nettet.",.. PROGRESS_SUBTITLE: "Installerer ...",.. COMPLETE_TITLE: "Fint. Vi har installeret din personlige onliner.dgiver.",.. COMPLETE_SUBTITLE: "Klar til start",.. COMPLETE_LAUNCH: ".bn browseren",.. ERROR_OS_REQUIREMENTS: "Installationen kan ikke forts.tte, da operativsystemet ikke lever op til minimumssystemkravene. Opdater, og pr.v igen.",.. ERROR_BROWSER_REQUIREMENTS: "Installationen kan ikke forts.tte, da browseren ikke lever op til minimumssystemkravene. Opdater browseren, og pr.v igen.",.. ERROR_VERSION: "Der er allerede installeret e

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-de-DE.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	5.255067116698152
Encrypted:	false
SSDEEP:	48:3BYBnLb7UozPrEqx8LL+79IAbBblfBWE6ToivxPEbgHIhygeCovzxkI+o5EREXVI:3BwbkLv+5Ik5lfgq8xAgj/Jvzyi2mCIu
MD5:	2F213E1F2FF65EC970B9953D8B44C8BA
SHA1:	7E6D1ADF1DD77F86250750007AD0835DD0694910
SHA-256:	646DD95542B2AA664E9F6CFF966EA9B2E7189B0C287DFA39DE2CB6B7E92449B8
SHA-512:	FA6FA2163F708877FBB8BB18D711B17139219D2A223B7CA1ADE42993E7E45586A9AB73C8D939F0969840D4D7E773AC058DD5F1C3B571ECDAE9D7646601B3F24B
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Lizenzvertrag",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ich habe den Lizenzvertrag gelesen und stimme ihm zu",.. //{0} - Company name.. THANK_YOU: "Vielen Dank f.r Ihren Download von {0}",.. INSTALL: "Installieren",.. CANCEL: "Abbrechen",.. RETRY: "Erneut versuchen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ist Ihr pers.nlicher Sicherheitsberater f.r das Internet.",.. PROGRESS_SUBTITLE: "Installation l.uft...",.. COMPLETE_TITLE: "Sehr gut. Ihr pers.nlicher Online-Berater wurde installiert.",.. COMPLETE_SUBTITLE: "Fertig",.. COMPLETE_LAUNCH: "Browser .ffnen",.. ERROR_OS_REQUIREMENTS: "Ihre Installation kann nicht fortgesetzt werden, da Ihr Betriebssystem nicht den Mindestsystemanforderungen entspricht. Aktualisieren Sie es, und versuchen Sie es erneut.",.. ERROR_BROWSER_REQUIREMENTS: "Ihre Installation kann nicht fortgesetzt werden, da Ihr Browser nicht den Mindestsystemanforderungen entspr

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-el-GR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3909
Entropy (8bit):	4.955336413520008
Encrypted:	false
SSDEEP:	96:3x8Ii5SdfTMcIa1KgRfSVl7C8mrs/0wzEjMBGrmvw:3V3dfTMcv1Kg5Wluc0wzMy2mY
MD5:	B11257A4695A3CDE837F02F36DB2AB12
SHA1:	B45A91D7DCE91B8E0BC18AD5AA29816B3ECC5C39
SHA-256:	7D7FCE54A0C4E288EDDADA6A0481D7049732853B514B9773C0C3BAD068A7138D
SHA-512:	91EDF85039FA6B4DE88FDE22DABA80470253B6B70B9693A2153C1C4FC04FCA467AF172F6D20F6FDBEC982FE3F82B255AA575435AC29CF02D6A0823A5FE7EB75B
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "........ ...... ......",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "....... ... .......... .. ........ ...... ......",.. //{0} - Company name.. THANK_YOU: "............ ... ......... .. {0}",.. INSTALL: "...........",.. CANCEL: ".......",.. RETRY: ".........",.. //{0} - Product name.. PROGRESS_TITLE: ".. {0} ..... . .......... ... ......... ......... ... ........... ......... ............ ... Internet.",.. PROGRESS_SUBTITLE: "..............",.. COMPLETE_TITLE: "......! ............. ... ......... ... ........ ... Internet.",.. COMPLETE_SUBTITLE: "..... .......",.. COMPLETE_LAUNCH: "....... ............ ..........",.. ERROR

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-en-US.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.282420457573034
Encrypted:	false
SSDEEP:	48:3TmE5KPHEAvhhIDX6uSBf15aN+conkQt5SfEZhozWZIMJJZh49yoT:33pAphIzqfE+c63ZhozqxJZhSVT
MD5:	E2188608C300715200C838E410D69AAE
SHA1:	F4230BB335900EF838664B35DFCD3DAA4B75C165
SHA-256:	22E43A37509854E0FEBAC146BA3B3D56C5B0B373974D16358455E77648175358
SHA-512:	70D86284D22352E318E59A482F29EF660F89AB23AB9AFF7ED5F87073FCA0316DD4960CE84675F1EF37B8A9034EC35767D3C0C2B042F7DBDDB0ACBE720BFD2471
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "License Agreement",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "I have read and agree to the License Agreement",.. //{0} - Company name.. THANK_YOU: "Thank you for choosing {0}",.. INSTALL: "Install",.. CANCEL: "Cancel",.. RETRY: "Try Again",.. //{0} - Product name.. PROGRESS_TITLE: "{0} is your personal safety advisor wherever you go online.",.. PROGRESS_SUBTITLE: "Installing...",.. COMPLETE_TITLE: "Great! We've installed your personal online advisor.",.. COMPLETE_SUBTITLE: "Ready to go",.. COMPLETE_LAUNCH: "Open my browser",.. ERROR_OS_REQUIREMENTS: "Your installation cannot continue because your operating system does not meet the minimum system requirements. Please update it and try again.",.. ERROR_BROWSER_REQUIREMENTS: "Your installation cannot continue because your browser does not meet our minimum system requirements. Please update your browser and try again.",.. ERROR_VERSION: "You already hav

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-es-ES.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2408
Entropy (8bit):	5.232833728602373
Encrypted:	false
SSDEEP:	48:3Cx17WnI7bV3mE7NISJvjOfQ2e5loiPLtjCE6zs/vmzuIoJoPl3YQ:3CxB1F337NISUfa5loiRv6AnmzuLJoPh
MD5:	63EC908BE10096D6B4163739654FC81C
SHA1:	4FC4AE68319E02813CF73B2A0A4359603A6C03AD
SHA-256:	DE4897FD40222A53E006CB4FA7AD75A0F779959A5D2CC1BEC321578C0A6030C8
SHA-512:	3BB1571CEE474D6B1B428D29878617448329D88B6FB2AFC09EB41E36775824368B13DE9AE761E155ADFD6E55B0ECEFBCB7D043B9F409B670F5855556B137D7B4
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Acuerdo de licencia",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "He le.do y acepto el Acuerdo de licencia",.. //{0} - Company name.. THANK_YOU: "Gracias por haber elegido {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Vuelva a intentarlo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} es su asesor de seguridad personal para la navegaci.n online.",.. PROGRESS_SUBTITLE: "Instalando...",.. COMPLETE_TITLE: ".Genial! Hemos instalado su asesor online personal.",.. COMPLETE_SUBTITLE: "Listo para empezar",.. COMPLETE_LAUNCH: "Abrir mi navegador",.. ERROR_OS_REQUIREMENTS: "La instalaci.n no puede continuar porque el sistema operativo no cumple los requisitos m.nimos necesarios del sistema. Actual.celo y vuelva a intentarlo.",.. ERROR_BROWSER_REQUIREMENTS: "La instalaci.n no puede continuar porque el navegador no cumple los requisitos m.nimos necesarios del sistema. Actualice el navegador y

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-es-MX.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2426
Entropy (8bit):	5.235616829312733
Encrypted:	false
SSDEEP:	48:3Cx17JnI7bVAEc+JJNISJvjOfQ2e5loiPLtjCE6aH/vmzuIoJoPl3i1:3CxBOFNc2JNISUfa5loiRv6aHnmzuLJL
MD5:	069048394A9EF2CB96024F4ECD52C795
SHA1:	5C1478B5987581EF31B499007EDCC3B28D23AD51
SHA-256:	89C2C97970F95C7249D7BE979DAF3C8E6D589074C6953228186BEF9B31742C25
SHA-512:	54B56F20316085AF02D72AFB79AF4D99CE9B08D07B7EF71E0E5EE91C713E56C260988B6A6B81A8ACB7182FEEC8B113DB309BE476BC5E8C980BEB3DB3F008F5FD
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Acuerdo de licencia",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "He le.do y acepto el Acuerdo de licencia",.. //{0} - Company name.. THANK_YOU: "Gracias por elegir {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Vuelva a intentarlo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} es su asesor de seguridad personal para la navegaci.n en l.nea.",.. PROGRESS_SUBTITLE: "Instalando.",.. COMPLETE_TITLE: ".Excelente! Hemos instalado su asesor de seguridad personal en l.nea.",.. COMPLETE_SUBTITLE: "Listo para empezar",.. COMPLETE_LAUNCH: "Abrir mi navegador",.. ERROR_OS_REQUIREMENTS: "La instalaci.n no puede continuar porque el sistema operativo no cumple los requisitos m.nimos necesarios del sistema. Actual.celo y vuelva a intentarlo.",.. ERROR_BROWSER_REQUIREMENTS: "La instalaci.n no puede continuar porque el navegador no cumple los requisitos m.nimos necesarios del sistema. Actualice

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-fi-FI.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	5.3280391518879195
Encrypted:	false
SSDEEP:	48:346H/PfLPVPEajg9IYxDT8i2LKxp8iElfSAnTi7D3/btDM57L6Tsq3sGozCAJIvs:3txsGUIYxHvxZIfLnT03DC5vlqc1zC6v
MD5:	1AE7940A53088FBE99A5ACF5F4617405
SHA1:	E94FC684F8736AEF6E2543006CE9CCB84C1CDC8D
SHA-256:	6328BCF9C96860957FC000C03EDB88722D4E9A41726AC20D6CF41D75FDC54818
SHA-512:	9ED2319C60D2C84272E73C4E1F5A633644AD2F8F55C074BDDF83702C1F015354AD1E76EAB461B1F29FD1EE41CE02485D9C13848EA4A963BE1ECD06EDC4A3DC02
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "K.ytt.oikeussopimus",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Olen lukenut k.ytt.oikeussopimuksen ja hyv.ksyn sen.",.. //{0} - Company name.. THANK_YOU: "Kiitos, ett. valintasi on {0}",.. INSTALL: "Asenna",.. CANCEL: "Peruuta",.. RETRY: "Yrit. uudelleen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} on henkil.kohtainen turvallisuusavustajasi, kun k.yt.t verkkoa.",.. PROGRESS_SUBTITLE: "Asennetaan.",.. COMPLETE_TITLE: "Hienoa! Henkil.kohtainen verkkoavustajasi on asennettu.",.. COMPLETE_SUBTITLE: "Valmis k.ytett.v.ksi",.. COMPLETE_LAUNCH: "K.ynnist. selain",.. ERROR_OS_REQUIREMENTS: "Asennusta ei voi jatkaa, koska k.ytt.j.rjestelm.si ei t.yt. j.rjestelm.n v.himm.isvaatimuksia. P.ivit. k.ytt.j.rjestelm. ja yrit. uudelleen.",.. ERROR_BROWSER_REQUIREMENTS: "Asennusta ei voi jatkaa, koska selaimesi ei t.yt. j.rjestelm.n v.himm.isvaatimuksia. P.ivit. selain ja yr

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-fr-CA.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2783
Entropy (8bit):	5.253204023782801
Encrypted:	false
SSDEEP:	48:3XYTQm7+XFcEqEmfX8IEKOIgkPgPjynfHzz8zq5n3k+HGjKm9bQErQz4YxkLzEtY:3XFVZxmfX8IX/gwfHz4zotKtrgxwzUh4
MD5:	220A48E6F9F418AB8B528CABB0461E66
SHA1:	B49F326867FB76142A17D2840383BE33283572EE
SHA-256:	B82B37DB0CD44F66E8E17CB60DCD94848E23475923348270F7FFFABF2A47B5E6
SHA-512:	45AF7E0373DA6E38D4BD859E35C87CCB71A996C6D8131994AAE84B9BF93C8175B2B224EDCC85CC5D1F06F2ACADD3E3DE815454A3287FBC104426960B81E623B0
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Contrat de licence",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "J'ai lu et approuv. le contrat de licence",.. //{0} - Company name.. THANK_YOU: "Merci d'avoir choisi {0}",.. INSTALL: "Installation",.. CANCEL: "Annuler",.. RETRY: "R.essayez",.. //{0} - Product name.. PROGRESS_TITLE: "{0} est votre conseiller personnel en mati.re de s.curit. lorsque vous naviguez en ligne.",.. PROGRESS_SUBTITLE: "Installation...",.. COMPLETE_TITLE: "Tr.s bien! Nous avons install. votre conseiller personnel en mati.re de s.curit. en ligne.",.. COMPLETE_SUBTITLE: "Pr.t au lancement",.. COMPLETE_LAUNCH: "Ouvrir mon navigateur",.. ERROR_OS_REQUIREMENTS: "Il est impossible de poursuivre l'installation, car votre syst.me d'exploitation ne satisfait pas . la configuration minimale requise. Veuillez le mettre . jour et essayer de nouveau.",.. ERROR_BROWSER_REQUIREMENTS: "Il est impossible de poursuivre l'installatio

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-fr-FR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	5.283376487823955
Encrypted:	false
SSDEEP:	48:3skZTOo+8CFRhEq5wkQ8I5yb7npX3uyb6FpYE3Kfjvz75B8g5DVdNABqbkyETa4S:3skOdRqM/Q8I5W7duW64sKfjvz1mmzX/
MD5:	829C6A307C5A90F19267948145E0438B
SHA1:	39FD683D27299ED6E4DC97EA9533FD6461D6DA71
SHA-256:	5C2CD2C485B07F2F36FB8ECD9C0080851212009D2F18DAC3C95E645B58C58CE3
SHA-512:	BFC7C3FB9C936947BB5EBFD5D7D77C1829508A4F6D577AED1AD1FA77D445EDA2D786C6511C3262565047F5905FF97DAFC52991E44D9F37031199F37A666A3352
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Accord de licence",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "J'ai lu et j'accepte l'accord de licence",.. //{0} - Company name.. THANK_YOU: "Merci d'avoir choisi {0}",.. INSTALL: "Installer",.. CANCEL: "Annuler",.. RETRY: "R.essayer",.. //{0} - Product name.. PROGRESS_TITLE: "{0} est votre conseiller personnel en mati.re de s.curit. o. que vous vous trouviez en ligne.",.. PROGRESS_SUBTITLE: "Installation...",.. COMPLETE_TITLE: "Tr.s bien. Nous avons install. votre conseiller en ligne personnel.",.. COMPLETE_SUBTITLE: "Pr.t",.. COMPLETE_LAUNCH: "Ouvrir mon navigateur",.. ERROR_OS_REQUIREMENTS: "Votre installation ne peut pas se poursuivre car votre syst.me d'exploitation ne correspond pas . la configuration syst.me minimale requise. Mettez-le . jour et essayez . nouveau.",.. ERROR_BROWSER_REQUIREMENTS: "Votre installation ne peut pas se poursuivre car votre navigateur ne correspond pas .

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-hr-HR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	5.350994231007747
Encrypted:	false
SSDEEP:	48:353pQsd9EjihC7lRIZYwfChm7gg7oG9RMGbm6O6IgXvzU6MIIJC52jdCMJ:3bdYjQgrIBfvMg7JruJgfzU6MIGC52x/
MD5:	046F982D6BEA5119DB3B0FFBFC2D3A9C
SHA1:	228934BA08CFE1518DB26692077EFF21CDEBBF71
SHA-256:	32D88864B6B689712570D175D8EE3A31E04BA77C560C8EC404320E54FCEE0B1D
SHA-512:	291CB83821CA7011DB39439FBB38DCF93AFC0F9A62EC49D184158551B53BB46B0852E552BAA1101030424DF5EA94F52ECB49565117C3655D6D6EF4E80126E4F3
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licencni ugovor",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pro.itao/la sam i prihva.am Licencni ugovor",.. //{0} - Company name.. THANK_YOU: "Zahvaljujemo .to ste odabrali tvrtku {0}",.. INSTALL: "Instaliraj",.. CANCEL: "Odustani",.. RETRY: "Poku.ajte ponovno",.. //{0} - Product name.. PROGRESS_TITLE: "{0} va. je osobni savjetnik o sigurnosti neovisno o tome gdje se nalazite na mre.i.",.. PROGRESS_SUBTITLE: "Instaliranje...",.. COMPLETE_TITLE: "Sjajno! Instalirali smo va.eg osobnog savjetnika na mre.i.",.. COMPLETE_SUBTITLE: "Spremno za rad",.. COMPLETE_LAUNCH: "Otvori moj preglednik",.. ERROR_OS_REQUIREMENTS: "Instalaciju nije mogu.e nastaviti jer va. operacijski sustav ne ispunjava minimalne preduvjete sustava. A.urirajte ga i poku.ajte ponovno.",.. ERROR_BROWSER_REQUIREMENTS: "Instalaciju nije mogu.e nastaviti jer va. preglednik ne ispunjava minimalne preduvjete sustava. A.urirajte p

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-hu-HU.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	5.515007946438886
Encrypted:	false
SSDEEP:	48:3tLzMpIEAIQIsOGfHgoZciWDBMK+Q4L8NPpTWzn9jIaLe78C6VQ9:3dy1AIQIafrCiMBMK48NPpazndBe7AVO
MD5:	A0CE12A95FD8E925937FF1BDD6A0940C
SHA1:	E48E9A6E55A5F0928434E3F76F8CE9845422D7E6
SHA-256:	14C72F4DBDC624BA00ACEEF1FB63C9817E801FA2588B5C4125BD9AF2E2B32613
SHA-512:	59682A2FFF9B1D9B00878B8831996F67341D6475AAA206C62598B5C27765806C4A3D32BD0369801A93175A862A152D26217D92693112EB3FADA7969733A4F6E0
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licencmeg.llapod.s",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Elolvastam .s elfogadom a Licencmeg.llapod.st",.. //{0} - Company name.. THANK_YOU: "K.sz.nj.k, hogy a(z) {0} mellett d.nt.tt",.. INSTALL: "Telep.t.s",.. CANCEL: "M.gse",.. RETRY: "Pr.b.lkozzon .jra",.. //{0} - Product name.. PROGRESS_TITLE: "{0} az .n szem.lyi tan.csad.ja, aki mindenhova .nnel tart az interneten.",.. PROGRESS_SUBTITLE: "Telep.t.s...",.. COMPLETE_TITLE: "Rendben. Szem.lyi tan.csad.j.nak telep.t.se sikeresen befejez.d.tt.",.. COMPLETE_SUBTITLE: "Haszn.latra k.sz",.. COMPLETE_LAUNCH: "B.ng.sz. megnyit.sa",.. ERROR_OS_REQUIREMENTS: "A telep.t.s nem folytat.dhat, mivel az oper.ci.s rendszer nem felel meg a minim.lis rendszerk.vetelm.nyeknek. Hajtsa v.gre a friss.t.st, majd pr.b.lkozzon .jra.",.. ERROR_BROWSER_REQUIREMENTS: "A telep.t.s nem folytat.dhat, mivel a b.ng.sz. n

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-it-IT.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.273234756793247
Encrypted:	false
SSDEEP:	48:3UWhiWDdQoGoIt/EqRw0+KIbpxLWpuKf/XG+E6lGN5/5wZplY8547w6ZzE+IR1uJ:3dqrt820KInL9KfO+Evf5y0jZzNG1u0o
MD5:	6D2FF123E8CAFB9BC0558832D03DCF78
SHA1:	6B012D0B5DFE705A5895BBE00EEAD226D1477049
SHA-256:	EEF20A106EF95DB5383DEE157C95BF47987388E2CCDDB16EFB94B03E7C3E6376
SHA-512:	E213469B7B803E3EDB3F2196D68243D8BC8A00388628801865DD0976D62A536A11EC1844A2E52AE67D31A7CBF9A00E877F4085C55AF1C5BD6FECDD780AFBADB2
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Contratto di licenza",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ho letto e accetto il contratto di licenza",.. //{0} - Company name.. THANK_YOU: "Grazie per aver scelto {0}",.. INSTALL: "Installa",.. CANCEL: "Annulla",.. RETRY: "Riprova",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . il tuo consulente sulla sicurezza personale quando sei online.",.. PROGRESS_SUBTITLE: "Installazione in corso...",.. COMPLETE_TITLE: "Perfetto! Abbiamo installato il tuo consulente sulla sicurezza online personale.",.. COMPLETE_SUBTITLE: "Pronto all'uso",.. COMPLETE_LAUNCH: "Apri browser",.. ERROR_OS_REQUIREMENTS: "L'installazione non pu. proseguire poich. il sistema operativo non soddisfa i requisiti minimi di sistema. Aggiornalo e riprova.",.. ERROR_BROWSER_REQUIREMENTS: "L'installazione non pu. proseguire poich. il browser non soddisfa i requisiti minimi di sistema. Aggiorna il browser e riprova.",.. ERROR_VE

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-ja-JP.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3042
Entropy (8bit):	5.651559802574649
Encrypted:	false
SSDEEP:	48:3wGDxx6nDARECJhlFV0Inu4+nc4sf79U6MwMiWBmxjGlmDr2hvuskl2KzYzKIKvN:3wwT6c62zFV0InOnKf726pEm2mqvSZzN
MD5:	F47F9E5C36DA5B99A4769F2AEEF8D37A
SHA1:	070F6B27C6FD437B4D5DF9D18D4273D749ED2D3B
SHA-256:	08E43E5C1A284F905589C23D926C40E8CBDE6DDA78951271FED01512CF31B612
SHA-512:	75B638FD04E9F67142B40C982A454EF95BCC27473C2F9C5E9EDF3235DEFF0787FE3C9E1230D816254B0635EA382465D5F719180EA9920E85B80B6BC526AE0BC1
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "......",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "......................",.. //{0} - Company name.. THANK_YOU: "{0} ...................",.. INSTALL: "......",.. CANCEL: ".....",.. RETRY: "...",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ...................................",.. PROGRESS_SUBTITLE: "..............",.. COMPLETE_TITLE: "....... ........... ...................",.. COMPLETE_SUBTITLE: "........",.. COMPLETE_LAUNCH: "........",.. ERROR_OS_REQUIREMENTS: "....................... ....................

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-ko-KR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2602
Entropy (8bit):	5.831644314643136
Encrypted:	false
SSDEEP:	48:3SvoaWNG4EaECInqhq5fqYb26FugHU98U5MmilHU5n9HU5MKzpNKI6iUIX2z01:3S84Fa9Inqhq5fLjFF0WU5Mmi5U5nRUr
MD5:	CC841D140886FEE491F32845443D3A78
SHA1:	ECE4ADEF87A0ACB9ED9A122B4FECD8B44B473DE8
SHA-256:	464D76D3315C74F8C1844ECEE2CCFBCFD10478DE27DC6EB081825C526C5C193A
SHA-512:	DF155722C3D92BF938FB975C30587B0619CBC824FF27A427CEB500A6D44744AA6BB36CF9C50FE4E8C495133534EF6A2BCE0655059C2580CCA2DCEF88D3B5CCBD
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "... ..",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "... ... .. .. ......",.. //{0} - Company name.. THANK_YOU: "{0} ... ... ... ......",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: ".. ..",.. //{0} - Product name.. PROGRESS_TITLE: "{0}. .. .... .. .. .. ... .......",.. PROGRESS_SUBTITLE: ".. ....",.. COMPLETE_TITLE: "....! .. ... .... .......",.. COMPLETE_SUBTITLE: "... ... .....",.. COMPLETE_LAUNCH: ". .... ..",.. ERROR_OS_REQUIREMENTS: "..... .. ... ... .... .... ... ... . ..... ..... ...... .. .......",.. ERROR_BROWSER_REQUIREMENTS: "..... .. ... ... .... ...

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-nb-NO.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2387
Entropy (8bit):	5.322241729749718
Encrypted:	false
SSDEEP:	48:3795VOotrOcpVDEY4IRw0/9IcBVFDqFafj8Kae0QJhGd/i+GFPxWj0ssjzr9cIUy:37R7pVgzCw0VIaVFuFaf3l5QAfjzrKZy
MD5:	1C4105C9D902290BB660B270F029995F
SHA1:	96FC7160A129DD7BEB2C425CEFDC6731D0585D05
SHA-256:	7E9DDC9C9DB9800F87DB49BD2F4B18B15D2F6155A0295DD01B74E43A0834235C
SHA-512:	863A4CD97282F68E619B31758155C3FD313BB6ADEC546A6DE3D1862D976144A33C5D2BA5E32BD0C8C355E7C5C51439C7B298EF78F06B92769AF28F7359079F8C
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Lisensavtale",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jeg har lest og godtar lisensavtalen",.. //{0} - Company name.. THANK_YOU: "Takk for at du har valgt {0}",.. INSTALL: "Installer",.. CANCEL: "Avbryt",.. RETRY: "Pr.v p. nytt",.. //{0} - Product name.. PROGRESS_TITLE: "{0} er din personlige sikkerhetsr.dgiver n.r du er p. Internett.",.. PROGRESS_SUBTITLE: "Installerer..",.. COMPLETE_TITLE: "Flott! Vi har installert din personlige Internett-r.dgiver.",.. COMPLETE_SUBTITLE: "Klar til . sette i gang",.. COMPLETE_LAUNCH: ".pne nettleseren min",.. ERROR_OS_REQUIREMENTS: "Installasjonen kan ikke fortsette fordi operativsystemet ikke oppfyller minimum systemkrav. Oppdater det og pr.v p. nytt.",.. ERROR_BROWSER_REQUIREMENTS: "Installasjonen kan ikke fortsette fordi nettleseren ikke oppfyller minimum systemkrav. Oppdater nettleseren og pr.v p. nytt.",.. ERROR_VERSION: "Det ser ut til at d

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-nl-NL.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	5.219172682762626
Encrypted:	false
SSDEEP:	48:3HZ/GOx7kopP4IeGyEY/n40AcTI3k7JWxXDk7JdIXrf24+0nB7v7lRbY2ID6XVUO:3Hb+nAqjAkI3WcxXDWPIXrfwkBD9i6X1
MD5:	342D009CCBC58295AAD31F9475D3D6D5
SHA1:	EB3CB3BD3A9A19819E9E397FEC23BB37A3FF3344
SHA-256:	8A2328030D33D83953717A4D2D26E2319F11EB732C992484F7B8E23F55DF904F
SHA-512:	CCA21454E3D8AE4BC91C685E172E11A478F27B8D407557EA0F9DE50C27AFAFFD1843482852895DB4E9C4F53543E3B1C26BC5A661DCF76E41E0E148C57FB6DFFD
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licentieovereenkomst",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ik heb de Licentieovereenkomst gelezen en ga ermee akkoord",.. //{0} - Company name.. THANK_YOU: "Hartelijk dank dat u hebt gekozen voor {0}",.. INSTALL: "Installeren",.. CANCEL: "Annuleren",.. RETRY: "Opnieuw proberen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} is uw persoonlijke veiligheidsadviseur waar u ook online gaat.",.. PROGRESS_SUBTITLE: "Installeren...",.. COMPLETE_TITLE: "Fantastisch! We hebben uw persoonlijke online adviseur ge.nstalleerd.",.. COMPLETE_SUBTITLE: "U bent klaar om te beginnen",.. COMPLETE_LAUNCH: "Open mijn browser",.. ERROR_OS_REQUIREMENTS: "Uw installatie kan niet worden voortgezet omdat uw besturingssysteem niet voldoet aan de minimale systeemvereisten. Werk het bij en probeer het opnieuw.",.. ERROR_BROWSER_REQUIREMENTS: "Uw installatie kan niet worden voortgezet omdat uw browser niet voldoet aan onze mi

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-pl-PL.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2589
Entropy (8bit):	5.547167815308863
Encrypted:	false
SSDEEP:	48:31Mp2pQa6EiVoNIGz2wizAsferOrW6IjW1FRHZZ8z0h0hXigYDzgzI77cclvND9j:3r+0iVQI5wJsf8GW6IjqfHZchygYDzgQ
MD5:	6DAA2EB9E3B6D9E0D3F81D065A56FD65
SHA1:	B4814597983AAADD45A0FF68CC7593C267FB142D
SHA-256:	7B967E6B1A9B3B0483AC4A6029A9AED3732B7015573719375FD680653013CB74
SHA-512:	471E124305EF00529C6722B506F8DDF006FE010B430C2D5E2D2D60A99B12E664CBA77D0E3CD812B66A12FC99E924FBBA01764952FA1D06BED1311E1F32E153C5
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Umowa licencyjna",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Potwierdzam znajomo.. warunk.w umowy licencyjnej i akceptuj. je.",.. //{0} - Company name.. THANK_YOU: "Dzi.kujemy za wybranie firmy {0}",.. INSTALL: "Zainstaluj",.. CANCEL: "Anuluj",.. RETRY: "Spr.buj ponownie",.. //{0} - Product name.. PROGRESS_TITLE: "Program {0} to Tw.j osobisty doradca bezpiecze.stwa online.",.. PROGRESS_SUBTITLE: "Instalowanie...",.. COMPLETE_TITLE: ".wietnie. Tw.j osobisty doradca bezpiecze.stwa online zosta. zainstalowany.",.. COMPLETE_SUBTITLE: "Gotowe",.. COMPLETE_LAUNCH: "Otw.rz przegl.dark.",.. ERROR_OS_REQUIREMENTS: "Nie mo.na kontynuowa. instalacji, poniewa. system operacyjny nie spe.nia minimalnych wymaga. systemowych. Zaktualizuj system i spr.buj ponownie.",.. ERROR_BROWSER_REQUIREMENTS: "Nie mo.na kontynuowa. instalacji, poniewa. przegl.darka nie spe.nia minimalnych wymaga. systemow

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-pt-BR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	5.299993722021728
Encrypted:	false
SSDEEP:	48:30pLnIOYwREtajaI1BKraNfZwe6GcIe+LLCEHxg5aozFVI1rJqPvJ:3VI68jaIjNf9F3Hwbz3aJqPvJ
MD5:	BEF0DB23F85CF7E1918E5BC44747D940
SHA1:	E227E3212B3625BD790425F25FB8B7A4C22F1C4C
SHA-256:	F465DB5A542C428CF684AB54C88D779A0748504F6B60F9DC68E4E6DB161C7027
SHA-512:	FD878571BDF0BC57515B20306ADDB9F1A5899E2620F7759EDA04265811DF4B4804AFBD7C04BAC877C421D199F0F54503BCFE0981CF4791CFC7FDD7A41EE58153
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Contrato de Licen.a",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Li e concordo com o Contrato de Licen.a",.. //{0} - Company name.. THANK_YOU: "Obrigado por escolher {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Tentar novamente",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . o seu assessor de seguran.a personalizado onde quer que voc. navegue.",.. PROGRESS_SUBTITLE: "Instalando...",.. COMPLETE_TITLE: "Excelente! O seu assessor online personalizado foi instalado.",.. COMPLETE_SUBTITLE: "Pronto para come.ar",.. COMPLETE_LAUNCH: "Abrir meu navegador",.. ERROR_OS_REQUIREMENTS: "A instala..o n.o pode continuar. Seu sistema operacional n.o atende aos requisitos m.nimos do sistema. Atualize-o e tente novamente.",.. ERROR_BROWSER_REQUIREMENTS: "A instala..o n.o pode continuar. Seu navegador n.o atende aos requisitos m.nimos do sistema. Atualize o navegador e tente novamente.",.

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-pt-PT.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	5.28324188686346
Encrypted:	false
SSDEEP:	48:30pgnIuAGE6y4IvQdKVvNfwSe6GfIhq+L1w9V5eEHp4aUzFy5JI1rJqPlEqdWo/:3uhX6y4IvQdUlfKF3PHHp4DziaJqPlE8
MD5:	A8D908EF11B6E6827318D03027A59853
SHA1:	894C65E390685AF298675AFCD2D1108B13BD9600
SHA-256:	0F64B9AB19FE8C5C7C6607B6E41E3C6EA37042FE9107AB4DA2774C058CB0BFD8
SHA-512:	CC0C2D78CEB2EC8EF66CED5D2972293253145D3BE9BF4597856B2FD64169DC81F0681E0AAC223B4705508FD53FA8350EFD9B78EC22FDA30A6FBE04593ED746C7
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Contrato de Licen.a",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Li e concordo com o Contrato de Licen.a",.. //{0} - Company name.. THANK_YOU: "Obrigado por escolher a {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Tentar Novamente",.. //{0} - Product name.. PROGRESS_TITLE: "O {0} . o seu assistente de seguran.a pessoal quando navega online.",.. PROGRESS_SUBTITLE: "A instalar...",.. COMPLETE_TITLE: ".timo! Instal.mos o seu assistente pessoal online.",.. COMPLETE_SUBTITLE: "Pronto a utilizar",.. COMPLETE_LAUNCH: "Abrir o meu browser",.. ERROR_OS_REQUIREMENTS: "N.o . poss.vel continuar a instala..o porque o seu sistema operativo n.o cumpre os requisitos m.nimos do sistema. Atualize-o e tente novamente.",.. ERROR_BROWSER_REQUIREMENTS: "N.o . poss.vel continuar a instala..o porque o seu browser n.o cumpre os nossos requisitos m.nimos do sistema. Atualize o seu browser e ten

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-ru-RU.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3518
Entropy (8bit):	4.980400611470048
Encrypted:	false
SSDEEP:	96:3UVaCuKa+4I4QashQrsyfb6yJBvr8/zsPoSBRbB+E:3UVMKaN91jb6yg/z2oSBRVJ
MD5:	BF7A97275E6D3C3A1A04385F3F8886DB
SHA1:	CA585A7FD8E3F03445855C31CEDB147E64FB4D4B
SHA-256:	96DD6E164702E07A9CCAACD4ECD6DA91E11193F0C7D2137EA7917042C1FA7D1F
SHA-512:	1DF91ABE3ABAEBFEC23394E3CE5EAF796CCD95526EBD3CE68FECE384E0EDDA4ADE37808A6982D21900A22A0F0EDF044C031A7E3AD3D98AC8B38FC59F74F7EC4A
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "............ ..........",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: ".... ......... . ....... ....... ............. ..........",.. //{0} - Company name.. THANK_YOU: ".......... ... .. ..... {0}",.. INSTALL: "..........",.. CANCEL: "......",.. RETRY: "......... .......",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . ... ...... ........ .. ........ ............ . ..........",.. PROGRESS_SUBTITLE: "............",.. COMPLETE_TITLE: ".......! ...... ........ .. ........ ............ ...........",.. COMPLETE_SUBTITLE: "... ......",.. COMPLETE_LAUNCH: "....... .......",.. ERROR_OS_REQUIREMENTS: "......... .......... ..........

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-sk-SK.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2503
Entropy (8bit):	5.599125488841342
Encrypted:	false
SSDEEP:	48:3KUCaDVRZIB0HHEFYdVXIBJSoAcJSjAKf+EPnAn9kwk8Aw7JmERmPezlU8IPJicJ:3K94Bu0HkFoXImoArjAKf+EPnAnewk8i
MD5:	08A88764BC54366519712AFA77281B14
SHA1:	AAA6E388B7A382E252B17C8A2727A01A5597FF93
SHA-256:	9D3A89DB1B1488981A8D4DF098E04D84038BCA2FA131027AC9554D3C3F9AFF85
SHA-512:	FF9BC34AAF789A260C7DA7543F1BEAFFFDCB6799DD5093D512D6CECDEC73CB00EC46B28DB89A9FD26FE50EF70A794EFAB3D4A32BBA36387A0212241B2B84E99E
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licen.n. zmluva",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pre..tal(-a) som si licen.n. zmluvu a s.hlas.m s .ou",.. //{0} - Company name.. THANK_YOU: ".akujeme, .e ste si zvolili {0}",.. INSTALL: "In.talova.",.. CANCEL: "Zru.i.",.. RETRY: "Sk.si. znova",.. //{0} - Product name.. PROGRESS_TITLE: "{0} je v.. osobn. bezpe.nostn. poradca pri va.ich potulk.ch internetom.",.. PROGRESS_SUBTITLE: "In.taluje sa...",.. COMPLETE_TITLE: "Skvel.! Osobn. poradca online je nain.talovan..",.. COMPLETE_SUBTITLE: "Hotovo",.. COMPLETE_LAUNCH: "Otvori. prehliada.",.. ERROR_OS_REQUIREMENTS: "V in.tal.cii nie je mo.n. pokra.ova., preto.e opera.n. syst.m nesp..a minim.lne syst.mov. po.iadavky. Aktualizujte ho a sk.ste to znova.",.. ERROR_BROWSER_REQUIREMENTS: "V in.tal.cii nie je mo.n. pokra.ova., preto.e prehliada. nesp..a minim.lne syst.mov. po.iadavky. Aktuali

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-sr-Latn-CS.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2366
Entropy (8bit):	5.377529074885516
Encrypted:	false
SSDEEP:	48:3iWxpQUZMEji4CqYBIInphvGEfD/cTdRCcegQ6DRjRSGnzUwMIIJLQ5omtn:3ikbTjBrGIAH7fD/cpUdiRcGnzUwMIA0
MD5:	1D59151978EDB5243B5FB2D1D65BC06D
SHA1:	AF7C1604BC7D3C92884E3BD1C6216310314F1C33
SHA-256:	1AB8E10FE1E87EF88C26902275FB1ABC88E714FAE6E1888765737681EC13A519
SHA-512:	DA3BD8C452C67050330BC3D48AE489D90754952EE6AE8040D99AEEFF93C41EAA007BE5A8BC7BB22C7B279107A738EA87062D3B254A3CF23CCD93A79D2F1A1895
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Ugovor o licenciranju",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pro.itao/la sam i saglasan/na sam sa ugovorom o licenciranju",.. //{0} - Company name.. THANK_YOU: "Hvala vam .to ste odabrali {0}",.. INSTALL: "Instaliraj",.. CANCEL: "Otka.i",.. RETRY: "Poku.ajte ponovo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} je va. li.ni savetnik kada god ste na mre.i.",.. PROGRESS_SUBTITLE: "Instaliranje...",.. COMPLETE_TITLE: "Odli.no! Instalirali smo va. li.ni savetnik na mre.i.",.. COMPLETE_SUBTITLE: "Spremno je",.. COMPLETE_LAUNCH: "Otvori pregleda.",.. ERROR_OS_REQUIREMENTS: "Instalacija ne mo.e da se nastavi zato .to sistem ne ispunjava minimalne zahteve. A.urirajte i poku.ajte ponovo.",.. ERROR_BROWSER_REQUIREMENTS: "Instalacija ne mo.e da se nastavi zato .to pregleda. ne ispunjava minimalne zahteve sistema. A.urirajte pregleda. i poku.ajte ponovo.",.. ERROR_VERSION: "Ve. imat

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-sv-SE.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2265
Entropy (8bit):	5.384815060230753
Encrypted:	false
SSDEEP:	48:3Ud6ODtNYPmAEYSwxFjIcvFLcFafDyMC/4ekY3+rh7sK0MCoO0oz/wrIfGEzjZsI:30DNcnIiFgFaf+imYJOvz4rCRV
MD5:	E78439F6F4B4708602625E4A72FE8F9D
SHA1:	1C5974A46847D65292BA9A430909CF0034EBA254
SHA-256:	17F548A03E9F64DBB946DCCFD8D9C54FA178CC4893C4A08C292A9A5DB038BFBF
SHA-512:	14FAC327E1C7DFC78E97AEB139DC2676113E71FB962A4103DED145B780FD6B040673962F8AB243B5D4A1267D84D4A00C4939199F52C8D3FFFE3597B5EF7DCA94
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Licensavtal",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jag har l.st och godk.nner licensavtalet",.. //{0} - Company name.. THANK_YOU: "Tack f.r att du valde {0}",.. INSTALL: "Installera",.. CANCEL: "Avbryt",.. RETRY: "F.rs.k igen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} .r din personliga s.kerhetsr.dgivare online.",.. PROGRESS_SUBTITLE: "Installerar...",.. COMPLETE_TITLE: "Perfekt. Vi har installerat din personliga r.dgivare online.",.. COMPLETE_SUBTITLE: "Klar att anv.nda",.. COMPLETE_LAUNCH: ".ppna min webbl.sare",.. ERROR_OS_REQUIREMENTS: "Installationen avbr.ts eftersom ditt operativsystem inte uppfyller systemkraven. Uppdatera och f.rs.k igen.",.. ERROR_BROWSER_REQUIREMENTS: "Installationen avbr.ts eftersom din webbl.sare inte uppfyller systemkraven. Uppdatera webbl.saren och f.rs.k igen.",.. ERROR_VERSION: "En nyare version av programvaran .r redan installerad p.

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-tr-TR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2564
Entropy (8bit):	5.490091438528594
Encrypted:	false
SSDEEP:	48:3DdmZCox80uGgE+dh70Ij+AUJBI+AxuzfvF57ybqEmpwAY3LgMseo44oU+Wz7kjJ:3kwoK0v+dhYIjMs5uzf7g5ue5Lgz6CXG
MD5:	05CC66347F07D6016A6266200949DF60
SHA1:	1599786111CE4780FEA8D5426D82E07DD3993201
SHA-256:	130DFBE1493ABCDCCE97774F996A976FE1A995E6F9EED59DA1E16CBE7BBCED24
SHA-512:	CB2EBDD25D6A2B536A948C345C542D7BEC9C35692A78FAAC9F264F870221234C432BED324611BAD220B563B3D34B7301AF6E2EF9FB730B82F8BB76BFFA77BDFA
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "Lisans S.zle.mesi",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Lisans S.zle.mesi'ni okudum ve kabul ediyorum",.. //{0} - Company name.. THANK_YOU: "{0}'yi se.ti.iniz i.in te.ekk.rler",.. INSTALL: "Y.kle",.. CANCEL: ".ptal",.. RETRY: "Yeniden Dene",.. //{0} - Product name.. PROGRESS_TITLE: "{0} Internet'te her an yan.n.zda olan ki.isel g.venlik dan..man.n.zd.r.",.. PROGRESS_SUBTITLE: "Y.kleniyor...",.. COMPLETE_TITLE: "Harika! Ki.isel .evrimi.i dan..man.n.z. y.kledik.",.. COMPLETE_SUBTITLE: "Kullan.ma haz.r",.. COMPLETE_LAUNCH: "Taray.c.m. a.",.. ERROR_OS_REQUIREMENTS: "..letim sisteminiz minimum sistem gereksinimlerini kar..lamad...ndan y.kleme i.lemine devam edilemiyor. L.tfen g.ncelleyin ve tekrar deneyin.",.. ERROR_BROWSER_REQUIREMENTS: "Taray.c.n.z minimum sistem gereksinimlerimizi kar..lamad...ndan y.kleme i.lemine devam edilemiyor. L.tfen t

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-zh-CN.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	6.279635522276187
Encrypted:	false
SSDEEP:	48:3oeWvFbBQLSECfPnIuDfC9lI2S1lZmYDbVzzIKg+bq2cmO:3obrYzCnnIuDfC9lIZmuRzzY+lcmO
MD5:	5C006F633594BE32EA846EAABA28EFAC
SHA1:	313416B877495151AA1DC4F7E606212E57B8C7F5
SHA-256:	A58CE6C9D3D5F2C7E3BB45B8EDF2FD69E29BD50A8C9EB96A672D8BAA4E07C7D9
SHA-512:	BBD45F569D93EF47A259D68C55BF2232BD35A09947202353C092C31595E9D4AE4146A49B1DC0CE2FEBA581A07E4F5160FFA774041F0EC2B8E4EE4B02A7C79C6E
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "....",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "...........",.. //{0} - Company name.. THANK_YOU: ".....{0}",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: "..",.. //{0} - Product name.. PROGRESS_TITLE: "{0}.................",.. PROGRESS_SUBTITLE: ".......",.. COMPLETE_TITLE: "...! ............",.. COMPLETE_SUBTITLE: "....",.. COMPLETE_LAUNCH: ".......",.. ERROR_OS_REQUIREMENTS: "....................... .........",.. ERROR_BROWSER_REQUIREMENTS: "...................... ..........",.. ERROR_VERSION: "...................",.. ERROR_FAIL: ".......... ....",.. ERROR_DU

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-install-zh-TW.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2196
Entropy (8bit):	6.290888542443718
Encrypted:	false
SSDEEP:	48:3/svnWuIBR1EwNsIb5w6fIPlBZWe2jeemIuzlJIeqwjhPcMJu:3/Cw4wmIZfIPlBcaeJuzXjqwjNcv
MD5:	4D50B043B9E92727C9974973D6C5D3FE
SHA1:	A3754621B014AD825F43EA3D3DD8B1750A9B164E
SHA-256:	C5BC5FF5CC64BC643220F2149BC74BF9FD9524B231FFF518AC40C3FCA0269236
SHA-512:	CBAFD790828A062534E1AFDAF61B0640D59D172A09A09626899A9266AE592684DC34DBAC192934B49E9C5E7A9AA97C4601014D3D69766BA1F62F8EB520CC2ADD
Malicious:	false
Reputation:	unknown
Preview:	.var _lrInstall_ = {.. EULA_TITLE: "....",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "............",.. //{0} - Company name.. THANK_YOU: "..... {0}",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: "....",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ...................",.. PROGRESS_SUBTITLE: ".......",.. COMPLETE_TITLE: ".... ..............",.. COMPLETE_SUBTITLE: ".......",.. COMPLETE_LAUNCH: ".....",.. ERROR_OS_REQUIREMENTS: "......................... ...........",.. ERROR_BROWSER_REQUIREMENTS: "........................ ................",.. ERROR_VERSION: ".................",.. ERROR_FAIL: ".

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-cs-CZ.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	716
Entropy (8bit):	5.603466386701819
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfx6v9LuO4biqra6fMocbkLwT5zxjAHo8+9wuRTos4SxQrKOCj:7e9SlNLiaf4v9KO4zG6fMocWIOHo8+9t
MD5:	8794C890BD2E81943C82C292F66F3667
SHA1:	3B4C2828FD3DAB4F81A8C31B1D4317970A19712F
SHA-256:	074AC361DD559BAD3396B7D2BBAB1DD617F0D703F1F9EDD187A01A70E5469C4F
SHA-512:	A092DDCA133709C3E07A59FF231F97ED03FAAE2DF99D819E92B0D49CDB0A832CB8C913405C438A7A9322466BC41D5BDD9D392EB8FA0100A8D15910239EE86082
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verze",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Prohl..en. o ochran. osobn.ch .daj.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//A33A9CEAAE4D249C0FFCF86B46DD3CFE7CFED92C807371FAAD24F10184439BD12196A90CAD70144F27B4D1487BF8C1647F83CB050B21FF0689425EE4A0E9E96D++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-da-DK.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	728
Entropy (8bit):	5.561213207315339
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bikzbkLwT5zxjAHo8wN9wuRToIDlUMJMlE9:7e9SlNLiafLYFv9KO4dWIOHo8wN9ZR0g
MD5:	A051DAA9B5606E594E4CD75E82068988
SHA1:	7AFC13E52ADC302A9E3835FC418A8ABB501957D9
SHA-256:	0F18C38792BB96A8CD3F11E91E8F8C05C463D7755945D5D0630C459A6EE90995
SHA-512:	341F223CDF8F49FB8CC8126B610026949E9171F85B24970E797F5EB75D3CAE9EC6C066B94DA62283972C57737D80C77241DE02B238D0B078FC012AFFC961B027
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Meddelelse om beskyttelse af personlige oplysninger",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "F.rdig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//775927AF51C58C15181597C0E40C51FFB2B46720C140702E55EDD759C98B1BBB9BB1BB67EBC5319E66CEC6C06F4E63D92929522DEBA419907802E4311F4B6AB1++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-de-DE.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	695
Entropy (8bit):	5.546960598972389
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bi+p3ibkLwT5zxjAHo8+N9wuRToh88JwGdOO:7e9SlNLiafLYFv9KO4pSWIOHo8+N9ZRw
MD5:	4CA73911A8549309C48D4E2DBCCD384A
SHA1:	D5E3B5C8D2C4353315B93EF16DA69F8E6F7445F6
SHA-256:	145DB2CDB5B8FD781A5F84E84A57CDA055A47551DC291D3335ED695E459AEDED
SHA-512:	8E9DBAD8225952584310480BF67DE048C2FD27D6EC7776F30F5EFB3C5821AB60513618B7E98BCEC0BAB954BC5197154CE03A6965E64D506C190E0A8EC2EE6AA4
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Datenschutzhinweise",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Fertig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//37B600152353029B4EE0D51C5F5DC779FA4154C41F9E987CBBF78A388CF7EAD941C181F0D37CD82E6A42E1523AF2D045963BF87889701AF7027EEA10566B41D7++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-el-GR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	750
Entropy (8bit):	5.75038358315992
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kft6v9LuO4bi7XKfRWkGmbkLwT5zxjAHo8JP9wuRTo2ma+apHkGKb:7e9SlNLiafEv9KO4mXCWkHWIOHo8JP9Q
MD5:	6FE7F9625E2B43D3DFA72219A32CD797
SHA1:	AAA18255C4C9228FAAC221451CC599881DFE99F0
SHA-256:	99DB09DCA477A43E3C1230DED9DB306527A648BC9CDD1FE4D11396EECBC4E8A3
SHA-512:	F60D3F083BB557ADA563E07568ADBA9E81BA9FEA3A385F9C57BE02B313DFF4AAB51A2B3EA42CC3B23BEFD3385A67C43BBA39098D711819B04226E397FF618E8D
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "...... ............ .... .........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: ".....",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//5D3C085C46ADBA2C87236F283C7F7A6F9F8528F5D95484748AD517E395A273333B09FFE5C5AD7832E2A2AECCDA0A44E491DE1E4FCE209B0AF2F79D34A9089B03++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-en-US.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	688
Entropy (8bit):	5.5148376008517355
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4biqkCbkLwT5zxjmT9wuRTouGQN:7e9SlNLiafLYFv9KO4zkCWIoT9ZRxT
MD5:	96F06BCE2F8241D3FAA99D215D5165E9
SHA1:	6CC4465149BA689E6509BA85C199C357DA5E76B9
SHA-256:	E6806211EC82E58650186D6CA0E2586158031052AFB622AF8D669B6DF8B10586
SHA-512:	294C816E99BFEB230C629FC90CA4DEC3E969731B25D0DC252A833C914AAED54E686005F875284488EC6432555EBA23C63DA0C27E05A0EF0B23CFFEE85603D2F0
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacy Notice",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Done",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//B470C7AAF5FDD24BBF32F7476686D802B0DDD7A2E27E19E227FC11A318F1F178EE4A187DD27F062D9068D7C9D3AF476F7739316C707BFE1246DBE8BCCB582598++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-es-ES.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.53027365887532
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToFVoEmUo/GbXn:7e9SlNLiafrFv9KO40gnWIqgV9ZR2Vo+
MD5:	6B40E984877643345441286818FD3E70
SHA1:	72C8EBFC44446664E55F7789FCEA06CA1B18DF44
SHA-256:	B49C9D62E2060E3BBFAF24ECC36016322B8E11A11CDFEAF1BCD5AC34605AE51F
SHA-512:	0542309BAB98597D6DE4608B2F14DECD65322D8517F9D9D95D7169EF5E9A1DAEECD9ED0894D8621B0AAFE9AAE58BB5DF95D8E49EDAC8404FDD527F961CD466B9
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BFC1DB273BDD11606013A9CE4642C9329CA41AD21F8C5F38531ECDD48BE2385679A485CD0BCFACF2455A2D5D9F53158546E6970F6E6C56ACBC14DB30A9FB7FB0++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-es-MX.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.524664431479274
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToJcdLRDonXqU0Xn:7e9SlNLiafrFv9KO40gnWIqgV9ZRHdVd
MD5:	06DD08181921F52A83115283267E31C2
SHA1:	34E1A98CAC15200DACF84A5C4EAAE3C48769F48A
SHA-256:	36C38D7E0367F32F8A4390424B826F337E3717AF61610D3B6DE7355735252DE2
SHA-512:	804FD02DC4B162A9D25A8F395E904100CD87073DE18AAB1941E56571BAB2EDC4904FCEA4FE3AA9DE27DA85EC723CFDAE0AFC6FE981E07EFA3992A4E90E56EEFD
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//754B3DBDEB13314364EEB697D5B6FCC9D319892836CC4544C9D93068886BD51329DF441F3502D2BEA4DD61E90BF9BABABFDF8DBDC811D9B264B26A0CD94D3A62++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-fi-FI.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	692
Entropy (8bit):	5.516986272783081
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfft6v9LuO4biu6gbkLwT5zxjAHo88WN9wuRTo8pcqxFaSRa:7e9SlNLiafsv9KO4RWIOHo8Z9ZR1cIav
MD5:	3C20435CCED9E2BECB29CAB56E69538B
SHA1:	406AEED3490CAAE193A4944197A3C682DEE6A427
SHA-256:	E0691F6FFCC80E2D932F5E32A9825BD7C4ABFC929C2DA9F74BC432F50AB8142A
SHA-512:	B472AD0D1AC7196F070CEB9E7D23ED70EBE5F6B2065C53FA98F0B1E10E9C9986CA8612DB622DBBAA938BBAB8AE0E5DD7D62CB03B864CFCC8FEBE840EA5102A0C
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versio",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Tietosuojaseloste",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Valmis",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0645A2C63F8874B2644CB688496CC128F3D37ADF4FC5C554ACED68A88DA43DABEF8D1954B6DD7DF54AD1137215CE6B6683F5A9571F7336393F5858DE05A9DAC2++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-fr-CA.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	710
Entropy (8bit):	5.554042069584347
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRTounXHUyEe:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRv7
MD5:	779EA85FBBF62C1510D3E05AB20C26EC
SHA1:	A57E416890AD142307798E99AAFF5E2F3BE4EEC0
SHA-256:	DBB25AEB94E9C422846AC42C27EEC7E640F1319EDD2AFFC2FD5567CC6B4A6B40
SHA-512:	A068B003B7F34147F770415F2934F03E4693197542897CC9BAB4E11C7155630B8A4F1AC2E50EF07C59FA5551E86C0D94872E55303F39212AE582310DB6777C14
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//9E70D09B967A834FE69317BA4B5B2CDCA5AC0F8BA4BCE75D9F9BDA71C2AFC01B14569FD2CB1D7E039B498BB092871C7EE39C6108057E2C26BF900E4805FC2775++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-fr-FR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	710
Entropy (8bit):	5.541459694602625
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRTo7NoqnUXLpKn:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRaD
MD5:	638D9816DE2A345FA16AE761F050A6AE
SHA1:	532A74ACD0DDF25BE6045AAD208641E89709CE68
SHA-256:	08098B71086F96092F73853EF83B8A022A91C47E63898F30B844A9E743C972D9
SHA-512:	0AE92E9CA59CF34623952AC68E61ACD46F09EE74BBD0CAF2CACA87D93DF7503C953229FDDF39E497FC1A0295F5A54EEB658E49690A95D0AB79FE4C4FA4C89627
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//6F7E8BC63672E5124455E40C6A50391F50FF34D1A21C9CC76B56B5DDC555534CC35BD263EF7C7A12E42D75356E165C5A39E0AA148F5F8A7BDE6016BA541E147F++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-hr-HR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	703
Entropy (8bit):	5.556912313975577
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfv66v9LuO4biaBzcbkLwT5zxjHT9wuRToUePBNIm2Xg:7e9SlNLiaflv9KO43BoWIVT9ZRzdQ
MD5:	0354889B640A12B309CC946C5354C21B
SHA1:	022A64BFDF5B8F2D679A6E156C152507498E16AA
SHA-256:	E1541C5B527D9D1E3A8811D5A6A7C507A8603416043B053CA97C288209BB8A4F
SHA-512:	72EA0BE258BA654EDDC88CB869FD0942ED95BAB5CB406E6B7F51B85446C2907E318C794D19B45D5D4FCD22A8A17459E903D95AB61FDDF2A02D90B272A0886295
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obavijest o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BD9F914B7A0128058D12F3AC184833E8A377909F9AA32B164D1780B4F12C26513CB70BE7383900D24E79F5DFC4F0B91CD6E9656E92B21310D6C6A3CDCCEB2021++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-hu-HU.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.595019305091011
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfQdU6v9LuO4bihIHmdcbkLwT5zxjAHo8Kwv9wuRTozXbVNVXc/yP:7e9SlNLiafQd7v9KO4k6ocWIOHo8Kwv4
MD5:	2CDA0C30A354370C38A338217D211433
SHA1:	E9847A549D61A27ABC0ED964FD5274CE0445A353
SHA-256:	2386382712EE52F5FBECA3B47504F3D4B5A4721A7D04A1E778F2E26E87F8C19D
SHA-512:	3619B598B49B9988EC39E1E3D6157F20657F89D01CC28D429DB0D7437190BFBAAF4059B5474140D28D4DD955DF16F019686B47D58E515CAA2AE81A93C55073B6
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzi.",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Adatv.delmi k.zlem.ny",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "K.sz",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//B646A3402844D34E1A3BA92A3ECDCFB4D75F7956083C08493BAC3027813F5D2321C77A171338350B777AE9128F7DF21D1E437C0236713F2161F293A88ACF137C++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-it-IT.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.5303189627766365
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfy6v9LuO4biNkbkLwT5zxjm79wuRToHMqjKVYVPT/idrr1n:7e9SlNLiafVv9KO4akWIo79ZRlqjKG/8
MD5:	7EB6790A46F59D57836EB565C8660794
SHA1:	DD58C46B3B5F26B17928EDE27D1A8E906B545634
SHA-256:	69B6D743C89B74E2C9E84D16C528D200CC2DA5CB664B0A42EDB63EDAAFB2C31C
SHA-512:	F6ED66EAC521E498E00C489C851D33B923160B13AD843393634F90D62737D2F41F676A19384C8574962766619B3E32A6EAFEB176C78E81E5E5163B4EBB7735F9
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versione",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Notifica sulla privacy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fine",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//E9BE2387F2CDBC3D449C22604AD71B570D5065387929BCD0066BA637E8BA9FE83771F4F1EA6F7C81CD037BAD09A8DCDE212A3E4D7A5EAA079206B856D67B6B39++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-ja-JP.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	808
Entropy (8bit):	5.724439798276386
Encrypted:	false
SSDEEP:	24:7e9fLdo5ijdfA6Dlv9o4A2AWIOHo8UHv9ZRDZNZU34F:K9fLdICdfA49XLAWIOfUHFz3ZJ
MD5:	07FDBD0D28F682026EEBC7916F698498
SHA1:	CDD412C22D0D717EA237AEBB8290191FE06CB248
SHA-256:	BF7E520F826F1B040E673EB83D63F59335E19555B8D30E13DB5D292BE76E65FE
SHA-512:	15BB86ADE7D71AD2FBD33735D6FF39C0B2E22E87D82FB4B3658BF777D0138AFD8F7A1C584441787782EEEAD50F30C0B170FE4E9033A4AE6AA374BC1F9A361324
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "..... .........",.. PRODUCT_NAME_LIVE: "..... ......... ...",.. PRODUCT_NAME_TRADEMARKED: "...... .........",.. VERSION: ".....",.. WEBADVISOR: ".........",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//7783325CA0B03097EBECF6759CE913AB93310E7D91DC918C9BA143A6ADA9FE7E0F2EF884278D3A99A8FC3097885BEB1D9FF0CF7E6AE5F0A3979CD545BE514079++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-ko-KR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	742
Entropy (8bit):	5.824735575206991
Encrypted:	false
SSDEEP:	12:7ekSd6ds63i7R6ikfV/i6v9kc4biyGbkLwT5zxjsGiFW9wuRTopvNWL2zXkK7h:7e9Ed13isnfVtv9kc4sWIViQ9ZRmz9h
MD5:	E8C5D1545F9A393D61EFD20253BF601B
SHA1:	B0BB63E52182556570FE309FE544C58833AA3246
SHA-256:	3A7D35147BE6D99B49508736EB75272896262B026B84DCAA2B549F3B4DFDB4CE
SHA-512:	B753B23CA68DC1D4A3ADEAD1B85B74A0A5C2EEC4E7A441AAB2C206C474FC2892F156B02B9046807BF962824940C044E05F875DFAE1F4BF492F75F3B036391114
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee ......",.. PRODUCT_NAME_LIVE: "McAfee ...... ...",.. PRODUCT_NAME_TRADEMARKED: "McAfee. ......",.. VERSION: "..",.. WEBADVISOR: "......",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".. .. ....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//D23508851469B0EA5EED19A4C0E5034E8AA911B017BE0301EAC8EC7767872C403759927A82BAD01581A53086B63B596E8A716496FDDEECFBF302529D7FCE4548++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-nb-NO.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	696
Entropy (8bit):	5.556600355543895
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kf3Hi6v9LuO4biqyNLMBHbkLwT5zxjmf9wuRTo3scybWLO:7e9SlNLiaf3Fv9KO4zyNsHWIof9ZR1cG
MD5:	03F5F916ED430732D2218BB14B0B42DC
SHA1:	4D0EF8E67F16E6552DA5A74F45A1AFA8D56300A8
SHA-256:	5400F723BC1A0E3F88990BDEB6271BB676FAA6EA6517EB6FC89609357CB7438C
SHA-512:	2F457D2C3059DD51F948379AAC6E7A60E0AAA4DF17C3353963787A72DCA7B6D6DFDC000C5EB12F545B80231AF8703C69A8BD4FBE0D52C8EB81395B6E858D0E48
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versjon",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Personvernmerknad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fullf.rt",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//98255434BED62EA15F51E86E3B8DE2FA4C5ED375452638A40C358F773F990D4A535C2EF1B49A47703266BCFF789DC96D2BC830BE3EB996D903CA66C70EE2BA29++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-nl-NL.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	746
Entropy (8bit):	5.612753891806925
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfP6v9LuO4biqLEnbkLAWB2CT5zxjAHo8CW9AWB2CuRToHWRsVWsO:7e9SlNLiafyv9KO4zLEnWtB26OHo8CWk
MD5:	775D563614C64FD3F82E7DAE40FA502E
SHA1:	FF27DAF15836E916D1E45F7EC26A92CF4BD9B64F
SHA-256:	A7344FC245049318767A5397C3B9E36A975201559F2B829D9B1B7B0F4370EA6C
SHA-512:	8FB67852EA2A891379F7EC062D3013FA6065E6A015984795D01BC26953DD2B4C15A1FDA59AAEB080CE4CFF233EF376AFC26C51B0A6243794602804795D60CB37
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versie",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacyverklaring",.. PRIVACY_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Gereed",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//727E9C732B0CD944FB705156A8CE66E8FD455712F1D580E15CE2F39E0B8C824793BC1475EC46937EE451EFE3565A81D88B2B1679C803A536DDC6FCDBDCD984C7++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-pl-PL.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	709
Entropy (8bit):	5.54596132666323
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kf6v66v9LuO4bipidGGnbkLwT5zxjmO9wuRTo/aSb8+viScjC3GxL:7e9SlNLiaf6vtv9KO4oMGGnWIoO9ZRGW
MD5:	F16C62EC1EBC7863FCAAD41304A250FE
SHA1:	4A15712ACE684882C40E47DC8827A12768A56FA7
SHA-256:	8A4D1AC4E1A0272C147173CFF86711028FB8D0CD944D98DAD8CC013C462C8EBF
SHA-512:	9B50630AED63B9A7F274626AAA6169293E80B5BD2675F3C573307DFE3B2F4ED44CF26FC940D8E887F0DD5704186434A567590E6137D210988778D6322063C7DE
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Wersja",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Informacje o ochronie prywatno.ci",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Gotowe",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0D7B3AB56D641A87696C4D7861802CB559C2F1BE08BFF6F2E435DEFBE8F7ECFC73135DDD88EAAE9F2CB34E783D1FAD68739D4EC473D6CB2CF389DA4B49EC967F++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-pt-BR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.5527621729689685
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfqX6v9LuO4bicmHbkLwT5zxjAHo8kf9wuRToVoHGqQhWngT:7e9SlNLiafBv9KO40HWIOHo8K9ZRpmqE
MD5:	28785D55CAEB93DC4DAB0E948BB295B8
SHA1:	B05E40516159DE35EE28E69E9027C7EEB217F53D
SHA-256:	299E921BF57E002F61B4831B666DDC3B67A4BDC53ED42EA28DD3F6221D44DEE9
SHA-512:	BE3E4BA37FEE694D8F1F535822E557A325891B0FEF100F37C907D9CE09C6E53C3959BCEF5EE7A31266DB4EFD92B910888C93F44B47A978E1F69F96434F8314B4
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//6384AD8AD4D850A59D39F3DF8D3E6FFC05FBFC8FFB3AFE45226E4F6BE153C05D14FD4108A00C5732762890D6B5A991E32590D693E6BE198229630DC131620C87++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-pt-PT.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.561157492608534
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfqX6v9LuO4bicmuybkLwT5zxjmkf9wuRToSQwCeO:7e9SlNLiafBv9KO40nWIoK9ZR7O
MD5:	6E9EBAC171792EF5C6F675889922D4E3
SHA1:	7EC4E4E9A6C05FEAD73A3CF0C0B30D599AC7DF94
SHA-256:	6C5A8D69D2FD38010862BE52AE391308663CE074F6B0E044F67C60A873F02812
SHA-512:	5341A9DC69DB49FEA4E7B82C02D57DBF51C549DC02B23E0FCEC7AF077552534249F8502044776D9BB0987EF12E1321A3A22EC0BC2A171FCFAAEF5380A188623A
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de Privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//58A82BDC7983BE1E70FE02354721ED75ADD01428ED2050CA7791180C6104C112BB5DB8E540169E5C91C0073A6773072B0F6BC2A1396F9FB25F73547F67070B8A++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-ru-RU.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.737759761884001
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kf96v9LuO4biq0epiXbkLwT5zxjhKgE9wuRTo3xP0XPUXR1wvE7nn:7e9SlNLiafUv9KO4zrWWISt9ZR6xP0KD
MD5:	E5366F92DC09135D4640ABB48E3D98D5
SHA1:	9924C9AA3F6A5B53E0682F2C9047D9DCD3825D12
SHA-256:	2D800754132F08AC208F3295F5EB6A3ECA08732CAB0DF5C146FFBC4B3864CC28
SHA-512:	094A4A7A669CC338B33867470A0D0ACC3A79959DEDAB1054557F2CC262287A5844481D0154DCAAE713D82F3C3F2CB999474AF848A53A54CDE2F9FEF51130CEA3
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........... . ..................",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "......",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//DBACDB75FBA39FBC15B351D433142ED25DB2AC0B412CECD79AF5708967C1C7BCA3374D5C31A7810DE779A2376DF88FC613485DE7403C105FEFCAAE13F10E164D++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-sk-SK.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	719
Entropy (8bit):	5.625409797709229
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfa6v9LuO4biIAbkLwT5zxjAHo8+9wuRToFyChIAZqXh:7e9SlNLiafNv9KO4uWIOHo8+9ZRCyhAC
MD5:	4230B155E5353C646812C4B20A90A814
SHA1:	9C2A64A9AD57DAE5FC6D236E1A68FDB84F98F1BD
SHA-256:	068D918BE3BF86CB7DF6DF57E46437AC3444D8EA517F9198F80D454A5FB16D5C
SHA-512:	A63B3886C005C976A2FEB66103D1B5B0747D378E03F3591D98FB0458C50825B971D8CE4932AA0088EB28374AB9646B3F791BDF997C9B835EF81807D01D28EB64
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzia",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Vyhl.senie o pou..van. osobn.ch .dajov",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//1698D976D7AC87F831659B59C60859AD6FBC935CCC12576FB6028F661C7F8E9DDCEE146AF5511923D30C7B2C5D2C545F1D4EDBE57ED8FF9EB69DF309F3F67480++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-sr-Latn-CS.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.560681855604894
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfv66v9LuO4biagkcbkLwT5zxjHT9wuRToeS+5biFKh:7e9SlNLiaflv9KO4cjWIVT9ZR8+51h
MD5:	379010E8E69CD46B7ED701D46C0274E8
SHA1:	26385C67C579AABA0126B71F0DE2CF7A4CE42139
SHA-256:	C73D7384F7D7468922ADE76DF21C28BD82AAC84E3183A5ADD983A635B5B0599B
SHA-512:	32686912626F89BBAB1739B18DA936DA20F70245D7524346C10C1F80E8C6463D291F2C0D04C9FBE79A37FE7158A8C673A51E142215C7BC9C23E3777ABF9D3459
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obave.tenje o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//81BC8CD8174ABC72C657AA1ACCD80081D790AABC38287E28008535C781AE076513523744D7D80A922489EC406F62A5F8430F7B5DBD6D02646433F82C562FA6F2++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-sv-SE.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	690
Entropy (8bit):	5.551835977982428
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bieGbkLwT5zxjmf9wuRToCBdA1urQhJI+wJ:7e9SlNLiafLYFv9KO4JGWIof9ZRpKG/
MD5:	3BBBA0177E49E07313D7AFA2D56FEB5B
SHA1:	B8A9ABA78CF68595606290E647D63EA61266DD1F
SHA-256:	FA7E940E883699DDA4C7F68408C33824574039570B0F238BEC73ADF54DF7A8F0
SHA-512:	4B6F2AD8C339877CB6CA20A3178007752E4AF7DBFABE58D00A234FDAB6A9888A310A93159A06576CA8D323FE37C650C5C7B77D4B7C6877628DFB1DEB2ADDDAE2
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Sekretesspolicy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Klart",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0B8440823AF6C68D538110EDF9B1057AB7F8C1344531F24CBC5959C7227B25E29BA23672DABAAF461F65B9F65E0E1368C143B4C026F21027AC9EE578336A7147++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-tr-TR.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	696
Entropy (8bit):	5.55794047416744
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfT6v9LuO4bij2VbkLwT5zxjAWoN9wuRTo8n0YPgWMkBhADQPh:7e9SlNLiafGv9KO48QWIuv9ZRvn0RK28
MD5:	824BCE38448D0B743D4476B8370F2C3E
SHA1:	E838BEBD1F9DC325B9E45627049D12C482095D0B
SHA-256:	5055352E2F168228580BB4A56319D9B6598FE1C100D324E10F7648376ADFD126
SHA-512:	B0D3C64B42845A0F0AF4FBFA3E48652236B1E2B971B4F92C11A998854BF3D7EDF619FAD422CFB8A9B1A9129151895580E6D6B5D15A4936C32BD4F2DC0A7E9AE6
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "S.r.m",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Gizlilik Bildirimi",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Tamam",.. DONE: "Bitti",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BA08A3B8359F502901E7D31E0480037E54351C96475E3E93E59079DA9A82A2DC78686CBD1579E3ACE9B26C82C069D2AFBBF896D32619BF9378E06BFCDBD2C09B++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-zh-CN.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	713
Entropy (8bit):	5.910535895650701
Encrypted:	false
SSDEEP:	12:7ekSuKxi7s6kfF6v9bgbiE4ebkLwT5zxjtDYv9wuRTo+sCfxRVc:7e9uui7s/fsv9bg/HWIv49ZRxZfxQ
MD5:	88A78221CC6E88E6DB37C449A1D1AEB5
SHA1:	9017C3F33738B08F6A99D567D57BE297E2E02F7C
SHA-256:	501566824AAC07EE52296D3410F9CBEF3834CE71624510E51228C25C6D26E084
SHA-512:	F77DB85E5F805EB1EC5BF4019F13091551B52794CFEAB3C878781E0142F6DCA951DD091BA013D19F03DED6A86CDDDBD5223D33143029919980D10A8DB63A571C
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: ".......",.. PRODUCT_NAME_LIVE: "..........",.. PRODUCT_NAME_TRADEMARKED: ".... ....",.. VERSION: "..",.. WEBADVISOR: "....",.. COMPANY_NAME: "...",.. PRIVACY_NOTICE: "....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//3FD962EDECC3B234D81E83329F4821B544341288A1BCDFBBFD54E680F6B982CC48E6C1257714B94C9335E839FF08DD1CE27166E81DDCE3CC0F2B71563A6EF948++

C:\Program Files\McAfee\Temp3475153614\jslang\wa-res-shared-zh-TW.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	694
Entropy (8bit):	5.710761896835509
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfF6v9LuO4biP3emebkLwT5zxjgDYv9wuRToflpU1PM0Rhn:7e9SlNLiafsv9KO4d1WIG49ZR9n
MD5:	2657FD5592A96D8AECB301F21F28887D
SHA1:	4D890B88E4C6FEEE10A2DA20C8616E4E35C8BCB2
SHA-256:	E43BEE2A6045B1703EBA1101350E3205FE3E7F734E7EF69B37303F72684CA9FB
SHA-512:	1218C8EE669D316DD247830058B4DE225870377AA5362E3DDE8A52E756210BE19C428F8A22875DC5D66A6C7E3C5ED9F12FD237CBC4DE42EBA2881A2424BD2F6D
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "..",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//779C74F28EF2D51F12A816128E5A3064780E7FA615050C896D51C037DB0E19D7BA8AC249CF54879EF4983799B68C53F507E053D3B9FF1911A15D49784F8475F4++

C:\Program Files\McAfee\Temp3475153614\l10n.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 259160 bytes, 513 files, at 0x44 +A "\l10n.manifest" +A "\jslang\new-tab-res-toast-cs-CZ.js", flags 0x4, number 1, extra bytes 20 in head, 39 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	280600
Entropy (8bit):	7.93298350917189
Encrypted:	false
SSDEEP:	6144:do0zCRw+H4nrXkT8jChIorjjm2rd90XnAT524rr:2uyw+HUO8Mrv13CADn
MD5:	5CCC4C0645E5C35756C7A2E8BD6368F1
SHA1:	8FB2662037C528993EA3ED80C6384F7B2CFAFBFF
SHA-256:	3E3DF2DE1E9122E6F0C556E1FD557829A6F05C1D95E56EBFE7F25865825157C7
SHA-512:	63DA51CF8BEB96F7FA3D27BD62E6655870C8E193809848450CCDD36DD28765E240279AF744A54C586431E28CC02312C00BA439A205FE8725059927A3A316157E
Malicious:	false
Reputation:	unknown
Preview:	MSCF....X.......D...........................X....S...........i..'..............Xst .\l10n.manifest.#..........X.t .\jslang\new-tab-res-toast-cs-CZ.js.#..........X.t .\jslang\new-tab-res-toast-da-DK.js.#..........X.t .\jslang\new-tab-res-toast-de-DE.js.#..........X.t .\jslang\new-tab-res-toast-el-GR.js.#...!......X.t .\jslang\new-tab-res-toast-en-US.js.#...D......X.t .\jslang\new-tab-res-toast-es-ES.js.#...g......X.t .\jslang\new-tab-res-toast-es-MX.js.#..........X.t .\jslang\new-tab-res-toast-fi-FI.js.#..........X.t .\jslang\new-tab-res-toast-fr-CA.js.#..........X.t .\jslang\new-tab-res-toast-fr-FR.js.#....".....X.t .\jslang\new-tab-res-toast-hr-HR.js.#....&.....X.t .\jslang\new-tab-res-toast-hu-HU.js.#...9).....X.t .\jslang\new-tab-res-toast-it-IT.js.#...\,.....X.t .\jslang\new-tab-res-toast-ja-JP.js.#..../.....X.t .\jslang\new-tab-res-toast-ko-KR.js.#....2.....X.t .\jslang\new-tab-res-toast-nb-NO.js.#....5.....X.t .\jslang\new-tab-res-toast-nl-NL.js.#....8.....X.t .\jslang\new-tab-re

C:\Program Files\McAfee\Temp3475153614\logicmodule.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1528797 bytes, 2 files, at 0x44 +A "\logicmodule.dll" +A "\logicmodule.manifest", flags 0x4, number 1, extra bytes 20 in head, 136 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1550237
Entropy (8bit):	7.999630270555075
Encrypted:	true
SSDEEP:	24576:ZTuuP9UjBassdZ91ABoZ2FvYwzmSR6RWen6Dk/npoAfaV+WrsQ8Jy/:ZfPCjE9vZ2vzl6RW6eFACSQ8c/
MD5:	9501B1366FEB857135E5D252618C1EEE
SHA1:	75C2463C0414BD7A446FAE59818B5E09079F1BF0
SHA-256:	2D0AE00ABB55E00F80A39A155272839D315F2C874CE597C3B2C49F89E8A34321
SHA-512:	05DDF40CC35A4D087033E9FA60C61E783E254D1D7F826078588A275502EA5F0AD68788213F73E8281262FACAABBC80F613215D2A1F876E89948B8835CD0A19F9
Malicious:	true
Reputation:	unknown
Preview:	MSCF.....S......D............................S...S..................(\|C........Xmt .\logicmodule.dll.....(\|C....Xzt .\logicmodule.manifest.m:..h..[...O ........5.....}_j.o..VX...X...[m.-.5;.DI.[..v.Y....t......:T.V.U-.....),..B.1....@3<....y{.....z..\....9...&.$-9.s..R...u.``......ee......m...#..H......8B...".0..GV+.dd.D...$...RH....i.:.7.o....s..y...........3#.;{...o.o..}..9......6_......S.....B...bb.$."+@..I.R..$....E.@X.....=...z..D&..@y........x.....:#9.o...F....1.yz..@...4d.hX..].~..v...f=...F.e...:.4n.$3...(t..4D.5.N.....+Y.;..y.>.e...W.P.!...Cxk......6.}!.6.K..'.=d...N.........dl...o.f.?.R......h= ......X..B....N.s..4b..Z.....~G..=.......g..Z,m.....^\<..u6......?....'`U.V.6.\|..z`.n.xZ...:Km..&....%z..q.u8.;.M....<+8......q...b..zW^[B..k.3M...\|....,.>.@.k.z..j.h...I...@........R?....u..v....~.`\.^{...{..r-.Yg..m....uu..P...v......Z.U..a.a.\|W...'....l.v.~..>..g.o...m[Fm....oUt..H.z....>UW..o.(t.....U....=....0$.q.=.........#..C.@Ag.

C:\Program Files\McAfee\Temp3475153614\logicscripts.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 37587 bytes, 20 files, at 0x44 +A "\logicscripts.manifest" +A "\logic\aj_logic.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	59027
Entropy (8bit):	7.928603007372189
Encrypted:	false
SSDEEP:	1536:Do0PgPT012RM/oOgIjhDvYFGBQIIrGg4icxB7NxT:Do1L0gNfKXBQIISg4lr
MD5:	3B9B80964BBFECAC64F133B8969A7AFC
SHA1:	3BCD2415169B348BBC88B23285E71AC898C7C617
SHA-256:	1883BB949ED1F2F180A418B06745168A7123B378339F6BFCCAAE7A1ACBDBFBF6
SHA-512:	8CA928177F69B5238639C5E11DBFDC02FD1D2BD46E3FF72C67F24965CB754C16FF72AF730A2E31CCF95390FD41E03C354353BBDE68711A7F76FC4B38681136FA
Malicious:	false
Reputation:	unknown
Preview:	MSCF...........D...............................S.............................X{t .\logicscripts.manifest............X{t .\logic\aj_logic.luc............X{t .\logic\base_provider.luc............X{t .\logic\edge_onboarding.luc.v..........X{t .\logic\ff_monitor.luc......<.....X{t .\logic\logic_loader.luc......C.....X{t .\logic\miscutils.luc.#'...V.....X{t .\logic\oem_business_logic.luc.}...)}.....X{t .\logic\providers_selector.luc.l}.........X{t .\logic\ss_logic.luc..'.........X{t .\logic\tests_logic.luc......).....X{t .\logic\type_tag_utils.luc......2.....X{t .\logic\usage_calculation.luc......:.....X{t .\logic\oem_utils\affid_monitor.luc.0...[?.....X{t .\logic\oem_utils\oem_util.luc......A.....X{t .\logic\oem_utils\oem_utils_wps.luc.Q...~V.....X{t .\logic\oem_utils\oem_utils_wss.luc......_.....X{t .\logic\oem_utils\oem_util_selector.luc.o...ob.....X{t .\logic\providers\bing.luc..<...x.....X{t .\logic\providers\yahoo.luc..LZGZ/..[.... FNq...D34C.P..._.....t...I#79....t......u.6o.ws73d

C:\Program Files\McAfee\Temp3475153614\lookupmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 988221 bytes, 2 files, at 0x44 +A "\lookupmanager.dll" +A "\lookupmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 91 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1009661
Entropy (8bit):	7.999407210563558
Encrypted:	true
SSDEEP:	24576:ugI7i4+3WRSVfvT/K+ERsOWlzFPVvkus4Bi8kdJyooMIIQC:TbBWavLtERsOWfd8uBi8IrQC
MD5:	CCD008B192EF72A73B1CDE8E8DA62D9C
SHA1:	E907B1F670E0336FDC5085E30447B3ACCD932A3D
SHA-256:	7B6EDB3FF653A4E35D46B7DF1D38758BDF818DE7C11B58960933AA60D0B9906C
SHA-512:	089C1FF9947AE2ADD2700580CA9481BF4DEE7B258431BF8D25EFB4FE8682DDCA4F85956C3037919888C959A9A823889959DFCE1F9A1B84938DA5359DBBF39ABA
Malicious:	true
Reputation:	unknown
Preview:	MSCF....=.......D...........................=....S..............[....L-........X]t .\lookupmanager.dll......L-....Xot .\lookupmanager.manifest........[..., .q...@2.0"....>....^.N....u^._..-p.T..=J..W..p.y.^i..K...R..=K>....8.<\...[..p.2.".4.E4UV...W.w;....w...\|.I.t.$...&.......h......d..I.n..L...0.t.:..^...`.....Rv(.U..Q(.0....v.A.".E..P$B.............!.".....>..w...../.N.&d.s..........'..h?..zpQ/.<....U..).......7..}.\|.......5.G.81..3.1.2Y....p.....y?..-..[....p.y.~8!o.M.x......7..C.8..,./{...u....^,..m..h...tO'.......^..........I..}....2h.j.7.y..s...>..(....:...\.).GK.K..c..i.Kc..z.....7.=......y..>..x..I02.?..........S/......'\|.E~....w............6........_g..S\..tC5gk.....}..?.nL.u..h......E.d.?t7...{.....#..?.t.....OuM..Ox.Yr.<.......>...D.....'.gw...p..?].v?(pZ...&....J..C.\g?.......'_...S....p#v.]J.?.(...>.[....?...\|.g(//....}.....j...~.K=d...[*.,:L$.\.&...~.....C,.K'..:..].}....~d...n...m.+........[P.?Y&..8.o.9.l..?...{........L....i....?ue.

C:\Program Files\McAfee\Temp3475153614\main_close_large.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 13 x 14, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.185064395828422
Encrypted:	false
SSDEEP:	12:6v/7Jmynud+EVDvBXmY5j9yEhcZxAalEbKWwz:vyGbVDvxJ5alnWwz
MD5:	3F33BF7A71F1A94B30AD98121F2DC31F
SHA1:	533B933BACBAE375164518AF202EB90086BEFC44
SHA-256:	4D3581315F5AB93538BEE793BA9727FC9E8444E9B09773566C4BDF0C44618828
SHA-512:	4E768ABACB878A5F9BE79B91E9BC77778F62AA4ACAEC4A246AB3359E86FF685250A1BA9E7765CE5174A42E5936CFAC27CB381B505F92F30EBF4B43806848899C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................sBIT....\|.d.....pHYs...........~.....tEXtCreation Time.10/1/14........tEXtSoftware.Adobe Fireworks CS6......IDAT(...1K.a..........+ht...".96..\....M..f..9........ n....~.KK..o..~..g{8.:...I..D%...^..6V......w<K.......z.?..dk2..p.G.U.&...?..U.].m.O....L2.o.`<,.....k....\|....L...Q._.<.....?(...[...lW...O.6....Z....r.q....Nr..p2.d._.w...1....F.....@..x....x.X..T./.H..w./.yrd.......IEND.B`.

C:\Program Files\McAfee\Temp3475153614\mcafee_pc_install_icon.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 67 x 57, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	7.890065571351557
Encrypted:	false
SSDEEP:	48:CHjblGYXQQEZZyIOrNK6rC4lWVkOjKpgOojQ9dCe2LfmC:PYgNZKJKSC4YF+WjyOZ
MD5:	18344204EC04F1E95E086D3BC94FA0FD
SHA1:	87CA3ED8948774091B451F7CB2F95139E56D351B
SHA-256:	30ADF46FD9311E5C6DFEA8A2AB2176EBAF83E7019EE341896FC3AAA5F498D2BA
SHA-512:	13757DC62505D01E44523823F38001D28A2FB9CBA5ACBF9CB7D9BDD8D0F19583D814E5A47B2DB255E18CCC05C34D43A02C387B60D05D1E802F9AF527D3633C5E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...9.....ms......gAMA......a.....IDATh...l.........\|u...4q....T$....IHK.u.h...lS..{.....i.6..h....@PX[.&...AH.&.($E.(.R..).......M..:..}.g.M.8.c3.'........{....}.``....q.. 0..b.=B..?.:t......1..P_f5.......).7\..e..Y.gA.......XPL...Hss. .ks..... ..aPx;\|VO..{{{).`"...VAb....u.\|..>_..#......2>V......9.g ....<Bss.T....LFI[[..+%.Y.....N...~X.!......h.q.J.l...A.s...p8,.\|.K2..'.{.j..c.<.\|m..<.....'.K....zF...nu..<...\.a#U.Q.a#`..ZF%`...6..=j{ta...ax.....\.<.H....<>.'...x......./n..g..'G.z.E.\|.....(H~)2...U..O.?w...u.X{..j.v.D.M...z.9.\|.a.......\v..f..0....0..1Xs..p&5.C.?....XY.~...K...p.._.+....KEF......5V.f....l.u...N..../o....t....b.......z.).....v............f......L.:.n+..s>.r0l.i..&.u...1.J)..sk0l.j0j0l.l....C.......3Q#..7.......f.[..&).r.z..0..^Xs...z.-`....3..........{N.e...g...O..~[A.F...."....E.d\|..?.8S.........}.\|;.......>u..B.....Y Z.w.....W..:...Z+.r....+...7..._..b..........~.a..w..o........0.J...[.d...W..>...

C:\Program Files\McAfee\Temp3475153614\mcafee_pc_install_icon2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7205
Entropy (8bit):	7.9471260512499375
Encrypted:	false
SSDEEP:	192:KS4Do1RyFyKSZ4pTSumpAO/Ap6CQU9Uw/JLO/xvifnL:F4E1RCFpWumX/Ap2UeMq/xGL
MD5:	F2E3045621ADE164E9DA40F294BEB00C
SHA1:	36E9D967C679FC898BED1FF6751A73BB863EAF79
SHA-256:	D820CF499FC4A9453771A23209A6C63DDD2CE3439E8B651A98DDF0C36ED2BDA5
SHA-512:	7E515A44BD63B33881EE86E0A911897138F2BA0A6E81925612EAF19E3EDAC5A9FDCEDE30E3AFF3E906A4BBA8AA4570E06308D75783057015C882C7E62A880928
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......w8....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.................tIME......'..l.....IDATx..y.\U..?......./.@@....E&..P..GF.Q.F.....#..T..........D4.AC....b. +![w..NuU/.....q.z!.ToI@..SIW.s..}.y..s.U..?g.D?`..._T.(..}.n.I.w"+_..r0}y,.....`&....P......8.,....n.I..c@.4._....]@.J..UL.....A...[K........[.-...A.....g.'.N........#.l`.p'.d..o.@@T.P..tQ.A..........t..q`5.=...B.(Q.).."..`1j..&..n....}..e..].....-...x]..p%d.(,............g....o.C......p.j ..W~tW.3.]mq ...H.Q.P..-...Q2...v..O(..`...8....?.4...A..}#K...m......\|-.....w.2.m..lwL....Ys..y.;..\.Q ..p..e....B'p..........^@m.c\..[..Z!v....*a5...T#R..B8YH\|.....iw...8......,f.v......i`..:T.!F.\....t"5....0..._..K ...M.`.8d.5.9.x.c.v.A...Ug...Va.d.?..M]B.U..E.E.....: . .B5.B.1."......>...w7.-....@.P.;.d.LUp.D.0..R..TE......k..K[.>o...?.~....i..}bu...6......Pj.g.U..~'..+.\|.F'......y..t.p..0.6 ........E.).n`...3\-D.......^~6..

C:\Program Files\McAfee\Temp3475153614\mcafeecerts.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (2293), with CRLF line terminators
Category:	dropped
Size (bytes):	126293
Entropy (8bit):	5.969613768259596
Encrypted:	false
SSDEEP:	3072:sY+8or+sWZ21Wzwtp31uRla7GTvfwjBobALAnr+sqDK7G3lq0lAE:dcPsjO31ui7GLjA8rPqDK7Gb
MD5:	D0CD30BD9B02F33B222FF8A846821D4B
SHA1:	DA85556707CB3FD59E08DF69017DF6BB82E52F62
SHA-256:	1CC3969AEF3DC3DC2330DB0386C6C27C09A58D078689D8D97D900A2B9ABE31A0
SHA-512:	6C1F9DE0897F02648638B26F20728C5F2E9822F8CAD232ED42ACC18F33AAE7E102C7A00E5D42B80C10E423DB937DC6AB783255342B12B0DB07B378508886C2ED
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<Package Version="1">.. <Certificates>.. <Certificate Name="McAfee Trust:0">.. <Privilege>PRIVILEGE_IOCTL</Privilege>.. <Issuer>Microsoft Root Certificate Authority</Issuer>.. <Subject>Microsoft Code Signing PCA</Subject>.. <ValidFrom>20060125</ValidFrom>.. <ValidTo>20170125</ValidTo>.. <SerialNumber>6115082700000000000C</SerialNumber>.. <PublicKeyMD5>4A171B7E5701870357585DD1BAAD752C</PublicKeyMD5>.. <SHA1Thumbprint>FDD1314ED3268A95E198603BA8316FA63CBCD82D</SHA1Thumbprint>.. <Data>MIIGgTCCBGmgAwIBAgIKYRUIJwAAAAAADDANBgkqhkiG9w0BAQUFADBfMRMwEQYKCZImiZPyLGQBGRYDY29tMRkwFwYKCZImiZPyLGQBGRYJbWljcm9zb2Z0MS0wKwYDVQQDEyRNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDYwMTI1MjMyMjMyWhcNMTcwMTI1MjMzMjMyWjB5MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSMwIQYDVQQDExpNaWNyb3Nv

C:\Program Files\McAfee\Temp3475153614\mfw-mwb.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 10317 bytes, 6 files, at 0x44 +A "\mfw-mwb.manifest" +A "\packages\mwb\mwbhandler.luc", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1503 compression
Category:	dropped
Size (bytes):	31757
Entropy (8bit):	7.8184602661258396
Encrypted:	false
SSDEEP:	384:EwuFWPcXB/Xxu5op6WU6ki2HPviQUDvY9qnAM+o/8E9VF0NyBy96ki29d1ikpJAl:EvWm1M5Sf2HiPvYAAMxkEf2PsWAMxkEY
MD5:	1753F1F1A623519D38631A1FF7237FB2
SHA1:	B3F2E94372D3BDBDE8C99593F68D93FD224999FF
SHA-256:	83F3E39419CC39AF3B448B12CE9223B9F1AB344D5FCE9C0BDDB8553EF8058CD4
SHA-512:	34A62B1C61EC80C07EF9DF669D7DE77BD671B801289F8BB2739F57F989281E96513489A90E9A5872EF949FFB559B2036E9EF4AFB4D6066921075B0D71EC66BC4
Malicious:	false
Reputation:	unknown
Preview:	MSCF....M(......D...........................M(...S..........m.......W..........Xvt .\mfw-mwb.manifest.....W......Xvt .\packages\mwb\mwbhandler.luc.3..........X.e .\packages\mwb\stop-video-alert-icon.png...." .....Xvt .\packages\mwb\wa-controller-mwb-checklist.js......J.....Xvt .\packages\mwb\wa-mwb-checklist.html......T.....X.e .\packages\mwb\wb-rocket-icon.png./.E..&ZV[......e..A..#..O...T.C.2.V.....Q..Rv#....mkH...w..'..}+..;...D.\..@........k..$..!.Z.qp...4g...i....k.[y.{_KRf...:.~......y{_.72..unY.3.qcR"N..+.....-R...O...............w.w7.~...].\.$l...U.H....!..N.p....x\|...\|..a..Db.J.(.d..A...+4i..F..!X..F...,.`.I....Qn.M&..`..Ca.%.R.HX.m....X...`k....i~.D.....7\|.z~`.;-2..\|e.{..d.#T.,pcTNp.#S..B.....2...i..]....B!..w.E..$N......3.7.'P4/...l.D..$\|2\|L.z..l7g22...(...-sH..I..../S.....;.2Q..?..._8F....%+Yf.i&..Cy.'.y...EK.W.9.........K..2....Y.....e...`.(.y.d..."....O......3 %Od.r...Dj.S.. ..-#d'........'....l.X.P.j_.]...4..O@.1.].......W.....9.j....N

C:\Program Files\McAfee\Temp3475153614\mfw-nps.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 12604 bytes, 6 files, at 0x44 +A "\mfw-nps.manifest" +A "\packages\nps\clipboard.png", flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	34044
Entropy (8bit):	7.838660318695978
Encrypted:	false
SSDEEP:	768:XK/lm58W5rym2HiPvY/9AMxkEz0z2PspAMxkEZ:XK988iR4ikxX0z7xxt
MD5:	006ACD223A6F124B6D18DC54E518027D
SHA1:	CAD740D4F3228DDB9518A0BAAD6C75DD5765D88B
SHA-256:	22FFACD39AC79E89A2B90C4E7A4A7C7CF6D9C2E08E8E3821217770A727278B45
SHA-512:	8A21C1CDB957C1524122E992AF6F6919EE915A8602FB63195FE3CF77984CDCCBCFFA79DEA64FF87A8306D88B2BF79C4D18541468F5BFBCADCEFB082E6DB946B1
Malicious:	false
Reputation:	unknown
Preview:	MSCF....<1......D...........................<1...S..........Z.......P..........Xvt .\mfw-nps.manifest.k...P......X.e .\packages\nps\clipboard.png.-..........X.e .\packages\nps\info-16.png............Xvt .\packages\nps\npshandler.luc..j..{/.....Xvt .\packages\nps\wa-controller-nps-checklist.js............Xvt .\packages\nps\wa-nps-checklist.html....9...[..... .........3.7.K...,^a.......7.)..D^y..xyd$.J....W.....F......T.x+A...9.k%.]A....w:..%l.\|C.I... {._P..........d..j.h~=I.]A.c...'.y...X.....\...c[3...1.7.jAM1-:X.[..Ks....mF.,.Z........k.nr_q$_."....A.;....>(.[.....l....6....2{M..L.l?..y.....5...QI.\..Y.}....,......A~.M$...3.B!..?...}.8....,.......e..c4t5}....w.....&~.1.......0~..........Q.Z.nL..u..O.\|..O.M..^.7..%...._Go....../G.W......t.o.^......;....4....~.)6'.O...X..[.....B..~/s....~.~._V.7..6...k~..7.D.'........M....F.~_O..........(......_.x`....%.......sS.{..}~.....dIv.q..,.\....2.'..../.....A...%=.C?LI.B.....).1.cI.aHO.....%-..`(hi.!.R....0.

C:\Program Files\McAfee\Temp3475153614\mfw-webadvisor.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 902476 bytes, 196 files, at 0x44 +A "\mfw-webadvisor.manifest" +A "\packages\auxiliary\reset_handler.luc", flags 0x4, number 1, extra bytes 20 in head, 48 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	923916
Entropy (8bit):	7.997495912415702
Encrypted:	true
SSDEEP:	24576:PaJXOe1+AAgR8uGSdE2OnxhSPyJb8vu/j+bez1NYOyst+:PaJ+NgHbdcgk8dGmst+
MD5:	B180379055383F30732D39EB0269C79B
SHA1:	050DE5A6A4FD8297E31259F0E99343648D798A5D
SHA-256:	E53A3FE148A06433DB5F6B1C880A47836D7A55CABCC96EEECC1AC82DF95F8C90
SHA-512:	F8D60AB6C6F266D48CF828CCAE7D0B54381E49E8EBE5CEF6EF5A74A7158873627F378D7F6FDEE6E55CCF516CDE1876B442330723590454FD0982315C9755F351
Malicious:	true
Reputation:	unknown
Preview:	MSCF....L.......D...........................L....S..........F0..0..............Xut .\mfw-webadvisor.manifest............Xut .\packages\auxiliary\reset_handler.luc............X.e .\packages\builtin\balloon-arrow-right.png............X.e .\packages\builtin\balloon-arrow.png..5.........X.e .\packages\builtin\card_bg_image.png......N.....X.e .\packages\builtin\celebration_white_bg_color.gif.8...iJ.....X.e .\packages\builtin\close_icon.png.T....K.....X.e .\packages\builtin\dialog-balloon-logo.png..I...Q.....X.e .\packages\builtin\enable_ext_guide_ss.png..R.........X.e .\packages\builtin\enable_ext_guide_wa.png.d4.........X.e .\packages\builtin\enable_sideloaded_ext_guide.png..8.. #.....X.e .\packages\builtin\keep_changes_guide.png.W....[.....X.e .\packages\builtin\logomark_white.png.....<].....X.e .\packages\builtin\mcafee-logo-1.png.EP..Sc.....X.e .\packages\builtin\open_sideloaded_ext_alert_guide.png............X.e .\packages\builtin\progress_0.png............X.e .\packages\builtin\progre

C:\Program Files\McAfee\Temp3475153614\mfw.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 296487 bytes, 54 files, at 0x44 +A "\mfw.manifest" +A "\core\class.luc", flags 0x4, number 1, extra bytes 20 in head, 33 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	317927
Entropy (8bit):	7.995046777687174
Encrypted:	true
SSDEEP:	6144:u8fzK82ijeGxRjH/pTNDArMgkPiYYonSYuPCwvF5X1TpXE++5NkbS+h+1V45l:FzvRjp+hkPwYAzf+EbzE1K7
MD5:	6DA354DA78B5A7C52BE22572EB5EFC55
SHA1:	791B010349C7397157A97106B7336F008BCD5EFF
SHA-256:	638278C1247E614FCDCC34892738A8E43F39C0D8B44848B4DEBF9021E4888903
SHA-512:	53AAC6EAE168A28BE0CE4181A21633DB6B0A64E41673FFB8C0620D901CEA59A4BC59476BE85DA37834BA2FC61019A0E7EB82BD0A4D98DA9E3B42A0CFC3924C7F
Malicious:	true
Reputation:	unknown
Preview:	MSCF....'.......D...........6...............'....S..........3...!..............Xut .\mfw.manifest............Xut .\core\class.luc..'..H......Xut .\core\dkjson.luc.....B2.....Xut .\core\handlers.luc.....M;.....Xut .\core\init.luc.2....D.....Xut .\core\json.luc.....%G.....Xut .\core\logger.luc......I.....Xut .\core\postinit.luc......M.....Xut .\core\priorityqueue.luc......R.....Xut .\core\triggeracceptor.luc......T.....Xut .\core\uiarbitratorhelper.luc.....Oc.....Xut .\core\uihandler.luc.u....h.....Xut .\core\uithreadexithandler.luc.Kw...l.....Xut .\core\win32helper.luc............Xut .\core\utils\browserutils.luc.r..........Xut .\core\utils\common_utils.luc.c..........Xut .\core\utils\packageutils.luc.....[......Xut .\core\utils\settingsdb.luc.}...T......Xut .\core\utils\stringutils.luc............Xut .\core\utils\telemetry.luc.^..........X.e .\packages\builtin\green_check.png..>.........X.e .\packages\builtin\icn_mshield.png......].....X.e .\packages\builtin\installer_background.png..l

C:\Program Files\McAfee\Temp3475153614\resource.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38328
Entropy (8bit):	6.3296688801046885
Encrypted:	false
SSDEEP:	768:pBr3M65R3Q2HiPvYXAMxkERVQ2Ps0UAMxkEDq:pt3xLg4isx1S7xxS
MD5:	5254CCD2156258B8E56D8D2E235FD2DC
SHA1:	749724E3180574AB238C74D5891ACC9B363B2EEF
SHA-256:	55AA4B5983444EF6E2D5D25E7298EB575AC4A945AA5E29FCA47A75AC1EE6D62A
SHA-512:	1F2627EAC246F3E52D38AC596D80B170E0CAB3F859F22E290F9AF6A8E44D8D1D5ED907717AEDEAB1814A086C3B546D713C1EB199C42B445D5B1E7FD7A366B757
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q=.0S..0S..0S..O...0S..OQ..0S.Rich.0S.........PE..L...)~>f...........!...$.....>...............................................`...... .....@.......................................... ..\:...........@...U..............p............................................................................rdata..\|...........................@..@.rsrc...\:... ...<..................@..@............)~>f........q...............)~>f........................)~>f........l...............)~>f............................................RSDS.p"...I.%=......c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdb........................GCTL....p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..`....rsrc$01....`!.......rsrc$02................................................................................................................

C:\Program Files\McAfee\Temp3475153614\resourcedll.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 30232 bytes, 3 files, at 0x44 +A "\resource.dll" +A "\resourcedll.manifest", flags 0x4, number 1, extra bytes 20 in head, 5 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	51672
Entropy (8bit):	7.920494071647311
Encrypted:	false
SSDEEP:	768:GpvGL8wijt0Vr9frJqiiIyFLAAy7Knb2HiPvYZAMxkE8CF2PspAMxkEE:Kvg8NMJqpIoL5G6b4iyxQG7xxQ
MD5:	08B4E5D3F3B19BF35BE7E71F107C5E18
SHA1:	64672EFA144601751BDCD50F217B15C767A15DFB
SHA-256:	F39012B54BA8AB45AFEB81257FEE103D8E96F74EEE8ABFDAD1156DCE80F19254
SHA-512:	CB28690C7CF4AB22E849A8F3B3FC3E2DDDB971F0E51F32516DC6461ACDFE03E5B52A9694FB37210A41AA6D26FD61A31478F458FC0B3C23A43AAE0C14BA157536
Malicious:	false
Reputation:	unknown
Preview:	MSCF.....v......D............................v...S.............................Xmt .\resource.dll............Xst .\resourcedll.manifest.4...p......X.e .\webadvisor.ico....l.6..[.... .fq..@.....@..;>...h.....ZH..C..E.KH$.%..JD....I)RI(Q*.E.m.@F........7~{.....$A..i.3..AR<..]..9....6.Y..f>zQ..whV..7.....n..a..}.xoY.(.b.!A! .d...?...t.. ..D#`E`..........9r....Hd@.E@"....P..h...6"....?.k...F...cy..(..K........B...c~O'.4.RE:m.8....E.s..C(q.."\\C...........V..49.4....d?Wj...pe/..-EeK.`\F...K[.T?.....z:8..1...0.......\..J.....;D....O..`..\|..u..../...\|.A4&....Xg';.\.\|.A....,<.xZ..;l'M. .B.}B........../.X.2....9~FI......hxc....^.'S.t.....^]^Qs1.7......%f._...J..c..6...xc.r-.@...6.tv.~..P....LO...[.Dei?D.A.$6&fw..6.//...7...;.......'...AM_}..<......n.;.74.%}>/.<..c.._..^.....}..f.n.5...........0..=O..K...i..9.$.C.....\|Gq" ...v.....>....._.k<..G....0>.....F[.D..1 a1..F.....2RaD.P..(c.F..Z..2pa...v?.....Pu./...i..}....C..s.^..1N.G....#Sz;..\|.Xm...1C.~.......4@....V...

C:\Program Files\McAfee\Temp3475153614\servicehost.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 303751 bytes, 2 files, at 0x44 +A "\servicehost.exe" +A "\servicehost.manifest", flags 0x4, number 1, extra bytes 20 in head, 27 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	325191
Entropy (8bit):	7.996834510537515
Encrypted:	true
SSDEEP:	6144:R17qYKB1HuwYYemnrgBxjYq1ATyres5QT9swAEs2DKhQJLKx745r:r7qYKB1dtn04qm/FTOwAEs2DKhWLbJ
MD5:	D2AC362FF38FEA03B7B06B8EC47CBED0
SHA1:	1DFC1D653C753FA0CF03F7277176FF539475D87C
SHA-256:	88A6F34CA571ECBCEFDB56CA59D1772CC4DB96856A67A3F4B00C4F4841919508
SHA-512:	0DC34DB6B73A58B10271F273E0CD4DA2CB0CD76895DEBEF5E7D7322AF4624049FD49ADF650E3346E18E32133F28393F8B5C2B67304D2BC7D88BECF9BCE47C90C
Malicious:	true
Reputation:	unknown
Preview:	MSCF............D................................S..................`k.........X[t .\servicehost.exe.....`k.....Xnt .\servicehost.manifest..t.&....[.... .....PC.$"....>.EF.I....g.def'pvF..}+ Bf5.8....\A.f.Mv...2(.....d.H......r..vkk.h.AD...........o.....]...._...].$....M)G.......4c.2.h6.q..p.U8...Z,...n..d.(`@/.$<@...\|J.%k.O..0..... C.SPDT0..y........0..s..........V......Y...Y.M..l..gWM..Y......r....f.G9...Cc..1..x.1.<...(..72R.'..m...Z......*....>.w......{e..M'Op-.W...ew.o...feY....!...?oP......xq.x1..-'...D...78.I....f........]...v.......m&/...M...y.o..}...S.....N._3MkQG..%cy..;>[..yR...H.O.^........m=..r.6.O.....>.{.(..8/F..;.O-.E[...._... 1...9bT..7l..n.....".=..y..5.`.kJ._;..y..y.V}f...J..}..;..l.H..~....P.r..s.j..o..1j.....}...g\..;..YY\|........H.T..sqv...}......Mq.........f......3.d..v...O........K.?.u..h........s?2.p...>....^o.D..?l.9`.....4..[....O=\|..o......._.."Nr.QrR.............f..c..^<...U..H.6.............5.......

C:\Program Files\McAfee\Temp3475153614\settingmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 785833 bytes, 2 files, at 0x44 +A "\settingmanager.dll" +A "\settingmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 63 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	807273
Entropy (8bit):	7.9994243096539694
Encrypted:	true
SSDEEP:	24576:jyvFd+ZKPYehddUkFr7llaMYXenAzFp7nc:2vb+ZTklgMYXeQzjc
MD5:	C0C685DD96B3F9A94A10197E4DFCC851
SHA1:	B8745C84E5A573B7A5349001213229D704579719
SHA-256:	6ED8C980565EF3F3A091E4A8CF314DDDCA86E38465B62450A9C6AB153811C8E2
SHA-512:	03E1D8835B2845D529EE54487B8FE2ABE63C82F28697BDD1115E2F7C40B24C0DF8CCA93E6B8D58B08E52BB4082F0131940917204EE552C85565AC7B515FBC492
Malicious:	true
Reputation:	unknown
Preview:	MSCF............D................................S..............?...H..........Xit .\settingmanager.dll.....H......Xpt .\settingmanager.manifest.1.<;....[.... .....GR.C"....+}S.mu.M.T....&.vYIV]R....E6.....J...R..lP.q...?..2....}.....6....\|...~..^..P.....43UU.`.V9.......^..p.....(".k@.z!2-."n.KY..k:v2h.P...q.. .AR....C.....e".0`...Cx.........................z.._.P...2.Fu..?.).#..mW.kg...Lkt.ypna...K......nG\|.....q..d..2.O..x.5......9.5.K...8.\|V.c./......;.v.-...=......W.}W.......}}G..x?g.>.?.....>D.+e.M....~...N..{.F.}...~j..8....K&......9.t-_]p.....]Kg}.r..og...i.....+....3......v..e.f..<.....V..o.k.Z. .....j......xz.........._......o.E...~..}I..{s.p..Z.7=.#..N..?..z......Wm.O...m.2a_...?..#...\|<.mw.p.?..>......,..t....Ew=.[....FW.>.....d.O....k....+......p.s..H....N.);\|.]......;.O..........K;u.{..]......{.\|...v....K9.u9..../..._.......~....G..0..K...-.}......?.\|....s.ct.....{tt..z.L...1....................}<..+.~.y[w..I.5.c......{.

C:\Program Files\McAfee\Temp3475153614\taskmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1279869 bytes, 2 files, at 0x44 +A "\taskmanager.dll" +A "\taskmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 118 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1301309
Entropy (8bit):	7.999637697498624
Encrypted:	true
SSDEEP:	24576:xuPrEOR1frjDyZV1+3lgBZuiqVcw5m/h8fcrBkKwPNYUa09EMaQjzNP0sA/rbPty:MPnR1uZjLqt5m/BBkHYUaCEV8PlAvPty
MD5:	8CF6C31C071EE0B2D40BD3B573412BB2
SHA1:	D35907DC3C0A3DAB95E9283ED240F92D9447EAA8
SHA-256:	DDCCC80534F3A777BE411A85E123A1E9E5A027A667099DE9EB8079012B15C11D
SHA-512:	5B986DFCEEAD00DD4F6FEAF1D0C38E20F15148F5E57B1C13647AA788695F4EC082A1838B99C6D104359011BC2546C5ED10E6D3AA9F5BC4EBAD5C2776AA11DA56
Malicious:	true
Reputation:	unknown
Preview:	MSCF....}.......D...........................}....S..............v.....:........Xmt .\taskmanager.dll.@.....:....Xpt .\taskmanager.manifest...$.....[...= ....PC.$".......2...@.@T..$D.` .fkL.F..` D.`h.$.....C.6[`..1w.5..Dv.-.i..N.B.m..=.b3'4DUUpgp.9.;...On..5..w...U..0.qu..C.[...i.2d8.......QVj..V..P...N^(...a.$.....E.Q:....c......_.`..0B.............. 4.4de.P.w...........D...r.z^..H-*...8.q..n./=..g.8..n....W...x....z..{.kg.?n....?...%G....1....ca.8.[..!....B.hywl.....#......};.....yn.?+.q......n;..yw.h...?..qI#yz.O../.{.G<.E...i..~...h....wq.8.....}..?...p...,....?......-9y.n..\|.Ggup..'.."..!^...].oO._...Q;....O...g.Km.}..3..(.g.?.......'........./..-..._./....T..>..>........._..c.x......zLGo.h.....v.yuz\.{\|j...c..-.!ysA.m.h...[?....=9.g.......y.=..?.z..-..Y.....Q.....>.....U-......w.7...l........?........._q.......O.n\|...)1W.s....oj.%..q?W....[~....3?./.[A......1.,W-M...~a........`.h.M..[?E..:?.?...c_un.9..^...I....Yn).pK..g.ly...&~...d..7+....=

C:\Program Files\McAfee\Temp3475153614\telemetry.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 71086 bytes, 123 files, at 0x44 +A "\telemetry.manifest" +A "\dimensions\dimensionconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	92526
Entropy (8bit):	7.923914299589199
Encrypted:	false
SSDEEP:	1536:GJk6Ss4QjgzVPjanY6r2vBOfQgACygr9pZ7N/GMwFlL4iH3xa7/gxsD:GJP2Qjij35OfQgwG3N/5w3L4mIjDD
MD5:	93D7BCC823AFF1FCB98F1A913DADEA1F
SHA1:	01256549663CEC9D6EB7E51D1D976111090F829F
SHA-256:	BF80C0E6F1B2ED8E7F2D72D8F4FDA1C6FDB35F60AA75914E8B4867175B981759
SHA-512:	CC428AD9705140631A527968C5BEF77ACC00ED927A13A5433360B6444F4D492514D89D9BB5B68244CFEAC8C1757F3C8ED95B0421B404BC3653903D0F6AC7100D
Malicious:	false
Reputation:	unknown
Preview:	MSCF............D...........{....................S..................@..........X{t .\telemetry.manifest.ym..@......X.p .\dimensions\dimensionconfig.luc......x.....X.p .\dimensions\dimensionhandler.luc......z.....X.p .\dimensions\dimensionprocessor.luc............X{t .\dimensions\version.luc............X.p .\events\eventformatter.luc............X.p .\events\eventhandler.luc.....(......X.p .\events\eventtransmitter.luc.....*......X.p .\events\handleonnavigate.luc............X.p .\events\sendonping.luc.p~..@......X.p .\events\telemetryconfig.luc............X.p .\events\telemetryhandler.luc............X{t .\events\version.luc...... .....X{t .\serializers\download_scan_ui.js......$.....X\|t .\serializers\edgeonboarding.js......(.....X.p .\serializers\edgeonboarding.luc.<....+.....X\|t .\serializers\edgesecuresearchonboarding.js.....j/.....X.p .\serializers\edgesecuresearchonboarding.luc.,...Z2.....X\|t .\serializers\extensioninstallationtoast.js.]....6.....X{t .\serializers\fw_av_warning.js...

C:\Program Files\McAfee\Temp3475153614\uihost.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 298787 bytes, 2 files, at 0x44 +A "\uihost.exe" +A "\uihost.manifest", flags 0x4, number 1, extra bytes 20 in head, 27 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	320227
Entropy (8bit):	7.997223956711411
Encrypted:	true
SSDEEP:	6144:VYWEWTZwXmZsAgxDBS+8yTlODJeT/Rtcj4lQo9MIraodc7/Ir81jYmHAcCJE4CUr:VYQwXmZsAgxDs+86lOsHcKCIraoVIF1S
MD5:	90A174F59AC31ACAFD2D4DF00A661EC4
SHA1:	483C58D8A0A4164E21CD503A805C42D95E62BC85
SHA-256:	96143A282E06A937A511619CABBA7CEF75B236B1E0C3E110B41EFBA47E9F2F9D
SHA-512:	77D389628EE12C1C55F591DAC3D0A1FC34AB684DBD3302DF4796D35A1BBD466D6518DCD1FD48B1EF07F2930E7B81BB2B04AD70B7D6254FA3DF2E0B981E2D0F05
Malicious:	true
Reputation:	unknown
Preview:	MSCF....#.......D...........................#....S..................@..........Xmt .\uihost.exe.-...@......Xst .\uihost.manifest...Y1. ..[.... h}...PC.%"....h....$../...$......./#.i.g(..i..`.@..Oh....3..........36:.;...x.l&!gg.d....U..>C?........sr `}"D.,.".!.{.. ...V,.4c.2.`5`.E.5Ta.7q......L........z+.$.Ht"................N......*.?....59.e/=.=>.l.~._6.Fz.....7~.v..m..&.q..$...s..y.jn!.s..\|..../..<.=q....o..<..\|1\....wv.}.2JJ..c...xD?.....Uax...]..V..x.Q=...~._...W....0......Z..{<..$d.......v.G.dz./^.....z...6.....~.>..#6.?./.>vn-w.....w../.....r.t.{.7..........0..s....\/..7...;M.........<..au.......~...."a.C?...G\|..%&...{.~...o. ..9..\|yd~i.[......n..@.0...xz......;...u....9....\w..c+..k;.1..._.^n._J..?..c...8b...{......[v....v.......s......g.<...{\^...Sk..e.z...o...7k..w.j.Lk6.A.[7\....>..~3...\|y.25._....3..C{..{.....75.5.?.....o......-......_......z....3......c....?.r..@..L..q..!...P..........7_....b.zx....z....g......{.....

C:\Program Files\McAfee\Temp3475153614\uimanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 1763887 bytes, 2 files, at 0x44 +A "\uimanager.dll" +A "\uimanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 166 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1785327
Entropy (8bit):	7.999503219323347
Encrypted:	true
SSDEEP:	49152:GIc4QY92ZrV7NYPe+3zYqlASQ6EZjzLK4plBp9T2:1jQBrXYXzYq6SQn9LVDpN2
MD5:	96E263C704EB690D769C95B1C34D03EA
SHA1:	6902E7C2F81C238A1A19994A2F22231204BAC752
SHA-256:	D1CCFA367F07A6E271ED67F1F3F8F3936EDFB6274D66A80086E9CDBB47931E0C
SHA-512:	A2E83FBE91C04305BCE0EED423C8E0831E4D98C07224AAF59D8FEB961F54ECED4E569B9BCCC751AF718E263945A2CDE0F3B3294A1A4DD61E6A437A1A7304B80A
Malicious:	true
Reputation:	unknown
Preview:	MSCF..../.......D.........................../....S...................~R........Xmt .\uimanager.dll.)....~R....Xst .\uimanager.manifest..\|..><..[...S X....@.. "......m..}.nyl..yi..~.^nyh]^yhLnzi]n9in+9(\-9(L.9(]-y.Mny-].y)m_x(.-4c3DU4`vg......~..o..][.$...C..VE"ItXmg4.3.....U.J...G......TD.k..i..Hfn........Yci8Ba.x...=.c..Vb.`....\|.."....P..&.R.A...D$@A.........!".."(....Y....2..2U..Rx.............u."-...............6j{....G.WI....W.<I....mH.Kg.u...kA:..t..7...v.n....O.. .<.......W.T.>...e....1.>..:......uJ,Z.6...F.t...lE.y.p.....^t...\...c....u.t'N/.\|..k..^...C.L.E........m...y.........k5......MKO...~..=.....R..[......U]?.v.~..[.}F6..~..6....,........>.r.......P.?..]I.Z~...]...{.t.......c;_$.=...:W.j..S.k.}.....\|..........(.:r.W.4....m..P.E]..V...?.........r...1.{]).r{.'..w0..Z.V..?.7....\|.....U.k.7..n...~...._...&...A5...........[......z5....c..j.w..{.wf.;[gy.^...1..\|....2.'.l....w?7.6.N................t...v.!L.iX.y..M.4....9.a....

C:\Program Files\McAfee\Temp3475153614\uninstaller.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 972838 bytes, 5 files, at 0x44 +A "\uninstaller.exe" +A "\uninstaller.manifest", flags 0x4, number 1, extra bytes 20 in head, 86 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	994278
Entropy (8bit):	7.999378863053224
Encrypted:	true
SSDEEP:	24576:523uSfpUsFxPaLNkvS77k7T4wEZokBs+F8VFNKXL:g3ucbPaec7k7UwEuCs8GNKXL
MD5:	2319C2AA297F5FCDD8956458F94D1A1E
SHA1:	E0C9A5398274BDBE17163200DF8B9200543B4DE5
SHA-256:	ADC108549827342AE93ED7163A61CCA1296824B3BE54E266DC5C779F8A7A87C0
SHA-512:	6778E179EE471C613947B729F6DEC579F6B50640B46336B97BAB5EE468371B681885058AF4CABF6842294E868A03D72FD6E10B76F181F2DEFB9E516CFD38716C
Malicious:	true
Reputation:	unknown
Preview:	MSCF....&.......D...........................&....S..............V....O........Xmt .\uninstaller.exe.u....O....Xwt .\uninstaller.manifest..'...a....Xvt .\wa-ui-uninstall.js.....s.....Xvt .\wa-uninstall.css...........Xvt .\wa-uninstall.html.o5d8...[.... ...@S.$".....^VZ.NdD.`.~...~.BGE....JF.....eA..A..o.&lV,.<.A..A)H)..0..4cV.1.!.......33.....?.o]..qr;u....#X... Z_.6...S[.....K....]k..m[w.c$.K.oRc...N.c..Rjbc...f"...K&....J..Q.....A.Az.}...A1...."...r..vi}..F.G.u....W..'(....r...4..E...F........A]P~%w..do..~.L..Q9......v.}.c......qu7..p.=...w.5.......6........N....n^..f;....P&w...N... ..\.GQW......:lg..j....!M..W.......u'..}...<.^.....M.r.e..N.....A.7.u.^n...T...g...i.~...\|.W...Ad)Q....E.>W...sc......n......j.-h]..~.T...).......=&.mT...O.N...{......{%Y...Y:c...=].../Y..}..O~.E...._v~,..u.....w-......E...Brh...Y......r....nu>...eo..^.Q...o9....f.j.....6.%.k.P..;.Sl>...w..r....f.U1..s.{z...._....[.u>...Go..pUF.....`G=...8..N.J.\.....)pY:.

C:\Program Files\McAfee\Temp3475153614\updater.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 952639 bytes, 2 files, at 0x44 +A "\updater.exe" +A "\updater.manifest", flags 0x4, number 1, extra bytes 20 in head, 83 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	974079
Entropy (8bit):	7.99943711138124
Encrypted:	true
SSDEEP:	24576:HIXBgn8I89ee5dkjG6+jbo/ZuPY0qqp90CXwPb/n/9Yb6b7+d:N89PEjT+gRugV93xb7+d
MD5:	7B483CBD80605019BC216F9BABDEE9CF
SHA1:	EF89717FF63335BB0689B7AEA4ACBE512D291CB6
SHA-256:	4939F02AC5BEF2BF850DFDE34902DC84101125B0AC3CB0ED71B2DCB9459B833E
SHA-512:	924C0732FBFBE01DF6055973E2005DC084314EDC16867B32D9F7356AD24AD3756CC2BD8FFBBD5B50B5553EDF285A92C51C33B0682557E66227E89B95D04D3EDF
Malicious:	true
Reputation:	unknown
Preview:	MSCF....?.......D...........................?....S..............S...hq)........Xmt .\updater.exe.....hq)....Xvt .\updater.manifest.....)..[.... XR...@C.$"....i.V_JJBV....I.F....WB..A.HdPQ `....Py/;8b^.... .FH.U#..)....4.2.b.............wy.s.'_....$R.(5..~ .....".uy.EQ6v..k..g..65i...vt9..p.J..h(5.....6...0.".L. "....O.....( `...........(."(..r./.9...AlIG.IdT=..?qE.................(.... ...2J'..f.t.2q...Jp..M....]+W.U...a.p.Wu\.a+\|y...a..Em....xV$Zw.c9..m;K.vt........v....W..._u.Z.....b.i.0>..F....).\|...$.?{..8.fj>.e.U.2qF..'.W.K..V...Y....%S<+E..o..4.a..U.j.....J0.[...s...\...s4]..M.d..e..z...J,....^.wla.y.1/..rh...)...\.m...?d.rV.........u.Owai.n4..y.0h;/.O.$8..<X.e..:......`&+.~..Y9.D...^..&.....v5^.y6......3.m1...uv...1?..*.w%..........L..........w.>.J3..9....kSq..W..u6....z_.;_..;.............\|.K..'.....x.,.....ik.......a..n....5n....xK'.\|.7.\|Y.H..z.-...'}.1.Mr:..f..._gM...30...%...`.t..<...E.R:.>.Nh~..h..v;.75.m.-...!....F%e....s.t.=.^-....n

C:\Program Files\McAfee\Temp3475153614\wa-common.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	ASCII text, with very long lines (33246), with CRLF line terminators
Category:	dropped
Size (bytes):	34082
Entropy (8bit):	6.048810099348607
Encrypted:	false
SSDEEP:	768:E9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZW:E9DDI6thXjez1jtn9
MD5:	BED2FF23927C34F86C480203AA7F87A0
SHA1:	90B1B32D7A9CEECCD555D674582CB8AEE64E8909
SHA-256:	9D7AC9A5AE897E993C0B6BAD468F56BF3B6CEFCFEAAD6FD2307CF8370945A2C2
SHA-512:	6538FEDBC2DCE5EAF944CBD18F93783CDBFDC2920726A3509D0686BD062793B422AE6C6F67DFB0C344AC3E084F8B1F10425FA4636D1BA0FBD9E2ACE86EA6AE83
Malicious:	false
Reputation:	unknown
Preview:	/* Open Sans Regular */....@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXh

C:\Program Files\McAfee\Temp3475153614\wa-core.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26073
Entropy (8bit):	4.775338242696645
Encrypted:	false
SSDEEP:	768:J+6T4vNmgN8t0+yycVCI6z0jG7RMDX4WUMRmvm/1x:IDIyNx
MD5:	764D5E9D902AD35DFB4655D22F836F9B
SHA1:	31AEC17A64B7D32438B2E58A1AEB8F388FA481FC
SHA-256:	8444823F2ABE9EAB852310641372093F3A8631D3B8B47753C8AE1C69B2AFEEF7
SHA-512:	589B8731C6A85DB22993597AED76D920C01E7AC2C7B4B394D5D5BF254CC9096E962097C0CAEF4ECF09940A2DAEBE18858665708884E65C6620E812BFF70FCCC0
Malicious:	false
Reputation:	unknown
Preview:	/* Core */..(function (wa) {.. var core = wa.Core = wa.Core \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External;.... //Component.. core.Component = function (name, status, key) {.. this.name = name;.. this.status = status;.. this.key = key;.... this.isIgnored = function (key) {.. var isIgnored = false;.. var startIgnore = this.settings.get("startIgnoreDate" + (key \|\| this.key));.. var ignoreDuration = parseInt(this.settings.get("ignoreDuration"));.... if (startIgnore && ignoreDuration) {.. var today = this.settings.getToday();.. var startIgnoreDate = startIgnore.parseBasicDate();.. isIgnored = today >= startIgnoreDate && today <= startIgnoreDate.addDays(ignoreDuration);.. }.... return isIgnored;.. };.... this.isInFixGracePeriod = function (key) {.. var inGracePeriod = false;..

C:\Program Files\McAfee\Temp3475153614\wa-install.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5549
Entropy (8bit):	4.066110247641768
Encrypted:	false
SSDEEP:	96:Uji+oLbHInScwC0oljdaLDb2nD6nu7aabv5k/yigIAMvda0hS/iS:rbonScwC0olMLDb2nD6nupbv5TbIAMc5
MD5:	F537A07AE7D570F52EE50643365B1FC9
SHA1:	F3EB5BF057F2F981123FEBFCC568741E4E0F8FFB
SHA-256:	2518B71F18A08AF85F79A3947C975A098346346750F0136891279B803F369529
SHA-512:	1DCA227E358932ADEE77011F3E0A949E20A402FE99AA71B204A2E1936EF9C159D8DDB39F1DD36E2A974369232CA59D703334833DAE72F2DEEF12C8EC48553F0E
Malicious:	false
Reputation:	unknown
Preview:	body {.. background-color: #ffffff;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....img {.. -ms-interpolation-mode: bicubic;..}....#wa-installer {.. width: 455px;.. height: 378px;.. border: solid 1px #BBC7E7;..}.... #wa-installer .header {.. height: 50px;.. display: table;.. width: 100%;.. background-color: #F5F6FA;.. border-bottom: solid 1px #BBC7E7;.. }.... #wa-installer .header > div {.. display: table-cell;.. }.... #wa-installer .header .title {.. padding-left: 15px;.. vertical-align: middle;.. }.... #wa-installer .header .close .button img {.. float: right;.. position: relative;.. vertical-align: top;.. padding: 4px;.. cursor: pointer;.. }.... #wa-installer .header .close .button {.. float: right;.. position: relative;.. top: 2px;..

C:\Program Files\McAfee\Temp3475153614\wa-install.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1222
Entropy (8bit):	5.1940162396320595
Encrypted:	false
SSDEEP:	24:csYR7A2NVMz71Mz7FMzrVMzPVMz6LVMCo7jScXRg4t2H:3C7A2meCeiCoHhm4cH
MD5:	4F636E5B6A304F3484E86B7C6906AEF3
SHA1:	D98F67176752372AFF04826649C00DBA203CFBBC
SHA-256:	7199FE6B6A25CFAA309E7BF4CBC01E6104B3EACB4927072930E30487131E22A2
SHA-512:	C38B84424121F73C74CD91CEF6E8879AE3EB4B86A4A2EF5D577E2811527E08116563D6A846125653CC8051695BFF614B3BF81BB194E40A8D57125325F89E1ACA
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=8" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-install.css" />.. <script type="text/javascript" src="wacore:jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-install-#loc#.js" charset="utf-8"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js" charset="utf-8"></script>.. <script type="text/javascript" src="wacore:wa-utils.js"></script>.. <script type="text/javascript" src="wacore:wa-core.js"></script>.. <script type="text/javascript" src="wacore:wa-ui-install.js"></script>..</head>..<body onselectstart="return false">.. <div id="wa-installer">.. <div class="header">.. </div>.. <div class="content">..

C:\Program Files\McAfee\Temp3475153614\wa-ui-install.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18662
Entropy (8bit):	3.8532610964247125
Encrypted:	false
SSDEEP:	192:GVtiO2qyGuMW2FnrjPfCfsdd5nwwCbvlOzNZLXQDCR1ZgpN7:GVXyRMBbOzCR1Q7
MD5:	EF7BC2C839DC47030099EE7B6109F4A6
SHA1:	0E1EBD96A417D223F3B1AEF637A499F3006DE953
SHA-256:	E3CE46EAD80BA41A531FF0744BA3A39012BC43453F2EA541F4690B47E39D5760
SHA-512:	8A176A5FEDF337449E7B7B04673EE804DD9D0F14F83EBBECF7C4EE28C0E981F421E4C81811224D3E1473B4729710FFB105D4E7D07623A5D7D7C60D00C4643F0E
Malicious:	false
Reputation:	unknown
Preview:	/* Installer UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.INSTALL).get,.. _window = wa.Core.Window,.. _external = window.external;.... ui.Installer = function () {.. var buttonId = "wa-installer-button",.. _this = this,.. RC_INSTALL_ERROR = -1,.. RC_INSTALL_DOWNGRADE = -2,.... open = function () {.. _window.ready(function () {.. //check preconditions.. var productName = wa.Core.WebAdvisor.getProductName();.. if (!_external.CheckDoWeMeetOSRequirements()) {.. _external.SetInstallResult(RC_INSTALL_ERROR);.. _external.ShowMessageBox(_l("ERROR_TITLE_CANT_CONTINUE"),.. _l("ERROR_OS_REQUIREMENTS"));.. _instrument.log("Installer",

C:\Program Files\McAfee\Temp3475153614\wa-utils.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15448
Entropy (8bit):	4.445293661315933
Encrypted:	false
SSDEEP:	192:BZwBjyfDzRj5csy4h11lidEaCaNz46UcEm7dO2qSFZC9OQ/Df:Wefpj5csy4DIE3oU6Um8r
MD5:	16C7A28A1836AF5710A14D43B7E8F6CD
SHA1:	9BDCAEC1345DB8F80D209D10509E7E148E5E5CD0
SHA-256:	235AE52CCAEA0000BEA5894F4733A1D94DB6A18490B578AA2B8BB3FF3D606117
SHA-512:	E9E1B419CD7C3C8221C2C0970AD385031688CCAD9E716F1FFAD7120CDE5315F4A92C53F2C9AA5CA81BB357C1E7FE125278563CD831A6688305C6EB68084B9D8E
Malicious:	false
Reputation:	unknown
Preview:	/* Utilities */..var _langResources_ = {.. checklist: (typeof _lrCheckList_ !== "undefined") && _lrCheckList_,.. options: (typeof _lrOptions_ !== "undefined") && _lrOptions_,.. shared: (typeof _lrShared_ !== "undefined") && _lrShared_,.. uninstall: (typeof _lrUninstall_ !== "undefined") && _lrUninstall_,.. sstoast: (typeof _lrSecureSearchToast_ !== "undefined") && _lrSecureSearchToast_,.. install: (typeof _lrInstall_ !== "undefined") && _lrInstall_,.. webboost: (typeof _lrWebBoost_ !== "undefined") && _lrWebBoost_,.. waiff: (typeof _lrExtensionInstall_ !== "undefined" && _lrExtensionInstall_),.. ut: (typeof _lrUpsellToast_ !== "undefined" && _lrUpsellToast_),.. overlay: (typeof _lrOverlay_ !== "undefined" && _lrOverlay_),.. newTabToast: (typeof _lrNewTabToast_ !== "undefined" && _lrNewTabToast_),.. ssToastVariants: (typeof _lrSSToastVariants_ !== "undefined" && _lrSSToastVariants_),.. pscoreToast: (typeof _pscoreToast_ !== "undefined" && _pscoreTo

C:\Program Files\McAfee\Temp3475153614\wa_install_check.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.494810764492959
Encrypted:	false
SSDEEP:	12:6v/7iIHftwTmWkW3O+xbR/GfmNFycqV7o5jNiXrj0IGDfjo/1:zT5+aVefmORm8bnGD09
MD5:	F8AF1796D709A69C3FBDD16822596FD6
SHA1:	D216CB9A49EF4223138BE20D027B3ABEEFAC7DB0
SHA-256:	055E07F760351C3F33E708E4720D5A34A60ABD8D13F2FE05A473DFD5ED9714C2
SHA-512:	FBD9C93490B818798F4614E6EEA7EF9FA05D535F50071806E763CD9EBEE478559F614EAC90720E4B5F88D803DB0AD459F1D1C67954C2C379B1BB435CCA74390A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............H-.....gAMA......a.....IDAT(.u..k.Q....1&.k..T..bO.K...DP....I..{.PRA..............QA..J/....eM.tS..7..v...y.7.7.f..R?......W.......N.....G...z.N.a._.X=.sg.5..r.k....Z...R....[..X..W....N....v...H.1x......L......R..@:v.w.....W........v.lc/F..b .C\.:.[Q.`..E`.L.J..!....<..m.q....R.&...""%F(^M.`..e.,N..q..y<.../.O:.mP..,A.QrZ}[u0..,3...S.K.\.EM5.!mH......}N.+j....p.O.E.......[..C.\x......nMi...~%.vv...\|8...y.xV..v<ZZu.....y]@.1......]..).6.M.'.'.%o.T..5.Rq8..l..;...Ha......5......IEND.B`.

C:\Program Files\McAfee\Temp3475153614\wa_install_check2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 14 x 14, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	785
Entropy (8bit):	6.380231936591206
Encrypted:	false
SSDEEP:	24:nmwBSRPy8iSvgv+aYS0NFVO/6cgDHNUPZ7SCOr2zhxNoEMBxNB:mwBSRVL4v+/jNFVO/6cgDHWhbOKHCEIj
MD5:	5367B11C1B0484E2B64AFFF761DB5B69
SHA1:	CA05EC2A55FAB6A4035920C38B6FF198044DA594
SHA-256:	1CAE0E0663BA559CA8FE7AD3A1E07AB23AB9E3DBADA1AA572AD9C2C5D51D5627
SHA-512:	322DF7AFB16185EB4D39AA4881A27E04B1D310773FCFBB77D0F1C83237A56D100F6567091E30BF0DC6A11EA29A22A52BF091B66C5863823596108C155C031588
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...#..$..%..$..#..#..$..$..$..#..$..#..%..%..$..#..#..#..#..#..$..#..#..$..$..$..$..$..#..#..$..$..$..$..$..$..$..$..$..#..$..$..$..$..$..$..$..#..$..%..$..$..$..#..$..$..%..$..#..$..$..#..$..$..$..$..$..$..$..$..$..$..#..#..$..$..%..$.....p~.S...NtRNS........................T....L..........K..T...S.....JJ...O....r)1N.T......L...P.....bKGDOnfAI....pHYs.................tIME........l.-....IDAT..-.g..`.F..o.PISC.[.........\|..s.@.Jr.PM.3.Ah.&....dI.01..t...v.K.h.o[?..^.....Gc.&..8....A..<..r5...QY.F..n.8..@=A.l.u.....n.C.....>.o.4...&!.KUd.&R$>.e*o..T....:...~g....%tEXtdate:create.2022-02-16T15:21:59+00:00h......%tEXtdate:modify.2022-02-16T15:21:59+00:00..x.....IEND.B`.

C:\Program Files\McAfee\Temp3475153614\wa_install_close.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	327
Entropy (8bit):	7.1140535970703365
Encrypted:	false
SSDEEP:	6:6v/lhPIcWn2ofLbzmoGGaKdwjXI76l4AXT8ctmzXxNuJpTqAp:6v/7DWn3btahecDAuJp1
MD5:	C0708D1E58F1EF1BAB621620F3B09130
SHA1:	0BEB49A1CC1E71F364BCF42B474890F35CB8CC3A
SHA-256:	834380BD8B6F9BFEF000A555541AEC2BEC01DC46C91DCB7F950D109B81BAE5C2
SHA-512:	241C93BC2677B1F0788C2C0DDD9A7FFCCC7A865DAD427EA8C89E437FC796FD12F80D2A962A8D02B1B2391E10CFF768F17E34BD45502A0E31D6E1C8F443C2AA34
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Vu\.....gAMA......a.....IDAT(...On.@........=J.&....5....8A..M]{..s......Q#0.7...0.......yr).q8..s....sp.....W.u.q+..;\|.5&..n{..{.............>..".^S......#q.6B...4.t....~e.[@B.&...L.o...h..8.......Q....+..b.i..MhxRaG....Y..F....,......G.E....`(....V.v.4.b.$..S.O.....Sh.B....IEND.B`.

C:\Program Files\McAfee\Temp3475153614\wa_install_close2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.591404605834916
Encrypted:	false
SSDEEP:	6:6v/lhPIcE/6TsR/nQV32e46OIoiMr6FRK7MhtCxllbp:6v/7DE/6Ts/nnPIcr6+ozCjz
MD5:	F79A1953A8E6CC342847B4B00DDBD736
SHA1:	9AC411CADB6652F4FDBD854300ADCB5C21C04BAA
SHA-256:	4F8EF204C1884F868866D03B4D11DF1237480C1CAA38ADEC1C13444050105B88
SHA-512:	DFB54D3D20FF53B867328945FE3D69B56055D5861EFCE2A069653B1792A5477AB4C3B73A3DEE82DD1377D1573099AB70C2F6C285C694DDBD0B1EE9667CFC4F2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Vu\.....pHYs.................sRGB.........gAMA......a.....IDATx.u.... .DW>...>.RRYJq>).>\|E...!..3...t...a.?..w.!.P..../l....2....Q..ZS.%'.........y^.Q..H.T.V.D..W]..t.*X4t#9O;......=U%u0...f.......3`...[.S^..m..$..?[...{4.Y....IEND.B`.

C:\Program Files\McAfee\Temp3475153614\wa_install_error.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	428
Entropy (8bit):	7.367179920202989
Encrypted:	false
SSDEEP:	12:6v/7iIHbGI9XbxzlcdqzUCOXC5pC38WWn9:eGIrzlcdL4CZW9
MD5:	0EF65600F5A2D01876B6F9EC668C9D2E
SHA1:	31F378D2D6BE62F3A426523B1AA3D61323B2B9AA
SHA-256:	17DC5C3BAA1D35CA60C7DEE7CC70B76446765769960FC5D4852E065478C871C4
SHA-512:	7D9EC74CECF8DF49D4F8E676053573798A029D889E8676CFE90891EB68E49A2FE9AE828F38BB99851888B25A76581EBE2B62694D3C66D193016B4446004A9271
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............H-.....gAMA......a....cIDAT(.uR.J.A..f..&Q..*....h..... ...(.........K...!Vib...B...qf..{.9....\|..3C............@..........5..8.b...z`-....s.ID..G....PEQ.;?1...p.h;..z6Z..4.X..c..$E3s.b..ry.\|..yVy...0.Rr..W..S.......A.1.....s./".j..g.H{l...Q....d................fE..;..'+.).j.F...J......~.s..Y./...6.v....\|......,...m..[m....n......D.E.OvU.n..W<.m..=h#.O..Zm.yj..@.tums.....IEND.B`.

C:\Program Files\McAfee\Temp3475153614\wa_logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 233 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5361
Entropy (8bit):	7.956335361585333
Encrypted:	false
SSDEEP:	96:tXYxwio7C2guemm5poLpMmjxiN4f7DsCk7RkuxKBaKeVfGJiQmiMQ2qileA2I:toxpo9gKmsMmjwSXgyLBepQblA2I
MD5:	0D8F8EFEB474FC9B2C825D7F2A875471
SHA1:	ADBC30FD0131A01B3150753C7EBFD6EF648F0DE1
SHA-256:	ACC40FDA844EADDF65B9580C484F1FE2E17358B352D99BABC6865BF0C74D9B00
SHA-512:	90FEBC4B2165D37CBB1CF09295CF2F5B5713DD14A02CDC101318426CEB55D35B7C47B254D0F20CCB8297FC69EE77EAA5969FF98A0965D325C94AD81B6A56BA9E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............9B....gAMA......a.....IDATx...xTE....I .D..l,....(....Q.\..ftf...qA..D...?a..o.#.8..<.9:....A..."......KB...?7...M:......}7U..9..N.s.T..hZ"%$..@B...$$..@B...4!.UYY.E].Ln.%Qu.K.8....Z+I..m...m%v.6...K..]ki....W.}.y.%.O.1"dY..5...{...x.ef.X.~a..3K.u.l^.8'..?.z#%.._.}.yT..Z..k..b..3{.{.>W_.,x,J......LM.T.>.x.....^..c.'...8^..(]...z(..._.......&..w..9..)..W.,s1.>.):.0.4.Y...nq...7....;......7)Xk.a...O...g.l...c.^..)8.%.e...h....U..7.O.'$.....]K.r0.Y5u..K....tH?.NSzwl.o..IG6...........X.(.z-.X....ju.+.Jpd.j......t.>...../?TW.0u..7........@B.. ....yYZ.iZ..:s...}_X2.O.....1kJ..3..9+... ].4.Y.2.....r>hM....}..-..\|!d..i#U...F...Dr...5....D[..]..u._u....[.>.{5.xX...t.\|L........}?........J.H?P.....M.n....-.......d......pQ....3..[...;vT.dg....5.@..0...[.c..1...U....i........a...o..[.PB.....E..^......."\|........$..."V....tZ..`W...[...z.1..[~.Buu.[.........]/..x.(.`Z.A....`p...]RR.4u'u.]..u'...p..[sh..w.....g+

C:\Program Files\McAfee\Temp3475153614\wa_logo2.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	PNG image data, 232 x 23, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2938
Entropy (8bit):	7.909981061900822
Encrypted:	false
SSDEEP:	48:nv/69bTJ0Ji4hnEhRHzXJH3ndGzDr9zHUeqr7zpiT7efEgo3cRE0+U9sLBCYv2ZG:vSdJN7HziDr3S9i/efLQcRZ9sowGdK
MD5:	65938FC9439B2307513A95D515BCA1F7
SHA1:	DDDFE8D64ED371E973C46B6726B60BB0C0810BF9
SHA-256:	B2703E2E2A404B90EDAB7A67B23037C32BE2780F20CB15FFA6F6E44666B8EFB5
SHA-512:	93F755F5E208CA08955684D7789F6B8AF49F542DD41AFD9D678EC417CB535734C9C8182B87EC2EA8B8AA9FA502AC8BA90E383A9977F7E01BFF393AF0D1F400BA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............m......pHYs.................sRGB.........gAMA......a.....IDATx..\]R...o.T.yZ.'.8..y..f_"N.8.....`N.r... '.y...>,{..'.}....n..%[..!U.)..\|.t...G..O?.. .~....@.N...a;..e.....1}.?....>.Ma...>.?..u.}L...m.N. ..8.>fe.z..dr..u.D.1.R<.....T..J.......\.ZP..V}....M?...2..3.....)...T.yG.4...kO....t......b5...-....4F].q%c...-....v.2...O....g0...g.&R.2.n..<?P.q9.....+l3...X&T;...z."L).12..D..a.G3..OQ.Y....%..P.=.....2....%u.}4.(..N.!.)t....w...M.@.0.pt.a%..N...\|.\|\f+H.Rk.?..G..v.q.7.5.'..F}.....lm....rS[.4..F2..R.-..V......AU....!./.\S;...M/..K`..w...>.f'm..bf..y>..$D@......1....3.>...Cn!.:.........C..-.PE14....$&}..?..I...._2.m.<....L.<.........92.p......jT....%.~..Q.U...6.4/.U..4L+HK.\i.z...Au.@>Z..Y.....kk...pQ..!....\|..1g8...Uc$.....Y......9.....`0t..p..(...R.N....w`......\...<......M....-.95.f..W;xx>.7"..'..._z.REq.=e2..bg.S..r..VKcI.j.....\.O..T...q.>....H..6AE...{'?.....w.X.J...w.d.......O%..-%...1*.53..NPB.O.[M./.:..

C:\Program Files\McAfee\Temp3475153614\wataskmanager.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 2879403 bytes, 3 files, at 0x44 +A "\microsoftedgewebview2setup.exe" +A "\wataskmanager.dll", flags 0x4, number 1, extra bytes 20 in head, 165 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2900843
Entropy (8bit):	7.9998613018539695
Encrypted:	true
SSDEEP:	49152:hy3xnx08sXqiQVLyAQ6l7xcha+PVhtnYsLeqiOTBFqfkjsXeOUpULw:8px08sXRzH6l7xktbLbvTBIfkwOOaUM
MD5:	A4DFA367963FD3E46210D3BD0B4102B1
SHA1:	9DD28C37AF5B86C1F20E52933CF9EA47DFE1FC60
SHA-256:	F4670F2DB3E33F2130B636AF2FAA495A52532EC304A58014AE2128242AEA5047
SHA-512:	339CA24709B5577FD3B20170C6B6E75D80F19408B67FB3188B5B9E1DE7A67A5FF2F5EB8002519BA9CA8609AEE0B30858FCA02CC455C5F4DB15F493A3F3FF8F6A
Malicious:	true
Reputation:	unknown
Preview:	MSCF......+.....D.............................+..S.................. ?.........X.t .\microsoftedgewebview2setup.exe..6. ?.....Xmt .\wataskmanager.dll.Q.....Q....Xqt .\wataskmanager.manifest......I..[........."S`$..........XY.....$.$B9f.....0`..u$..V..w..g;`.......l.........d<.......@H..E..F..h....m.l.m...sy;3...r.....g....~.....ml..<hm.......@y.`7m66..-Vp...[Xm......b..`...Zq..7...f.....71K4..\......#.TD.U.E.{{..f..]...BeD0 d"...t@@..A....pr....B0"`Qy.rS..>a.5..@..u...n...D....7..W+=.W.h.~.[?..SQ}o..I4.........vQo..w.K.O.Uj./......Q.?....T.^...l..'P........>.1....-....../...~....y=.~e....c...nVX./..U....4.o....T..O.....;..R..!..`.{l.....Cr.?.7:.Q.....+5.....>Z...,j.\|.....-..L..+0.<L}..Ecc...V9s.kq..u.8.KUb...7.w..l..d?..`....K..+Kc.h.=F...~...\...\F.....j3.<.g..r.4.\zO..v.-..;..:.\..wdH&....AU...z.....0W\ X.'5W.J`>...z.......}..dr.."...V....H.EI..[.A`.$[.fS ...z...^.Ez.....9..h..'.....6../.ut..(.c....0.b*.....'.dz0.!.`.....F~Z.....y.

C:\Program Files\McAfee\Temp3475153614\webadvisor.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, single, 1207 bytes, 1 file, at 0x44 +A "\webadvisor.manifest", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1503 compression
Category:	dropped
Size (bytes):	22647
Entropy (8bit):	7.676634476414908
Encrypted:	false
SSDEEP:	384:B4eoYQ6ki2HPviQUDvYI5AM+o/8E9VF0Ny0b6ki29d1ikgOvAM+o/8E9VF0Nyh3k:B4E2HiPvYGAMxkEB2Ps+AMxkESb
MD5:	354BA45BC1F16F0F644723E2660E3CA0
SHA1:	CDAB1B7A3CE71EB13EEC62B4CADC1EA5FEE6DA45
SHA-256:	B436CF419F88F409A7D27B43B5932C6E381C5B6A93A323B64051CD7C5EF59CE5
SHA-512:	E381FD66DBDC9B5D839B95556D0085D550C2A00BA1FB0430D41CA4BFD14C7DAC21EACA57EA393AD7E953940300DEB14679E9DB7A0FD54F9FE0729A4BE009E456
Malicious:	false
Reputation:	unknown
Preview:	MSCF............D................................S..........i..................Xnt .\webadvisor.manifest.b#z(F...[......K..3.%C...f...>88.$..@..../\..f....m_9S/.n..)..p..@...Q..B.....+C......n.]x...$.w..o..K.{co..Y1.... 8F...i..y.... .....$B...@b..04j5.$...q...1........\.&0...+fU...4v.Q.....3h.Z5.N.+..(g@m..k.....]...Ix.].)....m...r.}.KZ......:.@...V.o.#.(M..&.&A?J9rCw.d..4.#...ttH.H.T.%..>G...$.b..I..9!...`...w...NL%.....~.F....eQDs.>...2t.:L..e.D..M...j.Y1.B}.K(..X1...d<.7f...X.V....Y.f.V..N.7w.....@5......2.[..CV......X:.\|D.b..#&...D.P4D..x._3"} .]a.....!..N.Ak..:.l.>Q........U.0f....S.%U......?...mm......9...\..\.W....gp..<.V4r.`.}........YRm............@..j....%...Z.8...A..j..>}...9.n...J3.#.A......<...o..k...7....V.[>..C.5P..s.g....^9.......f.p#V........;[.kn.^..:t...Up.z...%......y....K.u.9..}..E..5*...N.&.F......;..E....b.]wm..."Y.@....F.....t..~t?.<.$s7..\.6.-....>..+D+..3.k.EP...6..G..z..@>i. .....Y......qk..tn.-.8.$.rz... .....O.`....

C:\Program Files\McAfee\Temp3475153614\webadvisor.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	MS Windows icon resource - 11 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	99892
Entropy (8bit):	3.9749743269785345
Encrypted:	false
SSDEEP:	768:JLBqG5eVRjB/jZRj0t4kgU1l50AIDP88+2Y:JLBh5eWgU1B8+2Y
MD5:	236FC5ABB597615A608DAB7BE98D5FBC
SHA1:	18D3D1CF56898B264A24DE24DC13E4B9B7EED768
SHA-256:	06ADAB20CB028B5DC61762691E8C8A6157EB1199526F7C773338B9BF51BD63C6
SHA-512:	155766AA5659BB9E298AEDE4064832168002EEDEE836710C2259446FC35437AD70C04454DEF2D9EB40A83A029351EA1726D65ACBDB8FE8217C016FD4986F7F4E
Malicious:	false
Reputation:	unknown
Preview:	......00......h....... ......................(.......00.............. ......................h...~"........ .n....'........ .(...TC..00.... ..%..\|K.. .... .....$q........ .h......(...0...`...........................................................................................................p......................9Yx...................yyy9Y..................yyY.yy57...............s.....y.yy.............y9Y9Y5..9y.w.............9yyy.....................y.9qy....yy5............yyy.yqy.y.Y9yp...........y.xy....9yyY5....yY9.y.9.......yq....p....9yyqqyp......y.yy5.p...YyY9..p.......yy9Y.Y.........p..............p...Yyy.p...............p...99Yw............y9S.0...................yy..p....yY8............yyS.p...y9y.............y1......y.Y8............yYy.p...................y9yyp...................yyY.p...yyy.............y9yq....9Y.w............yyY9p...................y9yYp...................yyY9p...................y9q.....................yyYyp.......................p.............P.....

C:\Program Files\McAfee\Temp3475153614\wssdep.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
File Type:	Microsoft Cabinet archive data, many, 579389 bytes, 3 files, at 0x44 +A "\wssdep.manifest" +A "\win32\wssdep.dll", flags 0x4, number 1, extra bytes 20 in head, 46 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	600829
Entropy (8bit):	7.998848570895185
Encrypted:	true
SSDEEP:	12288:lIRKqFg8BQQNWTWxyNCn0+VMct7D0IaIqas/8g+AfFsW8Efn+T:c1WmWWn0qBD0IVqas//eW8u+T
MD5:	784F7DF7907C8BBB77CFDEC26176B715
SHA1:	CF5792A14C9311E2B98A3122D59178FF536E4C2D
SHA-256:	4D49923AAAADF6A7DD4F9C093DBB6878A00363A3E0A18E5BCC54E61175AA8D80
SHA-512:	4E3EDADF6939FC8A6FD1ACEF72460D782397EF7A6E7ABCE7CA1A17B6E3E7BDDA54398091B6BE7547333D50B79F2FAA08DD02C17A53900A12D3C83E296B5CDE2E
Malicious:	true
Reputation:	unknown
Preview:	MSCF....=.......D...........................=....S.............................Xxt .\wssdep.manifest............X't .\win32\wssdep.dll.p....".....Xmt .\x64\wssdep.dll...\.<..[...8..3.."C`3..k....]..4(.....FUZ..Ck...T....,. ....#e...#..'.;{...G'......j....AF2.I......f62eg#........G.C../..:u..u.N..yd..=..y...-y....o..v... ....h...6.BkKi6.Y...%..%...6+t...(..i2J+d."..d.i..'..'O.}......f..j........w...oo.....&....Hnj.6."..C.X.U.XQ.E......K.B.@X.........M..}....&!d.l..^..F...t..e.3sk.....~.e..O&{D.f..A_..=cS.......5>}....>.......6....?v.Otl.?...%...2.6..2...dZ.....WOz.e.5KS-b.bZ.]..V<r.......V..g...>.+.8...nJ.u......8..J2.....N$........(....]....1...5:S9...$..Wq..........J/.{.Kmqb9.........G]....+...-Ns.{(..Q.nh.m...r.7]/.WG....[P.......Tf..rZ<..A....A..-{9.I...-...Glc;....OZ.u...u..;..5jh).z&{E.........".....N.............u..b.+duU.W/L.%..r.POL..ZfA..3&K.zL3...M.\OTL.i..)]=W+..Y....\.V..nd.V.....z...1'.2M$...^..s...$...Q.I..../-...61R

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\aviary_client.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (1458), with CRLF line terminators
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	5.299957524025923
Encrypted:	false
SSDEEP:	48:HL4WKW98d7lvOKi18GDAxJxFyWLcLBoHC85QsZKg:pKxd71OKincxJxMW08D
MD5:	1325BBAD2BB01570B527769E0AD7AFCF
SHA1:	7FE83FC3C9152EB433176481F1B09C6D77654F8B
SHA-256:	3D653E48C4CAC8C85C3D686EEEA27BA230D10BD49B44E72C69C0AAEBF279DF10
SHA-512:	199D8BF69E56D7CFC3AEFD6991AE0C8CDA0F2A632FCED126C51A7238EF62D7B6E70B47004AAF78BD5A6E28537D99650599266F410A7F3C9AC12C850C4FDBD58E
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var aviary_client_fileVersion = "1.2.181"; ..function CreateAviaryClientHelper(){try{var a={Get:function(d){try{if(this._aviaryPlugin){return this._aviaryPlugin.Get(d)}}catch(c){this._logError("Get exception: "+c.message)}return null},Set:function(c,d){if(this._aviaryPlugin){this._aviaryPlugin.Set(c,d)}},ToJsonString:function(){try{if(this._aviaryPlugin){return this._aviaryPlugin.ToJsonString()}}catch(c){this._logError("ToJsonString exception: "+c.message)}return null},GetDirtyFlag:function(d){try{if(this._aviaryPlugin){return this._aviaryPlugin.GetDirtyFlag(d)}}catch(c){this._logError("GetDirtyFlag exception: "+c.message)}return true},Setup:function(){try{if(this._aviaryPlugin){return}var f=JSONManager.getSingleton("dictionary");var c=f.data;var d=c.product_settings;this._aviaryPlugin=getPluginFactory().Create("ContextItemAviaryStore");this._aviaryPlugin.Initialize(JSON.stringify(d));getScriptVariableStore().Set("ContextItemAviaryStore",this._aviaryPlugin)}

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\common.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (13833), with CRLF line terminators
Category:	dropped
Size (bytes):	14033
Entropy (8bit):	5.342408631225737
Encrypted:	false
SSDEEP:	384:qtu3RAn5OgUkr5oAZ0hFrBhCHuBIeTGqU37nw+9RXSWV0ai:q43RAnblghz0eIH7nwYpV4
MD5:	144A8645F924580E833D56C442ACDEC9
SHA1:	25B4CE0D450DBDF87F854AD19D2EC027A3252086
SHA-256:	64F3218275D1D3A5A5B2643225728C44CD64A9E41F558AD150F7438E00B8B0A9
SHA-512:	7D64DBD260896223CA2F66C1800455A865153CFA6EB1A7E27006ECBBAE14A3A76A7C0540785DAC5D6684309005B8F7677C16B2E0A320D49523A649D0B65BE021
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var common_fileVersion = "1.2.181"; ..if(typeof JSON!=="object"){LoadScript("json2.js")}if(typeof enableAnalyticsSDKForUWP==="undefined"){enableAnalyticsSDKForUWP=false}var GetEngineSetting=function(b,a){return a};if(typeof GetSetting==="function"){GetEngineSetting=GetSetting}else{logInformation("Missing GetSetting function; will only use default settings (this is expected pre SDK.2.3)")}var GetEngineProperty=function(b,a){return a};if(typeof GetProperty==="function"){GetEngineProperty=GetProperty}else{logInformation("Missing GetProperty function; will only use default Properties (this is expected pre SDK.2.5)")}if(!enableAnalyticsSDKForUWP){LoadScript("logging.js")}var getSystemPlugin=function(){var a=getScriptVariableStore().Get("system");if(!a){a=getPluginFactory().Create("system");getScriptVariableStore().Set("system",a)}return a};Date.prototype.toISOString=function(a){try{function d(f){var e=String(f);if(e.length===1){e="0"+e}return e}var b=this.getUTCF

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\config_manager.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (842), with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.3308262881228865
Encrypted:	false
SSDEEP:	24:2VeEhIBolSPnrVCYJqPse4A7PWLb/X0rbjIfJNosj/fcIg:28EhDSPrHAPse4A7PW3/X2uosj8v
MD5:	2A57B3778C74AE74813C582C421E2B3F
SHA1:	8A26061D568A31F40A9B9F3FAAF07169B29BFDB6
SHA-256:	811306686B18AC1D3F4AC3BE033B9B2A0FAD47756EBD3B0DA732981807693020
SHA-512:	7B782F0C54BE0D9A179648B53D798FC977C6C4816DA5188C0DF23BFFE733B0447890FD288FDA48D9F67AD858DEC600D2A0F4ADE60C1DA18EA74B5C9FB7CF72CC
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var config_manager_fileVersion = "1.2.181"; ..function CreateEventConfig(){var a={getEvents:function(){var b=JSONManager.getSingleton("events");return b.data},getProfileNames:function(b){try{return this.getEvents()[b].profileNames}catch(c){return null}},getAttributeRules:function(b){try{return this.getEvents()[b].attributeRules}catch(c){return null}},getPriority:function(c){try{var b=this.getEvents()[c].priority;return b.toLowerCase()}catch(d){return""}},getDataSetNames:function(b){try{return this.getEvents()[b].datasets}catch(c){return[]}},_setEvent:function(d,b){try{return this.getEvents()[d]=b}catch(c){return[]}},getThrottleRule:function(b){try{return this.getEvents()[b].throttleRule}catch(c){logWarning("getThrottleRule: failed, cannot find throttle rule attached to "+b);return null}},_events:null};return a}ModuleManager.registerFactory("config_manager",CreateEventConfig);..//269916DD98552834BFB08C7C2DBF38F93397F34BCD7233EC8F33B0D2901D54943DA31E56165E4EE2

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\csp_client.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3383), with CRLF line terminators
Category:	dropped
Size (bytes):	3587
Entropy (8bit):	5.298620762714509
Encrypted:	false
SSDEEP:	48:39Brq8ECI+Vttye8xYAAkSynknNkTv5ApLCYnawFwklt48ZI3OU2k9qM4JCZ0urk:PrHEfqr6GpdL4RgI3OL8ACe0E9CI5
MD5:	76ED8D0EB457983AE7DC1E9CE0E2DF69
SHA1:	157DC04AF4C77C168A78248E0613D60FA3A7E6F6
SHA-256:	1C62B1F4BAF55818CF3C3869CF5A9DC2FD83F9C738EF9326A1636219EBC71D7C
SHA-512:	7A9222329543B7BA0CF7AF7685A26DAA7FB539C1395B42E4C795E86BBB6408E3DC7C0502A63E4EA5FAA4F71CE0C8689A9359E25A840C872729C9110FCE903B50
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var csp_client_fileVersion = "1.2.181"; ..function CreateCSPClientHelper(){var a={getClientID:function(c){if(null==c){logError("Invalid (null) appID for CSP::GetClientID");return null}try{var b=this._getPlugin().GetClientID(c);if(!b){this._reportGetClientIDFailure()}return b}catch(d){logError("Failed to retrieve Client ID from CSP for '"+c+"': exception is '"+d.message+"'")}return null},reportEvent:function(b){},getPolicyItem:function(c,b,e){var d="policy_general_settings."+b;if(e){d="policy_general_settings."+e+"."+b}return this._queryPolicyItem(c,d)},getCachedData:function(c,b){try{return this._getPlugin().GetCachedData(c,b)}catch(d){logError("Failed to load cached data for appId='"+c+"', service='"+b+"': exception is '"+d.message+"'")}return null},_getPlugin:function(){if(!this._plugin){this._plugin=getPluginFactory().Create("cspClient");try{var b={policy:"full_sdk_only"};this._plugin.Config(JSON.stringify(b));logNormal("CSP Client plugin configured to us

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\data_collector.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (13758), with CRLF line terminators
Category:	dropped
Size (bytes):	13966
Entropy (8bit):	5.2090049632194315
Encrypted:	false
SSDEEP:	192:eWRhWbpB4FRhL10g4fquSZHo7vwFCw43NvyLUPu1phBOeY4PZTIit6BU6wHAUJ6r:fmbpOFvY4WXo1tYQZTAhLhc0
MD5:	C0F8805AB18F2714D5407D77CA466165
SHA1:	3684896574EF06DC678ACEEFD4FA69F80B22E30D
SHA-256:	B9BE1DED5B76161372EB2B98528179E8D0AA8B73F7EAFAE3318B7F3CB6E8BF62
SHA-512:	53EF3C586DC660502F31CC31FF605241D1D6043F53C39EE3EE12633DDCD14B0B30A84BE16F20DEDBC647A58BE5B7BEDC22E807BA6265AB7A0898ACBA35E1BB58
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var data_collector_fileVersion = "1.2.181"; ..ModuleManager.set("uptime_tracker",function(){return{fetchFromDataDefinition:function(b){try{return null}catch(a){if(a.hasOwnProperty("message")){return"[Plugin method failed: "+a.message+"]"}else{return"[Plugin method failed]"}}}}}());var Create_data_collector=function(){var a={setup:function(){try{this._logInformation("Setup Started.");this._loadDefinitions();this._farmers=this._createFarmers(this);this._refreshers=this._createRefreshers(this);if(!this._farmers\|\|!this._refreshers\|\|!this._definitions){this._logError("Setup failed: farmers("+this._farmers+"). refreshers("+this._refreshers+"). definitions("+this._definitions+")");return}var c=[];for(var b in this._definitions){c.push(b)}this.markDataExpired(c);this._logInformation("Setup Done.")}catch(d){this._logError("Setup failed: "+d.message)}},get:function(h){try{var g=null;if(typeof h==="string"){g=h;h=[h]}if(!h instanceof Array){this._logWarning("get: items

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\data_items.json

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8960
Entropy (8bit):	3.7010716622460236
Encrypted:	false
SSDEEP:	96:Xvvu5bVDbDvhF/62/64N/6j89OywRq7ApAd31yycEMKlo/xJMx2m5H9MXYwfczyM:O/62/66/63xQ2m5dMoqMmOZ
MD5:	E9A5F604E451A4C240474457B6F5F775
SHA1:	DD5D46CF0A510C16D354096513F28C8F438B4C38
SHA-256:	D4B0031958C4B30AF517D6B22F76D22BF10EF19BBCE9A5A87D313717FB4CEF52
SHA-512:	A455B6AE58B94A390DC514B3B9A60161002AB138F3AD09CC56D9608DAA819146D41D66CBE56C40AB17AE84564B9EAA976D84DBFE1C0BBC3CF61E2B60C361F36D
Malicious:	false
Reputation:	unknown
Preview:	{.. "version": "1.2.181",.. "data": {.. "product_analytics_content_version": {.. "params": "getContentVersion",.. "rule": {.. "ruleName": "notNull".. },.. "source": "engineContext".. },.. "product_install_type": {.. "params": {.. "name": "is_loud_install",.. "scope": 0,.. "default": "UNKNOWN".. },.. "rule": null,.. "source": "waSettingsDB".. },.. "product_affiliate_id": {.. "params": {.. "name": "*Affid",.. "scope": 0,.. "default": "0".. },.. "rule": null,.. "source": "waSettingsDB".. },.. "device_geo_id": {.. "params": {.. "name": "SystemGEO",.. "scope": 0,.. "default": "0".. },.. "rule": null,.. "source": "waS

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\dataset.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (7140), with CRLF line terminators
Category:	dropped
Size (bytes):	7341
Entropy (8bit):	5.27407171797532
Encrypted:	false
SSDEEP:	192:BSNaQstBT0ZVs64Hwxizhs2RS+R8Btmm9TsbYF0Rx:+WhxhLCPmn
MD5:	8957C96F2D8A5EAE05B1FFB5DAF15B8E
SHA1:	41DC6CCF5E2434E5ED67FF1EE7329E5FD16C0FA7
SHA-256:	1D97C9DB7F04860A7B9571532191F0D7FA3A43ACED30256ED99852851F107CB6
SHA-512:	682864682122B9FA199E3CA9EE7548433ABF1B010BC38A59B2A0AA32AE92F25E9920FB199C4CBD0F6C078E402DE22EE885B0FB18FE177E7D4B924571991A2D14
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var dataset_fileVersion = "1.2.181"; ..function CreateDataset(){function b(c){this._name=c;if(!this._name){throw"Dataset created with no name provided"}}b.prototype={initialize:function(d){try{if(!d){this._logError("No configuration defined");return false}var c=d.data_items;if(!c){this._logError("Invalid Data items. Config ("+JSON.stringify(d)+")");return false}this._itemsList=c;var f=d.refresh;this._setRefresh(f);this._logInformation("Initialization complete");return true}catch(g){this._logError("initialize: "+g.message);return false}},get:function(c){try{return this.getContent()[c]}catch(d){this._logError("get: "+d.message)}},getContent:function(){try{this._logInformation("getContent starting");this._logInformation("itemsList"+JSON.stringify(this._itemsList));var d=ModuleManager.getSingleton("data_collector");if(this.dirty){d.markDataExpired(this._itemsList);this.dirty=false}return d.get(this._itemsList)}catch(c){this._logError("getContent: "+c.message)}},

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\dataset_da.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (6749), with CRLF line terminators
Category:	dropped
Size (bytes):	6953
Entropy (8bit):	5.406901064256282
Encrypted:	false
SSDEEP:	96:JE+7wzRBsvJdOwfwrsEkRvtPYiNsnWPVybI6gNzgMd7e6peMYs5mI98RGx:JE+7uoJdSwHlQit0ONzgC7us5mIme
MD5:	877309C597A1754C7CCCB61D7FB82320
SHA1:	04CEA4DFF078D64B4BC8F30C219039423FB483C3
SHA-256:	8EC7F3E1193864D6ECF6C38719F85511AB198B6506C4FBA601DDFB4D0B9FDE0F
SHA-512:	601BE3B231A89D41558C316C65A13DA13A7FA49603823F321B32190C1FF12A2210F965E0D343365D59B35291080EDD390A4F62B4FC638B384B195F49B7B54A5B
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var dataset_da_fileVersion = "1.2.181"; ..var Create_dataset_da=function(){var a={dirty:true,load:function(){if(!this.dirty){return}setTimeout(160601000,function(){this.dirty=true});logNormal("Loading dataset da");this._content={};var f=this._getTimeLastDA_Query();if(!f){logInformation("dataset_da: Failed reading query start value. Going to use 0 as start");f=0}var b=this._getTimeNow();if(!b){logError("dataset_da: Failed reading query end value. Going to quit loading the dataset.");return}var c=2460*60;b=b-c;try{this._processRequests(this._da_queries,f,b);this._store_DA_QueryTime(b)}catch(d){logError("Failed to load the da dataset: exception is '"+d.message+"'");return}this.dirty=false},add:function(b,c){if(!b){return}this._content[b]=c},set:function(b,d,c){if(!c){this.add(b,d);return}var e=ModuleManager.getSingleton("rules");this.add(b,e.apply(d,c))},get:function(b){try{this.load();if(!this._content){return null}return this._content[b]}catch(c){logError

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\datasets_catalog.json

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	3.717699904609679
Encrypted:	false
SSDEEP:	24:1r1GHkJZEwv0SD0FOZVYEsWElFcTduoLqr7QYrMKHqEQDsHdYrpFxG9sSFeJpK:HCEnvU2mEsWYFAnLqrtrMKKbDsHOrpFU
MD5:	CA4481199F1905633D8635ED4C4D9B2F
SHA1:	B151F60C430D398E9ED81399110D653D70F4BEB0
SHA-256:	83AA1C521E2FFE89D16B2EE44DD3678CAF95FC2567DB17263B97D87E2CE1BBA4
SHA-512:	E40ECBEB700E9A15195E83200F811EB3D2D120F83F860E37AE7FE57778E97DF2881776C00B5EA2C19D27B367F44B475AC4A86808B00DC616DAC5649F2A7C6539
Malicious:	false
Reputation:	unknown
Preview:	{.. "version": "1.2.181",.. "data": {.. "default": {.. "data_items": [.. "product_analytics_content_version".. ],.. "refresh": {.. "useEngineDefaultTimeout": true.. }.. },.. "wa": {.. "data_items": [.. "product_version",.. "device_country_code",.. "product_subscription_type",.. "product_ab_test_group_id",.. "user_account_id",.. "product_productkey",.. "product_package_id",.. "device_platform_edition",.. "product_cpu_type",.. "device_platform_version",.. "product_install_type",.. "product_affiliate_id",.. "product_subscription_expiry_date",.. "device_geo_id",.. "user_global_reference_id",.. "device_id",.. "device_platform",..

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\dictionary.json

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10174
Entropy (8bit):	4.056574499020934
Encrypted:	false
SSDEEP:	192:dWOHdgzPqNxXciNwSmX2C6mWaSgkzRqU83ZPh4U:rgziHGazGVh4U
MD5:	95B93A03B8CB08AF09BD8D482EE0D29A
SHA1:	5349BAD7E28368B4705028EB34C8B04F6D3604E8
SHA-256:	8A5E81CCFEB1CB82E0496FEAC6506A75654C546ECC0239055EEA64CB63F5370E
SHA-512:	70865CC18B2CCFD9A0BA4C4E45E844A61E35342647F7BACE640C19D1B1C1F9122D8999EBA0B82046B5465C495E92D1C535A51DCF6732756ACD2C1C9A37A3EAD7
Malicious:	false
Reputation:	unknown
Preview:	{.. "version": "1.2.181",.. "data": {.. "event": {},.. "global": {.. "uniqueid": "hit_event_id",.. "uniqueidentifier": "hit_event_id",.. "feature": "hit_feature",.. "trigger": "hit_trigger",.. "interactive": "hit_engagement_interactive",.. "hit.interactive": "hit_engagement_interactive",.. "hit.user.initiated": "hit_engagement_userinitiated",.. "userinitiated": "hit_engagement_userinitiated",.. "desired": "hit_engagement_desired",.. "engagement.desired": "hit_engagement_desired",.. "useridentifier": "hit.userid",.. "label1": "hit_label_1",.. "label2": "hit_label_2",.. "label3": "hit_label_3",.. "label4": "hit_label_4",.. "label5": "hit_label_5",.. "label6": "hit_label_6",.. "metric1": "hit_metric_1",.. "metric2": "hit_metric_2",.. "metric3": "hit_met

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\emitter.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3654), with CRLF line terminators
Category:	dropped
Size (bytes):	3855
Entropy (8bit):	5.20710916605884
Encrypted:	false
SSDEEP:	96:4yk11hc+h8Md+O2SNyMZ5uGC2AjrkCOGnDila1:vk1I++Md+O2SNtC2WrkCOGnDila1
MD5:	6C8C011735FDC08793118C82D92DA4CB
SHA1:	CB7B4BA48AA9E669C3D83D2BFBC69F80AE0CC2BD
SHA-256:	4297BF13FF46485DB3A16C0E64C894B83C53CFBE0FC19227066F0E99B2623264
SHA-512:	A2F9E1E123B4D113582B7A422DB1CE67BCC4BD3513ECDA6A661B9D825D500FCC4BCE9C5404E4F58BCF136AFC5F4AF2AF9941831E5737D0818259718C3CF19B71
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var emitter_fileVersion = "1.2.181"; ..function createEmitter(b,a){function c(g,i){var h=getScriptVariableStore().Get(g);if(h){return h}try{h=getPluginFactory().Create(i)}catch(j){logError("Failed to create plugin: '"+i+"'")}try{getScriptVariableStore().Set(g,h)}catch(j){logError("Failed to set plugin '"+i+"' in store as '"+g+"'")}return h}try{var d={configure:function(g,e){this.profileName=g;this.profile=e;this.transportName=e.transport;this.transportConfiguration=e.transport_config;this.dataSetNames=e.datasets;this.enableRules=e.enableRules;this.throttleRule=e.throttleRule;this.throttleMultiplier=e.throttleMultiplier;this.maxDimensionLength=e.maxDimensionLength},send:function(h){try{if(!this._isEnabled()){logInformation("_isEnabled() returned false. Will not send data to "+this.transportName);return false}h=this._sanitize(h);if("csp"==this.transportName&&"1"==this._getPlugin(this.transportName).GetVersion()){return false}if(!this.initialized){var g=ModuleM

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\engine.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (11329), with CRLF line terminators
Category:	dropped
Size (bytes):	11529
Entropy (8bit):	5.250907548570848
Encrypted:	false
SSDEEP:	192:K8+1u9z1l8Le62L9s9Zs2JFsIOSsnQSRTPd3uXsx14jxN2FhvsC7PquQQHDmksFB:0e1LYpJyZQSRrdeXsx1AxNWFRddDmWM5
MD5:	85C7C5CCEED140146D877939FBB40750
SHA1:	B3C266846A70C3B3E79526A8E3D59FBED5E5AC02
SHA-256:	F7695E7C7B6B0A793F2E518494D343002E5AEE0E4F735949D46A853ECF0FC58C
SHA-512:	C3136DBCD763AB2F9BE0FCA42F4696ABD7183C7BFA06AB2C19A24D09C7816A9CF699570F6F7DCF3A4A4B9D5E749E7F6E8182DB79FCB84E13F99F2962F0B1404E
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var engine_fileVersion = "1.2.181"; ..LoadScript("common.js");var _factoryManager=CreateFactoryManager();var ModuleManager=CreateModuleManager(_factoryManager);var JSONManager=CreateJSONManager();var StorageManager=CreateStorageManager();var PDManager=CreatePDManager();var RegistryStore=null;var setContentHeartbeatTimeout=function(b,a){var d=getScriptVariableStore().Get("heartbeattimerid");if(d){try{clearInterval(d)}catch(c){logWarning("setContentHeartbeatTimeout: Fail to clear timer id "+c.message)}}d=setTimeout(b,a);getScriptVariableStore().Set("heartbeattimerid",d)};var engine={defaultClientAnalyticsRegistry:GetEngineSetting("Analytics.Base.RegKey","HKLM\\SOFTWARE\\McAfee\\McClientAnalytics"),heartbeatTimestampKey:"analytics_content_heartbeat_timestamp",datasetsRefreshRate:60601000,userId:null,createEventJson:function(c,a){try{a["Tracker.Type"]="event";return{UniqueIdentifier:c,type:"event",payload:a}}catch(b){logError("engine::createEventJson: Exceptio

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\error_transmitter.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (2529), with CRLF line terminators
Category:	dropped
Size (bytes):	2740
Entropy (8bit):	5.310758777564662
Encrypted:	false
SSDEEP:	48:XURsQEqp22+r9sEDQgWenZsEXRiRmf3djAFzsEysEBQsEsFsEBMCnUGsEaffL/Tx:DQnp2fxsrsnZsEAEf3d0FzsFsfsHFszd
MD5:	BFB81A6C06296A0E3DB5D3ABCF633C76
SHA1:	C86B17B783EC3076F3E0D2BAEC8E6D0842DB52C2
SHA-256:	F5A8EF08DC65DD2E4B4E5769E445572B3F6F944BDDF4FF5E9ECB4100C084E5C2
SHA-512:	14A1E51CCCAEC42C2CAA85E0B70BFB31B663542A961FCF91BEB227B2CB6A2AE910C7A262A82D631FD269EA378A74181E0CC0066DED700FABFF658339EA8C64EF
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var error_transmitter_fileVersion = "1.2.181"; ..function CreateAnalyticsErrorTransmitter(){function a(){this.setup()}a.prototype=ModuleManager.create("transmitter_template");a.prototype.messageName="analytics_event_error_occurrred";a.prototype.setup=function(){var c=ModuleManager.getSingleton("config_manager");var d=c.getProfileNames(this.messageName);if(!this.emitter&&d){this.profileName=d[0];this.emitter=this.retrieveEmitter(this.profileName)}};a.prototype._generate=function(c,e){var f={hit_event_id:this.messageName,hit_category_0:"Analytics.Event.Error",hit_trigger:c,hit_action:"Analytics.Event.Rule.Failed"};if(findObjectSize(e.type["ruleMismatch"])){f.hit_category_1="ruleMismatch";f.hit_label_0=JSON.stringify(e)}else{if(findObjectSize(e.type["ruleError"])){f.hit_category_1="ruleError";f.hit_label_0=JSON.stringify(e)}else{if(e.type["rejected"]){f.hit_category_1="rejected";f.hit_label_0=JSON.stringify(e)}}}var d=new Date();f["__record.created"]=d.toISOStr

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\event_handler.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (6709), with CRLF line terminators
Category:	dropped
Size (bytes):	6916
Entropy (8bit):	5.333702053750348
Encrypted:	false
SSDEEP:	96:7b+vdzkDCDfgTg3ZyHORvgaF22TYlpt3NnhYqBU3YYXCf/:skDgrouvgaF22TYlpdNnhVW3YK0/
MD5:	6772FD53C0B998E06A851503E851BD17
SHA1:	4B7426F7D2B3585BB9FCCC132F9A76C63D7290FE
SHA-256:	D8848D8334CE9117374DD12AEBC180D208FEC0F958B89664E85E83D45A7E2149
SHA-512:	CF410C8D5D49B6A2603818CD3AA093DC2AD8B4AF8F71069E36B7D706BB82C6C0508B0F9C2BAADD3B5D2C152693D8B4319520BD89062E96E39677B9568A3EC4BC
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var event_handler_fileVersion = "1.2.181"; ..if(typeof dataManipulator!=="object"){LoadScript("common.js")}function CreateEventHandler(){var c={handleEvent:function(g){try{var h=JSON.parse(g);var f=h.type;if(("MessageBusPlugin"==f)\|\|("InProcAPI Plugin"==f)){this._processMsgBusEvent(h.payload)}else{if("UWP_Event"==f){this._processAnalyticsAddRecord_v1(h)}else{logWarning("Unexpected message was rejected (unknown type): "+g)}}}catch(i){logError("Failed to process incoming event: exception = '"+i.message+"'")}},handleV1Record:function(e){this._processAnalyticsAddRecord_v1(e)},_processMsgBusEvent:function(h){try{var f=h.name;var k=h.payload;if(("Analytics.v1.AddRecord"==f)\|\|("Analytics.AddRecord"==f)\|\|("Analytics.Automation.AddRecord"==f)){return this._processAnalyticsAddRecord_v1(k)}var j=ModuleManager.getSingleton("data_collector");j.notifyMsg(f);var g=ModuleManager.getSingleton("observation_analytics");g.handle(f,k)}catch(i){logError("Failed to process message

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\events.json

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	134361
Entropy (8bit):	3.1600337530633746
Encrypted:	false
SSDEEP:	384:0fzFRfzQO30XiSLXyM6dzYcUXgIo8RmsziMw6pl7tzBuWpCBwOCBwXzN3PKbDf8E:WvN0PXgOGPwBwhuV
MD5:	98F6DC778331E4029FB4B191D54FC985
SHA1:	84647C518329FF8C18F12C8B04A833C102BD03C9
SHA-256:	2BF53E32D9F91E0177C9BDC05DD9B3A236B3D0E6A41F2D5720F949DE9BDCEFB4
SHA-512:	AAB3F2C37628B1A0BB2563CF1532B310F75EC9CBD608EE3E4170DAA7F9CED8DB0F8379628C134A2C314023DE8BE1B76382DA04CED7867138084D4E3E1073B7FA
Malicious:	false
Reputation:	unknown
Preview:	{.. "data": {.. "wa_advanced_protection_signals_impression": {.. "attributeRules": {.. "hit_action": {.. "meta": "screen_load",.. "ruleName": "override".. },.. "hit_category_0": {.. "meta": "Analytics",.. "ruleName": "override".. },.. "hit_engagement_interactive": {.. "meta": true,.. "ruleName": "override".. },.. "hit_feature": {.. "meta": "TBD",.. "ruleName": "override".. },.. "hit_label_0": {.. "meta": "success",.. "ruleName": "override".. },.. "hit_label_18": {.. "meta": "AdvancedProtectionSignals",.. "ruleName": "override".. },.. "hit_label_19":

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\hash128.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (4059), with CRLF line terminators
Category:	dropped
Size (bytes):	4260
Entropy (8bit):	5.611174413374786
Encrypted:	false
SSDEEP:	96:/hGfe5Z6TQ25OkR/ZCpMJFU7Rz94+IFpRREbgMG6hxOIq4sU/G/HIGIkUNjYbah:/I14icRpVIbRybgMGyxOIq4sU+/oGIkE
MD5:	30DCF4CF45E8914CED95B9A7C012B7B9
SHA1:	B131D1710139B270C6C75A03B12D7615D4DD772E
SHA-256:	EDF4741A3F6E86889E6FC3FFAF2A1450678E2E16BD2D008E22DDE4A9AA44536F
SHA-512:	35044DC820842CBDF38FA41D5604ED0035D0339C0B05833F4BE10ED54FFAE4927F951AB3282C6EB83EE0275761CAB2363DAC7208ED2FD20492CFE950A4184ED2
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var hash128_fileVersion = "1.2.181"; ..function CreateHasher128(){var a={hash128:function(s){function L(c,b){return(c<<b)\|(c>>>(32-b))}function K(x,c){var G,b,k,F,d;k=(x&2147483648);F=(c&2147483648);G=(x&1073741824);b=(c&1073741824);d=(x&1073741823)+(c&1073741823);if(G&b){return(d^2147483648^k^F)}if(G\|b){if(d&1073741824){return(d^3221225472^k^F)}else{return(d^1073741824^k^F)}}else{return(d^k^F)}}function r(b,d,c){return(b&d)\|((~b)&c)}function q(b,d,c){return(b&c)\|(d&(~c))}function p(b,d,c){return(b^d^c)}function n(b,d,c){return(d^(b\|(~c)))}function u(G,F,aa,Z,k,H,I){G=K(G,K(K(r(F,aa,Z),k),I));return K(L(G,H),F)}function f(G,F,aa,Z,k,H,I){G=K(G,K(K(q(F,aa,Z),k),I));return K(L(G,H),F)}function D(G,F,aa,Z,k,H,I){G=K(G,K(K(p(F,aa,Z),k),I));return K(L(G,H),F)}function t(G,F,aa,Z,k,H,I){G=K(G,K(K(n(F,aa,Z),k),I));return K(L(G,H),F)}function e(x){var H;var k=x.length;var d=k+8;var c=(d-(d%64))/64;var G=(c+1)*16;var I=Array(G-1);var b=0;var F=0;while(F<k){H=(F-(F%4)

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\json2.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3618), with CRLF line terminators
Category:	dropped
Size (bytes):	3817
Entropy (8bit):	5.529217349892361
Encrypted:	false
SSDEEP:	96:d6xjvqEYontqQYCNRqihKDMl1Q9/+slg60yvb0Pz/RlOZglybLnEl:lEKTGzg2sWqz+lybLEl
MD5:	8BB6763E626752B16CFD110B5453B3E6
SHA1:	E4A8DDF530A4D05072E39F182D806348ECCD8CFC
SHA-256:	F3661180451AEE65BB609B6A28489D32B7A8B928AF5094F518E2DCB0BE16003E
SHA-512:	6E0119E6BC077A8D9AEF5D96F3D774FE1F2D27EA209E8542DEB0D9D2AAF6F91F301D267FEDFE768B5253D9800A29CF13CE1F1CB232E7C8368D32797FE0B26AC9
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var JSON2_fileVersion = "1.2.181"; ..if(typeof JSON!=="object"){JSON={}}(function(){var rx_one=/^[\],:{}\s]$/;var rx_two=/\\(?:["\\\/bfnrt]\|u[0-9a-fA-F]{4})/g;var rx_three=/"[^"\\\n\r]"\|true\|false\|null\|-?\d+(?:\.\d)?(?:[eE][+\-]?\d+)?/g;var rx_four=/(?:^\|:\|,)(?:\s\[)+/g;var rx_escapable=/[\\\"\u0000-\u001f\u007f-\u009f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g;var rx_dangerous=/[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g;function f(n){return n<10?"0"+n:n}function this_value(){return this.valueOf()}if(typeof Date.prototype.toJSON!=="function"){Date.prototype.toJSON=function(){return isFinite(this.valueOf())?this.getUTCFullYear()+"-"+f(this.getUTCMonth()+1)+"-"+f(this.getUTCDate())+"T"+f(this.getUTCHours())+":"+f(this.getUTCMinutes())+":"+f(this.getUTCSeconds())+"Z":null};Boolean.prototype.toJSON=this_value;Number.prototype.toJSON=this_valu

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\logging.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3176), with CRLF line terminators
Category:	dropped
Size (bytes):	3377
Entropy (8bit):	5.478774658651738
Encrypted:	false
SSDEEP:	96:RXNGJtGJIGM+GtH5jnV+g2CdWVvDK1lEwJ2MPRp0WvIttWh:CJEJTMpzYVrKwMPv0WAtgh
MD5:	BB39BF60BBB5649F2E6AF73E03C801A9
SHA1:	BC7B877FA0069FE885951438C15F6F7C157E6F58
SHA-256:	974599BC2BB79BFBEE739957B73F79D94953D1D97048F75EFC1A172C4222427D
SHA-512:	12D5191D0620E04DC2DE5CDA2D5957E2CF4A97D4D664025F0035082C715C74033B832A5AFF9AF18E46552B44CCA06C9B3B2235F0A5B2EDF5249CC41934E770C9
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var logging_fileVersion = "1.2.181"; ..var debugEnable=false;function callerName(){var a=arguments.callee.toString();a=a.substr("function ".length);a=a.substr(0,a.indexOf("("));return a}function getLogger(){var b=getScriptVariableStore().Get("logging");if(b){return b}try{b=getPluginFactory().Create("logging");try{debugEnable=GetEngineProperty("Analytics.SDK.Script.Debug.Enable",debugEnable)}catch(a){}}catch(a){b={LogMessage:function(){},WriteToConsole:function(){},WriteToSyslog:function(){}}}getScriptVariableStore().Set("logging",b);return b}var LOG_SEVERITY_NORMAL=1;var LOG_SEVERITY_WARNING=2;var LOG_SEVERITY_INFORMATION=3;var LOG_SEVERITY_ERROR=4;var LOG_SEVERITY_CRITICAL=5;var SYSLOG_EMERG="emerg";var SYSLOG_ALERT="alert";var SYSLOG_CRITICAL="crticial";var SYSLOG_ERROR="error";var SYSLOG_WARN="warn";var SYSLOG_NOTICE="notice";var SYSLOG_INFO="info";var SYSLOG_DEBUG="debug";var logNormal=function(b){try{b=sanitizeLogMessage(b);getLogger().LogMessage(LOG_SE

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\mappings.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (2160), with CRLF line terminators
Category:	dropped
Size (bytes):	2362
Entropy (8bit):	5.3401536620120975
Encrypted:	false
SSDEEP:	48:Ob7j7XL5Zqjbtkp2yI4XNJEE+yqAUfOh6A+33SRWVCYAFET:I/IkxXn1+yQOh6D33vC1ET
MD5:	ADB684CA19D54C05B7032156B1B26823
SHA1:	EF6460CAB61E66C3A06D7DAC877D7D54BE7E871E
SHA-256:	33656F3B24C664F73A57AFEB2C7B705C825CBFEE9BF7585D7359CD663518AEA3
SHA-512:	93D5166883CED16E3CCFDB430B4D5021DE13434E08FC939B5C5E8A82EB0E252D79F0B34C02F07201E8CDF0C81AC95E5EC4E0E11A3164440EFC6D1ED3FE555653
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var mappings_fileVersion = "1.2.181"; ..function CreateMapping(){var a={eventMap:function(c,b){if(!(b in this._eventTable)){return c}return this._map(this._eventTable[b],c,true)},globalMap:function(b){return this._map(this._globalTable,b,true)},daMap:function(b){return this._map(this._daTable,b,true)},profileMap:function(c,b){if(!(b in this._profileTable)){return c}return this._map(this._profileTable[b],c,true)},getProfileTableStr:function(b){if(!(b in this._profileTableStr)){return"{}"}else{return this._profileTableStr[b]}},getFlippedProfileTable:function(c){if(!(c in this._profileTable)){logWarning("Requesting flipped table for invalid profile "+c);return{}}if(c in this._flippedProfileTable){return this._flippedProfileTable[c]}this._flippedProfileTable[c]={};for(var b in this._profileTable[c]){var d=this._profileTable[c][b];this._flippedProfileTable[c][d]=b}return this._flippedProfileTable[c]},_map:function(b,f,h){if(!b\|\|!f\|\|(typeof f!=="object")){logWarni

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\mcutil.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (1832), with CRLF line terminators
Category:	dropped
Size (bytes):	2032
Entropy (8bit):	5.423419114482651
Encrypted:	false
SSDEEP:	48:nb9YBy8KJU9hYErsYvZ5YxHqbWbb//yb07jcFl4ADv8TuScfRD:n5Y7MErvScaiNXScZD
MD5:	CE103C399CCC08F9AA5B0DBF88881E28
SHA1:	6774BDBE18B6D63BA790FF9A32822230FAA6E1C2
SHA-256:	4FC19203D995BF3543796193E60841B77EFB660D5A0D4C91201BC65ACB8E8354
SHA-512:	AF6574E53690A6141D028079B6ACD7E54AEE853D86C619AABA635FE3848D7DBB69C86754EE7C36874D42BB72B48AB08E38458FDB3B8C0382CAE9CAFDDB8038C6
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var mcutil_fileVersion = "1.2.181"; ..function CreateMcUtilHelper(){var a={_logError:function(b){logError("mcUtil: "+b)},_logInfo:function(b){logInformation("mcUtil: "+b)},_getPlugin:function(){if(!this._plugin){var c=ModuleManager.getSingleton("data_collector");var b=c.get("analytics.sdk.version");if(b.match("^2.[0-5]")){this._logInfo("This SDK does not support mcUtil plugin. sdkVer("+b+")");return null}this._plugin=getPluginFactory().Create("mcUtil")}return this._plugin},_plugin:null,_hardwareId:null,_softwareId:null,storeHardwareAndSoftwareId:function(d){try{this._logInfo("storeHardwareAndSoftwareId - start");if(!this._getPlugin()){return}var b=d;if(!d){var h=ModuleManager.getSingleton("data_collector");var f=h.get("WSS.Hardware.ID");b=(f==="[ruleMismatch]")?true:false;this._logInfo("value: "+f);this._logInfo("storeValue: "+b)}if(!b){this._logInfo("Not going to storeValue");return}this._invokeGetMachineId();if(!this._softwareId){this._logError("storeHardw

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\observation_analytics.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (1151), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2017
Entropy (8bit):	5.2643713576298214
Encrypted:	false
SSDEEP:	48:KvZEumJTxfCViKARzApkiNOVBdDzdzHbp5db5GFDvVd9MGZdozuIdvJEd:KvuusTxfCViK0zJD5zHVjb5GFDvfb5Iw
MD5:	B3AE304C1084A7D4B5CABF74C64458D8
SHA1:	A88D20205FA58ADB5ECEA1985593FFFA2DA1C417
SHA-256:	54A31A36672CCD6E11CF0BFFA1BBC08460BCC91CF1AABFCFECB0A939EA189AEC
SHA-512:	F72F45665522B40AFE6BDC228A2E179320E9D835C20725D5A1846CC206DD6428C7A5B84CAED666416642CCB894EC6BD7939AB3E332941145ED6339E239B86E2E
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var observation_analytics_fileVersion = "1.2.181"; ..function getObservationAnalyticsEngine(){./. config format:. * 'Message.Name' : { // name of obsved message on messagebus that we will subscribe to. * 'map' : { // map from message keys --> analytic friendly keys. * 'Count' : 'Metric1', // ex. 'Count' : 123 --> 'Metric1' : 123. * 'Policy' : 'Event.Label' // ex. 'Policy' : 'XYZ' --> 'Event.Label' : 'XYZ'. * },. * 'default' : { // default values that are not specified in the obsved message. * 'hit_event_id' : 'XYZ'. * }. * }. */.var a=function(){var d=JSONManager.getSingleton("observability_datasets");if(!d){d={data:{}}}return d.data};var b=a();var c={start:function(){try{var d=getMessageBus();for(var f in b){d.Subscribe(f)}logDebug("observationEngine Started")}catch(g){logError("observationE

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\operations.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (6480), with CRLF line terminators
Category:	dropped
Size (bytes):	6684
Entropy (8bit):	5.337224061028135
Encrypted:	false
SSDEEP:	192:jAk6WqZs6iqL5QaQldifjf9i/OCi8sdHvzqZ+SSf72NfoDc8H5sviXvq:jEb3UidGBdT
MD5:	572BDB31B5DEF5ECDCBBE9D0F8298167
SHA1:	13C1BD6AA368846990EAE0527C0E7B3B9B6F6560
SHA-256:	53A05779BA4FF6DA18FCA7D817516F2FFDC180DC00DA8E91AE8F472493E67FEE
SHA-512:	4D04D03F7DD01C407F2554AFDA61D1CB1924256C7C67ECF3F72AE656703B0148A57D906876E2D7ED73E4A9A574B2F5146A0BDD072FC367C2514F3FA30E3A87C7
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var operations_fileVersion = "1.2.181"; ..function CreateDataOperations(){var a={apply:function(c,b){try{if(!b){return c}if(!this._isValidValue(c)){this._logWarning("Invalid value Val("+c+"). Operation with operationConfig("+JSON.stringify(b)+") will not be applied");return null}return this[b.name](c,b.params)}catch(d){this._logError("operations:apply: Excption caught("+d.message+". Val("+c+"), operationConfig("+JSON.stringify(b)+")");return null}},noop:function(b){return b},equal:function(b,c){return b==c},isValueValid:function(b){return(b!="[not assigned]")&&(b!="[ruleMismatch]")&&(b!="[ruleError]")},notNull:function(b){return(b!=null)},validLen:function(b){if(!b){return null}try{b=JSON.parse(b)}catch(c){this._logError("validLen: value ("+b+") not an object, exception: "+c.message);b=[]}if(!(b instanceof Array)){this._logWarning("validLen: value not an array ("+b+").");b=[]}return b.length},lenEqual:function(b,c){return(this.validLen(b)==c)},lenGreater:fun

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\preprocessors.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (825), with CRLF line terminators
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.406672124511126
Encrypted:	false
SSDEEP:	24:8eLYQI/YCqYJIAb2sFsn5caYyb2srq7Y4cbfsk0RrnsEeEc1Jntk2O:pLVI/xqIXbTFsKrybTAncbfl0Rrsn1Pk
MD5:	AEF9083AE508ECD909C4D1B26832761F
SHA1:	34DB0B9BF4F1949381C4397D03434DDEAF74BBF4
SHA-256:	E150DEEB702CC930402D7C5756E8DADF216F6FFFADD22E1C12C98E3DD5FFB92E
SHA-512:	B95970D7BAEBEC0BF538248960157D22D31CB0E912ADC11ADE890D9C45B923825FBC39FD8AE0D20AF27956D4B80D0FF94013B7438D94902C46EB60FECED7E698
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var preprocessors_fileVersion = "1.2.181"; ..function CreatePreprocessors(){var a={noop:function(b){return b},splitByComma:function(b){return b.split(",")},joinWithComma:function(b){return b.join(",")},sum:function(b){var d;for(var c in b){d=b[c]}return d},toInt:function(c){if(typeof(c)=="object"){for(var b in c){logConsole("toInt value="+c[b]+" parseInt:"+parseInt(c[b]));c[b]=parseInt(c[b])}return c}return parseInt(c)},toString:function(c){if(typeof(c)=="object"){for(var b in c){c[b]=c[b].toString()}return c}return c.toString()},toUpper:function(b){return b.toUpperCase()},apply:function(c,d){logConsole("rules type="+typeof(d)+" rule= "+d+" value="+c+" typeof(value)="+typeof(c));if(!d){return c}if(typeof(d)=="object"){for(var b in d){c=this.apply(c,d[b])}return c}return this[d](c)}};return a}ModuleManager.registerFactory("preprocessors",CreatePreprocessors);..//D9AD4ACE1BC0124B3BA656E014A50EA9D4D2D3F7739C91C96AE198CE73126023D2809CEE59018A9C678F901DDE34D55D3F

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\profile.json

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2283
Entropy (8bit):	4.215493750927689
Encrypted:	false
SSDEEP:	48:HV9y51drjiTX2/mIQft9y51drGhImxs9y51druhmmC:bf2/dGTYs62X
MD5:	EFEE1A73FA907F3D0A6AC06D624BDC49
SHA1:	563B2AB8FF69694D52F96F100A7BF53719621DD1
SHA-256:	3C29F581572B84D9D184785120E31D5A0344234E4BFBB44942E658C330DF7C9A
SHA-512:	9B5276A40F88231C01B974E49894C414511F15A9C2551613B7106E8259AC21947FD86DD660A4A9DBB746935B53B6B6A9B3381C3C6785241821582259A3BE7AC3
Malicious:	false
Reputation:	unknown
Preview:	{.. "version": "1.2.181",.. "data": {.. "profile_webadvisor_mosaic_100p": {.. "transport": "eh",.. "dictionary": "dictionary_wa_mosaic",.. "datasets": [.. "default",.. "wa".. ],.. "maxDimensionLength": 500000,.. "appid": "7b3ed1a8-7907-436a-ac6c-640bfd5db80c",.. "transport_config": {.. "apiVersion": "2014-01",.. "servicebusNamespace": "cu1pehnswebadvisor1",.. "eventHubPath": "new_wa",.. "sharedAccessKey": "IU1g+5XrDoldu/krnr8GDbVL/jHXoqZrH9alKG29J8Q=",.. "sharedAccessName": "new_wasend".. },.. "throttleRule": {.. "meta": 100,.. "ruleName": "dailyMax".. },.. "throttleMultiplier": 64.. },.. "profile_webadvisor_mosaic_kongapi_100p_qa": {.. "transport": "mosaic_api_v2",.. "dictionary": "dic

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\registry.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (2785), with CRLF line terminators
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	5.391913933403757
Encrypted:	false
SSDEEP:	48:WNToenoesA9R/io8udVQN7wfagenv7sboA+FNvf4uCmnWoGbA/WoGb5u4U7li2cC:yBVsuvsnvYc/UiWAWBun7hn
MD5:	5372B326CA29EC2DE36EF8F109502301
SHA1:	C3EEB4C2B4FAC9C4994248CF3D7F95D500C51F88
SHA-256:	03593C81230E51745836B2BCF35B3D908FC5B17841BF245B4D87ECAB67BFF653
SHA-512:	5FDC6490CAAA5A8461793870407D3A6E96271F552B5006C7AC8C8B8CC82B32B49FBF6391A8BFD98AC0C9B4E53B609366BF2E9543E2E733171F2CF600C06B18FE
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var registry_fileVersion = "1.2.181"; ..function CreateRegistryHelper(){var a={openKey:function(c,b){if(typeof b!=="boolean"){b=false}if(b){logDebug("open registry in write mode");return this._getPlugin().CreateReg(c)}logDebug("open registry in read mode");return this._getPlugin().OpenReg(c)},openKey64:function(c,b){if(typeof b!=="boolean"){b=false}if(b){logDebug("open registry in write mode (x64)");return this._getPlugin().CreateReg64(c)}logDebug("open registry in read mode (x64)");return this._getPlugin().OpenReg64(c)},queryValue:function(c,b){var g=false;try{if(typeof b==="boolean"){g=b}var f=this._getPlugin().QueryValue(c,g);return f}catch(d){logInformation("Failed to query "+(g?"obfuscated ":"")+"registry key '"+c+"': exception is '"+d.message+"'")}return null},setValue:function(d,f,b){var h=false;try{if(typeof b==="boolean"){h=b}var c=this._getPlugin().SetValue(d,f,h);if(!c){logDebug("registry.setvalue failed ("+d+", "+f+")")}return c}catch(g){logInfor

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\rest_transport.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (6423), with CRLF line terminators
Category:	dropped
Size (bytes):	6631
Entropy (8bit):	5.301476595849207
Encrypted:	false
SSDEEP:	192:E8sCKa1ZC0CG20+M9wBFmGO1zadW9NvEPzs5C7c8a5dcQbefnLpNxSf:8B9Pzpqf
MD5:	1AC8A0EC5A66AD08CC9DF81972F571AD
SHA1:	0B27C814B04BCC1C45F442A3D5B0305A38885555
SHA-256:	AD9BE63E53A1885949B3EBD506C1C911539BE31584ACDFDC081FB022B55A645A
SHA-512:	9F200BAA040AD089D3DD4A965C39A71A3E594395EF087DA25D7BB96730DFE19CBC9DA582C696D048607C04DCF68DA295402953A64C6A908B3772E9CA72A91C3F
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var rest_transport_fileVersion = "1.2.181"; ..function RESTtransportPlugin(){this._plugin=null;this._requestHeaders={};this._url=null;this.RESTClientAvailable=false}RESTtransportPlugin.prototype=ModuleManager.create("transport_template");RESTtransportPlugin.prototype.constructor=RESTtransportPlugin;RESTtransportPlugin.prototype.GetVersion=function(){try{if(!this._plugin){return null}return this._plugin.GetVersion()}catch(a){}};RESTtransportPlugin.prototype._createRESTclientPlugin=function(){try{this._plugin=getPluginFactory().Create("RESTclient");if(!this._plugin){logError("RESTtransportPlugin:: Could not create RESTclient plugin");return false}return true}catch(a){logError("RESTtransportPlugin:: Failed to initialize the plugin for '"+name+"': exception is '"+a.message+"'");return false}};RESTtransportPlugin.prototype._setup=function(){try{this._url=this._config.url;if(!this._url){logError("Invalid (unspecified) URL for '"+this._name+"', version "+this.versi

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\rules.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3246), with CRLF line terminators
Category:	dropped
Size (bytes):	3445
Entropy (8bit):	5.352977551180376
Encrypted:	false
SSDEEP:	48:IM0Vnh1PJzvkXv3i/kYrAH6aEPhZf3a4BdaFBLYFpGbaaPYFpGbMmUpXjJbO8iR0:Xfpkq4qFypHrVdiSN5bYQhavJ+N
MD5:	6D3E819131969A13A1CB711251D35B84
SHA1:	800E3D54CED7EDC9E4DA86C5EDDFF916A67C8D44
SHA-256:	0C65B236AEF00DA1CB864D02C60F5DA6D071ACD977A836EBECFFC8FF1D0FB0D7
SHA-512:	5D97D85E70B9805907790AA8074D6D43A928CA9E4705717B0D515D873F9B33623FAEDE59F61BF4BFFF3EFC697C1C47514BD193F354BE80CCF82CFBF79E89D777
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var rules_fileVersion = "1.2.181"; ..function CreateRules(){LoadScript("sha256.js");var a={notNull:function(b,c){return(b!=null)},inRange:function(b,c){return(b>=c.min)&&(b<=c.max)},equal:function(b,c){return(b==String(c))},greater:function(b,c){return(b>c)},greaterEqual:function(b,c){return(b>=c)},less:function(b,c){return(b<c)},lessEqual:function(b,c){return(b<=c)},notEqual:function(b,c){return(b!=String(c))},startsWith:function(b,c){return !b.indexOf(c)},endsWith:function(b,c){return b.indexOf(c,b.length-c.length)!==-1},contains:function(b,c){return b.indexOf(c)!==-1},regex:function(c,f){try{var b=new RegExp(f);if(f.expr&&f.flags){b=new RegExp(f.expr,f.flags)}return b.test(c)}catch(d){logWarning("rules.regex exception: "+d.message);return false}},timestamp:function(b,c){if(!b){return false}return(new Date(b)).toISOStringms()==b},"in":function(c,d){for(var b in d){if(c==String(d[b])){return true}}return false},isType:function(b,c){return(typeof b===c)},isE

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\sha256.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (709), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	37442
Entropy (8bit):	5.182556715531017
Encrypted:	false
SSDEEP:	768:aNLZ52t2LQdhrnY09gCZHAtV9EhhfVroWqAv:av5KUQ809gwHAlybqAv
MD5:	1F991FEE209172D247C3BE87A794819F
SHA1:	52974B066FB6AF6802A3C3A225710FE6C0B78260
SHA-256:	FC0F46A6495B9DB6789CAD245272125AE1D21D9A1AC823F663FA5D4D8DED39FC
SHA-512:	E5373D7BDD0D5C9697941ECD9ADD2752971ABE32A45519068A2B93B97A76578599854A71F6C5907025BF7E9FC8432EE55F81187421601DD3ECD3DC654C9BCF7F
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var sha256_fileVersion = "1.2.181"; ../.Copyright (c) 2008-2017, Brian Turek.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer.. * Redistributions in binary form must reproduce the above copyright notice,. this list of conditions and the following disclaimer in the documentation. and/or other materials provided with the distribution.. * Neither the name of the the copyright holder nor the names of its. contributors may be used to endorse or promote products derived from this. software without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS".AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE.IMPLIED WARRANTIES OF MERCHANTABI

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\subdb.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (663), with CRLF line terminators
Category:	dropped
Size (bytes):	862
Entropy (8bit):	5.488970807055558
Encrypted:	false
SSDEEP:	24:ZmeV5IOd09ODopDwLgmjNnbi1W7xzBtxR:hV5iOD+ss4Nbi1yxR
MD5:	B4D8A83F38DDDE9224AD7DC9939DFEBF
SHA1:	7FD27259867AF6DD887FFBF576E50A7DD10D19F7
SHA-256:	8A92A070A6980C4D1D7DA6770430FD9F489AF3E633900C3160289310CDB137C8
SHA-512:	EBD0F64906866BC24BFEC78EC4BF83AA9FF83C239F709F2DDA5AEEF3B681CDB7F974CA533E9077530EF8475DA072A8AFE6ABB63D79220CB2684C6693201A4B2A
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var subdb_fileVersion = "1.2.181"; ..function CreateSubDbHelper(){var a={_getPlugin:function(){if(!this._plugin){this._plugin=getPluginFactory().Create("subdb")}return this._plugin},_plugin:null,fetchFromDataDefinition:function(c){try{if(!c){logError("subdb:fetchFromDataDefinition: No dataDefinition supplied");return null}if(c.action==="canIRun"){return this._getPlugin().CanIRun(c.appid)}if(c.action==="GetProperty"){return this._getPlugin().GetProperty(c.appid,c.name)}logError("Unknown action name ("+c.action+")")}catch(b){logError("subdb:fetchFromDataDefinition: "+b.message+". dataDefinition"+JSON.stringify(c))}return null}};return a}ModuleManager.registerFactory("subdb",CreateSubDbHelper);..//96CD01F745528C105AEB51D4C1105E4FE241D7862766FF34045AF7A7EF36BC8D1A800404C1D9F2A3E989A6E8CFB15075436E6E4039508BE969B04D52F4780971++

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transmitter_template.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3717), with CRLF line terminators
Category:	dropped
Size (bytes):	3931
Entropy (8bit):	5.351870644238223
Encrypted:	false
SSDEEP:	96:BDeOIhVr9zrhSLCxNBpyX0irau/9lRCHfYMSd/:QOIBzrhscB80irj/9lwH+p
MD5:	4DE18F19E9FBDE4AB4792E99DD2C29E6
SHA1:	34954800F967063C688604ECE3B8FF166B07B9E3
SHA-256:	EAC9EA44BF0ADEE80A41D183D140D090271BBF7102A88ABED38A3F1E694C0E9A
SHA-512:	C8FCFC7DD9C8AD40AFBC951B4E92CBEB3186FC122FAF905F89873C4A5C96C8A25B971F0CACD6DFA30F34AD9952C3914B76342CA107B91088534C4FE948CDF8E9
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transmitter_template_fileVersion = "1.2.181"; ..function EventTransmitterTemplate(){}EventTransmitterTemplate.prototype={addDataSetNames:function(c,d,b){var a=[];if(d.dataSetNames){a=a.concat(d.dataSetNames)}if(b){a=a.concat(b)}a=dataManipulator.arrayRemoveDuplicates(a);logDebug("emitter ProfileName: "+d.profileName+". allDataSetNames: "+JSON.stringify(a));this._mergeDataSets(c,a)},_isEventThrottled:function(b){var c=ModuleManager.getSingleton("config_manager");var a=c.getThrottleRule(b);return this._applyThrottle(b,a)},_isProfileThrottled:function(b,d){var c=ModuleManager.getSingleton("config_manager");var e=c.getPriority(b);if(e!="critical"){var a=this._getProfile(d).throttleRule;return this._applyThrottle(d,a)}return false},_applyThrottle:function(a,c){try{if(!c){return false}var d=ModuleManager.getSingleton("rules");return d.evaluate(a,c)}catch(b){logError("_applyThrottle: "+b.message)}return false},_applyAttributeRules:function(p,o,a){try{var h=Modu

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (7089), with CRLF line terminators
Category:	dropped
Size (bytes):	7292
Entropy (8bit):	5.239821014895397
Encrypted:	false
SSDEEP:	192:BNppM62N2XDFDHmoHKvxOjrfFQdRn2ESa/ecRWUIWqdGE1SbGvk/Y:BNppT2N2XDFiRvxOjDFQdJ2ESa/ecRWt
MD5:	2CBEA70DF849FC997D34AC5696C8F91F
SHA1:	20E9B5CE417B20DCAA3531C7041260362B4A5A6D
SHA-256:	6CDC2626E4528A09BD088B29B2772EE28B8FEDC71D2A9E5AB688C17EFBBFBF5B
SHA-512:	7585A644CD7CF82B947A7C89EF87A7F522041380534A6CD3953BF0D7DE83CB49C7A8D8C7EB556045500B5A7642101CB25ABA26459EE601A1C65AC01E57D3A41D
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_fileVersion = "1.2.181"; ..function CreateAnalyticsTransport(){function a(){this.retrieveStoredQueue()}a.prototype=ModuleManager.create("transmitter_template");a.prototype.transmit=function(m,s,t,c){logDebug("analyticstransport.transmit message="+JSON.stringify(s)+", profileNames="+JSON.stringify(t)+", datasetNames="+JSON.stringify(c));if(this._isEventThrottled(m)){logDebug("Event "+m+" was event-level throttled");logAutomationError(m,JSON.stringify(s),JSON.stringify({level:"info",type:{eventThrottled:m+" is event throttled"}}));return}for(var l in t){try{var o=t[l];if(this._isProfileThrottled(m,o)){logDebug("Event "+m+" was profile-level throttled by '"+o+"'");logAutomationError(m,JSON.stringify(s),JSON.stringify({level:"info",type:{profileThrottled:m+" is profile throttled for "+o}}));continue}if(engine.isStopRequestReceived()){logWarning("transmitter.prototype.transmit: Stop request received, so stopping all data transmissions..");return}var

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_ai.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (2458), with CRLF line terminators
Category:	dropped
Size (bytes):	2664
Entropy (8bit):	5.49417849126966
Encrypted:	false
SSDEEP:	48:FtzciWIdy2hgcmGY2rVTOd6oNoP5vCuKKiWXUlK7Ytalh:/A2hqGY2rhOELKM1lh
MD5:	35B2B558D1017AF1D35BC86E2E87DC46
SHA1:	8C720ABC3163B1701D77518F83BAE046A02459B6
SHA-256:	206B340C24FADD062B525EBDBE788ECE76932C0C441B27BACB5F61DFD7B7B9E8
SHA-512:	FEEAF734F7ECF4DEDF5016D35417F0EE9F4550FDE9038EAF05102CC208E7AE900C6BF0B6929E503C605D27421687753A1DEF283B2F7B7C621BD716C75BE7B213
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_ai_fileVersion = "1.2.181"; ..function CreateApplicationInsightsTransport(){function b(h){try{var j=/\d{4}-[01]\d-[0-3]\d\T[0-2]\d:[0-5]\d:[0-5]\dZ/;if(j.exec(h)){return h}var i=/\d{4}-[01]\d-[0-3]\d\ [0-2]\d:[0-5]\d:[0-5]\dZ/;if(!i.exec(h)){return null}var l=h.split(" ").join("T");return l}catch(k){logError("getValidIso: Exception caught: "+k.message)}return null}function c(h){if(!h){return null}switch(h.toLowerCase()){case"event":return"EventData";case"screen":return"PageViewData"}return null}function f(i){var h={};try{for(var j in i){if(isNaN(i[j])){logWarning("getNumberValues: ignoring value at key: "+j+". With value: "+i[j])}else{try{h[j]=Number(i[j])}catch(k){logError("getNumberValues: Exception caught at key: "+j+". Exception: "+k.message)}}}}catch(k){logError("getNumberValues: Exception caught: "+k.message)}return h}function e(h){if(!h){return null}switch(h.toLowerCase()){case"event":return"Event";case"screen":return"PageView"}return nu

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_api_endpoint.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3250), with CRLF line terminators
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	5.33120514305712
Encrypted:	false
SSDEEP:	96:xLi5lyUHvoZQLbMF1YfEj05DK+wlVE15DkAPAkE:xLi5ZwibMF1YfY05DK+wkzDkAPA7
MD5:	625E5E7CC99E67C103A5BE1EA34EF5BA
SHA1:	C1B69DA64A1D568631A6A267CB182B9A5616159C
SHA-256:	E8A14CCBE0D37AA4BEB602D2742437F452022D15175F73A208266E151AA705C7
SHA-512:	0CA483AC74528F2CB3B66CB88353818C24FFF77262BC615CE176B501CD00C11358B6E4790419FFF0B0CB2032042E2A336F430AC949362B915B2DD7F8F6B3D2A8
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_api_endpoint_fileVersion = "1.2.181"; ..function CreateAPIEndpointTransport(){function a(){this._url="";this._verb="PUT"}a.prototype=ModuleManager.create("rest_transport");a.prototype.constructor=a;a.prototype._setup=function(){this._url=this._config.url;if(!this._url){logError("APIEndpointTransport:: Initialize failed url not provided");return false}if(this._config.headers){var d=this._config.headers;for(var b in d){this._AddRequestHeader(b,d[b])}}if(this._config.verb){this._verb=this._config.verb}this._createRESTclientPlugin();if(this.GetVersion()&&(this.GetVersion()!="1")&&(this.GetVersion()!="2")){this._usingRESTclientPlugin=true;logInformation("Calling parent class to setup using the restful plugin");this._plugin.SetHttpMode(this._verb);var c=getSystemPlugin();this._plugin.SetAgentName("McAfee Mosaic API V1 transmitter_"+c.CreateGUID());this._plugin.Connect(this._url)}else{this._plugin=null}return true};a.prototype._sendUsingRestClient=fun

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_aws_apigateway_v1.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (4753), with CRLF line terminators
Category:	dropped
Size (bytes):	4974
Entropy (8bit):	5.404388594792175
Encrypted:	false
SSDEEP:	96:8K44u2URXvoZjLFlE5WB1AwfitMQxHcdp:8K4LdwFFl2NwfitrxHcdp
MD5:	45A21281AA742D748DC7B91289FF2BEA
SHA1:	F36EBB2231B75087D814DD8EB5871E43FFDEA1B4
SHA-256:	3D92EE4BBFC16C0B57562A437CD4FC2D531AEB3D1F7A76332399C0E1AFC5C5E5
SHA-512:	AEBF728F5BA92A7D8BEC477D38DD0CDB7152860EB26E3573A0D6407135EA444B24C3EC16D6D8FAF5F7394FF7BB1202390BE81151A56D0080DEC43378127912A7
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_aws_apigateway_v1_fileVersion = "1.2.181"; ..function CreateAWSAPIGatewayV1Transport(){function b(){this._apikey=null;this._partitionKey=null;this._url="https://{dns}.awscommon.mcafee.com/1.0/{gateway}/v1/record"}b.prototype=ModuleManager.create("rest_transport");b.prototype.constructor=b;b.prototype._setup=function(){this._apikey=this._config.apikey;if(!this._apikey){logError("AWS_APIGateway_V1_Transport:: Initialize failed API key not provided");return false}var c=this._config.dns;if(!c){logError("AWS_APIGateway_V1_Transport:: Initialize failed DNS not provided");return false}var e=this._config.gateway;if(!e){logError("AWS_APIGateway_V1_Transport:: Initialize failed Gateway not provided");return false}this._updateURL("{dns}",c);this._updateURL("{gateway}",e);this._partitionKey=engine.getContextId();if(!this._partitionKey){this._partitionKey=generateAlphaNumericString(256)}this._createRESTclientPlugin();if(this.GetVersion()&&(this.GetVersion()

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_da.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (2581), with CRLF line terminators
Category:	dropped
Size (bytes):	2787
Entropy (8bit):	5.390816850510691
Encrypted:	false
SSDEEP:	48:F+RC4cETZD7ThSwsnoK2NkNCalAVKp9oH259ln2W8HsFAS0+NN70JxAesVuCdL0L:DUvhSwODAAce2OpNS+VfBs/P
MD5:	F1AE9AC1E6679143679FF45893E7BB4D
SHA1:	EFD1513AFCE156E20EA05E662C0B9F3783078CF8
SHA-256:	6538E69A2E76417848617108D1D64D0B5EADA2B717C8F8B12A6C07C470A81629
SHA-512:	A5932E41D2CCC7A4EC292C6086867C2089539E375186426E18E1AEC2B7F68592E13588633B329D4D5B4F673A25FCD64D67407F1BDE2F4C7C578CCF36DC71090D
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_da_fileVersion = "1.2.181"; ..function CreateDATransport(){var a={Send:function(c){try{var b=this._getMsgBusPlugin();if(!b){logError("[DA Transport] Current MsgBus Plugin does not support request/response.");return false}if(!b.IsAvailable()){logWarning("[DA Transport] Message Bus could not be loaded; subscriptions will not be active");return false}var g=ModuleManager.getSingleton("mappings");c=g.daMap(JSON.parse(c));var d=this._ComposePayload(c);if(null==d){return false}b.Publish("Data_Aggregator.Add_Data",d);logDebug("[DA Transport] Emit outbound data: "+d);return true}catch(f){logError("[DA Transport] Exception thrown when sending da event: "+f.message);return false}},_ComposePayload:function(c){try{var b={};var f={};var h={};c["__record.created"]=this._convertToLocalDate(new Date()).toISOString();c["__record.created"]=c["__record.created"].split("T").join(" ");for(var d in c){if(this._indexOf(this._metricList,d)!==-1){f[d]=c[d]}if(this._inde

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_eng_observability.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3274), with CRLF line terminators
Category:	dropped
Size (bytes):	3495
Entropy (8bit):	5.2002350269366575
Encrypted:	false
SSDEEP:	96:0fXKiK/bXDX8cX0XkXRXUXL1XUXSwXUXNXWXBoX1b6iYikiXxxiEiQX4iw2XK/nX:0fXK9/bXDX8cX0XkXRXUXL1XUX5XUXNq
MD5:	7A0861869FDBA66520911DC0EA0A9D99
SHA1:	5519A55F5EF099361C362ECAD231EB52CA31B204
SHA-256:	4DE1D0E6BDA27F5510B60B4A877DECD64DE08D52AADC1329C71B1CF838BB2CD9
SHA-512:	8224D939F4D49A47F5D7ED1724AAD45F1168BB8DA59187024BB5CEF4D58AA1F8457283AF1694F013EE19CCD7239011DFA2ED2021AA629E49A9858F762CC4F797
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_eng_observability_fileVersion = "1.2.181"; ..function ObservabilityTransport(){this._transport_api_endpoint_emitter=null;this._url="https://pl8qcwep6c.execute-api.us-west-2.amazonaws.com/prod_v1/v1/record";this._apikey=null;this._verb="PUT";this._partitionKey=null;this.logInfo("New ObservabilityTransport Created")}ObservabilityTransport.prototype=ModuleManager.create("transport_template");ObservabilityTransport.prototype.constructor=ObservabilityTransport;ObservabilityTransport.prototype.logInfo=function(a){logInformation("ObservabilityTransport: "+a)};ObservabilityTransport.prototype.logError=function(a){logError("ObservabilityTransport: "+a)};ObservabilityTransport.prototype.logWarning=function(a){logWarning("ObservabilityTransport: "+a)};ObservabilityTransport.prototype._updateURL=function(a,b){this._url=updateStringWithReplacement(this._url,a,b)};ObservabilityTransport.prototype.GetVersion=function(){try{return engine.getContentVersion()}ca

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_event_hub.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (7985), with CRLF line terminators
Category:	dropped
Size (bytes):	8198
Entropy (8bit):	5.26365769145665
Encrypted:	false
SSDEEP:	96:iiONyk/DC0+p55U7voKLgIEpfEdvQKf3Jmn/i/6/lWqu/K/z1gdnxmVMdqAQ7FG3:iivk7uYwGOZIWEcQ5s0nx23VIHkZK
MD5:	71689F9093BBFD5637CEFDCBE8756B73
SHA1:	7EB5652426259B7773D72CC15C581C02D195D770
SHA-256:	FC23D9D2806D5D4195F13AE1C557063052749FBA3396B050698B1A02934E3889
SHA-512:	B6313EBDBBE654F8B26BA0ACA5E0500F664422031A990948FF2C208BD59F71DFF4757ECE8C3110AEAE6D9A78997AFA53D090F18AD0E198989E4FEA52242F2404
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_event_hub_fileVersion = "1.2.181"; ..function CreateEventHubTransport(){LoadScript("sha256.js");function a(){this._apiVersion=null;this._servicebusNamespace=null;this._eventHubPath=null;this._sharedAccessKey=null;this._sharedAccessName=null;this._sharedAccessToken=null;this._tokenCreationTime=null;this._timeout=60;this._url="https://{servicebusNamespace}.servicebus.windows.net/{eventHubPath}/messages?timeout={timeout}&api-version={apiVersion}"}a.prototype=ModuleManager.create("rest_transport");a.prototype.constructor=a;a.prototype._setup=function(){this._apiVersion=this._config.apiVersion;if(!this._apiVersion){logError("Event_Hub_Transport:: Initialize Invalid (unspecified) _apiVersion");return false}this._servicebusNamespace=this._config.servicebusNamespace;if(!this._servicebusNamespace){logError("Event_Hub_Transport:: Initialize Invalid (unspecified) _servicebusNamespace");return false}this._eventHubPath=this._config.eventHubPath;if(!this._ev

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_ga.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (2200), with CRLF line terminators
Category:	dropped
Size (bytes):	2406
Entropy (8bit):	5.4783531591773516
Encrypted:	false
SSDEEP:	48:F7oavQfNfXcBBCE+yR60SO4k2WMWsH6du4jTk7tRIa:1MXcgE+yWOd2WRsH6ZkRRIa
MD5:	28C9BF3F57D8F2ECC7E964A74D6A2052
SHA1:	6E090268DEC59BC88B1C55D69630C21784B0DCFB
SHA-256:	BC8C873188388C0D3BD49D78EB6EB841E5A35FCCA8085131E5B5BBC612FD99B2
SHA-512:	08CFBDD3F118287402394E0AC783FA07EE1D8CAA04A3E1A92A22AFECD7F97358BF925254FC67654D775421599D25EF2E050FF257FD8D05F65D0E6980DB1AEA23
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_ga_fileVersion = "1.2.181"; ..function CreateGATransport(){function a(){}a.prototype=ModuleManager.create("rest_transport");a.prototype.Send=function(c){try{var i=this._ComposePayload(c);if(null==i){return false}var f=this.RESTClientAvailable?this._sendUsingRESTClient(i):this._sendUsingXMLHTTP(i);var d=JSON.parse(c);var h=d.hit_event_id;this._transportLog(h,i,f,this.GetName()+(this.RESTClientAvailable?"_rest":"_xmlhttp"));return f}catch(g){logError("GA_REST_Transport:Send: "+g.message);return false}};a.prototype._sendUsingXMLHTTP=function(f){try{var c=ModuleManager.create("xmlHttpComObj");if(!c.setup()){logError("GA_REST_Transport::_sendUsingXmlHttp: couldnt create a xmlhttpcom");return null}logInformation("GA_REST_Transport::_sendUsingXmlHttp: Using "+c.getSelectedObjName());c.open("POST",this._url,false);c.send(f);var g=c.getResponseHeader("Content-Type");logInformation("contentTypeResp:"+g);return g.match("image/gif")?true:false}catch(d){log

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_mosaic_api_v2.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3901), with CRLF line terminators
Category:	dropped
Size (bytes):	4118
Entropy (8bit):	5.22879538644478
Encrypted:	false
SSDEEP:	96:VitbQ5N+gtjbB6iYikiXxxiEiJiwWBibLVMUib2:V8bQ5IgyVikC3DAHWBELVMh2
MD5:	D63F0BFD3BE7FF03BC23C6F1E6FD777E
SHA1:	735606E253DA3E549F7BCBD9275450A52C1A0CE7
SHA-256:	D25EA0281876A50FA966850A274AAD05F5FCBC22D79B5714B44BF94722F8D209
SHA-512:	F5658418EEBD4C1123C467C085AC486DA1ED628A614E9CFD3CC6BA3A3B0282BB957D8D8156D315A755F73D7461F75AEA63D0BC25255B826532333152196ED177
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_mosaic_api_v2_fileVersion = "1.2.181"; ..function Mosaic_API_V2_Transport(){this._transport_api_endpoint_emitter=null;this._url="apis.mcafee.com/mosaic/2.0/{service}/{consumer}/v1/record";this._apikey=null;this._verb="PUT";this._partitionKey=null;this._service=null;this._consumer=null;this._environment=null;this.logInfo("New Mosaic_API_V2_Transport Created")}Mosaic_API_V2_Transport.prototype=ModuleManager.create("transport_template");Mosaic_API_V2_Transport.prototype.constructor=Mosaic_API_V2_Transport;Mosaic_API_V2_Transport.prototype.logInfo=function(a){logInformation("Mosaic_API_V2_Transport: "+a)};Mosaic_API_V2_Transport.prototype.logError=function(a){logError("Mosaic_API_V2_Transport: "+a)};Mosaic_API_V2_Transport.prototype.logWarning=function(a){logWarning("Mosaic_API_V2_Transport: "+a)};Mosaic_API_V2_Transport.prototype._updateURL=function(a,b){this._url=updateStringWithReplacement(this._url,a,b)};Mosaic_API_V2_Transport.prototype.GetVer

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_msgbus.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (3000), with CRLF line terminators
Category:	dropped
Size (bytes):	3210
Entropy (8bit):	5.246215650373015
Encrypted:	false
SSDEEP:	48:FM7AiguxG0OAO/YxsMY7/KK3q/JepiZOViXNlJdZJz7MfQ:eANwGPAhxeP6xGSjddPzGQ
MD5:	C017DD12FC87C05EE29B726A7653175D
SHA1:	555A26686F8DB7BFAB4DC42CD111AC03B0D36941
SHA-256:	41B1255A103DBB02CF0D076A438CD439E140E3EEBF09F1D572A61152EFF64C6A
SHA-512:	27EB4D06EA211BF394CA205652B4881567A145788588137A4EC69FF9CF42A39C3D3770F325168F2633BEF27460764280755080CAA6039D5F9E043D82DEFDEFF9
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_msgbus_fileVersion = "1.2.181"; ..function MsgBusTransport(){this._msgbus=null;this._msgName=null;this._processorName=null;this._processorConfig=null;this._processors=(function(a){a.logInfo("Creating processors");return{noop:function(c,b){a.logInfo("noop: Returning eventDataObj unmodified");return c},simpleMsgComposer:function(c,b){a.logInfo("simpleMsgComposer: Creating new message");var f={};for(var d in b){if(b.hasOwnProperty(d)){var e=b[d];if(e.startsWith("$")){e=c[e.substring(1)]}a.logInfo("simpleMsgComposer: Adding new key-vaule to message: "+d+" = "+e);f[d]=e}}return f},passthroughComposer:function(c,b){a.logInfo("datasetComposer: Creating new message");var f={};var e=b.filteredKeys;if(!e){e=[]}for(var d in c){if(e.indexOf(d)>=0){continue}f[d]=c[d]}return f}}})(this);this.logInfo("New MsgBusTransport Created")}MsgBusTransport.prototype=ModuleManager.create("transport_template");MsgBusTransport.prototype.constructor=MsgBusTransport;MsgBusT

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\transport_template.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (1249), with CRLF line terminators
Category:	dropped
Size (bytes):	1461
Entropy (8bit):	5.343806426879196
Encrypted:	false
SSDEEP:	24:F/8em3IGAIOt/m/HYu2eRejjysUutC9zf/98L4oIiAIu7LQ/Ho7/cmCGrXbt:F/pm3FAd/m/Hz2xLcT/696Dx7/pTt
MD5:	D6A5D0AE93A15F9B8B6729F56E2E71F2
SHA1:	4E85902BAD76183187932178F30A55BC52D0A24E
SHA-256:	914AFE8016FFFAC8EF01ADC2E6C79B165D008F9673B6A86723F6F1B540AC4367
SHA-512:	7B199633AD26E1DB7491AD6D935954491281EE807486DDAD59CBBC5E3CCD16BE476DCA998B96507D7F1655067D6ACB405EBC73E77B8A05F2850D1D81B7F46C80
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var transport_template_fileVersion = "1.2.181"; ..function TransportPlugin_Template(){}if(typeof TransportPlugin_Template.prototype.GetName!=="function"){TransportPlugin_Template.prototype={GetName:function(){return this._name},GetVersion:function(){if(transport_template_fileVersion){return transport_template_fileVersion}return"0.0.0"},Initialize:function(b,d,a){try{if(!a\|\|!b\|\|!d){logError("TransportPlugin_Template: Failed to initialize (name). Config: "+a+". Name: "+b+".Dictionary: "+d);return false}this._dictionary=JSON.parse(d);this._config=JSON.parse(a);this._name=b;if(!this._config\|\|!this._name){logError("TransportPlugin_Template: Failed to initialize (name). Config: "+a+". Name: "+b);return false}return this._setup()}catch(c){logError("TransportPlugin_Template::Initialize Exception caught with message: "+c.message)}},Send:function(a){logError("TransportPlugin_Template::Send: Did not overwrite function. Send will return false");return false},Uninitializ

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\uwp_storage.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (474), with CRLF line terminators
Category:	dropped
Size (bytes):	679
Entropy (8bit):	5.516887468680435
Encrypted:	false
SSDEEP:	12:UFdD47iGreq8C5qlHz0TTqB7kh8hqzfAImT0mgqmOYBeFePR2BhjL7jB6xXVWG:wd4iGf88qlHQ/qIUIqqq9u8ePYBVL7Yn
MD5:	941EDCDE45631326D5E531071BD587F8
SHA1:	E8A6BF6C4AEF3B9B48A4817D00729C692905FFDA
SHA-256:	B59E9800B6BF046D4710B043D2DFA3A2EAE60DB16035FE060E8AAA39D2FFB968
SHA-512:	9348929E433E54ECB6BBAE66822D7E62260FE43A9184701B6284854DD8796510AAA827656DFCEABC0A659EC102F012D562ECE1B864E202AFFAACEEFD06410B36
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var uwp_storage_fileVersion = "1.2.181"; ..var createUWPStorage=function(){var a={_content:{},add:function(b,c){if(!b){return}this._content[b]=c},set:function(b,d,c){if(!c){this.add(b,d);return}var e=ModuleManager.getSingleton("rules");this.add(b,e.apply(d,c))},get:function(b){try{if(!this._content){return null}return this._content[b]}catch(c){logError("uwp_storage:get: key("+b+"): "+c.message)}},getContent:function(){return this._content}};return a};ModuleManager.registerFactory("uwp_storage",createUWPStorage);..//7F09D5AE16C182D7FF3F1E073E5B279E9911F704AD072F91B0844161FFA3C8DF9CAF5B6AB7F7B5BCE977EE87FFD7635BA71F1E1ABDEBCC2D1F6EE8F5838303A0++

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\wa_settingsdb.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (814), with CRLF line terminators
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	5.402512092698406
Encrypted:	false
SSDEEP:	24:ybeFOX49BAsnzOURzngpy3WAsngFPSIO90doQUkQ0W88nTuNa3f:yqFOSAZA3WAzSixdW8UP
MD5:	6156BD039B5C6E4586C55CB1CAB5EBD8
SHA1:	D42978FFB0EE883E7AA76D6DF97C141CF9B4A9B3
SHA-256:	503BC36485E16E7CD8F2D9275FC85F5B4F9E5AD1FAACC47C582E8E9749225C90
SHA-512:	5F296644766BADD21B560F379010D620CB69B6D05C1505A29F0A6128D74659B7C49A5C4AF76CBC72935146C9044D28EE4B77CF15CF1BBE4D8D2F5D845C230FF7
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var wa_settingsdb_fileVersion = "1.2.181"; ..function CreateWASettingsDBHelper(){var a={getSetting:function(b,c,f){try{logDebug("getting WA setting: "+b);return this._getPlugin().GetSetting(b,c,f)}catch(d){logError("wa_settingsdb:getSetting: "+d.message+"setting("+b+")")}},fetchFromDataDefinition:function(g){try{if(!g){logError("wa_settingsdb:fetchFromDataDefinition Invalid data definition");return null}var b=g.name;var c=g.scope;var f=g["default"];return a.getSetting(b,c,f)}catch(d){logError("wa_settingsdb:fetchFromDataDefinition: "+d.message+"datadefinition("+JSON.stringify(g)+")")}return null},_getPlugin:function(){if(!this._waSettingsDBPlugin){this._waSettingsDBPlugin=getPluginFactory().Create("SettingsDB")}return this._waSettingsDBPlugin},_settingsDBPlugin:null};return a}ModuleManager.registerFactory("wa_settingsdb",CreateWASettingsDBHelper);..//AAD7C08342037B6720236970C005DB688706719B9A602224AF698FD933418A35A3D9570D5425B316160F603D82ED63DB9D0D364373576

C:\Program Files\McAfee\WebAdvisor\Analytics\Scripts\wmi.js

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with very long lines (7401), with CRLF line terminators
Category:	dropped
Size (bytes):	7598
Entropy (8bit):	5.384581923070925
Encrypted:	false
SSDEEP:	96:tt40Xb6wcFz1g8o3IE/ADvEWgj0xOsdmMcJS+c04IqIz65vSzCTJK:tt48brys3IE4D8WqM0S+c04wzlzCU
MD5:	91389CF32E9E19302DA3193FC5404113
SHA1:	FFA68C0465867F251C5CBDB810B3A303053A7ED7
SHA-256:	E9FF5DF0FD463B176922EF72F194A89761453643306DC3133A728153CB27B975
SHA-512:	85E7304662B5A5787C1EFA37E444E56B298AC30CEC90AD3EBFB996F90B6EC87AC2980A620E37C373D03538343E2471A8590AFDFE84AADB308E8A5CB669796AF1
Malicious:	false
Reputation:	unknown
Preview:	/! $FileVersion=1.2.181 / var wmi_fileVersion = "1.2.181"; ..function CreateWMIManger(){var a={_createAttribute:function(f,c){var g={_data:[],get:function(l,j){try{return l(this._data,j)}catch(k){return null}}};try{f.reset();var d=f.next();while(d){var h=d.get(c);g._data.push(h);d=f.next()}}catch(i){logDebug("failed to populate attribute object")}return g},_getMockIterator:function(){var c={reset:function(){logWarning("mockIterator: Calling reset(). noop")},next:function(){logWarning("mockIterator: Calling next(). Returning `null`");return null}};return c},_unavailableServers:{},resetAvailableServers:function(){this._unavailableServers={}},_getServer:function(g){try{if(this._unavailableServers[g]==true){return null}if(!g){return null}var c=this.getPlugin();if(!c){return null}var f=c.connectServer(g);if(f){return f}}catch(d){logError("_getServer: "+d.message)}this._unavailableServers[g]==true;return null},_queryWMIServer:function(h,d){try{if(!d\|\|!h){return null}var g=this._getServer(h

C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	Microsoft Cabinet archive data, many, 61533 bytes, 44 files, at 0x44 +A "aviary_client.js" +A "common.js", flags 0x4, number 1, extra bytes 20 in head, 12 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	74645
Entropy (8bit):	7.972630575101076
Encrypted:	false
SSDEEP:	1536:+MF3SvcRw2k6cljK92dgcljMWGS+AvZeoav6wxKa:+MYv2w2EjdzljMHxAvZeo8N
MD5:	A7B0DABF4A52B6827C35DE1E05111BA6
SHA1:	21065F550492165D5290446E433E0F9CDEFAEECD
SHA-256:	B92F20569BCB06EB12A87D278592AF03F564281AD9803EB8EE748EED0C4AFBF2
SHA-512:	5C4996DF6335D5CF045F09D04CCF2382306AB4AB962DC2AB1889248DF00F1470A336724BF137986DF7BE60E6B5B2417D75E4270B18F3F87FB533A8C1C530ED3D
Malicious:	false
Reputation:	unknown
Preview:	MSCF....].......D...........,...............]...83............................WW.A .aviary_client.js..6........WW.A .common.js.....R=....WW.A .config_manager.js.....lA....WW.A .csp_client.js.....oO....WW.A .dataset.js......l....WW.B .datasets_catalog.json.)....r....WW.A .dataset_da.js..6..E.....WW.A .data_collector.js..#........WW.B .data_items.json..'........WW.A .dictionary.json...........WW.A .emitter.js..-........WW.A .engine.js......J....WW.A .error_transmitter.js.....]U....WW.A .events.json.....6b....WW.A .event_handler.js.....:}....WW.A .hash128.js..........WW.A .json2.js.1........WW.A .logging.js.:.........WW.A .mappings.js.....2.....WW.A .mcutil.js.....".....WW.A .observation_analytics.js...........WW.A .operations.js...........WW.A .preprocessors.js.....'.....WW.A .profile.json...........WW.A .registry.js...........WW.A .rest_transport.js.u.........WW.A .rules.js.B.........WW.A .sha256.js.^...[.....WW.A .subdb.js.[.........WW.A .transmitter_template.js.\|.........WW.A .trans

C:\Program Files\McAfee\WebAdvisor\MFW\core\class.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.270979533065914
Encrypted:	false
SSDEEP:	12:6csNwI62Td/sSEw+gwG8k47nC6VY16oBzkykHQIJWvYtAkjQh:6clsh/qwzf8b7CwY16oBzkywW0vjQh
MD5:	0C5A014BADA2CDF491E5D25597AC3B45
SHA1:	E1EDF93DD8A7743286F73335E6BAD3DAE1D81DB5
SHA-256:	92FFDF2A2250CE3C4ECDC2C83A39F9AA42FC8326089112F9D3890BC21D5EFABA
SHA-512:	55826A082F91F5308FC3495B788AB3AA35A474D58CD3747AE4EA3FCDF008967B7B135D8236EADAF5AB0DD40D089AB3B02D48C64CDBAF5CBBEBE39F1FF35AB332
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........4...6.......-...B...-.......X...-.......G...A...X...-.......X...-...9.......X...-...9.......G...A...L..........init.setmetatableR.......6.......B.......X...U.......X...+...L...9...X...+...L...._base.getmetatable........%4.......X...6.......B.......X.......+...X...6.......B.......X...6.......B...H...<...F...R...=...=...4...3...=...=...3...=...6...........B...2...L....setmetatable..is_a.init..__call.__index._base.pairs.table.function.typeB.......6...9.......X...6...4...=...6...3...=...K.....class.core._G...//1043CC837754F0BE6E0812E3E5BD3C6402E812C55BA27EF7327A4D1A7635E88F644FFC0F4375894EEA6E351245757FBEBCC51C9D1EDB185CB6C39BBB5C23AA0D++

C:\Program Files\McAfee\WebAdvisor\MFW\core\dkjson.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10234
Entropy (8bit):	5.602878173938201
Encrypted:	false
SSDEEP:	192:jWXBkgh/3g7O7qaNfEyc80vDGwVd4Wog1DYEZpQ7+hC+Tf8IkZ0JUO:ckgBGO7q8RcTvf7xNZUq9
MD5:	3075C06E2DE277403C4FF91089FA89A3
SHA1:	E7A14AC133CF75B001D307EE00A30E767A773C1C
SHA-256:	287DF33A5E4C8753B802461CB94B79E486F34D2EE1337B5054AD896717265A32
SHA-512:	9F7B5F600F646A390243EF315A009AA419F3F597F8769369CAAB450B4D1EE4ED1D5C9FFA2BC163CC513E726F4624A69ED4F3DC5FFC9CF7C78F2EC1D5F4001DA3
Malicious:	false
Reputation:	unknown
Preview:	.LJ..>.......-...'...B...9.......X.......K........getmetatable.debug........'...L....null........5)...)...)...-.......B...H.......X...-.......B.......X...........X.......X...-.......B.......X...).......X...-.......B.......X...+...L.......X...........F...R...).......X.......X...........X...+...L...+.......J..........number.n..........w-...8.......X...L...-.......)...)...B.......X...).......X...).......X...).......X...)...............).......X.......X.>.).......X...).......X...).......X........... .......X.0.).......X...).......X...).......X...).......X........... ........... .......X...).......X...).......X...).......X...).......X...).......X........... ........... ........... .......X...'...L..........X...-...'.......D...X..........X.......-.......B...............-...'...........D...X...'...L...K............\u%.4x\u%.4x.\u%.4x.............................C.......-...........B.......X...-...............D...X...L...K...............A-.......'...-...B.......-.......'...B.......X.0.-.....

C:\Program Files\McAfee\WebAdvisor\MFW\core\handlers.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2315
Entropy (8bit):	5.730040719174927
Encrypted:	false
SSDEEP:	48:5JwHko/hrVeTYVJe7yAeeSiQRlVavdyJmlF6AjMj79o:UHkoucKOA7jQzRm36kw7K
MD5:	BA0744473708606B032AFE13F5092535
SHA1:	BBC4BB4DEACBEAA24F9BA05847FB00B43E918D6D
SHA-256:	BF3CDD88CB51670E22367794BC9AFA27036C1FACD1C6AB26F09BCF01D4AB0CCE
SHA-512:	AB1024465D30EF1E1CD1A2E1A15AD865A246B4FEE4DD894EF2B26D922DE864CB2B1ECACCE0C2CCACD26A30F4F9F92936830E3182E2F5C6E18FD38A0960CB9B90
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........]6...6.......B.......X...+...X...+...'...B...6...6.......B.......X...+...X...+...'...B...6...6.......B.......X...+...X...+...'...B...6...6.......B.......X...+...X...+...'...B...9...8.......X...9...4...<...9...8...)...........X...U...8...9.......X...X.......X...5...=...=...8.......X...8...9.......X...6...9...........5...=...4...<...=...B...X...6...9...8...9.......B...K....handlers....order..handlers..insert.table.check_updater_flag.handler....handler..check_updater_flag..order._registry.handler must be a function.function handler id must be a string#handler order must be a number.number event type must be a string.string.type.assert.\|.......6...6.......B.......X...+...X...+...'...B...9...+...<...K...._registry event type must be a string.string.type.assert........)6...6.......B.......X...+...X...+...'...B...6...6.......B.......X...+...X...+...'...B...9...8.......X...K...9...8...)...........X...U...8...9...+...<.......X...K....handlers._registry handler id must be a string e

C:\Program Files\McAfee\WebAdvisor\MFW\core\init.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2470
Entropy (8bit):	5.841164340330198
Encrypted:	false
SSDEEP:	48:BmEl2PssOUb+Oi6ZNmMWpIJQtbNSE6N+iwgOLLSuuRu4eMXIepaTG+8tEQTc:0El1sOUSOMtpIJQtbSEiJuuFeMXPQ+t+
MD5:	95F0FD0EA28356F450ECCE05DC3F7421
SHA1:	E1C34AD1903BD623E3C8F60C216C5C38441DAAA1
SHA-256:	DDE9D8E051F352B9BEE4982233E73488EEB323FA307C9D3D512B5E69D84B25D9
SHA-512:	CE15DA623BF63D56D0DFBBAFB14716C00491DC468214C4929ADBFC22DA16FD4AD21AFC99CD87629C1B94AA1342DFAF57543F7F85EF1D3D719699C154C86A5A19
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........5...'...6.......B...X.......9...'...'...B.......9...'...........&...B...6...........B...E...R...K....require.Loading script: .info...luc.gsub.ipairs.mfw\core\.....dkjson.luc.handlers.luc.PostInit.luc.json.luc.PriorityQueue.luc.UiArbitratorHelper.luc.UiHandler.luc.UiThreadExitHandler.luc.utils\SettingsDB.luc.utils\StringUtils.luc.utils\Telemetry.luc.utils\PackageUtils.luc.utils\BrowserUtils.luc.utils\common_utils.luc...... ...6...9.......)...B.......X...6...9.......)...B.......X...+...X...+.......X.".....9...'...B.......X.......9...'...'...B.......9...'.......'.......&...B...6...6.......'.......'...&...B.......X.Z.....9.......B...X.U.....X.:.....9...'...'...B.......9...'...B...6.......9.......'.......'...&...+...B.......X.......9.......B...K...6.......9...........B...6...9...9.......9...........B...'.......'.......&...6.......9...B...'.......&...-...............B...X.......X.......X.......X.......9...'.......'.......&...B...-.......'.......&.......'.......&.......B...K....

C:\Program Files\McAfee\WebAdvisor\MFW\core\json.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.509680195019466
Encrypted:	false
SSDEEP:	12:6uNkydLkg5M10kgPv7BkkFAtuUrbzV7jNixBLev:6IoERB2tuU3zV9ixBLe
MD5:	8AE71A8F4F2A7BB9A0D4FD2247C0BCC1
SHA1:	78B3B2F6BDFAEC907D144166042C3611896BE9AA
SHA-256:	5E7F3D7E4ECB43F626DD44E897A96F049FAE57697174703B03F4412A4EBDE1F4
SHA-512:	8C5B9F56193101CF25DD8E9025B5B56670D305F7C2DAE400638076CD1224A941FEBCF9979D598F2B2C7BE04528CA6626EE6DD041CAA63568B40AAE7BB62DC229
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........9...9.......)...+...B.......X...6...'.......9...)...).<.B...'.......'...'.......&...B...L.... pos: .',.), error: '.sub#Failed to decode json string (.error.decode._json3.......9...9.......5...D.......indent..encode._json.........6...9.......X...6...4...=...6...5...6...9.......X...6...'...B...=...3...=...3...=...=...K....encode..decode.._json....encode.._json..decode..core.dkjson.require.dkjsonTest.json.core._G...//080A09C7C56059162449D4DCADC0835F2094250E17721072CB0C4E9473DBF2FA13BBEA427E11F31D2F79350B4172F095C05BC2C198A4D7C29E0F818C8A762213++

C:\Program Files\McAfee\WebAdvisor\MFW\core\logger.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.306200106160255
Encrypted:	false
SSDEEP:	12:6x5bYn4wF0WNYtAr78KQK78KTR78Ky78KSV+AQlm1ZMWOPAKQMEGzIX:6u4wF0WNEUyg1qWOjlsX
MD5:	FF9E892A736B19BB258D46E2E1981BD6
SHA1:	79FA36CA81453EB88AF25671B982D3EA6EDE740E
SHA-256:	BE325147F65FA54CC22B3DE4B6067AF491AB8CA0A75D74D86476D0D1973F7B97
SHA-512:	21240F704496A33D4C43A71DFC7CEBCEA3974679101527BB7A9276354189A274A0BCC162903D977B829850D84BBC30DDFB7CEA142F36249195529819D42284E8
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........G.......X.......9...G...A.......6...9...)...B...6.......9.......9...9.......B...K....currentline.short_src.Log.utility.getinfo.debug.format........-...-...9.......G...A...K........Normal/.......-...-...9.......G...A...K........Warning-.......-...-...9.......G...A...K........Error0.......-...-...9.......G...A...K........Critical.........6...9.......X...6...4...=...5...3...6...5...3...=...3...=...3...=...3...=...=...2...K....critical..err..warn..info....err..info..warn..critical...log.....Normal...Automation...Warning...Error...Critical...core._G...//1562E1266400EF39503DEFF00CEBFBCB01C5DE9F24CFF3AFBEC3D8E1993DC894F1F60CB6224EB201E90BEAF867EBCD96BBC90A821F2ACBCD30083AFE2AACE9C1++

C:\Program Files\McAfee\WebAdvisor\MFW\core\postinit.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	980
Entropy (8bit):	5.703609054347431
Encrypted:	false
SSDEEP:	24:6YDsnrMjnBNMVCXMgrmPJ4rAobrLQJxX+fThOhcA9kXzNj:JuIjYVpgyhgbrLQTkEhcVzZ
MD5:	B575EEAAECDD102BB987DE42C92A4F69
SHA1:	695DD9058A3F759D2B5B575DE4AD9468086CF942
SHA-256:	CB1E9BE1BE71569BDCF3C9245C77C462D225E2E45A8D0C2FDDEBDB100E856CF2
SHA-512:	4DAD4AB6F2C3561A5E12FC5A09A5E96C11F2CDB20A73D2F9492C109891676A8CF7E2819F7FA3CA49BE98F6060DE6195F85348AC7B012002ED30A55F77723B2AA
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........96...6.......B.......X...+...X...+...'...B...6...6.......B.......X...+...X...+...'...B...6...6.......B.......X...+...X...+...'...B...)...9...........X...U...9...8...9.......X...X.......X...6...9...9.......5...=...=...=...B...K....callback.id....callback..id..order..insert.table.order._registry%Callback type must be a function.function!Callback ID must be a string.string$Callback order must be a number.number.type.assert..........6...9...B...X...6...9.......9...'...9...9...B...6...9...B.......X...6...9.......9...'.......B...E...R...K... Failed to run callback (%s).err.callback.pcall.id.order4Executing post-init callback. order: %d, id: %s.info.log.core._registry.ipairs.........6...9.......X...6...4...=...6...5...4...=...3...=...3...=...=...K....execute..register.._registry....register.._registry..execute..PostInit.core._G...//C1A958192E0741BA27D06065587946255895035E4325442A6B4223789D17BDBDC14728C776A94B979AD1C3F69B5FDAA361AD900F9CFF30E429EDF1C5A312CB77++

C:\Program Files\McAfee\WebAdvisor\MFW\core\priorityqueue.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	4.9831151589385
Encrypted:	false
SSDEEP:	24:6enUdjWd4nqwwyVJBdVJMxMi0kdVxIXkfF32CG79lgxLEIeYlRl4R2apeE:znUd6UqwwyVJVixMiNVjHyCdEI/mfeE
MD5:	A824C69901EFDB4B340481086B87C774
SHA1:	BA294A6B655BD0AA59FB09DD6977833EF029DA72
SHA-256:	A1CEBA72D9BDDB3BDAD69CE7468059AC796AAA776B0681B308BBC45A78DE5F52
SHA-512:	5780F3446D238E2E2FE0691BD8795D0EE346A50854804592F6DD471C5112DC859CE2B63ACA8ECAE431731053FB47C74EF6723D5B896AAE11C1E30D9A89AA1961
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........1-...9...B.......X...5...=...=.......-...........K...-...9.......X...5...-...=...=...=.......-...........K...-...9.......X...U...9...9.......X...X...9...X...5...9...=...=...=...=...-...........K.............priority..value..next..next....priority..value..next..value.priority....priority..value..Empty.k.......4...)...-.......X...U...5...9...=...9...=...<.......9...X...L......next.v.value.p....v..p..priority........."-...9...B.......X...K...-...-...+.......X...U...9.......X.......X...-...9...-...9.......X...9...=...-...........X.......+...9...X...K..........next.value.Empty._.......-...9...B.......X...+...L...-...-...9.......-...........9...L..........value.next.Empty.?.......-...9...B.......X...+...L...-...9...L........value.EmptyB.......-...9...B.......X...+...L...-...9...L........priority.Empty........-...L.....&.......-.......X...+...X...+...L...............4...+...)...3...=...3...=...3...=...3...=...3...=...3...=...3...=...3...=...2...L.....Empty..Size..TopPriority..Top

C:\Program Files\McAfee\WebAdvisor\MFW\core\triggeracceptor.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.39780644423966
Encrypted:	false
SSDEEP:	12:6gQrQouWHpCJHMjvoQwqbADclzB8AUEC0KBCrYYI+YQ63jWUn:6NpCFgAD8KAULuglQ67
MD5:	90318A3089BEEF7AC6F01748F7B1547A
SHA1:	70F844D332428FCC9890DC8B2D1BCEC2F5CDC35A
SHA-256:	962447F626FDBC1AB7F5A1A93265ACADCD18F322EBFC885C1ABBB4CF3508078D
SHA-512:	D445FC9BED6061784A60A4AFDE07A88DAA2211032BE59C0E6D87A1B0FBAE75A85AC6306DB57661967CCAF14CFB87FCBDCD13C4BCFF1CDD5CB43EE697686832AC
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...8.......X...8...L.......X...+...6.......9...............B.......X.......X...+...<...L...6.......)...B...K....error.include.external.loaded.package=.......6...9.......9...........B...K....execute.handlers.coren.......6...3...=...6...'...B...6...9...B...3...7...K....HandleTrigger..loadPackages.core.core.init..require._G...//DF522ACD6DB9C41A40762710A1B32180FBB86BB62FCC8E3C7CBBD1C35E32CB4166C5D3376DC4D09AEE5341CA97568D3CF3FD510B12F6BED40DCDEA7DBB2D1323++

C:\Program Files\McAfee\WebAdvisor\MFW\core\uiarbitratorhelper.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3788
Entropy (8bit):	5.548926821354657
Encrypted:	false
SSDEEP:	96:cklXnzJw5g1AGiz8wE8xxveb8ZvRXfy9L7GI:ckRVwGKd8wE8xxveb8jXfy9nGI
MD5:	CD17DE25B4B97D90CA63BF999ED79A58
SHA1:	6A1EDC19F70D84A716300993C09D4337F9E18B37
SHA-256:	BBCAFFB4216577AB4671E4F09BF69D9C9A3BB15A1D8E43FD0AC99E63AEAACA47
SHA-512:	FD49AD5AD03019508268DF1549CC5883B8C8D88177E68D00BFB5B7CF940B4B968F281F8DF4CDD31348D23E1242B90D75680D0B8C1E6BBBA9CBB115878C58E272
Malicious:	false
Reputation:	unknown
Preview:	.LJ..T.......-...8.......X...-...6...9...9...B...<...-...8...L......new.PriorityQueue.core........-...<...K.....T.......-...8.......X...-...6...9...9...B...<...-...8...L......new.PriorityQueue.core........-...<...K.............-...........-...L......0.......0...4.......4.......4.......K............B.......4...6.......B...H...8...9...B...<...F...R...L....Data.pairs........"3...7...5...-...=...-...=...6...-...B...=...6...-...B...=...6...9.......9.......5...B...6.......9.......B.......X...+...X...+...2...L............StoreArbitratorState.uimanager....indent..encode.json.core.ShowingUiRequests.PendingUiRequests.UiRequests.uiId....UiRequests..uiId..PendingUiRequests..ShowingUiRequests..DumpTableData...............4...6.......B...H...6...9...9...B...<...6.......B...H...8...9...6...9...B...6...9...B...A...F...R...F...R...L....v.p.tonumber.Push.new.PriorityQueue.core.pairs.........3...7...6...9.......9.......B...9.......9.......6...9...B.......6...9...B.......K............ShowingUiRequests.Pen

C:\Program Files\McAfee\WebAdvisor\MFW\core\uihandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1220
Entropy (8bit):	5.923058811639404
Encrypted:	false
SSDEEP:	24:6I0lBHW+Tks5h4uxHN2+PBh5DKScPDDQ5c4acKf3L3V1Q0rRtRNs:Kzd7h4uqwRKScPDvRlrRi
MD5:	02FC8C83B5877F1D79BF443CB1268979
SHA1:	B60E5FC56579AEAB8A1EAD505BAC38CF8043811E
SHA-256:	EA24E8A2F2908B513EC8C7417B21191E4E56F759206D01162EAB69AA73C08B5B
SHA-512:	D9B806BD7CEFA9D20B654988346B19095AF7D15980E8E93E6D9C3B2A3206294E913B06C9D9BC42988A12941715239B47A7E70C545CD863B5A62C3537E4283984
Malicious:	false
Reputation:	unknown
Preview:	.LJ........)...6...9...9...B...9...B...=...9...9...B...9.......5...=...=...B...6...9...9...B...'.......&...9.......B...+.......X.......X.......X.'.9.......X.$.6...9.......9.......B...6...9.......9.......B...6.......9...........B...7...6.......X.I.6...9.......9...'...9...&...B...9...............B...X.;.9.......X...9.......X...9...6...9...9.......9...9...9. .6.!.9.".B...A...+...9.#.....B...6...9.......9...'.$.9...&...B...X...9.%.....X...6...9.......9...'.&.9...&...B...9.'.............B...X...6...9.......9...'.(.9...&...B...9.#.....B...........J...6uihandler: no special options, removing request: .AddPending"uihandler: adding to pending .skipPending,uihandler: Added a delay timestamp for .RemoveRequest.time.os.setting_name.setting_scope.SetOption.SettingsDB.utils.delay_data.delay.AddShowing"uihandler: adding to showing .info.log.ret.Show.uimanager.encode.json.overrideSelfPriority.TopShowing._.Browser.EventData.tostring.templateArgs.config....templateArgs..config..AddRequest.UiType.UiTypeI

C:\Program Files\McAfee\WebAdvisor\MFW\core\uithreadexithandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	5.946559678110792
Encrypted:	false
SSDEEP:	24:6Bld27yrNDybt88WP3CvwgefKS6VlceP1Q3D2c0ebE0+pwpaBHceuU:UsQgu8QgWaZ1427ej+GpaJruU
MD5:	A5AA12E45E84C70A62BBC6F7E88CB7D6
SHA1:	DFBAE2F6D5931C777C4CA7916D2D8B158E143A17
SHA-256:	72664AF81A0D87C8BB96C6A475455C281A3FCD5950423D2C5C230EFCAA2D128F
SHA-512:	03378C4A0AED436487E45ED3C1C1F0B971AFE23A698690E8FDB7A6CB8D8184F48BE1E2D5E194B1F4CDD437307C43213786D99DE759491B2C0BEE1671167BEBD8
Malicious:	false
Reputation:	unknown
Preview:	.LJ........$.z6...9...9...B...9...9.......B.......X...6...9.......9...'...B...K...9...9.......X. .6...9.......9...'...6...9...9...B...&...B...6...6...9...9...'...6.......B...'...&...B...A.......X...6...9.......9...'.......B...9...9...9...B...6...9...9...9...B...'.......&...9...........B...9.......B...9.......B...).......X.+.9.......B...9.......B.......X.......X.!.9.......B...9.......B...6...9.......9...9...B...6...9.......9...9...B...6. .....9.!.........B...7.".6.".....X...9.#.............B...K....AddShowing.ret.Show.uimanager.templateArgs.encode.json.PopPending.TopPending.TopShowing.NumPending.RemoveRequest.RemoveShowing._.Browser.EventData.UiType.UiTypeInfo'Failed to run onExit callback (%s).).(.load.pcall.tostring6UiThreadExitHandler: requestData.config.onExit = .info.onExit.config,UiThreadExitHandler: requestData == nil.err.log.RequestData.ID.GetInstance.UiArbitratorHelper.core.....j.......3...6...9.......9...'...)...'.......B...K....Core_UiThreadExit.UiThreadExit.register.handlers

C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\browserutils.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3251
Entropy (8bit):	5.542033267686917
Encrypted:	false
SSDEEP:	48:f/BP24m6A8F6JjKtwxzqE+zqlRwr6RwEJdrNLu1oOWa0au9:f/BP24mvzxSwxzKz0+KRd01VrPu9
MD5:	E7781289007477996BFB8BC4EB4F8E56
SHA1:	3DA4EDD51EFD3908C1FB7480BF6D2FEFA1F57306
SHA-256:	E084CDA87779798394F25D6B02B833E5B9984DAF5B36E3D13164270796DC90BB
SHA-512:	CDA2B028CE6899D4E8C33B772E1AAFFA65766F48D78586EADB3061FD891F97806D7156A67A0E57B086DB1D70F76FC5D52CDDD70B8870246F3B98189F75A991F0
Malicious:	false
Reputation:	unknown
Preview:	.LJ..a.......6...9...9...9...........B.......X...+...X...+...L....GetBrowserStr.BrowserUtils.utils.coreI.......6...9...9...9...8...L....BrowserTypeString.BrowserUtils.utils.core.........6...9...9...9...8.......X...6...9.......9...'...6.......B...&...B...+...L.......'.......&...6.......9...............D....GetOption.settings._.tostring.Wrong browser type .err.log.BrowserTypeStringLow.BrowserUtils.utils.core.........6...9...9...9...8.......X...6...9.......9...'...6.......B...&...B...+...L.......'.......&...6.......9...........D..."GetUserOptionWithSystemBackup.settings._.tostring.Wrong browser type .err.log.BrowserTypeStringLow.BrowserUtils.utils.core........"6...9...9...9...8.......X...6...9.......9...'...6.......B...&...B...+...6...9...9...9...9...J.......'.......&...6.......9...........D...,GetUserOptionAndErrCodeWithSystemBackup.settings._.Unknown.settings_error_codes.common_utils.tostring.Wrong browser type .err.log.BrowserTypeStringLow.BrowserUtils.utils.core.........6...9...9...9.

C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\common_utils.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6002
Entropy (8bit):	5.579889180067907
Encrypted:	false
SSDEEP:	96:zjx4bqxfcsUvEBsF5e8yQLv13RBgoNevPg/lsvebKlDPCe9:zjx4bqi80EcvpjNIPsCebKlee9
MD5:	B63F1F3F49D3A131473C66F324D900BD
SHA1:	60C14ED2F296B013E23C93E086150C0694F4E05F
SHA-256:	EBB1B4B7E4F01C7F5FB2A141D13AA7BD909FADCCC69DCE1846BD1794ADF4C528
SHA-512:	779B5005D523E62819960B0964375809659658C75B32A357B36B7B918AF92AC110274B86A00D0F3861D4DD389E52F3640B17A3F981668D544159F4AD95F2D2D8
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...9...'...'...)...*...B.......9...B.......X...'...L.......9...'...B.......X.......X...'...L...6.......D....tostring.NULL_AFFID_ERROR..affid.QueryValue.READ_ERROR.IsValid+SOFTWARE\McAfee\MSC\AppInfo\Substitute.HKLM.Registry.Win32.core................X...6...9...9...9...9.......X...6...9...9...9...9.......X...6...9...9...9...9.......X...+...X...+...L....WrongType.DoesNotExist.Success.settings_error_codes.common_utils.utils.core.........6...9...9...'...'...)...6...9...6...9...9...9...6...9...9...9...B...A.......9...D....IsValid.KEY_WOW64_64KEY.KEY_READ.RegistrySamConstants.bor.bit5SOFTWARE\McAfee\MSC\Settings\ApplicationInfo\MSC.HKLM.Registry.Win32.core........06.......B.......X.......9...B.......X...+...L...6.......9...)...)...B...A...6.......9...)...)...B...A...6.......9...)...)...B...A.......X.......X.......X...+...L...6...9...5...=...=...=...D....day.month.year....min...sec...hour...day..month..year..time.os.sub.tonumber.len.string.type.,.......6...9...!...-...#...

C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\packageutils.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	867
Entropy (8bit):	5.425236194196901
Encrypted:	false
SSDEEP:	24:6DA+0TGrcQqcnEbbqTrc8u6BIuAfc6SAG7:eJcQqcEfIcd6BIuAfLSX
MD5:	8CD9701E1D7023DC2D48104ADC8D5659
SHA1:	A101E31FBDE99218695D7C1A6AD8310E1F51D41C
SHA-256:	1E66ED2EBEEB55F912A0609A1FDB5D8326FF1BC9A1EE84D495501BF5F4A53495
SHA-512:	BF2E3F785FA914F337F675CC0379A6DD8C3F52EA3B87196FDA77BDD1BF77B14A273C986FC95211DBDDF16B3B6256C7EFCDD5C34654DF2DED7A1C5064E33AB85F
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...6.......B.......X...+...X...+...'...B...6...6.......B.......X...+...X...+...'...B...-...<...K.....%Package version must be a string"Package name must be a string.string.type.assertr.......6...6.......B.......X...+...X...+...'...B...-...8...L....."Package name must be a string.string.type.assert.........6...6.......B.......X...+...X...+...'...B...6.......9...B...'.......'...&...L....\.mfw\packages\.GetInstallPath.utility"Package name must be a string.string.type.assert........&6...9.......X...6...4...=...6...9...9.......X...6...9...4...=...6...9...4...=...4...6...9...9...3...=...6...9...9...3...=...6...9...9...3...=...2...K.....GetPackagePath..GetPackageVersion..SetPackageVersion.PackageUtils.utils.core._G...//D240D8CC89200524D17815677D8B3C3D0F2F6A7A2D26B7915B64A0A6E4008F7DAEA2A171731ED8AF99801DF9912E07FD4E0C653AC890CE139D79D5B8D56D421C++

C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\settingsdb.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	761
Entropy (8bit):	5.516727707189191
Encrypted:	false
SSDEEP:	12:67gclf2Magc5B/oQjf8uSIcz5qqxDax0fh99ATjS8tX8PN71u+xMIf8wQjXeqqxU:6RpaZB4uSIc/O4Du+xCwUe96PzYRHN8
MD5:	AC180FC1CB74EB907F9E266C28EE35CD
SHA1:	2B7E0AE04C73ED189C251DD03CAB0D53460C509F
SHA-256:	B672AC2CCB8DE900C9C12B009E8F15799BCEC62B27F0E5DAC1D0A07533C4975D
SHA-512:	9920F291A54A247629AA06D5BB50CED80F1B8C8C78C4390C4409A3C07E4375B1B321EDD050CABD7E45820022D9391EBD7A665866DAFF501D535A535082AFD13A
Malicious:	false
Reputation:	unknown
Preview:	.LJ..6.......6.......9...............D....GetOption.settings.........6.......9...............B.......X...6...9.......9...'...6...9...&...B...L....Name.elem.Failed to set option: .err.log.core.SetOption.settings.........6...9...B...X...6...9...9.......9...9...9...9...B...E...R...K....Value.Name.Context.SetOption.SettingsDB.utils.core.Settings.ipairs........)6...9.......X...6...4...=...6...9...9.......X...6...9...4...=...6...9...4...=...6...9...9...3...=...6...9...9...3...=...3...6...9.......9...'...)...'.......B...K....Utils_SettingsUpdate.SETTINGS_UPDATE.register.handlers...SetOption..GetOption.SettingsDB.utils.core._G...//EE04DDF1C65525373743C0CC7BE8C007A7B98627EAC7AD4F1545775EA8BE8F5E9F6841120B81735A3885A5AA7CA26C4BD2B3311896FBACAE04A9FD0D1531B49A++

C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\stringutils.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.207449256748383
Encrypted:	false
SSDEEP:	6:6emuLqNlmHiRDPVj9fE+ATjS8JYcR7Qh5TjTaA8V7XIdj80:67lmHiRDh99ATjS8at+5zIhp
MD5:	1B5D802085EC4B8593DE5A4F12AB084A
SHA1:	C80BA0E0F9325A653D5DF5C7EE78FF4CE4BB4054
SHA-256:	929B4516D8B42E595D94656C467F6798041DFE5BE2D47C61220FAB89D75D8439
SHA-512:	D8CC95360E62A9C9A9692AF80EF55214EABD36C18244E9F18FC100129127898B744FFC0A1993E07B1242146777707CB22C2D7DB29BB86CFE33B704772A35A38F
Malicious:	false
Reputation:	unknown
Preview:	.LJ..O.......6.......B...X.......9.......B.......X...L...E...R...+...L....find.ipairs.........6...9.......X...6...4...=...6...9...9.......X...6...9...4...=...6...9...4...=...6...9...9...3...=...K.....MatchInPatternsArray.StringUtils.utils.core._G...//0F7D4E016E276C6994C93AD765A9505748AF71C16DA054D799106ECFE6FD60F8F506F0F8A16507A1FBD5BE845C38F07DA1518C118E2F8FAC2F91C17A8AC2FC45++

C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\telemetry.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	715
Entropy (8bit):	5.535593615657592
Encrypted:	false
SSDEEP:	12:6gklNIfqQHnLvwa76OWSgLbht2SYuuLh99ATjot0+F6pqQBulva9EDfdrxe:6gkPI3LvwSKSgLbhISKuw6+F6pq55CEy
MD5:	DE97AA50DC181E530CF18DFD86CEED4D
SHA1:	0F75C75A2406490E5D86CD54A9EFD4B2B93E5B46
SHA-256:	B5E3417F3387E15E25FE736AC13AA8D5DA8DF9E0A8F4434029CF6A0C51739A53
SHA-512:	0377CD9C0C80F87DD59A82B8E30D357E6F0B41CF2851AD5F1960C1C41DAC4AEAC65664A504C91CF0273972F8D1DA7494DF4D70D864C7C511F6E7A9C9108F886D
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........*9.......X.......X...6...9.......9...'...B...K...6.......B...H.......X.......'...6.......B...&...F...R...6...9.......9...'...9...'.......&...B...6.......9.......B...K....SendTelemetryEvent.telemetry% with resulting instrument call !Telemetry event handled for .info.tostring.,.pairsDEvent data received does not contain a name for telemetry event.err.log.core..Name.........6...9.......X...6...4...=...6...9...9.......X...6...9...4...=...6...9...4...=...3...6...9.......9...'...)...'.......B...K....Utils_Telemetry.TELEMETRY.register.handlers..Telemetry.utils.core._G...//D92EE3E9521D374CC29D5598CEEB27B1C22A4CE84E4632323ABCFBBDC26C2A48C3204BC7BB71E6A6534AA40482ED29DEBB4387029AADB49CF3DEB00EF8207D67++

C:\Program Files\McAfee\WebAdvisor\MFW\core\win32helper.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	30539
Entropy (8bit):	5.704909688534079
Encrypted:	false
SSDEEP:	384:JX/CIGkba/ZqyBhyCTz5KamxnbxSHoUG0hJ6khWG0J:Jfah5yAKaqboIUG0hJ6cWGu
MD5:	696F9BEFA20879EC2BC3310AC59C7A8E
SHA1:	68800108E5228EFE7ADDDC84DFC0745D1DBAD143
SHA-256:	17C18C725B47780233BF399A51DCDBB6615A3CCFC1E7F14EFBE2CC8DCB24327F
SHA-512:	DCF27037D411C3097D8F908EF461A1EE972A733CA4696F34DB2DB0AA32C862CB4026BB08DDE6B57818F6A5C50506D4EC484D04E800BBBFD449FA412C4C55B922
Malicious:	false
Reputation:	unknown
Preview:	.LJ..9...........X...6...9...9.......B...K....CloseHandle.C.ffi2.......=...6...9...9...3...B...K.....gc.ffi.handleV...........X...6...9...9...9.......B...K....DestroyEnvironmentBlock.userenv.Win32.core/.......=...6...9...9...3...B...K.....gc.ffi.env1.......6...9...9.......B...K....RegCloseKey.C.ffi........<....X...'.......X...).......X...6...9...9...9...6...9...9...............B...7...6.......X...+...=...2. .6...9...'...B...=...6...9...9...6...............9...B...6...9...9...9.......X...+...=...2...9...:...=...6...9...9...3...B...K...K...K.....gc.ERROR_SUCCESS.Win32ErrorConstants.RegOpenKeyExA.C.void*[1].new.ffi.hKey.rootKey.GetRootHKEYFromString.KEY_READ.RegistrySamConstants.Win32.core.(.......9.......X...+...X...+...L....hKey........n....9...B.......X...6...9.......9...'...B...6...9...'...B...6...9...'...B...6...9...9...9...,...........,...B...6...9...9...9.......X...6...9.......9...6...9...'...6...9...9.......B...A...A...4...)...:.......)...M.5.6...9...'...:.......B...6...9...'...:.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\auxiliary\reset_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2829
Entropy (8bit):	5.569198441759767
Encrypted:	false
SSDEEP:	48:ulTdkjpbD/LcwweIvvfE4bclwC2/Rzr9EWKK6vfj9yChFqLrAF6AA4bLHf6xgfxx:ubkFbDwRnvvffcG/RzriWKK6Xj9VhFqi
MD5:	F6992BEC3ADF7D10627984A6CC8112BD
SHA1:	636B0D2DC395225DDD03CAA7B1135F681028A997
SHA-256:	5BAB2A3845949D599F1899355F1332A31E61189FC7C80BC9C0EB964C8098DBF1
SHA-512:	4035C6322E0D82304FD596C3F7C17734D81841E8039C7306DA0CC7691B8B68B48700632DF05F356CB660962A858D15D922286E5D0E4135E40015D75D37A012DC
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........Z6...9.......9...'...B...+...9.......X...6...9.......9...'...B...K...6...9...9...9...9...8...6...-...B...X.6.6...9.......9...'...6...9...B...'...6...9...B...'...6...9...B...'...6...9...B...&...B...9.......X...9...'.......&...6...9.......9...'...6.......B...&...B...6.......9...9.......9...B...X...6.......9...9...9...9...B...E...R...6...9.......9...'...B...K......handle_reset_event: end.SetOption.settings/handle_reset_event: local setting name is ._.reset_value., reset_value = .add_browser_suffix., browser specific - .scope., scope .name.tostring+handle_reset_event: resetting setting .ipairs.BrowserTypeStringLow.BrowserUtils.utilsBhandle_reset_event: no browser field in event_data. returning.Browser.handle_reset_event: start.info.log.core........;4...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...3...6...9.......9...'...)...'.......B...2..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow-right.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	509
Entropy (8bit):	7.265106458574301
Encrypted:	false
SSDEEP:	12:6v/76lJ/6Ts/4qfsK+Sz2D2cP03cbekp8LuwkWBjMAraM7P:9lJ/68fsPSyFP03gpLWqu7P
MD5:	B9239E137DA0942222FD6E7FBB95F084
SHA1:	4D8B1C9DA9E1A8772F5C6929A4337D5D9A659EF7
SHA-256:	FB3B5BE9639CDB51AEDA6F379B0E3D78E64035C53EBBD9D99D28E6913A6BB761
SHA-512:	02EEB55B6C2A00D6E638B57CF448A5110C40A0962D68121BB869C8CD82812AA50FCC882A0E3FCFBF9DA5047F15A2686176CCFA1F61044DD8BF7F0CC957A630BA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...6.........c..+....pHYs.................sRGB.........gAMA......a.....IDATx....M.0......kzH..+d.6..$.0BF..e..!7. ......B...I..g....{.].b.D.K.....".e..."}k~..Sk.y.R...1.x.R....rcp9'.!.......n.&.<.zc.9..(..W..7..9.ZbX.d..e*.....n2v5i.x.!.8.0d....l.D..7N..q.D...N..q.D..T.X.....Ccq.ah......S..MS<..b...C.KI;h......a...k.%..`fx......{e&.r7.)...P$.T.Q(....(........h..P.G..Q(...(....i(....(....0....p....i....5`....p.c...5`......i^.e....dC!.0M.c.....^...4?..R...Kb_}nL...i.....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	525
Entropy (8bit):	7.401937246200202
Encrypted:	false
SSDEEP:	12:6v/7W7/6Ts/B2l3fqAXsMj1VswTbTfH9O95UzdOo9Fy2S97:F/6B3io1p79O/kdjHy2St
MD5:	CFD3007010FA11DFE25FA8D48E65E72A
SHA1:	9973303D168AECC57EF380EB705DB4B7C6055766
SHA-256:	8FFC2BAD58D0322050F9AF74D140A23A589AA6E0710D6E48285FCC123A80ACE4
SHA-512:	DA7514A4B7CCED85378E25B49742AB674937B7CE3AB714923D848CC1F3CE38CF6C11A0DEA8B97C2860B0BCFC770ED3CC39E74AA358A63BFE81E9DC47754DA60B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......6......<......pHYs.................sRGB.........gAMA......a.....IDATx...MJ.@..........EA\y....y........'..R.B=B.."dmM.L...$........4...$......I..........\ '.r;..~.o...zy(Ujq.vu.,.C.W.!t<......Q..h.....@C(.(x......#.P.>.......pD4..W>'.<...........#g..s..........r.c...p.7"&....k.._.os...SL.b......../8.......w..B.%.K4./......9.......&5'....x).}.........P...3Oo.^.........P-^..r...h.W.,.q...2.\..>.........}2M.G.t.3I.{... .....Cb.b8u.....1.:.S.p..N..c8u.....1.:.S...Di.(.."....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\card_bg_image.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13807
Entropy (8bit):	7.980033051105471
Encrypted:	false
SSDEEP:	384:r82XmabuE9fiCT7j5ggQkSDKoEBF4mRzzJt:40XiClggenEBp
MD5:	A7522FA80144583C5F0E070F50E06C47
SHA1:	FF32E2DB5468B183DE1FC7A68D3F82BCAC033262
SHA-256:	AE9F79BE354331730247196BAF87001D48330E8452593952820AFEE0DCE5724D
SHA-512:	FB8E730EB796F051AB4E84A1277C2C6B53CC8DFCA96CAD8B3CCE4DB48675B3D7AE008F1A1B100D776E1BB9F040CE0DCEC020462F13C9CC42126F463F87CC0802
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............0.y.....pHYs.................sRGB.........gAMA......a...5.IDATx..}m.#7.% _..c........{....X."upp........Uf. ...J...._......p.y...?.v.........UA.....k.i..W.+...f.?..8h.F.C..:..z.=...\.)..P.+yW.....km8.O.N.;s..9Hs....x....ni.2b..1.....$:.V.c%.~...4Q.w....VuT<N..... .....^.....j."Q../#n'....K..d...h.c...tQ'....L.U6@^.K..g.. .....>1;.@..m./...<.0.......d..o.t#........!d0.^9..\|..D..K..6..Z....<....N-...M....%....B04Rr.. H......u...f.........\|\.q...r.'Vt.g...,...[.V.....t%..]..H...J .G:.....x.....).....,.K..)....jC..........d(.m7p9L.Lr=.Dc.~..f}8.J.c8.`..`i.Q.'..S.......ZT^1..L{n.Qy.._.6..)hv./41!.i.7'}..F.L:. .... K._Ag.L%{..:/[n.P.I..g].D.80J,o....)g..~.z.P......y.\..K..7^+..d..]42..k...+=.>.......k[..(....E....Zk.;..q.xu..?.H.t..N\|.....].u..B/.TJ.+.x'.I..$@.)8.7..R..:9.)y....x...e...;^eP....K...H.G...#.)..t.=..>0..........I...n..,K\|)8.....o.?.n'.....h......u.s_..`:A.....R.7G.v..$'..9w5v ,..x...xL1>.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\celebration_white_bg_color.gif

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	129961
Entropy (8bit):	7.769772439114844
Encrypted:	false
SSDEEP:	3072:Bcbqed21Gq2m9prSuHM+unzoCySEjsOOKnh8acQE:+urGq2YIuspnzoljsOhh8acQE
MD5:	3EBE8FB664F1628C041FFDBB93589731
SHA1:	A59297E734DB199CCEE82164069D1B86E598E987
SHA-256:	79010FC6FAD8A3BEDC14ABE936AE3EC5D97CFA47D2B1E6698DBE595D68653D3C
SHA-512:	6F53DCC48FA1CB703062BC4503979080E9CFB61B3E0BB175D5C4E7A53F569F171E85C31190B2A58442864A8ED13AC2B3A9ABD87651DDE0484D943100D6E247DC
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!..!..................................s.......).....:.Z....J.R.!.....1....B....B....k.1........).........c............s....1....{..J..k......{.:.....Z....c....Z.:.....B..{..c..........).....J.R..J........R....s...c.k.Z.B.....).........R.).Z....k....B.{..k.R.J...........s..k.B.......k.............................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+vI....$.0(.#@..IL8...b.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\close_icon.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	312
Entropy (8bit):	6.773823438465042
Encrypted:	false
SSDEEP:	6:6v/lhP8AMx7/6TsR/Jr5OhJTtEEc+GbxMWMEHFGejHr5fDp:6v/7kAMx7/6Ts/Jr5GJxJFmxMQHFG8Ln
MD5:	539828AA00E3933554AD071A88D2620B
SHA1:	EAB3ED1CE4E11D3428840E48870BC138DAD58499
SHA-256:	CEB6F6C99816B65716862B6353DF4D4425D9E023A6BBEF7180E63954BAFED91B
SHA-512:	0982F97ADA2F432BFAA87AD0598F4CB5AE482A4E57D5CD81F4848B62A7C9783F988DCE1E8DCCDB2C7D0F16DEF28387BB702E91C33E65E6EECE365548201536D2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............w&....pHYs.................sRGB.........gAMA......a.....IDATx.}....0....-.#...A..$.H&@....F.]..D6`.2B.T...d.X....>.g..)..\]h...ho.,.j....N.'p5.Jj.....0..Y.........<..1,.v.....Jj.wr...d0.....cz(..b......d...w.......eW...C'ah....0....`..3..b.)..R.#....3q........IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\dialog-balloon-logo.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.801361627421433
Encrypted:	false
SSDEEP:	48:y/6nDZIGswiTaw1GdSET4w+r3RMMzXVetutVp6ipbIlSmdTKS:ySn+UP4wGMMzXVEut/6gElS+
MD5:	6432DED3B3287224306B81E0204B1515
SHA1:	4CED825AC86462D8004F80FEB0D771A8BAB89D0F
SHA-256:	41998FBE91B8B250B389D89D1AA80D5817E4F2D51CE929A7D89F37AE0093D8B5
SHA-512:	25AD6EA2105CDFE64D7153DCBC27F6EB64AD2565ABF378F6B8E0B7B8BDCADC8F370962B843714137720FC290CF41277ED612EB4660A209C67B1C7B44A4CAE486
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...,...0.....j.......pHYs.................sRGB.........gAMA......a.....IDATx..Ml.E....&.M..qZ...R%..a.....VH......ZG...PW.=.!..R..'.........:.R...I.TD,5j..`;..M.;...7..^..H.K....L~y~...1.}..c..}.f..6.r..;..05sei-bw.....@..Q.\..<.X..........C...A!....m.!.<....=.y.h_<...D.\.A. .q.....oW5mcn.o$..{..]...^..q..p..4...O..5..D.(g.Cv-^.O....fLZ.6[...A.5.EN..............6(.<.~.d.a.Yt...nX5.-V].R....?......l...."...x..].......~..Qh^I....,....S...u.....b.4...Z.j\8......_........_.W..<^...e{..8.(I..r.PPa0...)<."h4....g.$..j(J.....-J.;x.+......6...V..V=sa.)..R:#.........[...^.>K.&..J.V.....=.ww...5[.L...&.".b.../..e..........iq...K.Y...K,d.'.,b..c....a.A.9Z.j.c.^X......]1.\{......y..C.O....8..px......(\L-f.=..0..x)....?......?.-..k.e\c3.7'.N"..'..]....9..K...5...95..k."<.....&.a.Z..w.>........Z....&_SL....B7..FD...0.)J.a.O7.....Bd...oU+.\|Z.di......^.@.s.TF....u9.+E.\|f^.K....u..K..v..^....N.n`%Z..>ZYw=6v.g......Q..._l.gFS.Yl.O.1.~b.^...s..~d.I.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_ext_guide_ss.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	18923
Entropy (8bit):	7.9861701934335665
Encrypted:	false
SSDEEP:	384:rRQZ43uKP67gxwrBM1vfj16druGvBBuf9aDGCdOGuQ0Xzu:lQ/KnnAJdy1aNdpuQ7
MD5:	414AABA2691D865AF446A88F56DB10BF
SHA1:	C7DE664C4AE999D4F31678C106C336A8AA12FEBE
SHA-256:	A7B0B6B5834C71BF51DEA60B92CDB84692D7082D219F2FD460DA8B06D761B088
SHA-512:	394AAFB7F371DF5A2456E4D1F478515099EA077E2EC3B3F749D1CF7E2EA1FF27BBF28DF369345D785A74D920A6829F2E11C27B380C94E175EA1221DF90638800
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a...I.IDATx..}..^Gqf.....i.dI^dI.....&..c..-,38.@&..`.!...pfB..L.,..@..$.93$.r.@0.Y..`..[.-.................."..x.....]]]..uuu..}.=..Ax..1...S.v.m.h>e<....9B]....y..h1+B...]OO#.Z<s..t......2.Z+..pBhF..`.J...1u....R..d.OQ+^..\...S.3..I..b....a....V2..%..G.L$..e0..d.'(exA... ..k...:E.B.........h.).%].!..&.&...y...<.......R.....]....k..P...\|.X.[KUZ+..@`....h..qJ.....(?...@...NF.u..<......D.Q..OXn.2.^6.N...tQ.]<......}.7. ....~..!"....%-.....e9....sA/'.5..D....]...r....i.TfQ.".).d....E.&@.x..l..'7..]......$....+..... .P..<....r..2.1..0.h......?... ....E.@..[.n..<..y#..,..Eg.$.2.F~.K-..^n.3..S..x./}YHD......8..FI.gB..l.5.,..lN..C...S...'F.P.....a..-.a.p..E'.I\y..5M.;..'.........+z$'..x.N$u.m.`.`...+aHY...yT...$...j...G....P...N.....&n.nA.......5....Z.^(`..7P.\|.@.:... .......P.).C...^...Nc...J.b.b.....z.<;Le.....).V=.0.2.0Z)...;...:?r.Z..&.Z.4&..:O....W..kh...u.k...+....,.k

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_ext_guide_wa.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	21212
Entropy (8bit):	7.98325864342395
Encrypted:	false
SSDEEP:	384:O2GbDyxp4nQlUyEOZgtE0QsuSBmaibS7oiFaRXrDaLr:9SDyL4nOT9imai+7qXin
MD5:	F1FBD29E2D0C3FAA510DA6A8397532DC
SHA1:	FF5237B7D22A08182534B9083ABEDC36C0D3E349
SHA-256:	7371BE7448704F7CFD6A8776482774791ECA122397006DC5841CE1D69436F065
SHA-512:	EE496EC6F940CCF236FE8F86B7BAC8A62698049F2F310103A6BC4DCFEC4D2B3244762B844231A0326DC42197E3C851A82BF1E9E5D87A26B8EE7C5F686E4A2AD4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............J.....pHYs.................sRGB.........gAMA......a...RqIDATx....&.q.........f03.\.....^0.r%..D....k.&W.k.%..V.7.P...I.+.....r7(KdH..eY.LZ.@..M..A.$.......s..w.?...U......;f...3.............:...!c. ^....R..g\.ri.....X..%..h%.B.....N%.F<.....X.~..\.^j.s...... ....q.:..IY).:YM....xM...L.......O.a]j.y..^.D..H..$........D.L..^..4>....8O......#B.y.8Z\|JF.W....I.I.oD...2O...!3..)G.a.....J.\|.(YCB>.,.....f 0.\|Xj4t..{.....!iQ~ i{.(...':......<.:H3B...$KezBs#.i.gc. .A.=...A.rF....cP.~C.\|..!"...%}>..2m.2.y.,....B...."0.<....]...r`R}..%Oe..W.5e.....(....O...(..M(AW8..T.<.@z.......A..B9.....w/.IMx&4....!..r.0&..t...8oe.j8...".>{...8<m.R..(.].Ss...O..5.+yx.rC>..q.....\|HD......8.XGI.g..r.F...<X..<.....BL..B...C.&....#O.C...NQ.h$<.{^deM...A.I.e.c..r....\|$..Ny.F$....r..)....C.E.P.F..hL.\|..F.+y.PzW.....I.<#.....[.!...DCGe.,,T........TU.7#....5..0.<`(..E.r<......j.4F..u......Z8.e...T....."h5C..!........j...#.Uy.dY..D....7I.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_sideloaded_ext_guide.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13412
Entropy (8bit):	7.975594232205093
Encrypted:	false
SSDEEP:	384:w0HE4jJ0oyx9ehCCmVEKtChcK6pRhXUPFLe1iU:5P0o00Ej8cdnCluP
MD5:	12187FBB7EC8ADA4E6334B2297D78A6B
SHA1:	9155356FDC70C7BB4C60950ADC4EF55BEE023B6F
SHA-256:	05D775AC7CC5F970FA2A0DFF5A1F732B8DC43241F789242C17E39F4CF9AB39FC
SHA-512:	55920F35FDA8F19C2372439774DED2B8E7EC61360DB81C8DB78B2A2F75F9FD10556203067E129F4D52F3BD1C9DD2B28788A12853DA15EEC9C2C18086FD68CC0B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............r@....pHYs.................sRGB.........gAMA......a...3.IDATx..}....u........;......H..D..-n.DK".."Y...P..TRN....8..;.Sv.E.n)v,Q.(J"...Iq_.. @.............g...x.p...L/.ow..}.v.<..s..DH-......>..E...}....Q$....+K.....n.%..+<.N>~\...7.}.S..oV[.rx.@<..>.....R.Gy../H.Y..4.g..PTD.Ne.:.t=J:.W)...G_nN..(1...$\Iym0.2..By..G.4.._H..."$4N.........D.t..Dg..U\..'.....f.D..rEN.".8.A@....]......$,..xheH.)..S.N@j..........x.b...kT....#.`............^...J.......c.u:.(/..^.Z.+G./.........QR.:.....H.6....ld\.%1../.{]P.........D&..S.P$...u...T.2@.$r....<.j...t.R...t...I."%.9..e..!H=......'.-....y`.5[...L.B..... QI....6....uX..`..}\.Ga...5..4,...2..?.<.K.B,.0...._..............N[.+R.-..!mc.mA.N$r......Ny.MD.O.K.1.O....G.t}.L\P.g...F.f{..S.E...d0..)......R.-.I2'..HN#...@0.f:.A..lm.R......?y...u.w..e.d6.)..'..w. ..EH..>c .($..V.$...g.R.1..Vf...a%.!O.&.l.x.q...............>......J..\....9+.\|\|.%...d..1#...).,<p..../..X$cVX......

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\green_check.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3166
Entropy (8bit):	7.890916051269147
Encrypted:	false
SSDEEP:	48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODx7FspC:bSDZ/I09Da01l+gmkyTt6Hk8nT3KC
MD5:	2048DF489A12C4C9E2341BEF42883205
SHA1:	281863D9F8B8D4D0DAD62E66E35F5C96CA0155FD
SHA-256:	DDA74B071B5869A22B327633D9641F1340EC5B913359BB389C34C44A6DB579A5
SHA-512:	815FC1E3A2E623FEA3B13AA2BCB3895FF9DDB2A7A05E1633C83D3F647EC4A4050AF0670ED01CABA47F02A920BF6AD84191B0B03EAD1E45105DD20D302D00CCE2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\icn_mshield.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16099
Entropy (8bit):	2.1119107535632073
Encrypted:	false
SSDEEP:	48:R/6qMh8k29WJsEv+jJ/Zf9lnkouuJvBLD1LpKLxN+Y9rNGcfNGvsc5jq7LcQEdBp:RSB8kEWmjtZCxNXrNGQNGvsc5sx0
MD5:	FE56C156669CA636CE71E5D23D9C685E
SHA1:	6EF641E2CEDB274F9CE2AA2037697372C49CCA25
SHA-256:	CD48CA4C27625C9286738652535097FCD7406C709371D85AD8297F8FEA19FF32
SHA-512:	B82ADD72111983CAB0DB650F3D12D11E3E2CCC9681DB18484F2219EC4A8AD7F4E5BFEDEFBEE4362CD7CA03A17A025EA1E54E566AD2C458C1221F6EADAD099D62
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............Q.1....pHYs...............<AiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2017-05-31T16:18:28-07:00</xmp:CreateDate>. <

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\installer_background.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6612
Entropy (8bit):	7.943206975174219
Encrypted:	false
SSDEEP:	96:jSDZ/I09Da01l+gmkyTt6Hk8nTMVKh4rpfjDXliiulxWYwu4vw3eP29VIaUz:jSDS0tKg9E05TMq4Nf4QYw43v9V2
MD5:	13029396423BD78CCCBB0223EA143844
SHA1:	D23C69FE2AFA8469C06CD31FC8FF077B415EABC8
SHA-256:	9979AC854DABCBFFED54312E8EC33B5C0402E220E100E47F0A22852EC695F248
SHA-512:	32D34F2FF23DDF24D387D8A3B8A4B1D9258F525B785807466D9FD88A4097C288F0FC89E6B1C5A010F51E5C92F6941189404E194D9A3A85978F77418AA53AB85D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......R........ ....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\jquery-1.9.0.min.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	93205
Entropy (8bit):	5.287999364048036
Encrypted:	false
SSDEEP:	1536:fYcvR3VhH37Ha7EmakRhIHASkCDy08otU6myJXXxMZyYk0AjrzCqlKDo9YhnaTdy:fY8MaW2c+UELKUqnAdiD
MD5:	F8C37498AEEDD04CDF1047BED93FC757
SHA1:	4971BD1931341EF1CA2BF38F6486B0DBCD7B62AF
SHA-256:	74580FFAE479E338D5B38690767D37502BFC479ABD1254066D6EC37C502E3877
SHA-512:	33799953E4A63C7C73B37633C14496CCE156B7987D3D6D60AEC4C7DDA51AC50091A0800013E70D4016C4DDA32FB0BD52C57116ACC3388E3C5E3159EB823C58BE
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v1.9.0 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license /(function(e,t){"use strict";function n(e){var t=e.length,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===n\|\|"function"!==n&&(0===t\|\|"number"==typeof t&&t>0&&t-1 in e)}function r(e){var t=Tt[e]={};return st.each(e.match(lt)\|\|[],function(e,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]&&s;if(f&&c[f]&&(i\|\|c[f].data)\|\|!u\|\|r!==t)return f\|\|(l?e[s]=f=K.pop()\|\|st.guid++:f=s),c[f]\|\|(c[f]={},l\|\|(c[f].toJSON=st.noop)),("object"==typeof n\|\|"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.extend(c[f].data,n)),o=c[f],i\|\|(o.data\|\|(o.data={}),o=o.data),r!==t&&(o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].data)){st.isArray(t)?t=t.concat(

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\keep_changes_guide.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14533
Entropy (8bit):	7.978234763785096
Encrypted:	false
SSDEEP:	384:vbRTZyLGqlTGW2+6E7JfwA1fKUCYhVwKqpU:jRTZyKK6E7T1SUCYhVwA
MD5:	AD6E786595C48812BE2D9BC7FE5D1485
SHA1:	E98E3B2DFA4354754EC58188D88F6687DC239E22
SHA-256:	4715BA3F13FB3554D64542BA93605E87DDB8601301F2C15B9CD65B708FFFEE57
SHA-512:	2C0735D80841CEA8CE8F4816E9548B5A9474530781B1510A1FB72951EB36679B43F4ED86025CB9C5B8E2E81432B356D3466ED5FFE5A783773A77B142253BB0B6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............~B.u....pHYs.................sRGB.........gAMA......a...8ZIDATx..}y.^Gu...M.V..kiY.dk.!v,..bl.c...c.....@&..0......rfB.29.....5... $..c[F.dc.,.R.%..t.....^U.......^..}.~..u..{..u.V...S..r...c../Mu..n..Z.8..@.......b5..Q=/.O.\t....r.TS.\|.1......... ....`.J.s....~....$+...U.V./O..kf..t.g....x....J2.i.y.G..#...d.Z.5.(......K...o..4n.W....#G.>.<....'_.!.].P.P...._..=.ya...o..`0q...zd..T..f...7TXci.d6....1....9......._.p..9.i0......*....:..%.D.Q)-...e.u3.y,..:...<.VW_g..].....o.U_.n\C..8.kI...l..ux.Y01....WJ.q.Q.I&....C...J )..T....<.....v..b.u0..qv[.s0An.;..tC...S:.:XzB_G]....O.tc..1C!.....Ly.I.a.~xts.A.%.{....4...ln.g.)..........=y..@...:..QQ.]i...0....p........5K.xxTE.:.}...q\|...pq.SSSX...5.Wa...hin...)N.p..G]H..O..j.F+.<@..x......F.}.[.F...2-...%...=hmiv...$f..a.4bI+...C;.L.6.iM.....G.......DH.}QO....\|.Y..\|.i.Y.....x.......e..:.eZ:t..p&,U..KL...AM.iw..7...T....t..\oy..2%.!..!.p(V... ..X. V......).,.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\loading-spinner.gif

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	61451
Entropy (8bit):	7.343059446968563
Encrypted:	false
SSDEEP:	768:9fvs6a/gxRWNtTA4EOvbc51qb0zFy/Sc6mS8oyYVX3YeP8XFWZLNCih:9fkj8RWNtTA4EOzc3lBl58AdNCih
MD5:	CBE8A62A079FCC257A6334A506A865A1
SHA1:	B0135BD4B9A31BC7105111213C286FB3C06DEA7D
SHA-256:	3A0F2212D503E07BE1246CFEBBBDEB40B642A44B4A3DEB959DFF78063A9822E0
SHA-512:	C7AD87184B524C5908E9832675188DEC751484C849020031F91E5030AFA94AECEEB2DF3777657533947339A48A96A24C21D22D29C4A51C75BBF6000634993A05
Malicious:	false
Reputation:	unknown
Preview:	GIF89a...........2/.50.4/.4/.4/.4/.4/.4/.4/.61.>9.E@.HC.HC.HC.HC.ID.ID.ID.LH.UP.[W.]X.]Y.]Y.]Y.]Y.]Y.b^.jf.nk.pl.pm.pm.pm.qn.qn.ro.ur.yv.~{..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,............[..H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h..x...W..[Un[.u..j...}.J.,.*..N.#f.x....B..RF...;..x...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\logomark_white.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	343
Entropy (8bit):	6.9403490183632535
Encrypted:	false
SSDEEP:	6:6v/lhPUp/6TsR/N7FDkQp+Fj4zBeQzdHLqOkNTcvKMK5iloCQl53fHKxgjTfv6Rp:6v/7Q/6Ts/N7tWAHdETeKMKsoCc53v/+
MD5:	37F342F2D1658BF871B235B20CC254B5
SHA1:	137F20C7685717B19BB089041AA03FA001601D09
SHA-256:	432AF358A422B668D90A9B05D2329922BA20DE2E24F419232967601E7B8E77E7
SHA-512:	B20465A790529F063309426AB878CD67823EA40FC5B464C5ABE2DCD7A26721FB57D26BCFADDED47CE584E0F575CC0FF922C29DA2DF6B8A18AECD567B678B5DDB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a.....IDATx.....0..[....n...&8.n .8....t...6...;...[z..../5..g(9.B..5....5..7..K...fk.....D.......~.b..'Od.B_..%....P.T.(Y`......i!.....\...l.F$....l...=.ab}.;.f......N..Y.K...ffy.(.g.....,.<.M..2..Gdio?..A.W.~w.....5...:S...S....3.Z.......IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\main_close.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	535
Entropy (8bit):	6.070255751604191
Encrypted:	false
SSDEEP:	12:6v/7nsXUyptiPCC0turztDt5q8j1Age/6TZ+RyxtWcHzSoLiKEMBLKBd:YynOf0tiztDt4yxe/6oE8cHzhmKEMBWn
MD5:	78118351597A04AE4CC8D899475BBA49
SHA1:	3EED037A8879EC6F84C2545CBC3D710494C2FF88
SHA-256:	D9059CE8A29D6CE4FB46BBC2292EFCA3478FB5D2DF106B33D4A37B50E41FEC39
SHA-512:	DB64A010162385441800F0CF0212C68791447EB5361793389BC632B7B14E15EEA3CE7DDA89987EBF7414334022FC64FBB1002816532EA106F0CD873D109A1081
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...................gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE[y.^y.^y.]y.`w.]y.g\|.[x.ez.^y.To.\y.]x.]y.]y.Zx.\y.]y.^z.]y.]y.Hu.\y.]y.]x.]y.]y.]y.\x.]y.]y.]y.\y.]y.]y.]y.]y.]y.^z.]y.]y.]y.^z.]y...........,tRNS.............a}.C...l.3.>...=B. i.S.U-.`e<..*.>....bKGD,..q.....pHYs.................tIME......9.3.....@IDAT..c...g`..d.......``.....af`a...gcg`V.VTR.`PPQ.TSWe.........aa. .......%tEXtdate:create.2022-02-16T17:16:42+00:00.v\^...%tEXtdate:modify.2022-02-16T17:16:42+00:00.+......IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-1.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1559
Entropy (8bit):	7.837839289025892
Encrypted:	false
SSDEEP:	24:s/6yUlzHLuHwW1nx0MX/pET0ltUxHPJH3jT2M0wlH2s3R3LqyT7UFStz:s/6yOLP6vX/w0YlPRT2M0wlHfLjYstz
MD5:	FA83BC8E14C9D2734DDBE84015E5BF3A
SHA1:	2A863213DC1905FE82EFE6B1A5C4A039A34569B7
SHA-256:	89F1D402046412A2921E41B0C4660DFCC9EE8C126EE8852CEE8B450038836B2F
SHA-512:	3EEF9CC44509E74A4147BE230A372FC5E29E7A8AC85BB08B03FC584D9AEDECDBCB609208BA8951802FC770F70CA570159AC693C8BDF3F1EA2EC9F1F160A694C2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...W..........]B.....pHYs.................sRGB.........gAMA......a.....IDATx..X.j.G.>g....Mb.J6.&..(O....^Y~..O.]...].-...V. .U..$?A..........hd...v...=.^....\...F.g..\|..9g.?.]....;..}..eD'.V,.'&..(.......MO/..J........8.7.o.6..h..4Y...T'.....MO...1.,....I.....f..yqr.?.s..../e.lIeo.B...7.&....P.bSel".Y..y..a..:+@>g....B.j.E.X....l..;t.h.A.vw..FhbHq.Z.KH2WA.:H^...@...>.p...:{,...d.M..^.$......-M..Gp.S..).\.r.........#.Q...Z...1..g...(!...'.7_m.C.T:=....8.....R........%%..@...q...1....0.}.?....H......)..5Q..x........i.8.$...i84J...&.lr..).....U@..H..eaq,..k..P....h...b.Ur......-gN....7..OPd.=rt.)\E7.kC8#.IN..}.7ol.i..%...\.=......hMy...t..i.#.........$..r...n..2 %.zG.@.B[=...;.....K....<b.#C.B.B........K...^.B....!...V.mw.M...d...R+.\.......t.. ..i..13.b(}.!#..6.B..qH.cn....Z.....E#[%..........P.06....B...3......;ba!...-.w=!.\......w.....&.....T,.:...i...Q.k.~..w^..S.....'.P.<.G....G<14.`.p.D7..u...#.:e 7..L..9V....r*.\R..g...Ml0d.d.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-lg.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	7.870572433344458
Encrypted:	false
SSDEEP:	48:XC/6ajsovRkZHy/em1P2FGb2bQ3t/3NJ4BNofx6yRQG4R:SSagovk+emwqQYbJIo0yRYR
MD5:	2E6E7984268E9D344B13491198D160B0
SHA1:	E88EED75E8E8CA8A2458761B561927B6DABB8C00
SHA-256:	3EF3E4739C30F116531F7B40BD0E14D3A487C3F28C27B52C47EB04D8AB0B9C5F
SHA-512:	E60EE5CE3183AEE8C157CFD0922F9310103F0B291254897FE504AC0F10C440F3F7D3A32AED6383E8AD63D4414BD8E27A0C773929B63012D9CEB792445FE5EDC8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...p..........M......pHYs.................sRGB.........gAMA......a....)IDATx..Y.n.G.>3.`T.\..6\d....d...O.y..U.6.5Hq..........^...^d..8i......~gw.....M....I.fg...3.9gFx.R[.5.:......t.J.<...2..V....mT:..N.v....]...,."../Ju..Q...v..k.....kB..$.<..s[.z...?.H.\L..E.bb..6.a2.._-.4{}W..M......._....e..W.q.!...!`H[x8....W.L.7dqD>....R..O.S).!...S.,pR.Pq.....wI.".d.M...bm.X\..y...f..:.`7{.e..RH.,.X.R...1.P....XD...2...]..{..S.S..V.5/.H6.2eb..Xg.v....3...b..G.\5.\|v;X.7.b..C.....R....LJ].....\..{..]:[....^../....Z..x2...M.]....jM..l.I....&4qF.bM.v:L.vE.'.Y.h0.."S...y93...W..;.........s......4C..H.t....n...((p.4k.5/.}V4..HF!8 a.k.........nr.r.j......CY.b.d.....H&.Y3f.$.4.J.Z....w{=6r..l.o.....V_>.?.'...x..b..zY..J....h...Ay/..s....o...I..c;s.\^..^4...U9...r$..\....l..m...1..6..q.........+.Y.V ;....\|'.d...b.=..]....4Pj...BK..X..&..I......L_.m.`f..iQT... .....&.ou.0.'....c..;.=..t.c\|f).....i01&R..7oZx..B.?.}....J3 .KTD..A!O<.....jJ..,cA.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2238
Entropy (8bit):	7.897965521812157
Encrypted:	false
SSDEEP:	48:a/3bdLf7SAa7meAyze8p8XMnkL4NpP+Tl1TcVhCx4:qLddUJAyzVZnkLu6lF8hCx4
MD5:	2B2ED7BD7CD047459628DC4AE1728E85
SHA1:	F8F4933BEE5717D3CC67704F863896258EC023E1
SHA-256:	1DB0EC3C7FFD1C9DDEB5F0E4217C1EF38EB02700E4A7F3A557D1F052092D4E42
SHA-512:	B3CE912074BDE9758A93B18C6478AEB689A0AAEBC5F9D228A5C95F045C0BA24963FC7F32EC1E1BC93D50890132D3B1515247C9ED3DEFD99F517752A23BA7EAB5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...V.........G.[#....gAMA......a....uIDATX..X{p.W.....4,y.y.n..S..U.E.I`j....X..-.j..Gk.U..QFl-.p..V.Ne.hU..PBv.yF.....iI..I.$......../,.M........s..{..>vbAa...Tg.1....j-......R..M.?v..Vk..V..<.........y...t..%W\|A.v..v..t:.......i........-.xud.!...\A.M.X.e...?0.7.w5..9......=1........~../#.wD(4.d./...-\|..V...<f./l.Z..:..j].H.8..P...q....YZ....jsg-..I;'UqBJY....!.L..:......g.,.#W.4..y..f......=..<..B.......\|..<..L.....G.uR.z.L..?L..H..al......W...4.3.......La..}.t_.".j.p.;.....'"..]yy5.... ......=.Q....QH.R...TU.I....f.......v{.V...?.{.......D,....}..b2..6.......^....nf""...\\|.............w..J.i.W3!j....JCd...e[....$.U.F,OH.8....f.v.....z)z'.../...`8Pb....`xf.........^.7..`.K..}.c.S..7/z..Q..e.!9./..o..`.7.....v.$.'..X.v....v..".B._0Z.F..#......S]O..:.r.N.X..m...........Dx.....]....s"Bt.6.<..F.o+.z......B\|..5DC..).,..y.0L.X.5$.Mh+.\].....Xq...~`..8..;YQ..t.{&....H.l.b..3..@(...#r..,......-...,..#..,......C7..6~.h

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1201
Entropy (8bit):	7.763272753991154
Encrypted:	false
SSDEEP:	24:8B/659eWA6XuELEiVKshz96Ajxbd/ErBYPwxhYvjtcFpcG69X7VSkHVs6Lb:8B/63VXuELESZPxbSVYPwUvBcFpc1Dpb
MD5:	A624A806CD38AA64130A0C228271DE75
SHA1:	118201F6A512D67C5EE112CD0A0C4EBD5C66FAD5
SHA-256:	A6E96121FE3D151FAFF5B247F926F93D27790250F9E2A27BAAF841DF5D82B6E1
SHA-512:	D8C08C245A6F68FFC058D2571567034229EBB96A595B17469FC7B6E26F6BF47FDF34C2527B5800667790F88648CAE8C7F262677E53CCB713968A6C03B0D54FE8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...V..........W......pHYs.................sRGB.........gAMA......a....FIDATx..X.Q.J.n..b}["x"....dNr.."@....$"."...8.t.]>`G.2.n..w..t.j....v.@W.4......L.]..,......&.'TUGdL.\|.r.....N@.XJ'.BL).&(........A...L. ...,...d\|...`0,...8T...EQl.PU?.A...!..aZCL.w....^.....v ...xUuI,3.1......s.1....g.uj.#Z..A.Q...^.9ww).....Jz.....-..d....k...C.m.=3(....rc.'.avwKM.u!........%.._..;4,X.}vbh.r..s.W.4..o.3*.n.B...i{_..Z...7..}e.Q.\n.j2j}.T@"O....Z.B.....b/..l.[.....G..3d...&....AS.UG5..Q..)e..<.5....\|...O....g..b#..Mb.B.s.t.........R..;.1o..`..[.a.,d`E.....9.oT.........9..}....Y....Vf. i.3.. .....]..&.)...S8..u.(u0.N\|.....+.(........:.0.m<p(.[...X.P....`Hu....!..c...).Bw..\|.F<".7..;..........fT.......\|..P.........\|..-l.E.Y....E....L....e........V.W.]....~\...j.a..8...G4J..uC....(.....W6.....\..FDk..1...n.. Z...:....C;.F...jvbp.).....n...r...w<.j.Z....Q..\|...u....8e.(.M.,B...E'&1............._`..../....6'...VU.....amZ....E..;...Y....S..(..B.m..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	7.890065571351557
Encrypted:	false
SSDEEP:	48:CHjblGYXQQEZZyIOrNK6rC4lWVkOjKpgOojQ9dCe2LfmC:PYgNZKJKSC4YF+WjyOZ
MD5:	18344204EC04F1E95E086D3BC94FA0FD
SHA1:	87CA3ED8948774091B451F7CB2F95139E56D351B
SHA-256:	30ADF46FD9311E5C6DFEA8A2AB2176EBAF83E7019EE341896FC3AAA5F498D2BA
SHA-512:	13757DC62505D01E44523823F38001D28A2FB9CBA5ACBF9CB7D9BDD8D0F19583D814E5A47B2DB255E18CCC05C34D43A02C387B60D05D1E802F9AF527D3633C5E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...9.....ms......gAMA......a.....IDATh...l.........\|u...4q....T$....IHK.u.h...lS..{.....i.6..h....@PX[.&...AH.&.($E.(.R..).......M..:..}.g.M.8.c3.'........{....}.``....q.. 0..b.=B..?.:t......1..P_f5.......).7\..e..Y.gA.......XPL...Hss. .ks..... ..aPx;\|VO..{{{).`"...VAb....u.\|..>_..#......2>V......9.g ....<Bss.T....LFI[[..+%.Y.....N...~X.!......h.q.J.l...A.s...p8,.\|.K2..'.{.j..c.<.\|m..<.....'.K....zF...nu..<...\.a#U.Q.a#`..ZF%`...6..=j{ta...ax.....\.<.H....<>.'...x......./n..g..'G.z.E.\|.....(H~)2...U..O.?w...u.X{..j.v.D.M...z.9.\|.a.......\v..f..0....0..1Xs..p&5.C.?....XY.~...K...p.._.+....KEF......5V.f....l.u...N..../o....t....b.......z.).....v............f......L.:.n+..s>.r0l.i..&.u...1.J)..sk0l.j0j0l.l....C.......3Q#..7.......f.[..&).r.z..0..^Xs...z.-`....3..........{N.e...g...O..~[A.F...."....E.d\|..?.8S.........}.\|;.......>u..B.....Y Z.w.....W..:...Z+.r....+...7..._..b..........~.a..w..o........0.J...[.d...W..>...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7205
Entropy (8bit):	7.9471260512499375
Encrypted:	false
SSDEEP:	192:KS4Do1RyFyKSZ4pTSumpAO/Ap6CQU9Uw/JLO/xvifnL:F4E1RCFpWumX/Ap2UeMq/xGL
MD5:	F2E3045621ADE164E9DA40F294BEB00C
SHA1:	36E9D967C679FC898BED1FF6751A73BB863EAF79
SHA-256:	D820CF499FC4A9453771A23209A6C63DDD2CE3439E8B651A98DDF0C36ED2BDA5
SHA-512:	7E515A44BD63B33881EE86E0A911897138F2BA0A6E81925612EAF19E3EDAC5A9FDCEDE30E3AFF3E906A4BBA8AA4570E06308D75783057015C882C7E62A880928
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......w8....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.................tIME......'..l.....IDATx..y.\U..?......./.@@....E&..P..GF.Q.F.....#..T..........D4.AC....b. +![w..NuU/.....q.z!.ToI@..SIW.s..}.y..s.U..?g.D?`..._T.(..}.n.I.w"+_..r0}y,.....`&....P......8.,....n.I..c@.4._....]@.J..UL.....A...[K........[.-...A.....g.'.N........#.l`.p'.d..o.@@T.P..tQ.A..........t..q`5.=...B.(Q.).."..`1j..&..n....}..e..].....-...x]..p%d.(,............g....o.C......p.j ..W~tW.3.]mq ...H.Q.P..-...Q2...v..O(..`...8....?.4...A..}#K...m......\|-.....w.2.m..lwL....Ys..y.;..\.Q ..p..e....B'p..........^@m.c\..[..Z!v....*a5...T#R..B8YH\|.....iw...8......,f.v......i`..:T.!F.\....t"5....0..._..K ...M.`.8d.5.9.x.c.v.A...Ug...Va.d.?..M]B.U..E.E.....: . .B5.B.1."......>...w7.-....@.P.;.d.LUp.D.0..R..TE......k..K[.>o...?.~....i..}bu...6......Pj.g.U..~'..+.\|.F'......y..t.p..0.6 ........E.).n`...3\-D.......^~6..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafeeicon.ico

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	285478
Entropy (8bit):	2.4849077310090886
Encrypted:	false
SSDEEP:	192:gtOQaZJ9Lhsvel7gsxdrTr8M4JnGirZTiAF9EOoRoQoPEgyY7oooxro:SOQaZJsvel7gaWNVx4AF9EOg5O7BAro
MD5:	F7D9142AC3C0C7228507E927D05F9727
SHA1:	7B8C9829534DF5B2BAAC806141F72B0AFDCB03A3
SHA-256:	F91461D2F81839CB58DA4A9FACA47C51352558BB636C522F9272519F7D910E61
SHA-512:	5C53D7B6496CFC4A855A7CA9F95D2F127139CCB812610F74790867F056EC48A4F3A6F2CB95574FCF0AE027B9B3497F0D80B1FF235828EA66C92D18603081E725
Malicious:	false
Reputation:	unknown
Preview:	............ .h...F... .... .........00.... ..%..V......... .( ...:..(....... ..... ....................................................B......t...t:...........................................V..............u...t...t...tN..t........................j......................u...u...u...u...t...t`..t....................................h..tp..t...u...u...u...u...t............................T..............t...t^..t...u...u...t...................................................t...t...u...t.......................................................t...u...t.......................................................t...u...t.......................................................t...u...t...................................."..t...............t...u...t............................2..........t...t...t*......t...u...t.......................................u...u...t...t...t...u...t.......................................t...u...u...u...u...u...t................................z......t...t...t...u...u...u...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\minimize.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	195
Entropy (8bit):	6.068066723651005
Encrypted:	false
SSDEEP:	3:yionv//thPlJlawvlkV42/uDlhlp8Lts7CX9/Bxdzo1i9MsN2ocx1PmnCCj1vkxz:6v/lhP70wS7/6TsR/Dvo1oiPOnuMwkup
MD5:	DC1EB36132B94A110553E31FB69B06C3
SHA1:	B5E281F185E2A7159B4E1EE74C27FA31E00EDA03
SHA-256:	237B2E4C1D42366B7EC89852F5C43C7D12C961D2A8990A87FE5CAC827C6C2FC2
SHA-512:	3E51E41E82D903AC06A911CEB70861F49F682E6F22AB6EE07DE8FE4B351CF255F9D95FAAE7282C516C9226E56C6B7C8DF87135F0E7AC699F7179B4D176234E29
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............;.J....pHYs.................sRGB.........gAMA......a....XIDATx.....0.......A..9.....Y. .Kr..T..[W\|@.]C>.q...bE.I.s..........TL*..V,.E.q......X......IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\msac.ico

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	334740
Entropy (8bit):	5.49770045405099
Encrypted:	false
SSDEEP:	3072:vYW4/fFn7A4xnC0IzntmbG8B7doDbtYdLVYRWns6yC:vJCffC0Izntm6S7QbKDYInKC
MD5:	83923FAC3D4E58231B7527BDFACA2794
SHA1:	492C8D0F08203EB28A2999895B1B5994F51F630B
SHA-256:	B6E7BDFA89B2445E120C0583BF97EFA915DFD43BB02CB129C2D9267AAF3BA618
SHA-512:	A8A5B976417B19313C2939BD2BAFD9FB918A1F413713259C120A296BEA00B49D36CFFA1DE25A9C58D2987007FC9BBD4AE8D198C7D37448080C8E34D8EEDEFE54
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ......... .... .........00.... ..%......@@.... .(B...D..``.... ............... .(............. .(R...#........ ......u..(....... ..... ........................................../C..0D.@T7,AS..$-../<......................................-@......:Ri5Qk.=Yq.<Vm.:RgS5K^.(9F.3HZ......................-?.Gu..!<UT&D`.>]x.Ig..Jh..If..Gc\|.C^u.>Wmd:Pd.;Rf..........#3.0Pn."=U@)Gc.,Li.Cb}.Rq..Rp..Qo..Rq..Qo..Kg..@YoeD^u.........%@X.$?V$2Oj./Nk.-Nk.Ji..i...j...e...^}..Xw..Om..B\rqHd}....._\|..:Zx.Cc._Qs..Gg..1Qn.Uv..p...q...r...q...n...d..._{..........^...]~.,\...[~..^...Qq..Wu..n...v...x...v...t...o...j...m..v]...Yz.'\~..a...d...b...?O..&..1;..CU..Vo..h...r...o...f...c..;d...Yz..^...f...g...GX..%%........R...P...i.."w.+;{.:Wx.Pr..i...`...Z\|.D`...b...:Sr.,1..--..."a...0...1...D...x...j..,R.Op..^..Fd...a...f...<Yu..2Y./2..01...!U...4...7...:...~...w.Jh..a...`...\~.89Zz.:Z{.9Zy.9R.../..-....'...$....z...Q......!}.Vw..`...c...b...;\}.;\}#;\z.9O..#$..$$..&&..&'........s...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\open_sideloaded_ext_alert_guide.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	20549
Entropy (8bit):	7.986108821429097
Encrypted:	false
SSDEEP:	384:ekwMaIBryFTsB7sckuOrzdqL+0ZgDdNiC+Pjo0eiTGhXDEi0t+XKWDt:TwMaINyFQhLRizdy+06DOLjBemmzEFWh
MD5:	0050197C4E3C6801D783762609EF6226
SHA1:	5B1E4016652C53EE3729D3125EB3F231DD69A206
SHA-256:	F42ECF07D3EAD5B48C1125B19F101FA4B3C6271F4FB43196876003615C31F31C
SHA-512:	B527E6A611394798E8467D797251A094FD9E06686CFDD95C40545697E79308246C51C007D9EBCF8B6A5B56BF810A851A10DAED9AE1DE9995B757558DFDCE0F73
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............)......pHYs.................sRGB.........gAMA......a...O.IDATx..k.e.u.......0......`.....H..IP$ER.c1J"G.Rq.J?.r.........B....-+....T"..-3$%.,.!>.........<f...}..{...k.^.....pa.u..w?V...z....q?z...5m .D{..K.....hC..c.\|\F]V..]u...O_.nK....N%~V.#oW..........5....".....D}.%_.....MHS}..._/.G......Z).c..J....>..zsz.6..z......^[...Xy.h...l2..IT...\..R=.}..0.P].8.N..6..V.i.\|...O.ur.\|..u=.....2.x..>...K...>.....GP.<.3...6.R..78..G)..x........6(. .3...Q......r.^.....x.......q..@...]/~......F.v.W...IJ.3}......n>....l.-_I.0.;u..j.B=.9.y.?.d.].lB.C.....xQ(..2..dr..'C...B.]._.(e.k..O....9..2..p...=...y2.".V..&.lk..P=.x..K....J4..%1R...&:.%ax........B.k.q)....p..$...B+..:Y.s\|.B,hR...j.K......-...G.1....-x.(G..1....+5..?..#.......P_.....$/.>.e..l..c...... ......@.p...Z`I...5R..BV.8c.L#.\.... %..B....)AS.,.>..296...B...y.l.b.r0.O.D0...^e.iDL.5Xyb.RPf...a...MTL.4.x.t....\uf2).J.6@r.../....$gQ.X.r0hvrV.\|J.%...d+..#o..._.....G..a....+,v@

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_0.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6169
Entropy (8bit):	7.9459194185380495
Encrypted:	false
SSDEEP:	192:dSEVdqkq8aVCRBai6cYQLO0lGHhzrYvET:c+dqkq8aVCRnYTh4y
MD5:	779DFAA69A79BA66B20CAD0BD22F5EE6
SHA1:	98226967ECEFCA769E6B653A54E8AF969CC329F4
SHA-256:	34194DC7D094C4A0C5332A9688C938C83A31C8C37C4BD47A23E602997655A9F8
SHA-512:	8B4A01D1E101600E56CBB1422D92D255515F5A044C09D4E89FCDE71E658F790FA6594B14702025115B817C90B3908CE76B021F089F503845A877EB21C0E10F61
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............D;......pHYs.................sRGB.........gAMA......a.....IDATx..]...u..3\.......m...~(....o..V+.-.Br?`[.....5`K.S%;.kK~(R.~(PX....y.-.(..J7..OQ.j.;.J...Z.h%k...7.....rI........!.\.....s.....R.T(............5.82bo.....1.U.o....{.Xg......2`....j>g..Z.-.r.b.......6........emW... .`Z.0..8.A.V....s`p.hQ...R..u.....)(d9[...Y.q&E{..g...u..5..:..d^.x...L.x..d....j...>..t.. .QX.dE..-Z..n...b..l.D.Z...T.1........I...Y...l)....b`D.Q..u:..5.y..T.\}o.....o.....U.q..R.:.f.V.F...,..~.F.R....v.?.i#........!E.J.f.........R!Z......7v.....p&.~7.\..K..{.......d.-CbE[}>&A.3V.o.W...I.......I!.Q7Q.5.5....Py#)}.......v^......k.J...\|].....z],..5/De.C..Q7.q.Cn$...r6..U.&........7"1v!..u...].....q......KW..6.J.M0.c....'.d....T..........lF...A....].Cn...T.&......V..[..O.M.nv.~....;..H...3I.O....a.Rj......hQ...B..+[. OK.3[...9E+a....Z..eA....G......~....:uW..Y..\.1<.......-V...#qG.l.....I.A\|T.t.sk....db.nl..Gg...g.).....

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_1.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5131
Entropy (8bit):	7.9309654446277476
Encrypted:	false
SSDEEP:	96:lS5yoYOqOOEaiMp84+l5poeitPG7DHJwcx96N4W/BqKB:lS5y4qOOEaLiTHJj96N5
MD5:	44FC2B1768487E2F1F04F95F14B8C388
SHA1:	FFACC7F192C58F5B247A851984239D7C86304364
SHA-256:	2F22DFA6EC29824123DF3861B7C654C49B3A7935511E9138E26F800483FD24BA
SHA-512:	16B28760DB3B252B520397E1158862322B522B07E63BE85501269BA13DA88685C852580F72000C76C86F83DD078DEE7C32BF157D2739D247B1B73DF99F697ED0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............-m.}....pHYs.................sRGB.........gAMA......a.....IDATx..mR[........ef.e....<.@u..!u.0.@....1"........V 7U..G.\......3P..9g.......Y..\|.....@z..>....G.@pDbq.s.....s....KJ7.3.Yh4..{.p.....X.W3w..`.@-..{H.....P...'.N@u h..?#.:iU...S'..8.v.....%. ...Q.E....7.)..4....Z.m...e.L<.#PH3M..7.>>.........^........(."d.46BS.H....].........!R....#^..>.v.g.k....Y.\|..H{`"/..c@o.h.r'X.Kg.6....^....t.{....@N.`.....h..<\|Rt...V......d..f^.,.....c y.nf..:9m...g....eN...E..)...no.2Y...(,....e.&dB..,OM.#..#..4.7......8.n.#..n.R+X.......O.NZ.m.;...+.U.O+..h{.)!U......~j..H.).5.\..............= .X.H.....R#..?....SY..b4...>.S.T._/.C..Q...9{T-...........I...}H#...^mM.".B..G.w.].i....~.....?.&vI\..:s...gt..yN7%...5U.....U.a...7/.q....j..)......S#`.....ibl.B..a.c..S..m.B.d.U..HK........?2....i..Ho...i..f...X...k.B.eE..X8.^'+.i....;...%..I.....R.7.KY.,....`J.@.6Q...>......+/.C... .LO..61.Z.".@R.H....p..m".MR..XG..E..m..n...]..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_1.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.531868737958494
Encrypted:	false
SSDEEP:	24:9s/6Hwf01d5/znYDjqWy8Yi5x7fzO/eoTMO/0T3hQ:9s/6Hw81fzYHqWyyDzD2h
MD5:	50A8EBBBE54E38389C31C82D126B414D
SHA1:	C93D3B7CB702DE03C6AB2C8CF7C6520F45613FCE
SHA-256:	B5750D21ABAD17B37896862D5B6598FABEEC4B45EB1C327ECFE4056CC2E890D0
SHA-512:	E67712C56B2B5465BF9481DEFB814A98439EA9656A6F65A0F6A7355D30979C65093FA5325751F5753EC615E8EDD7BA604B9E3E7A5BD46F95179C6DA56012002A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............).....pHYs.................sRGB.........gAMA......a....CIDATx...MN.@.......7.9A.B.r........i.u.m@..r..P.mo..u....]...:...i>....q.?..q...../D.........}...V...bzA".z....ZH.$...z................$^.HVi.Po.@......<.q+.N.>..o3...u;..:;zO.%.<..l.a..2.....$"A...Jd$..7....d.r....(RO..5.s.w....%d;.CCp...=.Z.<8~u...w.p.H.DN.............+..(."..W.t....$.;......pE6......Z.id`...Ob..O...C.yP..M.6o.......p.P..PB%..f........'...WT......%Jd...6...F....V(>N>#...P.....Y..Dw....&.Q._SN...G..?.../L.l.!Y?....:......d.g.]......c.8.O.l.B.1....Q.{,......\|.=..,...-$..&L.6.~zL9m.>.F...(.0Y....$....!.M....A.uk.....X.....<..P..d..^...e.....Ku......#..8..<...%....\).(......F...eubo....<..........]..,..p.<.ZV....w.amk.V...%PT.Ff.<?9.2T.'.S..Z...$..!4.....t.g......"t....<@.....?I3`.\......p........?Hgj..>.?.....TQ.........<<.r.9...!..L..P....b).Q.......B.......f..#<a.\.X....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	936
Entropy (8bit):	7.559903053416362
Encrypted:	false
SSDEEP:	24:9s/6BsT2qpwH99jdztSFrR1SZ5id3SBMKSb6b0oqqR:9s/6BsOjxQFr88SBTBYoq+
MD5:	1380B82254D9056AE17D2C9C333BCD5B
SHA1:	FD419D0EDF583E313F7F7F1BE565E7EB3F2519B8
SHA-256:	FEECF9909347B956549A39AB182F367F78E9C1306CA2DA146638CBDD3BFBA285
SHA-512:	9FC77FA74EA43F15ECC787FBC6299492196E8218FFCA1A6A4D750EBAF2A588FC14399D498FAD9B1DE5A3E0A316F3DD57350A1B2B0D67309CCA699BC96ACE89F5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............).....pHYs.................sRGB.........gAMA......a....=IDATx...AN.@...7v.`...NP..h...z..9.,.v.d...J..$..n{...knP.........M...#.......v....L./".....X..^\n.f......kQ..7....=S......Z.%.#@..'.<.-@...WE......x.:..$#...W..A...v..z.G8.U..Xs.p....<.N.y.+@vG...T..0`...........~.....;c...{..P.......!5..x...J..DoN..!@........]n.Uj.....]{.5cd...V.n....r.E.3.~x17.. ....C<..;]..43...h.1.g.<x..=4l.Kk..........O.......Q....<K.W.T...S].......`..eDo.U....y(%NZ......J<\S.`...<....0..$.R$...J.8.....Q3/..,@....~U>d.@G.j0.\%.0vvy...5..\|.>.@....]...........<.....z3l.<$.!.!..@E..P`...]_U$#....\.zSp..c...B+..B..l.ly.....(7......os.Y..u%..!5..Z.$....M.E..~.J@.A...I.AgC.z..g.?c.O.sh:....fQ.yh..h]..#..3 ........;..x..L.......9...wS.{2.M.N.5.&.y...y...-.{..._4..'%o]U........~.F.....\|..@@.....3.........M.=7..yA/......<.N^y...8.F*........3.9../Zt..cA...<........V..c.iK4....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_3.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.3611901561562005
Encrypted:	false
SSDEEP:	12:6v/705s/6Ts/vZBGTY1vFn4D3brB0lG92JFFC/aE8Eq3b8jd7sNksCjz:9s/6EZBGV0A8A08WNksCn
MD5:	FF3D7C0157D5D1D9A28E91FB2A0E6662
SHA1:	F6B73B87D42B63F7BAA5A6CDE25961B6314CA913
SHA-256:	D55C2405879639524333F7262828C370B5331C8A39BE070CCDB888BFB4F715B5
SHA-512:	698830E86647EBA52042F0CCADA114B64C4462DDA153B563662AC6E91AE502A275B498649E3154C7A90CE1BE883C29DDC9AB8445F580562741A2E1C8DD4B309C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............).....pHYs.................sRGB.........gAMA......a....-IDATx...1R.Q.....Ha...x.z.3....0..h%....T...!.0v..b...VO@G.$.w.d_.. .Vg7.O..,..;....E.....U.......=....l#9U.....).e...^_.........hs.)..$[.rqr.!.....B......i.X.}...S.d........D...........{pr...P...x.{.2.6O.v.i.<......P@.......%8... Y.L?..Pz..x.{....t.\|.!.+...Pb..xE... ..V .YC@......C......wgnC...'..v....; ........"....,..X...(Ym....B.X....d?......w.j.T..f/,..^.uT.c.A.(..=8..E.5].e.\yY...........!.@_.sM'm...P@.........F....NtOflC....+.....~.?.z.\|......O.....P!..x.{........$W....`4i../..../T.K..{.B.h[nZ_.-!6..Igk...l}.X...x......w..F6y....5....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\spinner_large.gif

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15416
Entropy (8bit):	7.756586242434715
Encrypted:	false
SSDEEP:	384:eK1L3Lk1UyxwO8tIZrkr+8t4vR8O8t4vWn2x8t4yLO8iDd3TCqM1oOiOvL:P1nkKO8+pT8amO8aenQ8auO8iDd3TVMD
MD5:	365D3E659634DF5D5289F14E1855E714
SHA1:	51010713312E23DD9ECBCA17A57FE944A678576F
SHA-256:	651598C518BC9F405F1DBDBACF89343D87B70DD2DFF93A01FD20F96C524E78CF
SHA-512:	2243FEFAC77C3CDC1CAA5E17BB01057A6A343D1852B58B48F7F34610814CE8BFDD47E9E2D3D3D12C8ABA543786E1CEF8E22E42D6159F222F49534C03845F4D06
Malicious:	false
Reputation:	unknown
Preview:	GIF89ad.d..?....)))............................................www...................eee...XXX.............................................DDD....................................................!..NETSCAPE2.0.....!.....?.,....d.d......pH,...r.l:..tJ.Z..v..:Y..x<..(.....r..@{...DL8...=..t[.....6JzhaG5#.....W....kI...E......V........C8...&.U....z.B,..$.T67..;H..?.)>.T....F....T<.'.F!....G.J...G.F...K.t8..9J"..............c.....x.8..!Z..CV.r.CI..),........t.H...?x.....%L."..0..J.$.2E.7.&5Q.H".qS..1<{.4.a..aD0.h...:#Ls..8..X.G......F..j....E..g...0...!g....a...E..@...\h...em..=...x1..\.By.z,....X... ....U3Y.+D....+...y..H..<9.!....Ac.=lw..?.E@......h\[....c...q..Dpx..M...=..^.;...J...K....P.@......s......)Q...!@T..........Hr..w].0B..\|P..,l..mK08....G...`...8.`....w....u..6.v.."LHD...1..C..X.l...T....'.GD.#d.I.....l........h..X.".)....W..T.d...0...uc.Tn..BV.@.w...b%.e..v^T.U.).h...f.....8..........'&..X&......P.bC...`...$.f:.zi..&.,......B[.V...l.l........

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_ext_on_guide.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15075
Entropy (8bit):	7.979399641440617
Encrypted:	false
SSDEEP:	384:B80mK0kjvC93yIZ97t991dRVGJyjz4poyVIor28Z2ci:TmRkjkRr7z9lwJyOoyVIuy
MD5:	2B183B9A55E2A55A566E6DF71751FBE8
SHA1:	F5EDBACF9DEF16D0DF52888EA7C398BF51601AD9
SHA-256:	6965355533AA0487DAC22F5D44CBD72BCA2C2ED2A75558DE725CCF5B8D1156D1
SHA-512:	47FB4AE6DCE69854D78190797DA2536C21C04E34F47CC4CADDF4746CA6B86EC522A6ABD2BCB01D2EF26E378513AB49E97AD470EB2503B345A15A80475768DC86
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............}.......pHYs.................sRGB.........gAMA......a...:xIDATx..}i.].u..o..`..X.....I.+H.H.Hj1Iy..E......e;q.8.r..8.b.J.J~D.....r..Zh.2m.&ER....H,\.....`......>.t.}o@,#.g.......>}.t...s/.N..!c...sY..EgR.s..-^.#JK.3!s..Rt6."...zn:...f6%..:6.....g.jU=Z../. 0..,...L.."..K.W..9..:.\|...j3.&.........Q....^<g3$.i.<..S..`.Z..?VA(..-...__.0R.9..\|..`$......$.5).T.....7.l ..>.i.x...\|t...wMx.w:]..@:i(Hw...N[.l.K...4...8]...7..Ho/..@....T..x.o'.+.....Q\|..2....&..u....P.......uC;......,..kh..mHDI......l.....^..C.OH...Hh.$..ei.C..3d...U...S\..V:.t..qH.d...2..A.&X...._\.P?/.......C} ...M.e3..3B >..v..0.._@R.4&.GB.(.<.%....P.y...I.'.T.].%..4..4....ZW.<. g.......H..H.........(...k$o...]...9.d..]7bna.....0= }=....4..NQ..$2../...y....XS.^..l...O.].:.)...E.iKH..S.....%...&"5.4..@M".N...X.(~-g......&..l.......Q[......3.....M.....h.Q..r...0..G.M%.Z._...S.4F...x%4CLJ.d.y.........).V.(.<t.a.J..&=hSi..'.Q.d.l[.).. G:M...)N....l............

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_off.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.765526156253972
Encrypted:	false
SSDEEP:	24:E/6VTSxUkuCt85lv4ufWEzeHjWbbUTIOg88TZ3YA6KvyJykQ:E/6wOHD5lNfLz9bba0v6z03
MD5:	1B45AA1C87C95F01CD701E67021C8EE8
SHA1:	C5F46E430683FAD4D9C8D97EB07FEB4B0AB05000
SHA-256:	8AFAC0EF4E2A13909896CC2B0BCAD6A2D0C5890A0EE801A7F9F95ED3E788F65D
SHA-512:	99042A14C120ADFFEECDED7FB9DEE60B0081DC586EE44D87BA47B7C1EEB0976CFC2ADE61E0AA7B90F30A69EEC1C30D95235C82E7743576F5CEE4B52BD57968A9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...1..........f......pHYs.................sRGB.........gAMA......a....OIDATx...O.G.../{.1..E...9.!..,R.UP9..^8F.R/M.=..zk.. ..!U/U.JT=TJ...+.......cm....;..$5......eg.....3..;......=...'.._.....E....6}.....v..T..Q..)...b:nR..x.....a...."........L(.....h$..4`..L.RC..].V.........{.......Z...3..."x.......bV.v.b2..t../.....w...f........X[......uG.D.....R3q.=...8..."r.......9..8.E..&Z[....H.... .B.)........{..ah8....pv...h6.F..:>.'..i.H.D.J3Z h..'B.>..x.a .. `.r..!...l........6.&.UO....k.C..9,.. 9.A...o...F..'!.......bg..N..`H.u'.9.T.../J.x.S.....E......bum...\|'.mODy...<?.k....N.N......[..U..q..-.z.W.qq..I.....A.J....Y.GR...N.LF<.Y.BQ.Bne.3s.8)S...$G...........?.......@.4M.x..w.l{.^....LL....#..........!.M...'.<.18........a.....)..H.i%.}....f1K........$..D..m....}[.>.1==M.S..w.....4.^.....[..........^.{....=^....(....C......QU.o.l.C.$.}ahhH......X{u.B_../[Z..Y.p,...3.. {>jY..b$.g.h...\&..j.MZ29`q^jeLM$..s...^9...Q......._!Ko..!..P..E..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_on.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	7.791073489480044
Encrypted:	false
SSDEEP:	24:E/6mSAjeB9G+FMjdZy1nnvp3jRLalTO/c/PvJaHydaD6DYwlociHVLw24/QhH:E/6PAje5FMcvmvRaHydauBlol8IH
MD5:	2CB18A9BA461F4EA1A627AC4457F310E
SHA1:	2A482CE4421739A75EA57905F6C9417D67B0599F
SHA-256:	3630AD753F65CB8FFE2592AA4DA02DBC54AD46F5E6BC14C9111E82235A739CD6
SHA-512:	1EB92F13806C98324B7ACAA5F636D2E31CF94A330642B8378DC0DA88EF22D5B9D40F6660A74C719B9EDB9196258212D6214A079F9887A96243E74E292101E521
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...1..........f......pHYs.................sRGB.........gAMA......a.....IDATx..oL.e......Y....H.Hf$Ct{.....^L...H.{a\|...E}.&..l..........BH&N....l...:.2."..^[.^{.......A[.b............w.= ...;Z...y..' >.....dP:H).T'.qeO.....\|.A.`&~....{_.....E.~.Z....t#.l....2..+....[....x\..q..eL!S.m.'...R".:..2...@c..xg...................y.Fc.......[w.....!J...N4VT......x..........3"x.PA.d...W..x.j.n.:.F..w...Bd........,\7...G.....V?....=.f.2.n.,<.9aU"....G^.$.J...l..MDT...+1=.R[.....j.p\v.9.G...."X2?.<.X^.lQ..Y;.. ....o.........Y"(.yB.[..l.eaI...' O..f.j.i...W.K..t..sad...)....).......8...?.-&b3V8Qz..'.\|.\.&...7d./F.....)B*..#.t.~@$..j...+4`..I.}......6A.....M...<..1..C.'..`.._.p.e....i./d..~C.......... V..NZ^ ..N).....b..l.#..N...]....85.2u.z7....2..O..J...........?..j..s..~>.....1.tSL......Q...\.(..g.>......[.io.......}...X....f..3O...B2.1....da<Q...m...U..r..O..&.?q.]C......r..w...R.`.#.}....O.Z.....%.J..E.Qu../!.,

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_1_3.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	7.9134385325834735
Encrypted:	false
SSDEEP:	96:5Sxtw6uF4h1IoiShJRcX3/okKqShNmdXXs8oG0S6Fc:5S3w6X+0XZcsFNS6Fc
MD5:	42B15F32E9F2B2FE7874BC8B5CEC3FD9
SHA1:	0095AEB7A50DAD717D5C831DA04FB692ADCED9F9
SHA-256:	0AA2F6F56226AA14901D0FC02DCC9FE7B45A86F49725C1B638252F90117181B5
SHA-512:	2113BDE6D0E5F0D96F55C1DC07A1351A697B0C1193FDCA41C5E452DFAE38B96E53D717C74A840793E53696D0C3503D8693B403639C30D56955B47DA0787C7866
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a....BIDATx..._l.G......;.v.Z.%.I.(U+..mihCs..@....T...P....."......H..!!.#Q.}JC.<..VT....RKJsvZ..N.R......;g..8N......}$.......o~;.3..B.!..B.!..B.!..B...YQ>;.\.S$..g.3Q.r,...F..Kf/..h.@O$.-R.$$.>..>...e....{.).q...D.-.5...0.Z.R{.a`......$\.rV.FLS.....%6.. B..\|v2eD.G...M.V.r`2-Lq.0..m. .B....DOK..#..k.....)N..]C....k>;......).N.G.BV..K..t.T.T.t..BuZ+...Y=...c..V.....0).......8s..41..@-.P..7D.&X...s~..Gw.c..5..cA.......~..}hx,#.9...H_.k>{..<r.Q...Z><......h.1....X/..k..{Q'.>T.R....')T..T.8o.VS,..@R.....0.uPs..SS......E......Y........;_?5.i.g_}.....>.z.U..L.^.g..A.C.9.[...\$..>.`Y....!..j76?.....#.^.F.....h.U?%.....{.<...>.3W.Eu.X..'P'u.T.^2:T..@l......hR.TU*..._.y1.:.[...w.K...U..q.k.k.\|../..y.uR...BU..........1%..L.G..%X.L.q...TCu.....kU..0....L\|J..........?.x..X-.......Gx...._..B.'.-..l.. .z...~3.f.V.>E_.^.=shk.k.^.@....[.y.(.dU.k.Rajm-......Tk.H.d....

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4647
Entropy (8bit):	7.934941782690532
Encrypted:	false
SSDEEP:	96:5SrHsLRJGNY3SJ7+U/I+TWVdFP8FFYTq3+Nas4YCiuSuWozqB1phz:5SrHaZ3k+UDiV7P8FFY6o4S/oO1x
MD5:	06438B94B66EEB804C86F363C62BFBC6
SHA1:	CF3D09AC9D952D6FF0A85D0AC9BEEBDA22CE0EDA
SHA-256:	C879FAFA5892DA6841E0EA09F2EFC9F68762E5A4752D62ACA8C9B95828B6FEAA
SHA-512:	38328E330AE12BC31EDEABAD908C86A1C486CEB0D14E9FF946E459D0E88243F3DE0EB603CDB6E31B4CA2EF6BF70428DB5EC54B3C705E3043C9FB0A649E11FDA5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a.....IDATx...l[.y...^.zX..Fvl..:Mj.[`...m..y...Yn.>....(..N.n..`..tK..v.4.....k..c$..Hj.(..nk.A.;.`Z.dG.P.eQ"y....EG.. /....`..i>t.....w.s..P(...B.P(...B.P(...B.P(.#..YI%..r?.b...l...#.~...7.h.......i.@K(.....8k.wE....,......1.~F......./.."e..+'..6].]BD.....F....w._:..ub.P..J%.[...sSksGH..F.x.i...C.me.eJ..k,1.R...&..>...c.4..pU..C(3.FX...6.c..hE.r4!...rq.@...l.nO..P....9...c..V9.j&.0...U`..Vzlx.7..\.5..../D.FX4..4....;.a.;hd.O.E`......^{...X...i...0....&..A.u,..W(3..]....0.t.k.Z.E..h......X...>.M?.Du#...i..Tb...7.......A.aXSS......8h0.g.U8..h8.I..........._.......^.+........5A..i.}.s.n.E7.G.FX..0pH........-..o....m(.E.N..7..P..o.vY.:c#....l.z.ZD.^...4.$=......n....a..\...?..b'<.3.D.....-P,..q.K........k8...$.R...a.{..........C.....KT.;...#/...::.[R.cI\.j]....'.'.l..j`(.1..r%.{..E......2..XTR.....r.t.O.........i...8.7..=.5......k.E..JT..[.Eu5.....0.J..LS@<.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-checklist.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	37458
Entropy (8bit):	6.1115518910654325
Encrypted:	false
SSDEEP:	768:h9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZh:h9DDI6thXjez1jtnq
MD5:	C58C13F27431EE71CA92B90B8C1489FD
SHA1:	1CC53186CD7880425189542302E80578AF6B858C
SHA-256:	62ADA97381EA697031E84EBCC577CB3A9720F16BB2740161F9DF9B0386CE2FC0
SHA-512:	78E4CD236A3E33EB1516B5E9661A9B42647609EDFC5F41C530B2B6157A957434E55C555703C4972717D847BF833475A86719F714F0075C90A479AAD34CA5C9AF
Malicious:	false
Reputation:	unknown
Preview:	/* Open Sans Regular */..@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXhv4

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-common.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	34216
Entropy (8bit):	6.048880024669963
Encrypted:	false
SSDEEP:	768:E9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZv:E9DDI6thXjez1jtno
MD5:	B9C2D0A67F0DFB369AF59A0D59E92473
SHA1:	24707EF5942BCD780149B05CAC400E93A1835498
SHA-256:	88C968974A62EE4B7C4FEC7A74419166DCF4285B8870140117F2C7CAF97C3CD7
SHA-512:	B3FE1806246D952374EBE861CDB916619090724666632F62090202F84F143C89AF5A4437C825EDC19E7F5DA0AE4448E831293581A50C97568155AC8D035DB1E7
Malicious:	false
Reputation:	unknown
Preview:	/* Open Sans Regular */....@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXh

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-core.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	26073
Entropy (8bit):	4.7762916811662866
Encrypted:	false
SSDEEP:	768:J+6T4vNmgN8t0+yycVCI6z0jG7RMDX4WUMRmvm/M:IDIyE
MD5:	5BA48D77DFBB086D11459D4DF9AC49C7
SHA1:	27C502CA093CA7588E228F6E46FE0DF82B35A247
SHA-256:	E725C3B18165AC8F8A6DA0EB0FC8314DF843B97D3975574F5A931BC9E8A5B493
SHA-512:	B3475BABEC402EC07A3E7604B0B15A274C1C42A7D9AB2CFDE9DD1313DF5E9F7B423363DDB8B4B2358834F2948DD34B4FC9538E8660299576FBCA680D5638DF3A
Malicious:	false
Reputation:	unknown
Preview:	/* Core */..(function (wa) {.. var core = wa.Core = wa.Core \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External;.... //Component.. core.Component = function (name, status, key) {.. this.name = name;.. this.status = status;.. this.key = key;.... this.isIgnored = function (key) {.. var isIgnored = false;.. var startIgnore = this.settings.get("startIgnoreDate" + (key \|\| this.key));.. var ignoreDuration = parseInt(this.settings.get("ignoreDuration"));.... if (startIgnore && ignoreDuration) {.. var today = this.settings.getToday();.. var startIgnoreDate = startIgnore.parseBasicDate();.. isIgnored = today >= startIgnoreDate && today <= startIgnoreDate.addDays(ignoreDuration);.. }.... return isIgnored;.. };.... this.isInFixGracePeriod = function (key) {.. var inGracePeriod = false;..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-step1.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6397
Entropy (8bit):	7.947947094706784
Encrypted:	false
SSDEEP:	192:GSzkZH+IG8+1lqPrujYGCbSDp98cti4FSwgfYf3:poZHw1lNj9f98trfS3
MD5:	4538CF17F5E72D4AB6748D921AAF47C3
SHA1:	0721FB317398B3F389FC85B57D7BBBB5A5C8EAFA
SHA-256:	CD03355615D11022E11EE57F35A0E994F42F60A03CF9063FFA7AC0321276129C
SHA-512:	D9DC3ADB291EEC7CFCD317DB6D9BE5C662BB25DE22AC8056CEE7B16F710F119392A46CCE4250900DFF59DB4313A6B23FEBDE30240DB9A3244C3B008A49ACC422
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................pHYs.................sRGB.........gAMA......a.....IDATx...tT......I2I.....B..-..[.GKJ...+.+.(.j[{..t......O...n..Zc=.........Z8TA..=U."2...7I..w..M.'3o...wf.{.>.h..L2.......K.....V.....S..N...9ts.>B.....Z.G::..e..\.....c.i ..`.....k.J...[.v.v>.D<.?}..C..p./.@k::.@.S.B..No./.\...PZ/.X....7.[...?.....x.-..U..]PF...Qx:..Bts..\.It.............l.).I....LY..P.D.....G8.....#....th..JE\..^.:1.t..Q\|^Mk...ek.2Q.}V.o;..E.IR.#........u..`..!.....n......`=.)..N..2..ex?.. ~......y.......`M.0..a...m].J..k,ik...W.....Q.......O..0.m'H[..X.LP../.z.......y.F.6.E..l....`......K.H..1.6.......o.....9W...-,"&!..[9.....w.......=.f.......(......2Jy.l.F..7.U?.......>.u...WY.][V.F..j7.:`.X..g6.[.Z.Z\|E.....)kk._..X.....nx2.2.....6v..V....b...\.Fn....W....[.::.%.?H.5.H.C.....X..h..1.d..3...gPb,#D......I....K....#~.......>\..=R.9~l..D......w..2P[..%..B4\1..+.... ..@..c.9@.....iG!........d..'}..F.D....m.(.....=v.lz.:..N...F....

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-step2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5418
Entropy (8bit):	7.941310197666969
Encrypted:	false
SSDEEP:	96:GSscx0y/nkoEVlqHdvygby9KULounF17qTN/Sxgn7ylwgwIMyce:GSscKy/koGlCdv29hLJqxiEybYyv
MD5:	A1373F9C03567C27AF0DE96E770E45B7
SHA1:	A97E90B04460E4AF1D8425A9D9716782739C79B5
SHA-256:	EE56D3790702A7A91CF1BBD73326E6852CDF648C77249876D8D4410D5E1DD52E
SHA-512:	D65BA6F131F7EBAD0267FEF9BD555121429852DDB58F1D51CF3CBC800114C93BD8BC50CB06437BA999B7B585E943930CF7AB8A65632C1B9BBACBE5627027BE3C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................pHYs.................sRGB.........gAMA......a.....IDATx...S.Y..3.........A...6,.{...{",..a.=Ll.,.....8b.....=..r.eo....o{..........U..R.T.{U..O.m\.!.2_.x..4#.._Z8......C...U.M(.4=....St...S..<!, ."".....-..6.#P..j@X...QG....sU-V....+:h.../....F~8.."..NU....\|......L..'D...t.....Wt..V.&...@.v..$.s".8w..d.E.{....A.p.G6..2.Bt.....O.h.F....4..f)3%D.d.7..,...d.a)..r....r2!...El:....)...wMi@9.V2.Bl...L....r....c+m.L.....#..J...!j.....\%.L..9.iNSYT%..fh.k.$.5.....5QZ+Mb........D.X!zIhsWX.E.(..:]y^...8!j7..I...$......k.F...s..<O..@b,bZ....u._.M...k=+.M4..i...D...t..o..$......E5Q6.....3].i..o...}.3...3...1......;.(..\|./.U#.b.h.......Jy..XT..0f.....Sm87..?l\|..Y._.k../....?.AY.,.x....q...=Bc...X.... .2/...pQ3.j.........N.n.C..E.s..e.O......Tr.'. . f.(-":..&J.n.]..........K.h....$./...B.E!.".H.).X.8..Q.?.c.....\|.h.-d...?.5........K...1....<..:_...d..d....h... ..c.BlUJ.c)........... .T..1Q.1R!.'.l..ai...Q.1R!.&..R...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-woman.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32309
Entropy (8bit):	7.9804976554334655
Encrypted:	false
SSDEEP:	768:7NFP/8lSUsE2h18x4Su69ZU+VJpszMXneyg5PTg:fP/8lSkLd9jpszGneyg5U
MD5:	FFEBD5099333A2223979DDC7AD6E75E4
SHA1:	5BE640F0A871C4B1C9B2858ACDB8795B96F44586
SHA-256:	4F80FA15BA8934B3E4612BAF88F1DD2A633A1368A18F4F592D17FBBFCB635851
SHA-512:	359A50BDF3CAC8AA7B4D8CE42CB83F52CFB61AA969EB8B258F09B9BF1311C0B7FB3B974CEDEA72A0B94FDB0055CDF1F7489390E492F07547DEBE75B2EE5FC728
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............T2.....pHYs.................sRGB.........gAMA......a...}.IDATx....\e.6~.[.^.g%...t ..H.#::iFG.uh..7..3.gQ.HG....F...g.q!......."J.i...v.$.....{..9oUu.;.Iw...._..[.}....lD...0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.!..9.e..."O.B'..6M.."(.rQ8..E..9.....\..........:.$.Q...C...{C!2p.. .9.....o.I..D!(.k.A.L;....&.s..).Q.-.}+....B.....m!.s..).1..A.;.o....T..)b.a5.M.....\.fKA......Z..M../X..?/p..H..%...R.#`w...3\.G....t.L...Kkz..!20'`....[....U;M?.p'.....{.....T=.R.rp.....!......07`..U....)}.F........k.j(d.j.LR.l".."..d..aX.U..6.z'.B..Bu....&...,. }#..Z..B....D..f/"..X..0......P....N..~....@U. ...>u)..!.J2P.0H.....c({.q.......A.U.].z....z.202.R.>....).A.U..0..L1.R.:..2``.a.B...9h......)T.2...:\|.........t.&.U........H. .._....7.........3.6\&..[.^;.....d.*a&..FA%!0V_.,].x<q....w..[7..%3S!Py.9c....0H....m.#.....v!......xa....... ..z!..@Z........F......w.&.....K$Q.U......

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-bg.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32345
Entropy (8bit):	7.970403798736529
Encrypted:	false
SSDEEP:	768:b4L2222222222gBS2222jbjKQiIlGtteBfKZiPb6++0SqnQcI:bybjbBlGzCCI0qnDI
MD5:	EBE97C44DDCD9F77F1BBA3B2438385D5
SHA1:	42648E15E7B62FCEE58CA5EAAF0CBD81A63E35C2
SHA-256:	26EF082565402F86EB018C87E41473F4FB2D52EEAC73B9CFD8FE81D51931AFE6
SHA-512:	552D36347A3943830B04A4DE2D0E4E2032A9A108203E824ABBF16595781A2A19CAF36FC813422AA6F4FE74F4B219ED376305D424E0CF17332397969E26DFC5D2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...,...H............pHYs...%...%.IR$.....sRGB.........gAMA......a...}.IDATx....-.f..k.c.........l................RO...x.@..A.R.......Q....\.......j>.HYVdCuv.1.#;.y..W.zg......De....\|.gE.,+..:-.......<g.e...>..._._a...V...+.@F...6hJD..+.H......m..+.H......m..+.H......m..+.H......m..+.H......m..a...U......l..6fW..~.T.J...zy.]zX..(...!..g./ _.9#......GPH.#.....(?#..c...k.6o.-..e._tO.Mk...'.B..W...V+.. ].N5xW![.y...~.vx$....U^K.....~.I..GQ&.w.{ye.l.6.hug.ff<V.HD&....e..r..Y..L.F.j.....I..9..+u..@...._..lGWN..l..J.H$.F>%L$..A:.D"q...J$..A:.D"q...J$V.O......wbm7...g..\..5............a...QS...*..k..4....3Y.:..ioq...VN./K.b.S.../...r.o.]Z.(f........(.........p.#...E'...J......j.&.......AG+....X.}%,_.t5.......T_.C.<...!...C<.>! .._..#....3./K...#.Q.@.b.iz@..U...h....&.5nD..UEFQn<.nu..qVz....k.-......)q..+..0..V.E.....h/.....w..+.xu...t.D.Y...5.(._f..Jg.......;.8..".....C.j.f.U$...tw........0.H......m..+.H......m..+.H......

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-logo.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3472
Entropy (8bit):	7.914294719380596
Encrypted:	false
SSDEEP:	48:0BOO0xiRfpQu8pTvaIyE0E+y2Y5NTIMDBoY9I6ZDS9vH8C9SHZ/R0Jjnjc7xa0Dx:CryTvkE75NTLOY9IuS9vcCnU/DW2
MD5:	DAB5B1667C76E51B013C1C4AD2F7D532
SHA1:	49375ECB91B075E06624BFB5FEDB3A0DC4F1935A
SHA-256:	A4B95F7D7A776BBC6A84997A601993D3D4E0EC66B48F7D1DBB816497A248A24E
SHA-512:	843E8852408E5962C9FE62EE2441E3A41622CC929CC22AC9C692B5B9C8CA9D912AB143BBAF274899C59132A429B9032BDFADA51392E221F6F98E25C3DF0119B0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(.............pHYs...%...%.IR$.....sRGB.........gAMA......a....%IDATx..]Mo...~g).,..]... . ..(P;..T/..R..z.....Ut.n..\b.?.q......-P.P..P...X{..@.AW.Lq..;;kQ..~S.e>......pv.y?g......^...=.Gc#%..v{.>...pbb.n4V.{{{.E...2gl...iA...I..Z3L..O\.\|....9..^..Y..ax.....'o.g....1........-0$...-..i.e!......6....u.u.I}."..A.....xI.......~5...~....\|......L......y..iBB...w.^...]R(.y.q..T...}.3.4.pf.Q.A.)...../..kmp..$9.Bg.?....."...=....G..W_..?.._M....;H........g5....r..g..... .....jA.($.o.y...7)......c..)..T7.h....W I.{.5#I...\|. .].p....Op...\.q.,.@.@.r7.Q>......5{....O....."...#.L....]..-.U..\,iZC...\|.......i.s..-d.R.....4...(B."51.MB."..g*.'.<....e....8..'...!Ks,....i",A\.D.............{.U.0......:..x........~.P3.x....x..o...,..-....3-.{..Q.+y..+m..!...m.$..\|..U...H...O@...8..rQ'.J......@....^..P.vvJ.....L.......m_..s.$[...dK.}...L...~8...../^\|..U...x.De........>..jk.r.saK..\.:..".....3......S. &:...}....T(..?......k....Q".....^.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-window.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6759
Entropy (8bit):	7.889394285207192
Encrypted:	false
SSDEEP:	96:ZgNNLlmxVJnzXmgYshy0/MMA+SJ3zjaVDRL3Y9M8jX10ZYUQhyG:Zg/lmrVXnPVkzJ38dL30M8X14G
MD5:	F17683FB6249E0FD8188AB2844EBA5D2
SHA1:	A084098F96F87604F96737B202935BB1AD023F71
SHA-256:	A0977CF048480EC62B8CF0BE174466A31612C21CD57C20A28DF69EC7A465E8B2
SHA-512:	3E2406EE7F4BC41059D4F5ECEDAEBDD0377906EDBA31423AFF86163C217DE47181201272641688AF52FCD00F10BC3F0D90A819D5F48868F598941A4B8BED32DD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......-........<....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx...{.T.....~.L......pI"B...M...j.+HRV...T6Q....M%Z...U1.....q.&fAQ.a)...DA....0.# ....=.......3w.=..{...p...L.t.4...9..;.^"....:u.Ot...D...[Hy.\..<.!...R.~.#...;wP.j........P.....Cy#.#..m...y..o..F....w..]..uS..u-.,.Fs:.;.\|~=..].R>w...g=Z..%....4.....x..9y2.....sC....q<.......P6.Ea...k. .4.:...r\|..._..~.0..`..@3.y......,..u.#.O\|].....ty7.7.SU.^......... ._....~!B...S.p...].~...y.^.s..$D.......O.g..z%]...............~.n.t.^:0Ju.X..n....sd....0H..:6../.q........?T!. ..8s.~..HM?.......)?.....dB...xt..i..;. ....A.d.\|...........)A.^..?.1G.j.R..&.........w\|..0.O...._...8..9..0....x.(.:..^=.....3.5\|..B./..`......@..vT:F.k...!..}..... X.P.<6,......S...t.d..P..J.;..W...\|.."P.....S........~k.........._..W..T.fr ..z.=...^T...T.u.}.qEu...=.}.w..~.&.x..jm.VD=A,..V!.G..g..".~..}^R#.Su..S...8.z'..0.....@...@....8.. ..6..@...@.^..r.....Um...~2.....1M...a...a...a...a...a

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-checklist.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9632
Entropy (8bit):	4.045467695885821
Encrypted:	false
SSDEEP:	96:jUSSVnGzSsn2hwPYeTZK+GzoulH8OJo6Jbtyxo9+jRusFRLLDeWn4bMe:ASSVGzSoJweTZb6JbwkEukZ0F
MD5:	FCA1638E8007044BD9EB099AE7952CDC
SHA1:	8FC3EC2B8D2E756688C166C2E7EC65CAC984C4C0
SHA-256:	F52C4E21B111DCF7B039409869483CBB0791F5E2E841BAB1E1E211115A63EF21
SHA-512:	6400DCD31C8FBF234F49DBDED0530D812AF991FE84993CF62352FD79A4A70B20A9393DE7883EFEFE634E381A0FE0D6EFECBCA5D0C6DECB74AC1EA6681DB4A1B1
Malicious:	false
Reputation:	unknown
Preview:	/* CheckList UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.... ui.closeDelayTimer;.. ui.CheckList = function (options) {.. var el = {.. $checkListWrapper: $("#wa-checklist-wrapper"),.. $checkList: $("#wa-checklist"),.. $messageWrapper: $("#wa-message-wrapper"),.. $message: $("#wa-message"),.. $messageImage: $("#wa-message-img"),.. $closeWrapper: $("#wa-column-four"),.. $close: $("#wa-close"),.. $logo: $("#wa-column-one"),.. $state: $("#wa-column-three").. },.. checkDomLoadedInterval,.. animateDurationInMs = 400,.. self = this,.... setState = function (options) {.. el.$state.. .html(options.state.template).. .addClass(options.state.css);.. },.... setMessage = function (options) {.. el.$message.. .html(op

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-dialog.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4238
Entropy (8bit):	3.782527164526876
Encrypted:	false
SSDEEP:	96:kZ2B5nzQw2n95lN1i1BMHiKHzReZDeVBvwCip1:kZEe0fIpHNeZDQBwCip1
MD5:	E4BBDE9EB69D4FFC81DE9F00433D5429
SHA1:	3AF039064EAA72DE58B859E2C0510071F25A5EF9
SHA-256:	3AE7AA1908FF423E9EFD17A5AD46D88AE89C6CE17E5904BD330A8A4D441648A9
SHA-512:	A2151EE7F3348D6DB1A5C25EFB34D24D5EB7583553B05C3E6D2AA43C780F26CC75CFA7CD7E571265EFAECDC81EE9CE743C1B42A6F3190509EEE05705B87569DC
Malicious:	false
Reputation:	unknown
Preview:	/* Dialog UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.... ui.CheckListDialog = function (options) {.. var animateDuration = 400,.. el = {.. $dialog: $("#wa-dialog").. },.... create = function () {.. clearDialog();.. createHeader();.. createContent();.. createButtons();.. },.... createHeader = function () {.. if (options.header) {.. el.$dialog.append(.. $("<div>", {.. id: "wa-dialog-header",.. html: options.header.html.. }).addClass(options.header.css));.. }.. },.... createContent = function () {.. if (options.content) {.. el.$dialog.append(.. $("<div>", {.. id: "wa-dialog-content"

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-uninstall-icon.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3395
Entropy (8bit):	7.880811480479431
Encrypted:	false
SSDEEP:	96:WS0DKX8AWw5a9tRVEGCtbiHX+VGIGW09iYl1Avo:WS0DnAH5YRVItSLjIYDco
MD5:	E423607709409638253C24C3688A88D9
SHA1:	8ABC653F71614F6B707B01862449FC800D27EC61
SHA-256:	3B7849200BA0C2EAF22C3D111DAB6A630A00EA4A6EA968344EFB900E79084E4C
SHA-512:	BF70D4EE71BB441C7C36D0AADBB73C68B089D7E431694E54FC1606FB5CEEB8A30FB50F28FB5BDF5815EEC600364B0AEF98F57C23C8C160FCC704728918886259
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs.................sRGB.........gAMA......a.....IDATx...r.G..O.H.!..6..@Y.[..[./r..\lQ[......x..'`.....r...T..\d..m....X....56..K..9c..}.4.fF..U.I3...........B...b...3..%....c1.<.....x.7r..s...`./..<...WK&.......0v>?.2.%..4..y.....9. S..{y].9s&..#...>\|.......\.Ry.4.G.3..9.=66....F........c)..Y.o.......b.....w@..-....q.....]....`,.bH...A.&.)....\7....79]...b..(....5.W.u}v4....!........:....."..]c.(`.)..u2F...).m.+x.f@BF..67.&&&4....@..;mn..+'...."..~.....T....[.......5.._.@u}o4..,..Ao.!.?.Gl...,f.......[..Uo$...'.{KO=.............,x.'...~p`.&...I.Psqcss.V...0..H$.O.A.......@.{...\..4.O.,.W. ..3...m.H.w..D.H..T*..6LQj.....UE...w..\|f]..Z.q].Q3...rN>.....J]RU.F....q...~......./p...c3......{......L.+..............9v._..:..h..@o_....p..9.3......p...?....G..F=z.X.....#.1..A.?Rz}..I:....T}7..V.?.R.....X...Z.....H.C..OU...Fl.....a..?.......n<.VWA-.~....x.......{$..I..V..X.AU...^.\|Ys....T...c.`...hg.......vy...{.v.......

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-utils.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15448
Entropy (8bit):	4.444349910118249
Encrypted:	false
SSDEEP:	192:BZwBjyfDzRj5csy4h11lidEaCaNz46UcEm7dO2qSFZC9OQ//A:Wefpj5csy4DIE3oU6Um8g
MD5:	5BA1D5A22AFC4C92E80F6354B8193BD2
SHA1:	31EAB632926B34E33B0B93A703AD251B3D9979B6
SHA-256:	17257166D2D7EA1810299CEE28B1388F3C814180A76DB401B2F863ACBA13D0E3
SHA-512:	3781A99D47FEBCADF04E02BA53FB6DF818CFEC82BD5266078B0E59DE49F0DA69B592F9A9F4599A386D94B537C499E9810C860E15976ED41CA00FB0028482FDF8
Malicious:	false
Reputation:	unknown
Preview:	/* Utilities */..var _langResources_ = {.. checklist: (typeof _lrCheckList_ !== "undefined") && _lrCheckList_,.. options: (typeof _lrOptions_ !== "undefined") && _lrOptions_,.. shared: (typeof _lrShared_ !== "undefined") && _lrShared_,.. uninstall: (typeof _lrUninstall_ !== "undefined") && _lrUninstall_,.. sstoast: (typeof _lrSecureSearchToast_ !== "undefined") && _lrSecureSearchToast_,.. install: (typeof _lrInstall_ !== "undefined") && _lrInstall_,.. webboost: (typeof _lrWebBoost_ !== "undefined") && _lrWebBoost_,.. waiff: (typeof _lrExtensionInstall_ !== "undefined" && _lrExtensionInstall_),.. ut: (typeof _lrUpsellToast_ !== "undefined" && _lrUpsellToast_),.. overlay: (typeof _lrOverlay_ !== "undefined" && _lrOverlay_),.. newTabToast: (typeof _lrNewTabToast_ !== "undefined" && _lrNewTabToast_),.. ssToastVariants: (typeof _lrSSToastVariants_ !== "undefined" && _lrSSToastVariants_),.. pscoreToast: (typeof _pscoreToast_ !== "undefined" && _pscoreTo

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.494810764492959
Encrypted:	false
SSDEEP:	12:6v/7iIHftwTmWkW3O+xbR/GfmNFycqV7o5jNiXrj0IGDfjo/1:zT5+aVefmORm8bnGD09
MD5:	F8AF1796D709A69C3FBDD16822596FD6
SHA1:	D216CB9A49EF4223138BE20D027B3ABEEFAC7DB0
SHA-256:	055E07F760351C3F33E708E4720D5A34A60ABD8D13F2FE05A473DFD5ED9714C2
SHA-512:	FBD9C93490B818798F4614E6EEA7EF9FA05D535F50071806E763CD9EBEE478559F614EAC90720E4B5F88D803DB0AD459F1D1C67954C2C379B1BB435CCA74390A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............H-.....gAMA......a.....IDAT(.u..k.Q....1&.k..T..bO.K...DP....I..{.PRA..............QA..J/....eM.tS..7..v...y.7.7.f..R?......W.......N.....G...z.N.a._.X=.sg.5..r.k....Z...R....[..X..W....N....v...H.1x......L......R..@:v.w.....W........v.lc/F..b .C\.:.[Q.`..E`.L.J..!....<..m.q....R.&...""%F(^M.`..e.,N..q..y<.../.O:.mP..,A.QrZ}[u0..,3...S.K.\.EM5.!mH......}N.+j....p.O.E.......[..C.\x......nMi...~%.vv...\|8...y.xV..v<ZZu.....y]@.1......]..).6.M.'.'.%o.T..5.Rq8..l..;...Ha......5......IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	785
Entropy (8bit):	6.380231936591206
Encrypted:	false
SSDEEP:	24:nmwBSRPy8iSvgv+aYS0NFVO/6cgDHNUPZ7SCOr2zhxNoEMBxNB:mwBSRVL4v+/jNFVO/6cgDHWhbOKHCEIj
MD5:	5367B11C1B0484E2B64AFFF761DB5B69
SHA1:	CA05EC2A55FAB6A4035920C38B6FF198044DA594
SHA-256:	1CAE0E0663BA559CA8FE7AD3A1E07AB23AB9E3DBADA1AA572AD9C2C5D51D5627
SHA-512:	322DF7AFB16185EB4D39AA4881A27E04B1D310773FCFBB77D0F1C83237A56D100F6567091E30BF0DC6A11EA29A22A52BF091B66C5863823596108C155C031588
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...#..$..%..$..#..#..$..$..$..#..$..#..%..%..$..#..#..#..#..#..$..#..#..$..$..$..$..$..#..#..$..$..$..$..$..$..$..$..$..#..$..$..$..$..$..$..$..#..$..%..$..$..$..#..$..$..%..$..#..$..$..#..$..$..$..$..$..$..$..$..$..$..#..#..$..$..%..$.....p~.S...NtRNS........................T....L..........K..T...S.....JJ...O....r)1N.T......L...P.....bKGDOnfAI....pHYs.................tIME........l.-....IDAT..-.g..`.F..o.PISC.[.........\|..s.@.Jr.PM.3.Ah.&....dI.01..t...v.K.h.o[?..^.....Gc.&..8....A..<..r5...QY.F..n.8..@=A.l.u.....n.C.....>.o.4...&!.KUd.&R$>.e*o..T....:...~g....%tEXtdate:create.2022-02-16T15:21:59+00:00h......%tEXtdate:modify.2022-02-16T15:21:59+00:00..x.....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	327
Entropy (8bit):	7.1140535970703365
Encrypted:	false
SSDEEP:	6:6v/lhPIcWn2ofLbzmoGGaKdwjXI76l4AXT8ctmzXxNuJpTqAp:6v/7DWn3btahecDAuJp1
MD5:	C0708D1E58F1EF1BAB621620F3B09130
SHA1:	0BEB49A1CC1E71F364BCF42B474890F35CB8CC3A
SHA-256:	834380BD8B6F9BFEF000A555541AEC2BEC01DC46C91DCB7F950D109B81BAE5C2
SHA-512:	241C93BC2677B1F0788C2C0DDD9A7FFCCC7A865DAD427EA8C89E437FC796FD12F80D2A962A8D02B1B2391E10CFF768F17E34BD45502A0E31D6E1C8F443C2AA34
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Vu\.....gAMA......a.....IDAT(...On.@........=J.&....5....8A..M]{..s......Q#0.7...0.......yr).q8..s....sp.....W.u.q+..;\|.5&..n{..{.............>..".^S......#q.6B...4.t....~e.[@B.&...L.o...h..8.......Q....+..b.i..MhxRaG....Y..F....,......G.E....`(....V.v.4.b.$..S.O.....Sh.B....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.591404605834916
Encrypted:	false
SSDEEP:	6:6v/lhPIcE/6TsR/nQV32e46OIoiMr6FRK7MhtCxllbp:6v/7DE/6Ts/nnPIcr6+ozCjz
MD5:	F79A1953A8E6CC342847B4B00DDBD736
SHA1:	9AC411CADB6652F4FDBD854300ADCB5C21C04BAA
SHA-256:	4F8EF204C1884F868866D03B4D11DF1237480C1CAA38ADEC1C13444050105B88
SHA-512:	DFB54D3D20FF53B867328945FE3D69B56055D5861EFCE2A069653B1792A5477AB4C3B73A3DEE82DD1377D1573099AB70C2F6C285C694DDBD0B1EE9667CFC4F2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Vu\.....pHYs.................sRGB.........gAMA......a.....IDATx.u.... .DW>...>.RRYJq>).>\|E...!..3...t...a.?..w.!.P..../l....2....Q..ZS.%'.........y^.Q..H.T.V.D..W]..t.*X4t#9O;......=U%u0...f.......3`...[.S^..m..$..?[...{4.Y....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_error.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	428
Entropy (8bit):	7.367179920202989
Encrypted:	false
SSDEEP:	12:6v/7iIHbGI9XbxzlcdqzUCOXC5pC38WWn9:eGIrzlcdL4CZW9
MD5:	0EF65600F5A2D01876B6F9EC668C9D2E
SHA1:	31F378D2D6BE62F3A426523B1AA3D61323B2B9AA
SHA-256:	17DC5C3BAA1D35CA60C7DEE7CC70B76446765769960FC5D4852E065478C871C4
SHA-512:	7D9EC74CECF8DF49D4F8E676053573798A029D889E8676CFE90891EB68E49A2FE9AE828F38BB99851888B25A76581EBE2B62694D3C66D193016B4446004A9271
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............H-.....gAMA......a....cIDAT(.uR.J.A..f..&Q..*....h..... ...(.........K...!Vib...B...qf..{.9....\|..3C............@..........5..8.b...z`-....s.ID..G....PEQ.;?1...p.h;..z6Z..4.X..c..$E3s.b..ry.\|..yVy...0.Rr..W..S.......A.1.....s./".j..g.H{l...Q....d................fE..;..'+.).j.F...J......~.s..Y./...6.v....\|......,...m..[m....n......D.E.OvU.n..W<.m..=h#.O..Zm.yj..@.tums.....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5361
Entropy (8bit):	7.956335361585333
Encrypted:	false
SSDEEP:	96:tXYxwio7C2guemm5poLpMmjxiN4f7DsCk7RkuxKBaKeVfGJiQmiMQ2qileA2I:toxpo9gKmsMmjwSXgyLBepQblA2I
MD5:	0D8F8EFEB474FC9B2C825D7F2A875471
SHA1:	ADBC30FD0131A01B3150753C7EBFD6EF648F0DE1
SHA-256:	ACC40FDA844EADDF65B9580C484F1FE2E17358B352D99BABC6865BF0C74D9B00
SHA-512:	90FEBC4B2165D37CBB1CF09295CF2F5B5713DD14A02CDC101318426CEB55D35B7C47B254D0F20CCB8297FC69EE77EAA5969FF98A0965D325C94AD81B6A56BA9E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............9B....gAMA......a.....IDATx...xTE....I .D..l,....(....Q.\..ftf...qA..D...?a..o.#.8..<.9:....A..."......KB...?7...M:......}7U..9..N.s.T..hZ"%$..@B...$$..@B...4!.UYY.E].Ln.%Qu.K.8....Z+I..m...m%v.6...K..]ki....W.}.y.%.O.1"dY..5...{...x.ef.X.~a..3K.u.l^.8'..?.z#%.._.}.yT..Z..k..b..3{.{.>W_.,x,J......LM.T.>.x.....^..c.'...8^..(]...z(..._.......&..w..9..)..W.,s1.>.):.0.4.Y...nq...7....;......7)Xk.a...O...g.l...c.^..)8.%.e...h....U..7.O.'$.....]K.r0.Y5u..K....tH?.NSzwl.o..IG6...........X.(.z-.X....ju.+.Jpd.j......t.>...../?TW.0u..7........@B.. ....yYZ.iZ..:s...}_X2.O.....1kJ..3..9+... ].4.Y.2.....r>hM....}..-..\|!d..i#U...F...Dr...5....D[..]..u._u....[.>.{5.xX...t.\|L........}?........J.H?P.....M.n....-.......d......pQ....3..[...;vT.dg....5.@..0...[.c..1...U....i........a...o..[.PB.....E..^......."\|........$..."V....tZ..`W...[...z.1..[~.Buu.[.........]/..x.(.`Z.A....`p...]RR.4u'u.]..u'...p..[sh..w.....g+

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2938
Entropy (8bit):	7.909981061900822
Encrypted:	false
SSDEEP:	48:nv/69bTJ0Ji4hnEhRHzXJH3ndGzDr9zHUeqr7zpiT7efEgo3cRE0+U9sLBCYv2ZG:vSdJN7HziDr3S9i/efLQcRZ9sowGdK
MD5:	65938FC9439B2307513A95D515BCA1F7
SHA1:	DDDFE8D64ED371E973C46B6726B60BB0C0810BF9
SHA-256:	B2703E2E2A404B90EDAB7A67B23037C32BE2780F20CB15FFA6F6E44666B8EFB5
SHA-512:	93F755F5E208CA08955684D7789F6B8AF49F542DD41AFD9D678EC417CB535734C9C8182B87EC2EA8B8AA9FA502AC8BA90E383A9977F7E01BFF393AF0D1F400BA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............m......pHYs.................sRGB.........gAMA......a.....IDATx..\]R...o.T.yZ.'.8..y..f_"N.8.....`N.r... '.y...>,{..'.}....n..%[..!U.)..\|.t...G..O?.. .~....@.N...a;..e.....1}.?....>.Ma...>.?..u.}L...m.N. ..8.>fe.z..dr..u.D.1.R<.....T..J.......\.ZP..V}....M?...2..3.....)...T.yG.4...kO....t......b5...-....4F].q%c...-....v.2...O....g0...g.&R.2.n..<?P.q9.....+l3...X&T;...z."L).12..D..a.G3..OQ.Y....%..P.=.....2....%u.}4.(..N.!.)t....w...M.@.0.pt.a%..N...\|.\|\f+H.Rk.?..G..v.q.7.5.'..F}.....lm....rS[.4..F2..R.-..V......AU....!./.\S;...M/..K`..w...>.f'm..bf..y>..$D@......1....3.>...Cn!.:.........C..-.PE14....$&}..?..I...._2.m.<....L.<.........92.p......jT....%.~..Q.U...6.4/.U..4L+HK.\i.z...Au.@>Z..Y.....kk...pQ..!....\|..1g8...Uc$.....Y......9.....`0t..p..(...R.N....w`......\...<......M....-.95.f..W;xx>.7"..'..._z.REq.=e2..bg.S..r..VKcI.j.....\.O..T...q.>....H..6AE...{'?.....w.X.J...w.d.......O%..-%...1*.53..NPB.O.[M./.:..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2517
Entropy (8bit):	7.899112131446941
Encrypted:	false
SSDEEP:	48:/O/6MOvIltQSb2EVW6+mjuOR6aPFUCJou7qDnUa+oNWsYFKaUCBmb:2SrOtQFglR6a9U2f7qDMoEh7UCU
MD5:	C5FFDD4032AA96D998DF4BBE0DFD49D3
SHA1:	46BACEE7C5C587024EE25C2E900C7580B1F12FF9
SHA-256:	010AF7BF170A9355D191C042768D37E4E8559EC4384F27EEA39A79C4BD1C3AE1
SHA-512:	BD89D324B107FC6B7806B3E5C098ED19C7D19DE47430D68C903F632A4471DE2C00B4290F306366C51EE71819AB8E4C9897C4827846EEE604F7F6539DCC38B6EB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............`./.....pHYs.................sRGB.........gAMA......a....jIDATx..Z.o....YJ"...[$r.(P#Fc.\."...^E.....=.:....@.9.....d.^...S4.6.@..D,."Ll.....Y..!.T. z...3o.y.W.....O.yrq....b.l......u.z............O....uZo.]..A.xu1....M..c.+!6.N{,n.P..{B.<.....9....~.W..z-..#.1..q.7p5.._%ja....w..\.W..H..........By.%.?....CQ.Z...j......bV.f.....c.](..6..d...\|)..hTe6.O....X.\.:q....^.I..fZ.y..q......}!.....v........U..x....].e..o...P.]...u&A._........c.<...P..3..cO]...z...:bFh.~....`......1V..&.......4<..{...t....S..j.S.s..Q........'../..b.PRn..P......`p.......@...8T.P.Q.R{..A.\.).N.i0...+.=<9...k+K..vz.DL.M.^.7......O.. .o...@... ...wU...m.3....x....l.\|u-...2.M.N{^i.d.......s...R.H.`.09.;.....U:..c(.D$.N.(G.P.2.....T......r.W)...@h..1<..CI...<........M...X......$....[S..#.r..C3..y.R.P$z..).n....Gy.W......d..H{.3.q}....q....H..T._~...@..5....U......n.......1.)..'.M.x...Ab...x..=.<...&.x...k.q_.4#...l.6.i9.;.C.9

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2146
Entropy (8bit):	7.878767198815235
Encrypted:	false
SSDEEP:	48:X/6uYit83CnCOqfU1paiFTeUpKJX9+E+orrs30ocDx4/OcrG1:XSXi6SnChfypRFTBpu+E38kNxKOcrQ
MD5:	39D8F472934136936FF3FEE841245A9C
SHA1:	812281447AAE48A891F8A5FA9CA63C117E5E9ED1
SHA-256:	DA9F72BF2AF97A5A1D5C8884F8D5BFB2CF232A7026CF9123E02F5909AAAD2F70
SHA-512:	7C3791E59F161A31486E36F6FB6A23E0589286342FE4A11D9DCBE975194ED0EC0EF223478072B2360E3CA276D6BA5BE0C4E2FE64FC82BC646945965E03556447
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............-......pHYs.................sRGB.........gAMA......a.....IDATx..Z.Q.J.m-.....G`9...?..".C.^"."@D.D..........8..........>==.HH.k1..v..y..zN?.d.?..nA.?.......L.M.o#...f.GOK\|m..O...........KW_.P%....k.X.........;.v...\|.\|..KH.,.@4.....d#+{(WcN....... ......C..).CG~.g..M...jQ.y-S.u.}FA....4........b..9.&\.../)=&.3MY6Mc.5.SS.r.rI..NX."Q. .;PH.@..$....3l.(.1.x..\|=...CE...*......Q~.J.......r....d.$.9...\\D.x/..;.%>,.p\|.EO..].4"r..i......D..Z..%.-..bQ....m .~...k.a..n..lR...>p./(.f:-.k..lU.!.7..]Ut...~\9.....@...L...\|...h.W..R..e..PV..vt.x_..I.h.4...]<...G..K.T.V.)...w.....,fv...^..)........)..........Y....@.8.....[..\|x.wYYW.9.X..C...p..nP......p+\|.-.q.F......>%........FL..s..?.J.%NH....;....b.dy.HN.13^.y.3`.zM.0.....u[-.....A.\|e...4..P.3o1r>.y.`.gM}...H.R..;..F...<.zT..T..[.+.P..Q.>QS.Y..aN .>.....vc}.?u}].c6}..y...y[._....Z.@....P..o.S...^...yg......h....>.jB...+.1?.&V..V....<.O.......\|uX...m...::..9...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_logo.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1627
Entropy (8bit):	7.826159192497283
Encrypted:	false
SSDEEP:	48:3F/6TZYDTDiZweTZamTAaTJ6r/OIQz5URWkUX:3FSCXi6elamQ/Eb
MD5:	E6797831954D0AEADF1E7CD268F4BE8D
SHA1:	8CDEAC8420271C46DB443A03C58AA2E039EBDE50
SHA-256:	9EE5FC5E12400AE65711B9B664E75EEB3273C051E29FADF4FE2104B59C89437A
SHA-512:	EB53492D4B7BF87E09D049006E8759A87C4062950A9F88A636E7B7469AA5937DAB463DCA22294FE64A09DFDA19BDA711A6160E7762F147E5D2F5A95E3EEDE984
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...d.........{.......pHYs.................sRGB.........gAMA......a.....IDATx..X]n.F..%.@F.V)b[z.OP...O`...O`.H.j..h..>A..X9....A....E.Kv..H....7.%..(J.%...@.........n..DGN.sH......B...w[Y..R.....]..'......3.#...+........q\|..)......$e.M.d.;..w....^C1.Z..h....O.o.X\|\|.,.&A.....>).vF...p..S)e......./.y.pW.Ph.Z_Hy.h..LG.{..,.b..4.."~].qg.Q....(dx,..5...sFh/.n.0. ../....y....K.......\F.R.....R.. 8z+....7 ....[b..dS.^.vQ.X.+.B....W=n.b.m.,..q.?...<....l.H3..V.a....r.V.\|?XP..t.E$._?..k..[.x.].E....5....^y...b..6.9.u......e:....<@iV..-C%W.....8..C&M.o....!?KY.\o.6gr.j....../......@p......r&C....D.v:....[k}.X.l.u:..vv...Ve.....:.....J.@.~G...^4.M...4-W%....p.z....[.D.J....0....K.K.Lm...K....@J..vvgd..Iyf........O''...%....MS....V..2.\2-..O.y.iLe..x....k~~.Z..6.H1.h.@:...;PF...l\|...}.\|v..)3..q....nw...6{...i3iM......}pe4..\..... ....d.]....D.`.a.C....FD.!/...s.4%.I....\|S....-...nK...D....&Ov....a:H..V.&..."\|.......:#.S...\|..u....H.:..../...a4j

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_increase_bg_left.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	46909
Entropy (8bit):	7.985537981297596
Encrypted:	false
SSDEEP:	768:QMJyYB6qa5O8KgieNFdjfsA8dh5+7xOBkgZuC02S11anRxHsogCdCsf6NL4EqapH:QPp5LXieN7Qdz+7gygZuC0B11+RhiQCp
MD5:	B3DD8F8E04608CC298018AF91FC7A0AB
SHA1:	6EEF374ED0D7A0E6AD13531186D896276370B943
SHA-256:	E056F875F8782046646E871CBA23BD89BD7926D2397CCBDCDADE5E75D5891148
SHA-512:	128D618645427B816C6C68D0B72C6EA0815771E3058C14A37782F1E6EDE9C6E0000727B4E8F54913A516746D9E17BDE62289D9A8BAFBED1F6A5421BBC475FD0C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............&{.....pHYs.................sRGB.........gAMA......a.....IDATx...[.-I.....s.s.S..3....4....A$ H..(.A&..7.z..h..IF.... .^.LOwWWwW.s..p......AT.2##..._xD...._..../.#.?5......S..G.{.....]..-.....:.......>y..Be.I..F?..E..]........<.zmM?n;_[...8...)...?.O.%/....39;.b...@?]...DWpL..d.Ua9.\|.yoq....Wu:....5.;Qt.4...9.0..Zt".fPw....Rxg..I...R2.U.C....fN.i.H....L..J$.v....3.bnoe,..g01Y.K..._'.dA......o.{.!t]..G..2...R.j.hF.Y.;ig.Q.....R>.1..P..\.#.G...9..L..........Su..4?..&...0..U=......Y..$.T..F..'Eb-.X.Z%......g.....Nv.]M.......\|j.f..}..!.<.....Q.{?R.O.&.e..h.Q..)9.&}..:~Vd......h....3..,...%.o%....4..0..]...S.~v.....&9...r.hi,...p..U..<..jq...8..T-5....{.......IE8.c..nV...^.....0f..%..1cG.....s...j....eo@...d.W...j.\|L.......I....m.2M....`.&8.i.a..L..j.........j..F#=...-.@...C#.aM.......b..<.<..a`3IP......ee.r...jU..&.d.;.P.P>3;u'SI.6.....C..86n'.7>.....a{...s..y.>.z....e...\).G;..S_.D..._.\|...'..2...@..JD*

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_bg.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	69604
Entropy (8bit):	7.978415362384725
Encrypted:	false
SSDEEP:	1536:QXPNryf1U/w2kW7qSIxd1+2yfystvuxnkyWkCE6w:wxyf1ewf2N2SydkwCk
MD5:	241BC522B02EF7A35A2CE7E1185265AB
SHA1:	B4DE10905ADCBE62C1ACFCE168F91B614CF21183
SHA-256:	5C7B6C5A87A3DCAD175D9C0DFE0D885BABF22227B5BC161E7C478779AAF2AC30
SHA-512:	4DA6920BCB0A57CEEC14F68058912A1785E434A1487EC8B7DD6FD6EEFDCB50A7E17EA25995CD3844D7964851068D3C22F56E8AFBF737ADB0AA32D3AAD11184AC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...5....... R....pHYs.................sRGB.........gAMA......a....yIDATx...,.q.x........9.G9....h.(..Y@....@r`.Z@..$...t@.X.p.`....U...Df.7....y...2##..N...........p~7...o....M~.m.:O..m......K..eg..^./...A.g.{../u..1..F.v.u.w..l......o.........p...K0[\|......5.y...e3.........e.-[..r.3......4...H.~.S.te.H.^..!....=....b....O..M....v....e5........a....hR...._a....o....%.).F..0..<f.F.c.....Oi.$q..:...."......-[.l..+".}?SUgq....f~.%..@........cF..0J...r..,Q....7H.#T4..g....:N...l%...Q..y.1.Ro... ...I)v...6n..4%l.....c..G,..9}.q...g..-?......e.-[..b..;..w`...#...u2.0..).........P.......I.5?.....i:f5M.m.S...2"i...!......E.......`....f.;..i4.di..\|C+I..Q.z...'...\|..W.e.-[.D9<..oS).sJ. F....A....a...I.]."..7..1.1..&.S....U9., ..(........b..J..erz...q.b"......3.e.`0. ..25w.L.U...#..L.38z.c.....~.z.c...l.e./Y.....L..og.1..kR../.......X.b.X/..bf^A....\|}..N..[..l%...'G.4.).~U\|..Mb.-.cL......N.M..8.h.x:\|.>..j.2......#..'

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_bg_v2.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	84857
Entropy (8bit):	7.9803219968216474
Encrypted:	false
SSDEEP:	1536:CaRkLhrM2oTVEtv9ES5L6+t1QLtb3v9hPi4Aumb5AVU4QtOWjal9U9GZnf1eT:8Lh/oTV09ES5e+tAtb3jPIumNA1H97Tq
MD5:	F038158CCF02E238051E916E68C43F53
SHA1:	81A63F396EC4593E1BD0CBEF520C1A40F4D35D50
SHA-256:	4AB364638C2771DB7C9EBBD40E8EBCD1AC7C92A9D4D08E616391831426B01C21
SHA-512:	98DD7A5C127FA1D00DFC84EDE548E4D4CDCEDA3F7C97A2815DAA24858DBCDB230E6FC6DB82DDC31E8F96467B141ABE402FBDF0BE86F9602444D0A4790C20EE9E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...5....... R....pHYs.................sRGB.........gAMA......a...K.IDATx.....u.q..UM......'..Y...09 u..o ..... 7...B..9......H....!.$#.#...(..H[...$.......T.......?]{..Zk..S.s..OU...........QU..{......c....CY.c.S...N.9=2.]p.;....}...>.^...+.)]..u..(5..W....$.{.@u~\|.T.....(.].OK....&{;n.....b...... \#e......\|.i.e........._\|3..9r......e...mx.b@&....e.[Id..y....O...\|.R..Z..R.r.p..).........@M.[.q.W.x....a._i.B.....~..........'AF.......V:..p..>Bm.6........Q}:..C.X.y.&.j..Q..m&..:.....#G..9.."..w..6U..,pR.$.=.\#.A...:.......`Up.V...5..,N....)..V:.2....Z.b.>.....3...s...#.n&....(-`..4f\.. .....r.i.......%.a0i.UXjAMN.._@....y..a+~...G.....#G..........g.m......qK.Y....h..r.ELP#...%P..,.%.o..7.!i..I..nt...4..N..k7..:48..B...T...z.~p....l.d.}.JP.Iy....AF.x...w..R..2.Zt..!H...32/..L{.8>....7...8r..#G>a....1-.r81..........E%c.d..$..+m.7...A.0.{f.....@.P..@..J.T..=i..X.'..X..d....(..5....@Z..v....>o@$...BK.)... .b....:.....J@..:.@.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_good.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9327
Entropy (8bit):	7.970469640393894
Encrypted:	false
SSDEEP:	192:5SAlgBGtPGIcDO3cUWjPvAiL8zG3vRG+e40rH9qlGIKZSA:gAlUrs2VP3vRGcUHwoUA
MD5:	F88AF81EA6E8672EDB7044DCF877EA91
SHA1:	7B51E57EE82590B5B22F03D0E88A10A7B0DF4993
SHA-256:	CE6BE399C30F141E790638A21721D0040C415375C1E2E79BAB0D3A5E5895D2FA
SHA-512:	C52923E9563FEA752297AEB14E66246CA1DE3240D4F7F659177EE03295698E32BD38D76F5F7A95416727A12B29D0154F03E98C6EF91FD7B0F0D32DDBA53CFF5D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a...$.IDATx...x....3...5q.8N"C..p......r9.&.n.1.eK).dwK...;...t..P..9t.8.v...$t..e.@i(.8.$%....cG.J......dK.l.F#.N..3.n...........<y..-H.s.r{..RD.Q$y%..c.+.... .{$...^.E....].I....)kZv.8dS."I.H QA.pdw..$C...$.k.!...d.$e..E.x...3JXJ.J..L....nvQ...t...-...$..7mE...Wk...Z......6.....S.....w.....w..p...I\|.8...e..&.V. ..K.0&;N$.<...kwN...#,.F.R.@....z........w.....'!l."..BM..R.l.%..-.U].m...&.{.....yFjE.Q.O.B.;.;....u.dnq.......U."..ZX...~...m..z.o..3....%.5>.Rz.....k2..&...Sj.?>D.R.(.I.$:1.......^..3.bc....O.9...:.%0......`].J..Z`I-..b.a.y..\|W......v.6..M8>.E.zaQQc../...Y..b......S.6caE.UOBr...4z.f4m."%..{.UjdY..j.,.....FL..rM......jQA.Zp...F.p....\|.h..z;......!..q..e..nz..Y ...?Gv7...%..._.-,vu$.....\|R..........X<$.....A.2r..T1Y.......z...eWIb../.l&..%*.]..d.}......V..l..A.....:.x.K`.`{........]...puz.4...$......b..:....B....oX:...q..[...39..&1Q.B...Q1O<!5......&.m..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_red.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5806
Entropy (8bit):	7.947492621878631
Encrypted:	false
SSDEEP:	96:5SJ+1CjtZfXEe5cDU4mBmhX1HNx6EkdEQ1Qqx49JrywZAtwRygSHGkJWWPTupdgw:5SJf/sUMhlHNx6EULExytHRgdgZ+
MD5:	3988A50B6D996F6455E9229A53E1DE2A
SHA1:	094BE688DD8DF4CB8D355501EB11A4FD335C11B3
SHA-256:	1B081F386B0FC37D1415F9D38E71C43F60E2FF493688048DF9CA4ABE65683782
SHA-512:	CC9ED3FCDF6D0A48999B32871D9360F68176ACA3E7C0CE0F4C37B1362DBE6E1BA6E5CF0706AB6CA8CF756AE740D5C65BCCC26457CCDB549CC3B17AB0FF0609CC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a....CIDATx...l..y..w..d}Q.,.#.i)..G......t.vp..N.tM..v.......t)..2.bC[....[.$..,.....4H.M..n='..'...m.-Y.......</E..(.w<R$.....#)........;@".H$..D".H$..D".H$..D"..E.H.#}...l....5.....(......4.C....(>..A..c.T,.A".s.....(....v..F....&......S.....B..Co-..n..$....b.7.auk.2GDl!M?D....bA+..y),...J..#m.ux.U(^.Z+..W.Ydy#,....[m6l.>1MEDdA-./.Bf...........5y..@.@.....UT7#..Ya..]..l..q.dQ.......E^.(9'...T<.WU..(...$g.%.;[..j m.".`.."sBX..{w.z..:,..\..Y-,.{......S....^-.....Jaq..........$..+.#..`Y',......:...L..M..g.....;u.Ms;.2Jv.^.....=...2..VUg..."f.D>e+=..}...M.qV.....m..l...K.}pK.YZ..f.Y...U.Q.4;.v`.....2.l.+...J......zI1P\<..gI\.....9...A=v..._.O._...^W........B...>#..3.........8$..,,.........}....2"..@.......P...t.!A.........~..a<\PQu.. ..Ly. ...u..?..G........]...G.31..Va....B...dfXTO......d....3.6..i=.6mc...C..df..SY,......r....Q{x..L.e.9...$q<..e./.,...FE...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_yellow.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6192
Entropy (8bit):	7.953945165570691
Encrypted:	false
SSDEEP:	192:5SzpWPgS9/QQi/AZsf5G9qTxAS58Eb9hXXHS0gg:gzpIQQVsRG9epGEb3HS0gg
MD5:	B034C9F982264AFFC7A81122732ADAF2
SHA1:	0DA8E840BCC6CEDB79E2D54697ED25A3BA8147C5
SHA-256:	D124043692362003A48C4DC875B7014ED3AACCAC452522B32C5BD98E253354E7
SHA-512:	48239CF4BFA708B7BC7A46EEE4F692828C54D4E0B887D2C38BEE60A513007363EE4B54BE409B59EF72EEBC76398BD3FDED6AB493958D1E660BCB048859E0928B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a.....IDATx...p..y...w..tB....d...#.U.9<.....L..uSd..t.I03..t.E..g.4.q2.4....$...Wl.d.....;...... .I:}...y...t.n.vo..7...j.........}.]@".H$..D".H$..D".H$..D".\.(.@....Oi.bX.U.A.........%}....oA...=...T.KZ!.....C8.'.]E/W.!.E..ZZ....VDB.Jec...y/,..\...RWSt..W..3.......lq...V<.y...]...m.4JB...*...........d..&C.Y8..R.......N..Md....+e....;....9N..+..5...b...rNX...f.;9,...V^G...A...)W.m..+/...b.ZXZ.gu.!.Zy..._m.R..1d1Y+,m...D...K{...q8.&[...,.......D..RTS.....X..nB..U.K....n...U...,"k.%S_.dYj.T..}.E..4.(O.^D.,.qa.?u).;3..z....8...xR)Ai..z\J.R\|..8.#..Utw.6(..gV~..x.n..8....2....(r...K.?)..A."'..T(.:.0$..5f.B..E,QR..r.%....D,......<$."......b...%.......u.oFNp[....G}....M.Gl.....<.-.C9....1x.Fl.X....L...~..%\|....n%i..[..F..B.G....a.R....@....@U..F..a5..5.......>.$5..kq..)8..K.p......fl.c.B.~.z.F..bb.L.Y..^o..x.i.A..H...O-.X....[.^......u........yr....iC.F7..~..a...=...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_check.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2902
Entropy (8bit):	7.8683772202551845
Encrypted:	false
SSDEEP:	48:i/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODW3O1:iSDZ/I09Da01l+gmkyTt6Hk8nTb1
MD5:	E4C0EC02D11F61DA1A702B0EFA2EC744
SHA1:	F4E64300F14D0BEA27129A72BE91A668A9B9FB9E
SHA-256:	2AC30B35B0BC163BC18B3B4B2982A6EE4095202FCF2EF8E35BCD415D8FFE04A8
SHA-512:	6E659358DC715D700E4FB9BED2B8054408D3BD79AF8B492D6197D53038990AA12558957CA9C4BD436D83C2507DF165C55F2F0FB4E93C13480DF932E58E16EED1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............".L.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_downchevron.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2816
Entropy (8bit):	7.867254837776759
Encrypted:	false
SSDEEP:	48:/h/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODM:/hSDZ/I09Da01l+gmkyTt6Hk8nTM
MD5:	59934A5C534B8372CC2ACAD83B1F55E6
SHA1:	8285F5654E3A077445E73685ABFD638BE7F1F4C6
SHA-256:	130541A07A3D9E2050A6AC15D659E29A21F080F6CB1D7DB2800255FF94FD8310
SHA-512:	37D1BA15D460F33B62FEF40B32DB95F136C268727AEF5ECFDFD3ADA471D26C78FE89438D0BF13FD966E19FBB7A9E06BD3FA27DFC326AA42699330145AD634BCE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............TK....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_exclamation.gif

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.513362384873133
Encrypted:	false
SSDEEP:	6:772Q1kVEn88d0e6FEVU5drwF0cVe6FEVU5drwF0cVe6FEVU5drwF0c4e6FEVU5dH:772LVEnl6FEC5drwns6FEC5drwns6FEM
MD5:	BFE2AF9C7C0433C86314783E61A437BA
SHA1:	4CB221B2CC8ECDE82AA813C3E136DB749BFCE3A1
SHA-256:	0DD3C3D9570BCA1ABC663C5E301B9CC8025F92EC0C12B6781A8A521663A8DB75
SHA-512:	22E3EBE60BCBBFE6B728885CAE1B16BDB8D980B1AA80F931DDAC4020EC13CB7F3AE80CCD0A1A7465FB513D1AC70AEB59B12FB5E88CF6EC809EB178CCA2DB5405
Malicious:	false
Reputation:	unknown
Preview:	GIF89a........2^.q..Aj."Q.a.....Qw................E...!...2...,..........#p..$.u24.K2)....0..d<..0.....h;.3..!.......,.............I..8.m#.!...2...,..........#p..$.u24.K2)....0..d<..0.....h;.3..!.......,.............I..8.m#.!...2...,..........#p..$.u24.K2)....0..d<..0.....h;.3..!.......,.............I..8.m#.!.......,..........#p..$.u24.K2)....0..d<..0.....h;.3..;

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_questionmark.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	391
Entropy (8bit):	6.968282594262006
Encrypted:	false
SSDEEP:	12:6v/7Y4njM9CusK7SWlR4oPfMrjbi7voD7:0njM94QSWlR4oP0XbVD7
MD5:	A85D5FA023FD935DDA508A42B9DFECC4
SHA1:	2EE82A16CE7120CB2B211A3502E63023DD011C4B
SHA-256:	A47F084F275C50D52E4E74E44E554E4810210029337B13DCE3E98EF29FDDD35E
SHA-512:	1E07CC1A5CB220AE4C3FFE1860DA715C2C9E569B79A61818B4FCC2EDD4C9C6D05EA597DDAAB20B37950A005B642CBBF995AE809C0774D2D8584D87D2C366BADB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............&.....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.10/1/14........IDAT(....DA..._.V.%D.h.(x....(6^.+(<..3H4:...S..M&...2.w.f.w.sNf"...s....0..6...8.~.`....u..(.0pU.~..X.&Nq_xn".6:..a.......SJ.6("V.u...H..]....\..X....k5z...Z.q..X.NhR..X,f.....Y+0...jhXC)..`0X..}~..&-..J..>.:@..;.......IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_timer.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	449
Entropy (8bit):	7.31532155890383
Encrypted:	false
SSDEEP:	12:6v/74/6Ts/MYcGVkHcafQ2ueaTxpJz8mbEYST43v9u:x/6C3VkHnQ2vcxputYST43v9u
MD5:	DE0508D8669FC70B4D92B58076D288DF
SHA1:	AE206B763654EEEB4457853BDBD46A510A693ACA
SHA-256:	2ABBD585797B5DCF4CFE7908B5325E51CB5A0A5EEA117723A78444D484C1B269
SHA-512:	212BC0318562BED2CEE66C6BA4855F9F4A6A69125B869859AEE7BDC3F08A02EBAD9C6F5C432E6DDB3C091E4D8796FCF56AE6F2253A0C40DC2DDE7F97F49B3413
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............w=.....pHYs.................sRGB.........gAMA......a....VIDATx..U=N.0..R.....J`.1...%6...#p....M.'ho.#.7..ea0...M..8...>9...s...=..~....+..1.....R.-...t`$.si=....W2...E..,...$gh..{.j....<.T[..O!A<.?..&<'G...!.M..T..\|.@H....N..S...K.8.Z.p@....\|M~...(Lc.........).......E.....#....C..]sxlS.}6=....~.._.?.;.K..5..)r7h..nV.E.).=.F5.u3.2i..)`......*.....$@.}..] .9W.7......8w...y?....r.OW../c;.v.^.....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\women-on-laptop-features.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	35407
Entropy (8bit):	7.981941276020834
Encrypted:	false
SSDEEP:	768:EpdvcuDHkWJh2y4Aw9aT1hHkXQmyDyrXl+diVnF62TdD:CJx07ihcQml1kilD
MD5:	60A3D8470E34C3481A68B76078BA192A
SHA1:	8789F29DB3FE5FD262B2B68D8B98FF9BF153C19B
SHA-256:	1D23EFAC84950F046E1D0A7E9D1F483BDB73655023832071EC98314A690E651B
SHA-512:	A5EAEA04EAB134EE4722A2F5C756FCE51B4897598BE1152958E6530FB5C952AEE0A7D4FC34590EBB9480A7EABB73D640D41B695FF2F5110476C19B9312533762
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............hr....pHYs.................sRGB.........gAMA......a.....IDATx...`T.y..~..i.K..16`..68vj..nv..'...i..M.t..z..l."N..v....mZ......8.n....v.....Kl...s..y.....@...y.y.3+.{..}....&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a......L...+o.5@9K....0B...Y'.01.LB1A....... ..w.\.)L.F.8.2.}..!2a.LB...r..A!..B.M8..4y..2..... .W4LB....%."-r....)...!sb...n2qE.$.+.......l..E{"+......P...l...U....G....[f...Z..`....vq."._.N2)....b.k.;......LT4f.L..i.8.>R.`)...;@&.&.T0..c.O....C..4I..a.J......Ds.L5....{.?C&....Hh..F`...t.m.h...H..R.XyS..n.F...;,.t..M...(O.a....I.B..Xf.T.L....Ms.L.~.%.J&.&.T....4/ .d..`.J....y`.( .LT.LB. ..D..~.s.DE.$..A.B....zx...;..q..$..A........g?.....$...AZ...4#. ....P...;..D..$......... 3...`.J.@JZF..R.&.T.LB11%X..j2a.$....&.o}...K.q,.n2QQ0...eaAs...i..~W..Ky*.R...0..R).4L3..L.L.^..}..q)O..........,PI3..d..........Qw.<...V...i..l!..(....R

C:\Program Files\McAfee\WebAdvisor\MFW\packages\edge_search\edge_search_events.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	5.664005286911799
Encrypted:	false
SSDEEP:	48:RRlHOu3OOVO/XYJ8ZcS0JtS1MCGxMa5hekjPGm3kqZQuoS0mQQ3T:RSu3OOofEc8y2xMPwum3kqAbQ3T
MD5:	F5C03EABDED1332D7F1734EB80A7687D
SHA1:	564B7231455754EFF599F2E94DC3CECC538D9BF9
SHA-256:	370A60D4ED6197497F83E4C121EF74A7A36D7A99D79F762AD14A08566B7873BF
SHA-512:	56A5567D719CEEA977C16017A23AA7D7A1451AAACFA24E1947B801F1B0EA3E1EDAA1951C89796C29CF2783EACC9F2159E09832D83315A6514A9AFB1F26FB2AB3
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...9...9...B.......X...6...9.......9...'...B...)...L...6.......9...+...-...)...B...L......GetOption.settingsPpackages.edge_search.search_ext_popup: web view is not enabled or installed.info.log!is_web_view_installed_and_on.common_utils.utils.corev.......6...9.......9...'...B...1...K.....Cpackages.edge_search.on_search_ext_popup_coachmark_exit called.info.log.core........S-.......X...6...9.......9...'...B...K...-...B...6.......9...+...'...+...B.......X...).......X...).......X...6...9...B...9...'...B...9...'...B...9...B...6.......9.......B...6.......9...+...'...+...B.......X.......X...6...9.......9...'...B...K...6...9...9...9...B.......X...6...9.......9...'...B...K...5...=...6.......5...B...1...K...........balloon_type!edge_search_enablement_guide.tooltip...ShowUi.EventData....onExit<packages.edge_search.on_search_ext_popup_coachmark_exit.EventData..web_view2_ui_templatecfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\edge_search\edge_search_ext_coachmark.html.UiTe

C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\mwbhandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.878358931842105
Encrypted:	false
SSDEEP:	48:920riK5mljJJVdRquhrp6G5hRCmkasNfK0xxPUCgc:PriKOVJ/RquhrgGHRjstK0xSS
MD5:	F3308533582DF76AB419DA53E38A3B05
SHA1:	29A00EFB047460631E4743432FBCD3CF29A19FD0
SHA-256:	3874AE45E962A077C7FB6368062238D6F6833366AF9A640BDA9A1996CBFD83A5
SHA-512:	1847AEBC1316E70F2B15DDA11E21A11B0BFDD5B387C51B669C465E8D229EAAA2B5C23A6D0FEE68428A212651EDE65690B4A4FDE5D72C38A246C02FE6164BDD81
Malicious:	false
Reputation:	unknown
Preview:	.LJ..:.......6...9...+...=...K....checklist_showing.mwb.packages.........5...=...6.......5...=...B...6...9...+...=...K....checklist_showing.mwb.packages.checklisttype....checklisttype..ShowUi.EventData....UiType.mwbChecklist.web_view2_ui_templateGfile:///[WA_FILES]/mfw\packages_web_view\mwb\wa-mwb-checklist.html.onExit#packages.mwb.update_mwb_status.EventData..UiTemplate2wacore:mfw\packages\mwb\wa-mwb-checklist.html......$...9...6...9...6...9...9.......9.......B...A...6...9...9.......X...+...+...J.......X...9.......X...6...9.......9...'...B...+...+...J.......X.......X...+...+...J...6...9...9.......9...+...'...+...B.......X...+...+...J...'.......X...'.......&...6...9...9.......9...+...'.......&...+...B.......X...+...+...J.......X.-.6.......9.......B...-...8.......X...6...9.......9...'.......&...B...+...+...J.......X...6...9...........)...+...B.......X...6...9...9.......9...+...'.......&...+...B...+...+...J...6...6.......9...+...'.......&...'...B...A.......X...+...-...9. .J...*...6.!.9."

C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\stop-video-alert-icon.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4147
Entropy (8bit):	7.943867399456676
Encrypted:	false
SSDEEP:	96:rwd191zRv2ElL3+eYGSRCvWC7P4cHALED9gqwptnaO6:rwdXjv2Yz+mbuuZ09qwnaO6
MD5:	96E5352C228F18132282903C3CA79F35
SHA1:	9D7D72FB9134B222D7FFE36811FCC82FAB5FE0B1
SHA-256:	64BDF768575AFA7B3ECB4786F55F67983F5EFA2A8882D1F0131F8C28F646F5EA
SHA-512:	992F49CFAEE0692705D769F906CBCF7479FD87D2506D95DACF198E3457D6AC5A91776C710312405A7B5FF651B8C97CB10DD54B5D86DA202B8A1E9CEFC7D53955
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..._...H.......).....sRGB.........IDATx..\.p.......n...G....D$.b.H).2.tl.Vgj.....L[.N;c.T.vZ:.b[;..C<PK....$.p.B ....{.....mv..Hv...!.?.....{........i.g....~..hnu:...l.B#....4........6t..........$^..\|..l.M1u7$....8u...hYy....#..Z...\|.u.N.?$..#...n....<..O..j....d&.........^x.?.9}...=..^.... ''...J.;.8....]...Lo.\tvtb....gW.k<....._.c.........2.k....NG.....F...FBBB@A._$se@.?}.c...._{......o.l.5%.F....@..:<......._.'.[...$o.....X.x>./X.}.......M......;.a%zzzQtCA..P.<}....B.#..C.7....\|...a...L.-m8..)....V...\|..sf*q.j..RPp.r_s.<..:.am.tZ./.7"7;.{..Bcc..-..7.O......^....Y.i>q#.I.>.[.nG]]..'.I..i.............&..o...uy.::....r.8q..a....1.............y4._C\.nZ..{..7.\|..u:-.W.Sz...2...[..G...e.7q...\......]{QT...w.q...q.....<.}..QTT..^..?..If#..{..ErR"j....^..9..9.=..x%.lCFZJDeH...d.....9........p....>.C.......q[i).>:...7....#!.=.....V..N...;.........O...C........W....y.ts..x..188.GC%..q..G..-PDSV.....E...47.lhh..5e..+....N.\|..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wa-controller-mwb-checklist.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10945
Entropy (8bit):	4.489476408707097
Encrypted:	false
SSDEEP:	192:b4H4SSJczePaYszA15HyXnTMAFdOSVwqA1zHS73j1S4UZ:MYSSJesvyXnTDqSV4BS75S4o
MD5:	BBF031A5962E85F37A61A50A56CF8C94
SHA1:	E81D138FE01A6B9B819D363FA7E5A593ECA37075
SHA-256:	3C381BC8DE8E9D40B2F6A7F79A0F6798CA734525CB895AA89680742C41D7E505
SHA-512:	6AB1D4E9086C1355851DD506F0658A58EE0421A75BDE98EBC577A2EBD7E5DA3A884D3E386DD80CB1A31C38039DB41E662C1D4E784F6289BA04F4F232E5C900EF
Malicious:	false
Reputation:	unknown
Preview:	/* MWB CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.WEBBOOST).get,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. var self = this;.. var browser = _window.getBrowserType();.. var wbShown = "WBShown";.. var wbLastShown = "WBLastShownDate";.. var installDir = _external.getInstallDir();.. if (browser === "FF") {.. wbShown = wbShown + "_" + browser.toLowerCase();.. wbLastShown = wbLastShown + "_" + browser.toLowerCase();.. }.. this.update = function () {.. _window.ready(function () {.. var args = JSON.parse(_external.get

C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wa-mwb-checklist.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.948347035373098
Encrypted:	false
SSDEEP:	24:csYzTlGNVMz7QVMz7tVMz7EVMz7VMz/VMz8AVMzjVMz3EeVMzk5hVMCFqOcO/TPs:3OTFbMv26ITWDE5g2CFqOcqehQORDqs
MD5:	C1D31140B4AB01290D9FA42F5FC63FCA
SHA1:	36A95CAAE568375840E2863255FD5296E9910776
SHA-256:	CBEA69E7A22E965CF121DF415FF7455046F65E3717A2E22872102803A3730667
SHA-512:	70F10BF66BCA1FFB53E839D52EAA1A48405813D043DE1B7ED21E430D77F06EF1F26014AE969209EB1A3A31C8C13CD18EA7DE1D914C8DBA04CD2D72B5C8A62E45
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-webboost-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-checklist-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:m

C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wb-rocket-icon.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	435
Entropy (8bit):	7.339595422017506
Encrypted:	false
SSDEEP:	12:6v/7op8DZNN+N/mjoPou/d3mFiRWpK2NV9V6/v7CFmP1:lwwN/fPouV3mkWvn9VSmMP1
MD5:	17F00098D9F726B994583103F81EB7AC
SHA1:	18DF2437F9019ED8A7E111EEE48E1CA17F3BB19A
SHA-256:	71983847EA4F7014741BD89DDF4A33AF884A7636414E55912077CC00959199B9
SHA-512:	2BD4C0C36B43B61E1544C99E4B8B7C46789EDF91206929EF7EB1F7E5E5B810439D2A673E3EDC200BAC295003D544B9B9B94275AA29D3DDE9F5585E550553E6E0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............-.....sRGB........mIDAT8...=K.A.E.1...&....X..(.....V..h.O.....J.l,l..t.je.."..Z....B.DD..d.f...f/.f.{sov.%.T..a...p....R..6X.O0..;.w....7...,K=V .n..'*C....D[..ds.N.4...W..C..]..}0uM1.. .^...C6..O{.3....8....\...t.#.Fc..eks...x...K.....W..o.}@.N.pH.l..H.E.....ix.....z.1....=....P.SG.y..]CL.p....=.@..`..^..~/.8.,k..5(B.........di.IZWi..t6........&..n.c...4.'..e ...]3..........[....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\clipboard.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	7.943205117846418
Encrypted:	false
SSDEEP:	96:XpIVSotMeomWtuupLHgHzDJhbpmV3G4fNjirxU:mSCJodtwTDJhFu3G4fNWq
MD5:	744E7ECE73DE770613033AF4C28735FE
SHA1:	F7598A712AB76AFBFC8B880FAFA9C307D0942952
SHA-256:	7D324265349E5DF77B3A3A56112E5D13B7A1C9827C4B886205DAB99C279B19E5
SHA-512:	2BB6285603F134BFC6B3B0AA9B4F97B4156D354558AC3B73CE5661988D3A6516528D79DBCA1F82996BC395FE780F41AF7CF144ABAA3CAFC951C0D3FE0A08B165
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...F...E............gAMA......a...."IDATx..\.l\.....zw...^{.qpBB...........KA..Q.P.Am.......j..E .r........P..BI...hP.;.......\|....}o.y.g.1.d.y....7.....f....C}........f..gE.Y"t......I....d.>d..O,r.&.d3+.x%..G.J...$...P8.....FC.4!..0A`.fk.a.n4....A\|..~.@,..'....7tF...Q..C........d....Y.&2..29.HR"..Fs..L.J........<sZ..0..f..[M.A........?w..FcIJ...l..A..l.H.h.L.Fj...+...L.g.....)..x.f..M]mQ&^.Q........-^..v.....n...Y.-.pN`..j!..N.#..?4g_.`>.s.h.?I^. W..E.K$ a..M.Dc.....{..z8.."...40..v.+.f.......C..Hb?.H9..1+.\N./_K...082A...(.%...;H........".....n...=.#%+.&.b`...wP...e.t.......X.......:;..+......../.N.............>o.Jb.#v...>..].j9g5_.....;8(f.).....V..V....J.Q.g.........>.?.p8J...v8..,.$.>.n..aE..;.m#.t.J.t....wkKY>...\Q.e.Rg.....1.....Dc..&EQ4.....t..."......'.?.&.c.I.....I..:.i...:...9..UUg...z..kw9....7;.O..xVq[...s~{..`.SO..E.....n]..gv..w.ib:.F.>...Uhi...z..p:r.].+]...U.m....ZB...P..1mm{....9.a.c...:..l.....=v.g..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\info-16.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	301
Entropy (8bit):	7.008936185757553
Encrypted:	false
SSDEEP:	6:6v/lhPfAlD5bn3S1bu/6BIMYE00yLbOxD/WeahrkSiuBZ4dp:6v/7HAthII3MYEJ41lBiuBiz
MD5:	B437E1CC057558224FEBE4A96FE66CB7
SHA1:	DECA512775F0FF42BB1B6F734BDDD07DBCFA0AA6
SHA-256:	5F233229050143BA35B24A5DA5E1DB5F2ADCFB0E0F2B78707FFEAF39DAA19249
SHA-512:	EDACD7B9B7674FABB02BA5CB3B2BB5156C992C95715A71D6415353F9B62E9936335F490D2AE4CE7D58DBA68AAFC583AAEAD482D25DFAC459879CF289E2EBDB0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8....JCA..?.[...$..+.........\|....BD.....i...V..h..+.>.......X.s...f ..U..X}..B.U.s~SX.}..2..=.........0Q...D]U{.M.?../..}....... .eu.x..~.6..3`% ....y....+..BP../..8.)pm..\..M.h..Q.....-..Y.....u...T....S..0..e..%....u.8].^.........1....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\npshandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6035
Entropy (8bit):	5.764655196109786
Encrypted:	false
SSDEEP:	96:iPCHoe1nDk6k/Lap8sPnYuOKWi4s0reMRkyi0DlbwOxjHXExCDr:0e1DkFsPnXLWRs0reMRkyi017xjHXExE
MD5:	7CA18DD47762CCC1807F5DAAB9310142
SHA1:	B5173864A13404AF83AD3D1FD166383EBF5C581A
SHA-256:	E9E622ED8DA5520234BBA4FBDAC4159DA922175B1572917D932F491EB693E543
SHA-512:	A5107E7742CA216E7688F402819B779E700BEB95B3531B6CBC490B55306D9EF5DB102BF377D2015BFEEFF8CEC41914D890D3E78BA051F5A691B88A09024479E9
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...+...=...6...9.......9...'...6...6...9...9...B...&...B...K....tostring[NPS] packages.nps.isSurveyShowing = .info.log.core.isSurveyShowing.nps.packages........#6...9.......9...'...B...6...9...+...=...5...=...6.......5...=...=...B...6...9...+...=...6...9.......9...'...6...6...9...9...B...&...B...K....tostring[NPS] packages.nps.isSurveyShowing = .isSurveyShowing.triggerType.shownTimes....commandName.showNPSSurvey.shownTimes..triggerType..ShowUi.EventData....UiTemplate2wacore:mfw\packages\nps\wa-nps-checklist.html.UiType.npsSurvey.web_view2_ui_templateGfile:///[WA_FILES]/mfw\packages_web_view\nps\wa-nps-checklist.html.onExit$packages.nps.UpdateSurveyStatus.EventData..nextSurveyCheckTime.nps.packages![NPS] TriggerNPSSurvey start.info.log.core..........6...9.......9...'...B...*...6...9...9.......9...+...'...+...B.......X...6...9...6...9...B... ...=...6...9.......9...'...B...K...6...9...9.......9...+...'...+...B.......X...6...9...+...=...6...9...6...9...B... ...=...6...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-controller-nps-checklist.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27277
Entropy (8bit):	4.105586925257985
Encrypted:	false
SSDEEP:	384:toM7vbmeEzk/beyLkwi1y42ykBkbae2vxDqkDb:+GbmSil1A
MD5:	55BDC14BC6A46511E00A06610748E071
SHA1:	4FD6F9D896B4F2E079BB1E028524CC1C1BEE1C5D
SHA-256:	382F0144DF91A2A1BDA18E1070810E8DC57A64CBCC0F8BC48037AD6D52E9111B
SHA-512:	B5EAEA80A0409A20EF5E047B45CB2CA07B6E09EEE23470059E7CCAA19CC9877A287ABB9AAF63C779DD5D55CBF43783D82563C20F56566E5898A01A2337AD0F28
Malicious:	false
Reputation:	unknown
Preview:	/* NPS CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. var self = this;.... this.update = function () {.. _window.ready(function () {.. var args = JSON.parse(_external.getArgument("template_args"));.. if ($(window).height() >= 630) {.. self[args.commandName]();.. } else {.. _window.close();.. }.. });.. };.... this.showNPSSurvey = function () {.. var html = "";.. html += " <table style=\"border-collapse:collapse;width:450px; height: auto;font-family:Open Sans; color:#53565A;border

C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-nps-checklist.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2495
Entropy (8bit):	4.948796230125604
Encrypted:	false
SSDEEP:	24:csY0TlGNVMz7tVMz7EVMz7VMz/VMz8AVMzjVMzJVVMzk+VMzkVVAFqOcO/TP3G+B:3XTFMv26ITWVMgZgAFqOcqehQORDuZ
MD5:	D8F15460CE641BD6628CBAAAA248522B
SHA1:	F9578831BF825A1AB4FA7F3EADB1941864EB5C47
SHA-256:	64C1627E6FD09FE4C859C8CA5BA16D273EA3F3CBFB891B7337135B1F377DE613
SHA-512:	5EAED775BB2F35940C08688ABFCC0BCE520EF46D16EAAFE3CE3BFEF2660F8AD879DB9444647551B0771FD230927C61054661741EFEA8CC26E8BFB6CD4132138B
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-checklist-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-ui-dialog.js"></script>.. <script type="text/javascript" src="wa

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\pscore_horizontal_header.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23888
Entropy (8bit):	7.972575063100117
Encrypted:	false
SSDEEP:	384:EUB3ty3llPPn9q8h2pUKKvldY0LnnP4iNn95BbbYaEyuIrHkMwx0knasAJ1gZ6IS:EUFty33E8h2Onvv3LnQyTBAaJzrHkMhT
MD5:	C3BFA93D5C7DB61C39EE0964408A9652
SHA1:	0BF196BA363A55386E34EC578FB998434DFFA76E
SHA-256:	A2DA83CD9A0EE76F8030EA0A98A132062D3715D314120FFBF15E7E5CF6C07C5F
SHA-512:	262713F8063DE027CAB620F5752B3BB7A9C52F55643644570BFF84E877B7EE292257B32F34515FAEE6D00707368480F0039668F649979F2E07F1D2F68CDA33E4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...,...z.......e.....pHYs...%...%.IR$.....sRGB.........gAMA......a...\.IDATx....$U...".2+k_..z...fiD.E...u..Ft...WgFt.....qFg...gQ...Qy#....* ...6...M...k.......yo,..Kd.o..32...._.s.7...%......~..e..Y.z.u.........<.R.V......~S....Q.......G-......;..r.i.............o.X.0......a..".0...X.....,X....,.aB....0....a.....0Lh`.b.&4.`1...X.....,X....,.aBCm.:i3..H..b.&4.`1...X.....,X....,.aB....0.....sLg.w.e............u:..r..H..{=.cr.Fu.N...w.a+..9.=...s.Z....i....t...D..&....9>..G.uD......p8n..n..2......k.......2...X.....,X....,.aB....0....a.....0Lh`.b.&4.`1...X.....,X....,.aB....0....a.....0Lh`.b.&4.`1...X.....,X...Z.w8..uh..aG5..}.S..w......8.}.^.>./...P}'.....a..nu...@u.t.<..7..s:....t....t.N.[pz..i.....2....q./.l......._.+..@Ue.l.k.n....t.;m...\|.y]..>......).{...>..'....w.r.~.%.....r..9fr)[...]B.aB....0....a.....0Lh`.b.&4.`1...X.....,X....,.aB....0....a.....0Lh`.b.&4.`1...X.....,X....,.aB....0....a.....0Lh`.b.&4..z.E.qz...<.p...7.k.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\pscore_mcafee_logo.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3442
Entropy (8bit):	7.917211786885695
Encrypted:	false
SSDEEP:	48:1/6S6av9TkhLdTA7EQcAQWgDDJMB4bcpdQA7xSxygZAW1swGfru650YOydA5Yv3z:1SSdlx7EhAQLJbcp4tzf65xA5ef7gC
MD5:	857F7BDFB5EB00AAA643F1288B5A391A
SHA1:	7D58AD880ED35E794A5D3EB6AFF43B25986E348D
SHA-256:	E62646B24CE91D1A91D423A9579F67674124CDE0E76CEF490614588D0859EA2C
SHA-512:	910A14E7EF21901A6159403F98DB37866AEA7DEA6386484691C688AD1D5BFDFD7E43D1DF88D419E951511683E00FA28A6B50A335DE9D3EB51FE45F90E616FAC3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.eb....pHYs.................sRGB.........gAMA......a.....IDATx..]]n.H....[.&..`..O.O....C. ......0;......,.....@.........5O.q......=foU...2....l...Xj.Mv.W]U].d.f.m...`..........}<....<..m@......\|...a.....f....B.\|..o<........AF.z.....~.......r..O.k.....8?........C..Baq.c....z.q....N..N....Y@8... h.q....=....gO..a}`......?..l...@.&.;.r.fs.8.U.8.Ji3l.6[Z:.~..m..RT,......{.......W. ...15"L.H.v......:...i6...quuO.$..4..\.IxE.h...M..ip0.p...\|.....i..%........._...e.r......Fd'.s..A......_AA R..Lq....s..P....w....xs.w...a.Y.E..Bu..-..(P.\|P....Z.9...l=%).U.}.s...A.T....AZ."!...}.wO..."T[...)]x.@'.......r...Q..AZ...-1#..9.,..:..>!B.....`.j..<.Ic.5..0..}.........O{.ybQu....kp......K-.....K.3..(.q..\|wvft4H.....,.....@9.N<]!...py.!/.\[%..G.\.{%..H...A0..Y!.Z.t.y..!"...>.+.~9....6..8..UI......!..'....q.ps3l}.t..B.d..a.x,.[..,..c=..A._.N3......L..^p}=.F...h;...:.K..J2.y....H`.G..bF.IB..z......j..'.u8.*...<4#9.2.`...s@..(../

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\pscore_vertical_header.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12414
Entropy (8bit):	7.971836009107372
Encrypted:	false
SSDEEP:	192:mSwhyWo8nM3LYKcNcMEt2VHCk4pH4KjJBOh16ExrZLYTicctW1MUwPk1:JwW8M3LYVbA274pzNBS16E7ET31twPw
MD5:	401311D74B22F9A58BBB4567A9035C62
SHA1:	3C3AD0696E506D1D51B823CD0FA3E13CD2F605C3
SHA-256:	79D6B5369F72EABBB18D444363CC5A345F91538696238CDF03952975E51162C2
SHA-512:	791E332576282688F9F74041DCD7A27DC8C81046FB04869D2F08C0E88325BCCADED9346F696E6F4D8BCD4AC5EA1F8DD18488B1CAF9DEE1E6CEDBBD28940E7254
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...^..........c......pHYs.................sRGB.........gAMA......a...0.IDATx...x\.y.....W[....66`v.....p.m..4I..$i.....i.$.mC.K..i.%-$i.CY.....,.......,i$.....F..f.3G.....f.....{...}...@2..a.F3.`..a4...0..1,^.a..a.2..h...a.FcX...0...e...../.0..x..a4...0..1,^.a..a.2..h...a.FcX...0...e...../.0..x..a4...0..1,^.a..a.2..h...a.FcX...0...e...../.0..x..a4...0..1,^.a..a.2...>0L!X...2.......c.3ya.2L.."Ss.....$..`.\...$S`..(..?.....v.T.....N...q.r.T...#h~.k.....+.e5.F..u.....cL.`...up..;`..80$.O.8.v:....S.K...z..C0..;.....8z. .....n..[......h..F-.x.EH7.3.G.".\..r.......>..1!....G.6"...."..L..Q.A9&....p....DBMI.v....~n$.......u&.?..J............J\N..6.....y{....+.Z.0....oB- .v.J.&.;.....G).Q.G....".....-........+..}.{.#...)..m(....1`.....K/.....RX.v.hK.:......E\y.e)Q.c.x.......2].V....7.......[.]tG..8.h.}.HIO.v.....E........w(..#..}X.$.\|.2I.....ar.W.....A.H..K...u%I.~..E.7lO.I.q#../..!..w>..5.\|sAr...2[...E.T....]vya..$,..).....DV...}....[y.. .x

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\score_ui_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	630
Entropy (8bit):	5.682584786783875
Encrypted:	false
SSDEEP:	12:6bgmZUpC1DgB3Wejth99A1JjHg5PQwS2DZRQAb2X+0SJI5ORkU4LO5sO:6bjZCC18VWej0TA5PQwSQ12X+0XORUOB
MD5:	4B4DEA0A51D0F8CE8E2D2122332D4694
SHA1:	C8347489490CB83527DAD23E2226EC4BCD2AC6C2
SHA-256:	1F13C2582FF73DFF58EF03C03176649C155B61B5A96E0E869DB4910DEDDDE390
SHA-512:	DB19016A204F4A6F8756858CEF345137E8BFE95F968DDC6EB1BF2D9ABF78A3A1E7A1EA29C2B3197A3F472616D8E5EDAD003FF965575D5379323BF0E3E7112A06
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........5...=...4...'...=...*...=...9...=...6...........B...K....ShowUi.template.UiTemplate.transparent_color_key.upsell_toast.UiType.EventData....EventData..UiTemplate............$6...9.......X...6...4...=...6...9...9.......X...6...9...4...=...3...6...9...9...B...9...'...'...)...B...6...9.......9...'...)...'.......B...K....Builtin_ShowScoreToast!EVENT_SERVICE_ShowScoreToast.register.handlers.ssToast.upsell_toast.RegisterUiType.GetInstance.UiArbitratorHelper.core..builtin.packages._G...//F2B9743A89A324254AF6F0F3BAF3830DA13B48DF6A5CB264A0786353AEF709E2CFCEA0EC2CA44EDD103143DE5B684C9C1F9D343C323A0744FC46A87AE3461D14++

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast-h.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2598
Entropy (8bit):	5.036945595061714
Encrypted:	false
SSDEEP:	48:xmp5UQXxoNKNv4spv4aj0MuoZv48Nv42EkGxvyxs0M0oLpxMIcoPP2u0pqPc:xExd4847hk4a42Eyxs0VExkoPOvw0
MD5:	29CCF52A50A48CC86A7FD316A857FE0D
SHA1:	8DF120565B4F710CB8B0ABA6A409D21B3B696728
SHA-256:	2F13B5CEA7274BD0A96F31597D88CBBAB3992AF46FBD9BA252DE891D02469574
SHA-512:	8A786B0EA66BFC97D365F11AB2EE2828D0ED57DC1A8BDCE79245E106AC9C19F8C744B20B798AEF48C502A4F409415FA50F7232073B15C421686BBBCF43E52DDB
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}.....main{.. position: relative;.. width: 525px;.. height: 189px;.. background: #FFFFFF;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;..}.....header {.. position: absolute;.. width: 150px;.. height: 292px;.. left: 0px;.. top: 0px;..}.....header-image {.. position: absolute;.. width: 150px;.. left: 0px;.. top: 0px;..}.....content{.. position: absolute;.. width: 375px;.. height: 188px;.. left: 150px;.. top: 1px;..}.....content-middle{.. /* Middle /.. position: absolute;.. width: 327px;.. height: 134px;.. left: 24px;.. top: 30px;..}.....description{.. display: flex;.. flex-direction: column;.. align-items: flex-start;.. padding: 0px;.. position: absolute;.. width: 327px;.. left: 0px;.. top: 0px;..}.....description-heading{.. / Heading */.. position: static;.. width:

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast-h.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2121
Entropy (8bit):	5.113008581901908
Encrypted:	false
SSDEEP:	24:fgn2sYswbZbMGNVMz7/VMz7EVMz7VMz/VMzEVMzkLVMCqGJKY0Zf+PGQHmROLpj5:YabMuv26zgiCgFFmG8Umz
MD5:	7DC9842A3F1801B9CD3B4DB8929410A3
SHA1:	8C3C1CC6F24534F918D89B35B57491D74D0CE70F
SHA-256:	26346FB5E71AD5974810BFA91273A2A3C0C4D92DCAF8F8AFDD7C9F7351AA4E25
SHA-512:	58A900269759A85EF589A69197F05D2D06728908590100F38FEDE4EEC196B5C428A96F17E524CB04DDE3EBACCA003B6C5F01D02ECD0A810171D412CBFAE4AA46
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>Horizontal Pscore Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600&family=Poppins:wght@600&display=swap" rel="stylesheet">.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\tests\\score\\wa-score-toast-h.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-pscore-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\tests\\score\\w

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast-v.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2850
Entropy (8bit):	5.087031229035728
Encrypted:	false
SSDEEP:	48:xmp5UQXxxxvmyI2Muoyv4yoEkMVGvgQ+L/MjoWEOM5RchYubipqT/MIM9m+2Cy:xExxZjhF4r8wdU0xz6iFiwT/0EVCy
MD5:	13166B6235ED6761C3C0FFFA4495EFA8
SHA1:	65C56EED9B43B93FADD7FED7004333761675701D
SHA-256:	8CE79010DE4D118B643FB624CD417FA541B785BA70E03E5D37B1D22DDA1D225B
SHA-512:	079C719C00E8BB8AE5791D02351F351AE9E6274102D0C1D9D9E4FE4C9E24E6B8935E536223C1DF98072FE6EA11D89D752D0C82A96224093CD486B32165D2F494
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;.. border-radius: 24px;..}.....toast-container{.. /* Score intro toast - Vertical /.. position: fixed;.. width: 350px;.. height: 486px;.. background: #FFFFFF;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. left:0;.. top:0;..}.....header-image {.. / Image /.. position: absolute;.. width: 350px;.. height: 200px;.. left: calc(50% - 350px/2);.. top: 0px;..}.....logo-image {.. / McAfee/Landscape /.. position: absolute;.. width: 100px;.. height: 19.63px;.. left: calc(50% - 100px/2 - 103px);.. bottom: 245.37px;..}.....main-description-container {.. / Auto layout /.. display: flex;.. flex-direction: column;.. align-items: flex-start;.. padding: 0px;.. position: absolute;.. width: 309px;.. left: 22px;.. top: 253px;..}.....description-header {.. / Description */.. position:

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast-v.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	5.1842531654655275
Encrypted:	false
SSDEEP:	24:PKn2sYswbZb2GNVMz7/VMz7EVMz7VMz/VMzEVMzkLVMCqz0y5kAEaAPHRggjBb:qabOuv26zgiCU15+lgg1b
MD5:	42FB02544D45868E282F9302FAD9882B
SHA1:	D61917B187075BC0EAA6871346603EA69860D465
SHA-256:	CC70FA7644BA8481DAEBAF807DA6E0E00F63A0B33B8F93EAFBF6183096F50C15
SHA-512:	605F7C6FAC0E32567026CD4184A35691A4F4DDD6C8D53B874F76222A2E0D1E6BFF55A1A8AB49478A5971E5CE8E8D530106CCF934FA15D801B4D292084837D447
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>Vertical PScore Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600&family=Poppins:wght@600&display=swap" rel="stylesheet">.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\tests\\score\\wa-score-toast-v.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-pscore-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\tests\\score\\wa-

C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3537
Entropy (8bit):	4.942590394818312
Encrypted:	false
SSDEEP:	96:T4dKKNAuahTxUATiX3JGJuCEsyU4Im2OmZiiJ:UKKNAuaNPaZGJupvIm2OXiJ
MD5:	C9B60B28112A58ABC843F19A379AF82B
SHA1:	D34F66F1D1F2CBB8EFEE2EFA906A03AFE29E3747
SHA-256:	4ACBE6AD6C4CD4D9CC85AB7C943A963D3992FF8B6C32BFAC293573473820E5E9
SHA-512:	45092856A7D399F56CCE3C80B5572D75B791CBBB7BFD4CC776172F8D4FFD95239A4F3A4AE007544D154551572C92A02E88AD8131ED874FD6F34F3D1CBC10CC42
Malicious:	false
Reputation:	unknown
Preview:	/* Protection Score Toast UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External;.... ui.pscore_toast = function () {.. var $el = {.. description1: $("#description-1"),.. description2: $("#description-2"),.. acceptBtn: $("#accept-button"),.. ignoreBtn: $("#ignore-button").. },.... show = function () {.. _window.ready(function () {.... // Get protection score cohort value then set size toast window size based on that.. var protection_score_cohort = _settings.getSettingScopedWithDefault(1, "1", "protection_score_cohort");.. setSize({ width: "364", height: "500" });.. if (protection_score_cohort === 2){.. setSize({ width: "539", height: "203" }).. }.... // Get settings data.. var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.PSCORE_TOAS

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\about-icon-selected.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	477
Entropy (8bit):	7.351051330229087
Encrypted:	false
SSDEEP:	12:6v/7y2VDhNOYjroguA84jleUzz0BDdbNSp42duo1:wVlYq7kC02yNSp5Qo1
MD5:	8DD33EC0D498CB6C2FAA490D5FFCAB72
SHA1:	E278EF1E92293D41820D83E115A7195E30509BAA
SHA-256:	C43CDCDA1172EA4E55CD6725B5FB3B0F2ED9F8AC2C3DFAB3CB5A927550C00492
SHA-512:	20257C6B39D94376C69118E91480F101B96E168E0C1AE599E505E76C4785A08C7CEC0297B84B8FB99EC690C16FEBE8985C8558AFEE13A7503D053760FB52B242
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.19..d...ZIDAT8O..1(.a......QJ1... ....2.3..`R2.u....h1. ..,.1...=..9}.........y.._....E..M...%;j....}\|.Z....m5........;..,.v.l6...X....^].F./{.q.-V.0.sGaf...\.S.WV..7.3f{U.A......Q.....L..%.Q..\.'....M.Q.lOn~.;.p]s...j.....5G...c.QV\|a..(....1.+..W:.2l;....b....)7.3`;.....Z...Y.....KY.V...Jx.V.G~..V......+.!..U,.........\|.O\|.s.`...'I...-Ps4m."....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\about-icon.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.440301212402691
Encrypted:	false
SSDEEP:	12:6v/7y2VcCkoWVpXHvC+N3Pei2PrEyBvatOrED0uapdvoXP:wVZk/9/ei2D6d07m
MD5:	CAE22AF422FC994E24E8CCAE7ECDFCD2
SHA1:	E237654EE11A51773BBC840A27F79D6EB2DB0000
SHA-256:	48B34A024F5B925DFB6B8973876708BDD49B363712E74981078661D638E8440B
SHA-512:	8A818292FB67F81A7339DC2866EE5884DBF5DD97707F6567F4B1A6DA7CDD8FE8ED8BBEAB04CA610FFF2C1B80C36A1873ED331187FD9A8BA8734DBAA401076379
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.19..d....IDAT8O..1H.A../!Q....@@kI.H...AmR......w.'.W(j..UHa%H..b.(....R^.B,...!M .I.B....x'..`.._.....y....U.e.D.4.D..Z..Z...I.+...B...i~.R.=.2.Ci...3.zw.c...;...n.ju...(.G.e..(}..<w...Y.R.b..v}.='0.V.^.tQy..,rf"T.B.Ry..&..._sQvw...%g$p....8.8...,...R.I..........'......g..m..^F.7N..Q.i.....<..O.8....y..<"..I}...,...*...<R&...s..;\..J.'8.G....f..o...l .^...(e^..;..t.._.....F%...k$.......:.'..u.n..g....@..N...E.....m....4M.\Do...H.b^?...t....}.......}Ahl.G....~..>.@..3g..U(\.Q....L......IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\badge_unsafe.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	957
Entropy (8bit):	7.697613181319463
Encrypted:	false
SSDEEP:	24:A/6SFlM82TeEtptDqNrmcMg+nv5eYIIHUVcIFOuIvEvKZiSGtvml:A/6TRnONav7he5FBIvESQSGAl
MD5:	BCF5ED81D209242E53EF15C8F0CE28F9
SHA1:	DA551082C031F0F532E61953479EA7BEED4E1068
SHA-256:	D7BBC3068A4447D0B6AB734C9CD0AE5E13393152FFDD51E6CC6117637F9063A6
SHA-512:	0B51D2BBFA103E53E7C7E204DD815160B0AD679218099AF9C8BDBCFBA83A6FB1FF480651D2B28DE690C222B2A8B74D44823BC5E16CC46AAE1E725E9694390B37
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...4......x......pHYs.................sRGB.........gAMA......a....RIDATx..OR.@..npeie.%:q.F\."s....`.....8.s.9.a....eJ,.Ci.....I......$...$$..z._w.n..Q.....R....E.v.&.k=....xyy@F......T..T.K..T.B"..J{Uq..i!@...,a...~#.K.2&$."...9....2.%..,....5....Rm\|\|..`0Hr{"Ajo.F.r.k..b.k-..D..i.\|v.H..(h.y?......t.b.....:.a....t.G....T..6.Y>.....o.~.....@>.l...tu]'.[.C..2p....c..O..U.O(....;.I.B..e...P...... .j.F\........9....1..BB.wH.-..@.".....2.Rh..(:<'.H....O0!.....Y..Z$......I.g.,Pr...9.E!-.R.,I@.!-.%......>..!.B..A.........x....2...4P^.\.....:(.Jut.D....^.....&.7YG<?....-Lqu5.).9\..-.O_]d.g\|....8Qb.RJ.Qz..-..\...7...b.`\|,.D.p.onF.\|lB....0.9..8.. k....b.`..N...0..1.j4..:..A.-..FQ..W...Y........w..[[...1A........r...t]'.:c..{...+X........../.7.N.n3X...\|\|..O..X/......oC..m.4..X....7.'Q.G..J.l#!......a...>k.TZ.7..<.~{....<^..:.."....7..v.,..fNj..}.-=.'..._!C.8.kha.....h.t.....j...5...A.S.......IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-checkbox.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2269
Entropy (8bit):	5.22954284436638
Encrypted:	false
SSDEEP:	48:xmp5UoZJx7MdDjTPWfx9gczwPpCRulmR+VEI:xArx7M5TPWfx9lzws+n
MD5:	D1A32162FBACCD8E4FCFEB89AFA5AFBA
SHA1:	F0EC989710F16445259BD3A18E19E62053F2C0ED
SHA-256:	6FCBEEA073AEF67DFB2230171088E7C99188C0ED994B734EAAF98189B34EA898
SHA-512:	EC90762FCBD503BEB9127F01B16F12E26C4E3CBE19292D100FB079598F7CB0471BB1CDA19E79C911A37247CB1091C84540AD874158EDA182DA8A7B850F090664
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container /...toast {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px; / Window width is 530px */.. margin-bottom: 6px;..}.....content__checkbox {.. margin-bottom: 16px;..}.....card__content {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}.....card__content #checkbox-question {.. font-weight: 600;.. font-size: 14px;.. margin-bottom: 16px;..}.....card__content .button__unfixed__width {.. background-color: #1671EE;.. color: #FFF;.. padding: 8px 16px;.. border-radius: 100px;.. display: block;.. margin-left: auto;.. height: 38px;..}.....card__content .button__fixed__width {.. background-color: #1671EE;.. color: #FFF;.. paddin

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-checkbox.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2337
Entropy (8bit):	5.2080130541526115
Encrypted:	false
SSDEEP:	24:AswDjY49GNVMr71rAVMr7EVMr7VMr/VMrlqVMrkbAVMCrmglBkkEEvURFWS4Cicx:DOjllTneCPIHCT4QSFWSO7QmqPOtFaLn
MD5:	8D6BAEEB11FB34CFAF3723EBCC3B445F
SHA1:	C6B8583CB4A2B4F4542B3FD86702B5B5F203B084
SHA-256:	99E0A44899A6683F5F56886821FACF7345EFE4140C44E57F237680574258EA20
SHA-512:	818C0B460DB17603D911029E64B0E501CB4FB4309C168295FB0720B557671FF0343C18F710C551F1D30E178806898F14E52A1BAA8969AD1D3E77C1875DAB00BD
Malicious:	false
Reputation:	unknown
Preview:	<html>....<head>.. <title>SS Toast Variant</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\aj_toasts\\wa-aj-toast-checkbox.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-ss-toast-variants-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\aj_toasts\\wa-aj-toast-checkbox.js"></script>.. <scr

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-checkbox.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4550
Entropy (8bit):	5.052741375618858
Encrypted:	false
SSDEEP:	96:CAATI313XsdWNR8jEcYw1TwVVXK+0OG1rAVXX0fFFXsWN:lAGJsA78jEcYwFCVXuOGuVXkffXR
MD5:	6E5F0002413E6D5A1659BCF28E08D2E8
SHA1:	28A3FE1A8D4D82AF86EAEF27A00EB37FF620263F
SHA-256:	47BCFD1D3D5E16922D6D56ED478508D06176E08D85F5981A467CB6E0CF774871
SHA-512:	0D2BBFDAAFE055278B38A0E427A0B069D1A44C3CC244034BF5BA8772CFE57FA2D1902328F2AB2FEB398E47C49CAB33FC7530E03DB6E8E8669393CBBE1A8FBECF
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. cardImage: $(".card__image"),.. cardContent: $(".card__content"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. checkboxQuestion: $("#checkbox-question"),.. checkboxInput: $("#set-secure-search-checkbox"),.. doneButton: $("#done"),.. toast: $(".toast"),.. setSecureSearchLabel: $("#set-secure-search-label"),.. };.... function fillButtonText(btnText).. {.. if (!btnText).. {.. return;.. }.... if (btnText.length > 8).. {.. $el.doneButton.attr("class", "button__unfixed__width");.. }.. else.. {.. $el.doneButton.attr("class", "button__fixed__width");..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-toggle.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7069
Entropy (8bit):	5.116877989593178
Encrypted:	false
SSDEEP:	96:OWZxXMHRMroWa7b6xEgPGquAED+YhAAA8b89Y/5Pbqx51E5hh565/M7buH0eFDe0:OW0H28Fguf+y89K2kCdMunbt
MD5:	9263F905C17DAEE2759DD16459223725
SHA1:	0D3BEF52A7B6CC4EFEF72596D0F93F1E5C6D35D4
SHA-256:	EF186B6F22CBF01006A86EB06CDE12C2F3C5C0F6B5DBD91A53C308BAA42805D5
SHA-512:	4A12ABFC854B132676F4434F527DB8713E9C7C6D147777EDD86A1C0C852E6AB4A91AB79A14E08ED4253F73C32A7452CB55414410D40F9042D8AE6FABC661A64A
Malicious:	false
Reputation:	unknown
Preview:	/* version 2 3 /.. {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container /../ version 2 3 /...toast2_3 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;..}.....toast2_3_larger {.. width: 761px;.. height: 565px;..}.....toast2_3_smaller {.. width: 761px;.. height: 500px;..}..../ version 1 /...toast1 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px;.. margin-bottom: 6px;..}..../ version 2 3 /...card__content2_3 {.. background-color: #fff;.. margin-left: 297px;.. width:fit-content;..}..../ version 1 /...card__content1 {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}..../ v

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-toggle.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3755
Entropy (8bit):	5.084796922211164
Encrypted:	false
SSDEEP:	48:jMsaeRv26XbWgHZNG50ybUYoA1gPeaNS6cD2QXIan7/u:jDbLNw1AYomgPeaspDfXIanru
MD5:	0CDA5D30639BA94B0706EDF8925668D0
SHA1:	ABA2559EC90D0E94564A64B4CE401908F4607C82
SHA-256:	D460318679A7B4E15872A050C16132FE92766DE64CB4AECD8E13690E3449E91D
SHA-512:	CA85E9493D70CA4F544A70862F951A03A6BD8BE02BAE532BD8F6A8F6404BDCF698380270C3A4D414EFA753F11A432AC0F5DCE099A51693A1D2C1034C411C3D7C
Malicious:	false
Reputation:	unknown
Preview:	<html>.... <head>.. <title>WA SS Toggle Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap".. rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\aj_toasts\\wa-aj-toast-toggle.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-sstoast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\pa

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-toggle.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8089
Entropy (8bit):	5.125908453797107
Encrypted:	false
SSDEEP:	192:lAvUEJU5h6wFCVXuVdDE6hYkBaWPwT0JrrvG10qAvlGuVXkfldX+kO:mvhJYDCV+fEGIj1sVUdtO
MD5:	A91DD10D5A5C076986F7655AFBE091EB
SHA1:	A216F7DA269BF5AB9234AA60704F53FDB8B985DB
SHA-256:	1FA4642C3438A07AA47EAEC7625120911EB8227D2F7A7B92FF26FD95CDD362DD
SHA-512:	E21E8F1A6E8F850B516DA7F75B96579CB0FBCF0BB02040DCEB49C70768326D9D6A6E54BC42E5CC98E151A59A8A969FF88BCEE12AAFD115F922DF3E99EA40EBCB
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. version1: $(".version1"),.. cardContent: $("#card-content"), // different css for different versions.. cardImage: $("#card-image"), // different css for different versions.. featureDisabledSection: $("#feature-disabled"),.. progressPic: $("#progress"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. feature1Label: $("#feature-1-label"),.. feature1Name: $("#feature-1-name"),.. freeLabel1: $("#free-label-1"),.. feature1Desc: $("#feature-1-desc"),.. feature2Name: $("#feature-2-name"),.. freeLabel2: $("#free-label-2"),.. feature2Desc: $("#feature-2-desc"),.. checkboxContainer: $("#switch-se

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\amazon_upsell_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.705896669991843
Encrypted:	false
SSDEEP:	24:6wBTG+3j9qlatg94bXSx7ngIdMKWF8gGX5p0TA5+CUTm2X+0XUpS:BBiIj9qlatVXEngJKWqg8+CUTvxXUpS
MD5:	BB80C853309E69A6B5A48F611BB85833
SHA1:	66925DD38E6F279FD6D64721B9052239540F495C
SHA-256:	A620B87A665CC92D4982C4CDF717B66242CE539C2E725B95AF1CCB9402FE9023
SHA-512:	7B013C59BEFFF94BF366AE63376DC17CC2E2D9C45193574ADA6C92F5E605E427299CD010CF20CF06770E4893034FFBF9D1925DA89F769085DB86DEFE845904BE
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........J9...6...9...9...9...9.......X...6...9.......9...'...B...K...6...9...9.......9...+...'...)...B...).......X...).......X...6...9.......9...'.......&...B...K...4...4...9.......X...9.......X...9.......X...6...9.......9...'...B...K...9...=...=...9...=...9...=...'...=...=...'...=...6...........B...K....ShowUi9wacore:mfw\packages\webadvisor\wa-amazon-upsell.html.UiTemplate.EventData.amazon_upsell_toast.UiType.toast_cohort`amazon_upsell_handler: amazon upsell requires toast_count, amazon_extension_status, and url.err.url.amazon_extension_status.toast_countEamazon_upsell_handler: amazon toast upsell is disabled, cohort: .amazon_extn_toast_cohort.GetOption.SettingsDB9amazon_upsell_handler: amazon upsell only for Chrome.info.log.ch.BrowserType.BrowserUtils.utils.core.Browser........$6...9.......X...6...4...=...6...9...9.......X...6...9...4...=...3...6...9...9...B...9...'...'...)...B...6...9.......9...'...)...'.......B...K....upsell_amazon_toast.event_amazon_upsell.register.handlers.a

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\checklisthandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4661
Entropy (8bit):	5.815955551693316
Encrypted:	false
SSDEEP:	96:X80GptO8fi2UgfH+ge9YYdWkHm18LbWQY6guNx6g2:MfjfX/+gKPWkq8XPYduNx65
MD5:	8D5C47922C3B66CEC9F4EC1CCC0CECDB
SHA1:	E99258F5B417F0FDF03023E67811B967845C4D97
SHA-256:	0859DCB804E1CCCDDCD15131C3C3214A930870B2B5904FAA1B61D88B031BD17A
SHA-512:	8ED6642097FE8EE9CE49E4D3E0A5C29BCFFC16CF4BF6BC07977DEB538E14921FAAC89BD1D9DFB85F0765393DCC6B988E0870A47AF9396DB088538A849F1CD550
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........5...=...=...6...........B...K....ShowUi.EventData.UiType....web_view2_ui_templateJfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\wa-checklist.html.EventData..UiTemplate5wacore:mfw\packages\webadvisor\wa-checklist.html.UiType..........5...=...6...........B...K....ShowUi.EventData....web_view2_ui_templateHfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\wa-dwtoast.html.EventData..UiTemplate3wacore:mfw\packages\webadvisor\wa-dwtoast.html.UiType.downloadWarningToast........U6...9.......9...'...6...9...B...&...B...9.......X...9.......X...6...9.......9...'...B...K...4...6...9...9.......9...+...'...+...B.......X...'...=...X.).6...9...9.......9...+...'...+...B.......X...6...9...9.......9...+...'...+...B.......X...'...=...X...6...9...9.......9...+...'...+...B.......X...'...=...X...'...=...-...'...........B...K......checklist.showChecklist.showUpgradedUserWelcome DisableUpgradedUserWelcome.showCryptoLearnWelcome.DisableCryptoLearnWelcome.CryptojackingDisabled.showNewUserW

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\chrome_extension_push_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1660
Entropy (8bit):	5.578802467973094
Encrypted:	false
SSDEEP:	24:6aCRoYslDAbfu+oqxMdiyUZXvyBRCziQGePQ6NNL9aN+j/eHzsRNYa:kYkbfuhxdiHqKtGaHy+j/eHK
MD5:	37B5DC5AF1F288C164D185C89A8BB7BA
SHA1:	6EB6B3747F8F121DEC1F959DE2B3C41BEF27CD09
SHA-256:	209E7B7B465AA87FD24A9FE566BC14BDFFE8CA826BC2A839845A0739AD22250C
SHA-512:	04AD4B881407623B0925D63346A3E735D846FAF85AFBB6D1D04D399B2D215AF1C957E6AA422BDF992A50B6D637BE50CA08EDF7736788ED9F2F93D86DE516C5DD
Malicious:	false
Reputation:	unknown
Preview:	.LJ........&...6...9.......9...'...B...6...9...9...9...9...9.......X...6...9.......9...'...B...6.......9...'...'...B.......X...6...9.......9...'...B...K...6...9...9.......9...+...'...+...B.......X...6...9.......9...'...B...K...6...9...9...9...9...9.......X...6...9.......9...'...6...9...B...'...&...B...K...6.......9...9...6...9...9...9...B...6...9...9...9...9.......X...6...9...9...9...9.......X...6...9.......9...'...6.......B...'...&...B...K...5. .9...=...6...9.!.....9.".....B...6.......9...'.#.....B.......X...6...9.......9...'.$.B...K...6...9.......9...'.%.B...K...!chrome_ext_push_handler: endRchrome_ext_push_handler: Failed to trigger LogicMsg browser start on browser.OnBrowserStart.encode.json....IsExtPushTriggered..Browser.., no need to engage1chrome_ext_push_handler: extension state is .ext_no_entry.ext_enabled.ExtensionState.ch_wa_ext_id.get_extension_state.browserSettings. is not supported.tostring&chrome_ext_push_handler: browser .ch<chrome_ext_push_handler: chrome extension pu

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\cryptojack-icon.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5286
Entropy (8bit):	7.918352410896778
Encrypted:	false
SSDEEP:	96:VadOXrG7NapBuqn5EVYrylb7le57jdIt5X/pu660z4GKbAkhYaPQGflW1:B7smri6ryhGGX/JNzoAkhjYGfe
MD5:	992B99090456FAE196C91BFCA1630D5B
SHA1:	5079D7427DB7384162CFD4917A87D1B9C3235A55
SHA-256:	F86960D443E848E83A2BA3B27B68EE488623A6E6E80E74594E69802FC472AC8C
SHA-512:	80A8DACF479B444979889F0D9B5DDE429AA794D8D7E1430B4555571513FB3FB5F6F950B2FD989A7DF9B4EBAB7ADE271B5C8A635C4B247FD9D3D97EA96FEA0AFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................\....pHYs...%...%.IR$.....sRGB.........gAMA......a....;IDATx..{.T....{.a......GO6...E..`.n!<$+L$.ML...X1.qe..V........M\.2C.v.'....uf...$.Vx..0.. P............}o?.....3}ow&...;...HA.ljYLzj..:Q.........(."I.LOj........Q4q..)-2....\..>_.^."K.\|.f))H..F.XTF.XTF.XTF.XTF.XTF.XTF.XTF.XTF.XTF.XTF...'.V5..b.G...4.Qv.a._..21...4...=...g...WD.....\.......d;.....6......D..N$2........3J..2J..2J..2J..2J..2J..D.r.t.-T..n..OS.......C. .....r*..^5...E...n..%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%.[..fc.....:.g.0..Su.%^...kkg'.Z]K[...).?H...N\|z...[..v.z..........x.>\|8UVV\y.....X..xf..g.....5v.r..?_@..K..N.(g..?....o...cFSuu.F...kcE..V.....o.LRY..9j<...i.>...>S=.n.i.x.....k.......VB#.ow.b.X[...^.3..w'.#......P....}.....<.T.F.b./U;.n.{B.8.v..t....rA.W.....[......h..5T...<U.Pg.Pk..5.~v...J'.B.5;.ijv..vB.Q.?.-.3u...R.S..kj!].....H.T..o<Pr..PE.eO=).H.I5 l{..I7.d../V....N.Q.P..E...u..E

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\ext_install_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1239
Entropy (8bit):	5.766803864174691
Encrypted:	false
SSDEEP:	24:6uhfXWnvmJJdPObNlpwgMT9CFbzVNh0TA5js2X+0XcLWvRduP:dhfXguTdPCFM4bz7jNxXcCvRde
MD5:	61241513B2381BC14D9312F65D07A792
SHA1:	1CC0240DBCCF81CE2057977FE4912C3C76393253
SHA-256:	A69865D8377819D81123E6C12C40CB05C5B63D0D7DC7B0658A1D68CAFE708259
SHA-512:	F03675188A36122ACB0C484A0805F33ABB7CE379D521055C1914747006DDDEA9BF474813C5132A55C3D57DDF2A88B1752842687F883B27B526589F81A47856CE
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........<5...=...'...4...'...=...9.......X...9...=...6...9.......9...'...6...9...B...&...B...X...'...=...9.......X...9...=...6...9.......9...'...6...9...B...&...B...X...'...=...9.......X...6...9.......9...'...9...&...B...9...=...6...........B...K....ShowUiEshow_ff_extension_install_toast: got implicit close event name: .implicit_close_event_nameRfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\wa-ext-install-toast.htmlCshow_ff_extension_install_toast: got custom WebView2 template .web_view2_ui_template.web_view2_template=wacore:mfw\packages\webadvisor\wa-ext-install-toast.html.tostring=show_ff_extension_install_toast: got custom IE template .info.log.core.UiTemplate.template.extension_install_toast.UiType..EventData....EventData..UiTemplate.........$6...9.......X...6...4...=...6...9...9.......X...6...9...4...=...3...6...9...9...B...9...'...'...)...B...6...9.......9...'...)...'.......B...K...$Builtin_InstallFFExtentionToast*EVENT_SERVICE_InstallFFExtentionToast.register.handlers

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\facebook.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	407
Entropy (8bit):	7.1407976551071055
Encrypted:	false
SSDEEP:	12:6v/74/6Ts/+smsfwZQlyCzDSkG+ZlfDN+y9X:x/6afkRChDZ1DEy9X
MD5:	52488EF2BAA65366C96F39947B5CEC32
SHA1:	580C1612E3D607EA8C3C83B03285ED6B5E5AFC23
SHA-256:	C0E9102EF0C19E55052516B7B11F95E96A13A93A19DA66328DE5B66740CE4A4E
SHA-512:	0D54D10933E441EB624CCE78C293162AF8150134199D7C2AA54554476CDB70983A3CC069B23D3C93D736612C80EF6C31CA1842EB72385FA4BE359A40F36A5B67
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............w=.....pHYs.................sRGB.........gAMA......a....,IDATx..k.P..H.....;.P:..Z....[.QG.I\..]}L...... 8..........1W1\\|../8.....\|9.;.r.@>. ..(HZ.%'p.Y..;...[..r..m...Z..&.l^.....k-B...Pk...~?.....{.....b...f...}...ty..C..`...@<..,.]..R<u~.{@f=.w.<..x\|.zsjq V.......I.KC<.}.....V{.l].Lg2..v..m!c....@g..-.>...@v ....L..l.y.>.)....."....%....P*........IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-noxup.gif

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	7.777921392960299
Encrypted:	false
SSDEEP:	48:I/sUg09pp/qKHlZpbkXt8K7n5bTh5lTdAiwy9QntZ9C:onJpp/qKXpbU2g5DlT+i9QnY
MD5:	DFD80EC6F7EE421AEAF3F785922438EF
SHA1:	DD3FCFB2BF921A6C67933093B1AE64CA23E1AF26
SHA-256:	FF31AC8E9802988BE162D31CD350711F460E8AB292CC45950C202ECD1A8FEEAF
SHA-512:	8391CD280487F73F7FDF5529BB6677696BC815DC99ADD5AA229EBE1B569B94C1D8C5370A86C0665F5F20CF918325B23338EAAE347FE441550C0758A687297C06
Malicious:	false
Reputation:	unknown
Preview:	GIF89a..2......'.....-..&..,.."..,..(.....-..!..&..+..(..5..)..(..2..$.....!..2..&....+..1..&..... ..%..0..6....&..+..0..-..:..5..+..0..2..-..5..5..;..@..6..7..=..?.#<..>..E. C. >.#@..<.'H.$E./K..N.S.,J.6I.,O.1K.+@.+N.1N.)W.4W.>J.9R.;P.6W.=Q.:V.DW.A[.GW.>].HS.E^.J].Bc.EX.Mh.Nc.J[.Re.Pg.Mg.If.Pb.[h.Ls.Mm.^o.^u.]p.gt.dt.jy.g}.qz.u\|.{{..~.x..{........{.............................................................................................................................................................................................................................................................................................................................................................................................................!.......,......2........H. 7Z[<DX......#J.H....3j...a...B..)O.?~.....J..........8s.....@..MP...HM..._.. 4x....X.j.:..Q."..S........a..p..I.(.....O^...6..Pu...}............A...3kF.x.g.'..........`.....

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-top.gif

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	369
Entropy (8bit):	7.019028949718389
Encrypted:	false
SSDEEP:	6:aPd7Wm9a7S6xP+rDzujMhsACN1brSF+dmz0fmBDbf92buPamIPW19mW:aPd7Wm9a7zGDu91Ppdmzka/f8bQasX
MD5:	3D32D5CBF24BDCC2C74E876AAD4C19A0
SHA1:	E4F405F07DC0D870A2CF4E5EEF48C91393676290
SHA-256:	7456A5B53B0E7BAD980926BA86EF437ABB19F5C2D397031C83B27198DEA3C5D0
SHA-512:	DB97E6E8E062B75FE46D49558BDA19674AA574476F85458A22A536FD07384618524007342098E5FA095532A2D8CFC2612CAD0AD77AC406E5C12029E48F112830
Malicious:	false
Reputation:	unknown
Preview:	GIF89a..2....................................................................................................!.......,......2.....".di.Y..l.bp,.tm.x..W...`.B,...r.l:...tJ.Z.X,e..z..xL....tZ.n..pxdN.....^.........................................'..#..................................................................................................&.....#J.H....C..;

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-warningbackground.gif

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	361
Entropy (8bit):	6.510176350874939
Encrypted:	false
SSDEEP:	6:DvjkRhk/NruDE9Q0QVlMjlFGCyzVwFECgVp/R5i9pNoj3f31XoB/fNfkc/:zjkRiFrFQ0QELV8VwFELjZ5ii3f3No1z
MD5:	2D1CCF8BB4F2013151F9BEC12542D9A5
SHA1:	9AFEE504C285A2FD7B09BA3AA745B3CD4AEA3ECE
SHA-256:	8CE5E1DE817FCEF6618DC2279753936423A975ECBA3C28732FE0CF0DAA52E1D3
SHA-512:	C640B6921D144E76417CCB433CD7B0359FCB8298E546454AA31067FF70D4356DB86A223C83E70F2C43F46420CC4D6554834D3998150DD2D6257F65F8F7708942
Malicious:	false
Reputation:	unknown
Preview:	GIF89a..F..2...$..$..$..$..%..%..%..%..&..&..&..&..&..&..'..'..'..'..'. (. (.!(.!(.&&."(."(."(.#).#).''.$).%).%).%.%.&.'.)).'.'.(+.(+.)+.*.)+.+.*,.++.+,.+,..........................................!..Created with GIMP.!.....?.,......F...q...).V..+...0....XX.j.J.P...d2.H..H$..@...C.p8..F..`.........................................................A.;

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.242680215298125
Encrypted:	false
SSDEEP:	24:xmp5UoZR3xQiD3RJMZcUhiLKyFc43bZ147IKHYcz:xmp5UoZJxBTM3Q3SdLYcz
MD5:	EDA80E87914D235FA0B9074531B21037
SHA1:	80BDB531BBED1BE955994BCE031B769631E74A63
SHA-256:	F197311F863312F07FAECC8FE512C84DF90934F3B16A31B0A52E6C210A62FB8B
SHA-512:	0500B2BE4C8AE836C5EAB9DDDB20E6B5871330A6786EA651B7161252C55F63BD4C31F477E953D1F0C702A128A5E04AFB9395E8CC7F99C129F0F49631225CFC9C
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}.....balloon-chevron {.. height: 20px;.. width: 20px;.. border-top: 2px solid #E6E9F0;.. border-left: 2px solid #E6E9F0;.. position: relative;.. top: 10px;.. transform: rotate(45deg);.. background-color: white;.. z-index: -100;..}.....chevron--centered {.. margin: 0 auto;..}.....chevron--right {.. left: 337px;..}.......balloon-main {.. box-sizing: border-box;.. background-color: #FFF;.. border: 2px solid #E6E9F0;.. border-radius: 24px;.. padding: 24px;..}.....enable-ext-btn {.. background-color: #4989EB;.. border-radius: 4px;.. border: 1px solid #EFEFEF;.. color: #FFF;.. cursor: pointer;.. display: inline-block;.. font-weight: 600;.. padding: 2px 8px;..}..//3D25A275F42B0E290B913A1AB9903A413EE0B14576277056328C88DDEA4047041EC9918

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	5.274400257400703
Encrypted:	false
SSDEEP:	24:LswDjYlGNVMr7xnVMr7EVMr7VMr/VMrlpVMrkANVMCrNM/QogXORMkfq:oOjmxuneCKIJCEQxyNi
MD5:	021DF1CE72B6F7327FA9B9F79FE430D8
SHA1:	4B9EB53A3A4EE333CF253A254C7EC74DD3054C88
SHA-256:	371D383396866B86E082E4BB832F0D962C0245E2BE730FEDA1B787E367B890E9
SHA-512:	847E80F83176A159FD133C46A2BCA1582E213F67AD8A8B5555B220C3EDD8892A5A0050101D04F192E03B33E130C9389D41188F6C73B348684E4A0E84C8F4DDF5
Malicious:	false
Reputation:	unknown
Preview:	<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\new-tab-overlay.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-overlay-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\new-tab-overlay.js"></script>.. <script type="text/javascript" src="wacore:tel

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4438
Entropy (8bit):	5.062432071908128
Encrypted:	false
SSDEEP:	96:T0AmdonK4uoNDsVgV1PixEeB0NufP9SdaQbXkATWx:AATK4bNDAg/jeCQS9bXhy
MD5:	D157B88D8CFB3795732AC2382C30BE60
SHA1:	FC91C32A3D9A61257ACE07A69EF16B1F82DB10BE
SHA-256:	62773BAFA0B6A0812924C425513399D823C3324A6B19AA0A12CA2291BB55ED2C
SHA-512:	C2F5B2EE79450AD0CBA0F39CA402EA0E35FD665F5E17A44371DD2755907FA4AAB73D96C873AD6F8654F609B3A9E03BE1EF25E2091CBA3C93034DAF8F7712A903
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI \|\| {}),.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. content1: $("#wa-dialog-balloon-content-1"),.. content2: $("#wa-dialog-balloon-content-2"),.. arrow: $(".balloon-chevron"),.. },.... show = function () {.. _window.ready(function () {.. var settings = JSON.parse(_external.getArgument("overlay_data"));.. var overlayType = Number(settings["overlay_type"]);.. var extensionType = Number(settings["extension_type"]);.. .. // Polyfill of isNaN for IE version < 12;.. Number.isNaN = Number.isNaN \|\| function isNaN(input) {.. return typeof input === "number" && input !== input;.. };.... // Validate toastCount is valid;.. if (Number.isNaN(overlayType) \|\| Number.isNaN(extensionType)) {.. _window.clo

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1660
Entropy (8bit):	5.2349241144579715
Encrypted:	false
SSDEEP:	48:xmp5UoZJxwqqZlmlXMwWlYAlCiIpuj+i+Un:xArxzqvmfWlYAlc2+Un
MD5:	3B662448A94CF4F2048C0012A4107165
SHA1:	29427F2A5ED853902E223232712EEF0B1519718B
SHA-256:	EB3618BFF2E9EB3B8769A23E95A12E9DA9F9C9A1F5B45F52AB60517A56D96964
SHA-512:	8C57EAF9C209F0F87EC8D120A4AFDAA1D95846E886639EF694F125375703D12C901041840592E623C6DF9E2A44576CA1FD3790A58CA0911D82B444815FA72DCA
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */...balloon {.. overflow: hidden;.. height: 255px;.. width: 505px;.. border: 2px solid #E6E9F0;.. border-radius: 24px;..}.....balloon__card {.. background-color: #FFF;.. height: 100%;..}.....card__content {.. height: 100%;.. padding: 24px 20px 24px 24px;;.. ..}.....content__images #wa-logo {.. height: 17px;.. position: relative;.. margin-bottom: 10px;..}.....content__text {.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-weight: normal;.. font-size: 14px;.. line-height: 20px;.. padding-left: 24px;..}.....content__text > h1 {.. font-weight: bold;..font-size: 24px;..line-height: 32px;..margin-bottom: 16px;..}.......card__image {.. float: left;.. height: 100%;.. margin-right: 24px;..}.....ca

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	5.185423212299676
Encrypted:	false
SSDEEP:	24:LswDjYlGNVMr7w9VMr7EVMr7VMr/VMrlWWrVMrknkVMCrAedmsQ26qK/OFhItaI2:oOjIxneC4WCInHCFy26qAqIMImqIudns
MD5:	8C1BC60C2E64D53A7495440C5A190635
SHA1:	82F7271CD854CAB7D63D4719E546C3199F267665
SHA-256:	12ACE8B8B084E7EC23062DA111CCEABCC8E359BC103BF5F5563C8420ADA68F16
SHA-512:	86EBF4649D0F34DC780302514A53150B63446C2C65714997C210F3495045F7AE53AE89C690C946BA6C643772DFC4C0EE0B3426C29370888E80D587EC5377AB40
Malicious:	false
Reputation:	unknown
Preview:	<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\new-tab-toasts.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\new-tab-res-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\new-tab-toasts.js"></script>.. <script type="text/javascript" src="wacore:te

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4066
Entropy (8bit):	5.128136900384235
Encrypted:	false
SSDEEP:	96:n3AXKffHguIKz1hauWSu0RVflDh84bXkj+:3AogosHiVfVh84bXi+
MD5:	0253D448463ACDBE951977C57F1B3843
SHA1:	E9B0A3A7F095AD100A57675FF0A17EFFA03D2A62
SHA-256:	B9E43DBBDC7E74CF71917AAA7668B92FC707A4A4940E4D545BA9F86EA6BEBA2A
SHA-512:	3C7935D685302E27B7371124E5E30130148606073DC9D035E3173B34818DB6A1FFDDABC4A9906116D88CEFC7107B80B1964EFFC97F7B7DA12BA1B0763E346250
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI \|\| {});.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. balloonCard: $("#balloon__card"),.. headerText: $("#content__text-header"),.. contentText: $("#content__text-description"),.. acceptBtn: $("#content__actions-accept"),.. declineBtn: $("#content__actions-decline"),.. };.... show = function () {.. _window.ready(function () {.. var payload = JSON.parse(_external.getArgument("overlay_data"));.. init(payload);.... _window.show();.. });.. },.... init = function (payload) {.. var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.NEW_TAB_TOAST).get;.. var toastCount = Number(payload["toast_count"]);.... // Polyfill of isNaN for

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new_tab_main_logo.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9836
Entropy (8bit):	7.914414293589123
Encrypted:	false
SSDEEP:	192:4SzlM0MAc3Z+8WM/h/Cl3oKSo5i1TL999zhgwfnt1ztUOTGgz7dEM:/zYcc/Cl3nSoIxL9XuwVhtUOTGy7dN
MD5:	89FC18BBBA9A69CFEEBFB5ACC4E9089C
SHA1:	1FC704BA2ED65674BC9DD7B7D882D8F588C1F898
SHA-256:	DDC5EB8EEBD2874C5774A4266EBF0A064FCFBF94A34686839B3FDF7E73235F62
SHA-512:	12099A1DA49A4AEA5A5BEA2E41C94E8151743191B48AD6B0F099B43A3532FA57ED7D335C9A2748BAC7F43C11212C04CA63D42E38B0D278C20A3A0D2DBB49A632
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............`..n....pHYs.................sRGB.........gAMA......a...&.IDATx..Y...y..........")..J",J.ER..(mh......a....~X.F...v..z..#\|...."%..D..i.4...%..@..qc....g.3..2....{.s03.lTu.=S...jr..9..b.. .!Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1R.....Jp...{.S....c0.~.V.(.ef..4<.....k'l...y.v....jDG..=G.Y...~.7.........\|........m..+4.........`..b[&..#4.7..YX.........Z....m.8v.\| ......J..f...'.."..J.lX.0....?z....n'..}...dPl]...S.....`%.n..p+.).........../o.ld.;...>4...._.".tPl]D....3{...<.....eVA...f......{.C..Z.nO?.*.tPl]......F.....IB\^\|.......n%Pl].$4n.U.lb...,

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\overlay_ui_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8836
Entropy (8bit):	5.668036096779965
Encrypted:	false
SSDEEP:	192:NLDv0Hf9pf9JeSOoxYeaya6eQ4Rt356VPibkOtxXS:NLDv0HfTf9JvY7B6ehUV6bi
MD5:	78358E6B7C927B9FAA4647FF44C4B95B
SHA1:	A92D803084BEC56CEDC64E47086FB2D17274AEC4
SHA-256:	3595334AE9D4909F14834B875E6AE80CE83601012B003114CC38FD1A23D22D77
SHA-512:	7A2340A950E0A086E65B51C467C39002E60789FDEE085900DE6CC46E9280187DA2D365C79001378BE1CD6DE468F2080D493A07A9D3211D95B93B960140253E38
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........-...8.......X...6...9.......9...'.......&...B...+...+...J...6...9...9.......9...............&.......B...+.......J......GetOption.SettingsDB.utils3overlay_ui_handler: Not a valid browser type: .err.log.core........66...9...9...9...9.......X...6...9.......9...'...B...+...L...6.......9...B.......9...B.......X...6...9.......9...'...B...+...L...6...9...9.......9...+...'...)...B.......X...6...9.......9...'...B...+...L...+.......J...Doverlay_ui_handler: edge onboarding from process start disabled.edge_onboarding_option.GetOption.SettingsDB,overlay_ui_handler: Locale is not en_us.en_us.lower.GetLocale.utility,overlay_ui_handler: Browser is not edge.info.log.edge.BrowserType.BrowserUtils.utils.core.t.......6...9.......9...'...B...1...K.....Apackages.builtin.on_search_ext_warning_coachmark_exit called.info.log.core...... .v9.......X...9.......X...6...9.......9...'...6...9...B...'...6...9...B...&...B...+...L...-.......X...6...9.......9...'...B...+...L...6...9...9...9...B.......X...6

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\securesearchhandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6212
Entropy (8bit):	5.812453316751698
Encrypted:	false
SSDEEP:	192:t9fXZSbmxcJgeCmxqW7ycZkJ09g/oxhemfE2hKxfaST:tdwKPHcZk+9aoV82srT
MD5:	16677949C91948032149FAEC0485934C
SHA1:	A674E14E93A01551A0002CC958829823649A5AF3
SHA-256:	C06933A000FF7F3865A0229D1D4458985C6C71A074D39BFC81233A17B9ED9504
SHA-512:	5DC2C0EB632B9DD041AFEC971AAC2CBA74569887AFC965D4A4CFD7E7BAAD0CBA55568EFB884ABFBFF28A673C06247C958A97FAC1ED7B10894F8C443BB786593D
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........!6...9.......9...'...6.......B...&...B...6...-...B...H.......X...-...+...<...6...9.......9...'...6.......B...'...&...B...F...R...K...... removed=packages.builtin.updateSSToastStatus: toast for browser .pairs.tostring6packages.builtin.updateSSToastStatus called with .info.log.core-.......5...8...L......._ie._ff._ch._msb._edge.........5...8...L......2Global\{8DB68CEC-1C6B-46B8-8808-90838C14CA3F}2Global\{F84F0E05-209D-427A-A977-A5AEAA90EEBA}2Global\{64C7DD73-FBD5-4B1B-8A82-B49950F36A97}.........5...=...6...9.......9.......B...6.......9...'.......B.......X...6...9.......9...'...6.......B...&...B...K....tostring:Failed to trigger LogicMsg browser start on browser: .err.log.OnBrowserStart.TriggerLogicEvent.utility.encode.json.core.Browser....Browser.........H-.......B.......X...6...9.......9...'...B...K...'.......&...6...9...9.......9...+.......)...B.......6...9...9.......9...+...........B...'.......&.......X...6...9...9.......9...+.......)...B...X...6...9...9.......9...+.......

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-close.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	379
Entropy (8bit):	7.24199845007647
Encrypted:	false
SSDEEP:	6:6v/lhPW/E8kQoywGZy2QuloYCnWnXmYFOwrMFOfzs9fOPrmi/MsTjWnDU4p:6v/7uMpQoji+YCnWn2lwAAfz/jmiU8SP
MD5:	0D006D29C298D5D75780C5514DFD7E02
SHA1:	47231ADF89D53E452EEBA1A7A4F6F51697B93C4D
SHA-256:	CC72D82ECF19CB08D92F5EA6A612A12FD54B86D8E6AD1019D3516CAC0E90353A
SHA-512:	B35A08D6FB781DFEEAE99CA78F70C85517DCEC702E59A920967AD146C38B06442C95FDE021EEBB47901CA9D8B4B3DE3E2192DCA910C68497D5D4F5E721B5F35A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............V.W....gAMA......a....2IDAT8....N.A..GLL.....U.....Di.....k.m.S.<..`.&.....M.u.c.......~.........N....\.x....\|.....z.X.......)(..?vDzF...q.h.B..r..S.....j.=.`@8.A....F...g...._ .E..*!.Z...aV.IL...z...?. r...q..j-..0{r3Y..M...m.)....Z..^....$\|..... n&.....RB.1...v..~.#..t....4..k...E.........~M...S..>.S..&6t..oB.Y......C.Q....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-icon-selected.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	366
Entropy (8bit):	7.181473502943194
Encrypted:	false
SSDEEP:	6:6v/lhPUyCfW1DINGm00Q6GhmVMWW5tDGMYmw3H0zPsXFdCkhY1+8EtWmTp:6v/7yfW1i700sMVI5tDGMX0VdCWY9EZ9
MD5:	808F5E9FF7B694D5926CE6CFFA336085
SHA1:	58C5D8F14FEA91E715F8B3CB9B84421FBE99317A
SHA-256:	5331E5CCC4E6F8082F7AAC9492FC3DF5CB810087E6F0CB71D99B1582E233A61D
SHA-512:	E2DC4A40D8BD68D7DD31A002F480F3D0C5ED7433D0CB6F966EA11D437FD38A2B12C3F9CFC057DA9118E05BA5E81C1BC0896C5844D78F256084AC81554FC89A82
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................gAMA......a....%IDAT8...AN.0.E..`i....+.-.....(..E9GO.[..._e....P!.....x<v.4...m.<v,c._...?......p..p.7...d..-T.....B..p.G...m=a..Y3.qm.B..m.WWq.p.Q.C..^.w......&bd....^G..W...TMM.....R...~])...]$.#.jA.Qq..<o.......-.M.-.j.k.8..>..b.....w.-.Q..\|(.&~..M..Y.>..=.:..Y..n.....S.&....)s.c.T...v0.%..!.Y...J%....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-icon.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.536368903712138
Encrypted:	false
SSDEEP:	12:6v/7y8A6KCbdR+rqKuKRLIRBG9EtiJjt+KxqMK:R6JrXe+BGkiJ4z
MD5:	112768C9A06EA1AC8783E7EB786450C3
SHA1:	15312DD4FD8F87FD23725531726261CFD73888C9
SHA-256:	3AA7CF0C447D88B8CE2C2FC0B50E80E49851217D0CB3BB7D4E38FC22209DEE03
SHA-512:	87E13AA38498C7E76EA9B017A893CCEF4819FBC13EB387C8A4946C721EAB176A44A5F3B181FD23AC2D16943D12B452EB8462FE7A57F6572EB047F3876BD2CFEE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................gAMA......a.... IDAT8..S1k.Q...K.H...p...TV...../'v...6V.U..PP.;q...H%.&V6...!.i...;~.[&..q.,taw.....f.........z.G....j.Z..Gg.dg..F.l.I.oX..H2.t.\T+...A+....vD.\...6X.....\.R.-.v.{..>....\|jb....@7C..Q l.]....A.47.....O.X........$C......p._.d&.......M..?m.!.,.C.a......../.8...@n8gw.....@7..1.X.p=......._67.V...a.)...V&....a..R^.b..eN.Q.>?.j#4..A......_C+...A..H?....,o:.>........g...[._...d=\..^:.~.?......A?.cN.,...B.q..M..h.7.I.pT.T.4[.o.o...\..m".. ....6.0jk1..../..o....J>..6...C.6l.q.)1..N...s.....^..Y6.p..7......,.....:...C..y....IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\switch_off.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1523
Entropy (8bit):	7.849513030462221
Encrypted:	false
SSDEEP:	24:4V7JCN3mFRJOJsHKyzBNqS+s6snN326HGGeV6CouULfX7GBo6Bqy4XoRE8ndBAQe:507Zzas6s9lH06EUSBnBqy3dBAPl3
MD5:	0A57D1C2AF64AE52DF0CC5AE10897E72
SHA1:	923C6AEEA726F5BDAE43F4837C7FFFFE34E90B90
SHA-256:	541865D3715C481C1C111ADF0729928E0F6DE4A6B8E1687BB2DA2D26166E8C57
SHA-512:	2466E5EC410C6A9484A792B5F431FE3A527A04C01127CF11DFA6AB2ED49860FA052DC84C8AB61441359E03E2DF62341CD7E05F3CD94612AABE1E37564521CD38
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0.........j.......gAMA......a.....IDATX..X[lTU....;.N...R(}D.-..CA.1.T[.`L4..5~k....\|..~.eI0..DA..H../..6..VZ.J....:}..{.......bO.....Z..}.>C.P....F@..Zi:z.X..v.!.-.'.d..=.%i...m.d.}.d_].E'..}.J..t....c.......7M.T-.$vF.. ....U.....M..2..}..$.P}.....:....[9\|..KBx>7.=l2..<ZS.O..fQ0.M'..iht..........".zV...xB....-.8..P&.....s.B.8..+..ris.......s~.M.......{.<^.M....a%a.<...5.}......y.\|.g.OW.QmU..qu...E....$T....."...e9. >j:.*';.=...7>YJ..+\.NU..z....x...k.dB...!'.]....P.......$.....A.[...i...[....M.\|#......K~.\|...H.;.@ei!m.. .gd......QLz..S.../..'....^mr.......(..\|.`.sf!7...E...M....x<C.t2..:e.n^.D...SiqA&.......a...?.i.....D....}.q#....p...I...nl\...\|j..s.s.w").a..Wm...$x.A......8.)......_.i..a...q..$!gb...U$.%...o..X.O....D./.....4.[X..yG]../..:..d.%....................-.g>_....h.$.%b...l.....\|7\..>.j....[_6'aSs.:n.'...l.\|.z.k..h....yu...TU.r;Yv;.F.b.38b..s..$...L.5.....r.9....)+.C....K......'g(.....P....,#..C..F..!

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\switch_on.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	7.855339992904692
Encrypted:	false
SSDEEP:	48:URY+DGIp5LXcjQxWPQjWqIiU27j2NbCYv0WGYKmUjDeQuksU:Z+DfdXqQihAv/WGYBFQuksU
MD5:	1CCDA19F6B165F0487EBB6C65E870492
SHA1:	3CB6473AE58648F9E6365DDD44EB6A24529DD55B
SHA-256:	8A3C7A2285AF72210C4CEDEB87701596B05C96A435E200A1BC3F0FE1947DB566
SHA-512:	D681758B205597B043FFF6F8BE779B5D05E37708FBCC9C08C88DA963B2B4681C33BB3E3B5912E8DF0CAB819A89D520BF1D21DE1C7B7499B5738AB0D557329C57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0.........j.......gAMA......a.....IDATX..X]l.U.~.um.....l..!.i"..8...J.@....+.....41A\.K.B....;.:T.1(.B......(l.u.l.m]...k}.....n.vr.....<.{.s.{..[.(..........w#.z.....F..)8...T.pL"V.e....g]...C<.....K..eq...0.o..S.g..T.E\.I.3%.....Mh1i.3...O......fG..Ez.J.....g.t.6...O.H..J.W...;..P........?...,.......H.......$..V$W....B7Sn}..e-.'i..=.....k....3::.....8.p%...6.g)1OT,.L..W.84.....u...7v....!$E.-....j%L....C.T.....&.-~N.b.wZk.y.......:3.W....s...w...1....a."..Z...n..1!........J&/x...b@.=..}.U..rTF.a.....N...A761?q=..~ZID./..Q8.s8....U.m%......3.x....D....2.7V..C.....}..Mj..y....\e..`1.`...Y..i.I6....o....5..?.kzz.dN........9.........8,o.%...5T..o..cH...j,o...5.Bz.;......<....x.x.._nq...<.{V..o!..!.....S....tx.\.U............u$j.>.....4.....H....F.,..b.Z...R]2}WP.,1L...m.........W.....R)..a..Nl%..s&....9S....F..:q.`..1....b......j%..S..<v\J..]..5z>?=65.Qf)....hd..rx..QtS...pR....r>..G.J.Qj..]Yn........L......L<*..T..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\toast_impact_close.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	245
Entropy (8bit):	6.356933018581735
Encrypted:	false
SSDEEP:	6:6v/lhPe/6TsR/h2Ogt2PfVuymklNXULhg+/qp:6v/7m/6Ts/NutyJlNn
MD5:	BE47EB430418C03DF89E2CA140BC1325
SHA1:	A099F0ED4114F8476D6558BAA30E3DDFDF0512C7
SHA-256:	F651001BDF0AD41D9BFB7D5942F136CE75ECCEF744752EE72934980B8ECFFA4F
SHA-512:	AD150D115D35F1F796BB0E24C61FFAF72401FE2857A0A4475A2CB7E36325A5130CAAC1F167628E26C7AB6D053B7A3757D57EA3A07C71FC14FC848CFD2771232E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs.................sRGB.........gAMA......a.....IDATx..S...0...$..F....J&.i..X.b...w.\|.pXJi.N.\|..-.."s.Y.`...MX...._.6.mU..aD.0FY.T.O.....@C.o....&A...Y..C.Z..G...D..5:....9...s..............IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\twitter.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	473
Entropy (8bit):	7.236375221337779
Encrypted:	false
SSDEEP:	12:6v/74/6Ts/fWEpw+mmdlVkAV7AnpSvLkXfwtelX8EFQgdPjSTFN:x/6MWNmXVfV7opSYp8eZPev
MD5:	640A9A68216D3ACE0A04C70F745760F9
SHA1:	DEF457CF4CC59B638CB4C988652925CBBD7A972D
SHA-256:	40171CFFE5FB5BBFDA44569BBF7BBCB3848ECEF6A975CCC237F475B3141CCF4D
SHA-512:	A1CFC930207C1F468D423F072CB80CE6D6BC2FE6E8ED54A8A21386445882E9A922BE55AE627330E7810EA3BEF6108F06B4A2E0A3E62EDC659E1992046FD9D8C8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............w=.....pHYs.................sRGB.........gAMA......a....nIDATx..J.P....&........8...... .=\|.}...y.....A.X.5.N.P.&1.{.X...B&...$7....O.c.,x..D1x.@q..P0..a...:.Zb..%.........%y..Gp.X.9...ze.$p.UQ]..~uNt6,....3YX..F...2.....O6..]...]+#r...`[TzyP......c......Py.... ..j).......5uD.c......?..1.;..3.x..P.gA..3..=.M...ns3...C.U.L....VO(.............tq....WJh-.o....0..y..0..-u%.+.g......Z@..V...-...P..{....I........IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\upsell_toast_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3856
Entropy (8bit):	5.6360979059558725
Encrypted:	false
SSDEEP:	96:lVvGHx5uXl00jS5p2KCM49vcyp/4tx5CZ:lVvux5u10Jp2K/49vcyp/4txsZ
MD5:	6AC96189F04ECC0DDD7543B3BCB5EDA1
SHA1:	AF824CFD27B8819B12C5648F471B3F6EA86A1007
SHA-256:	C1E3CE4ECA27AE14EDC15E83DA7F8129149DC5B0F2B74FA17AF7C25E1B1378DD
SHA-512:	A97AD2EAF9DFC6DAE2A142D1F149D395FF7E30C5F6DA113F6215DCBF6611F2928F368DE0EC2B4349693ADB3F616BD1A44EDCB6E50A4A26D12751337C2A77FF1E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..X...........X.......X.......X.......X...+...X...+...L...+...L....new_tab.browser_launch..........D6.......9...B.......X...6...9.......9...'...B...+...L.......X.......X...6...9.......9...'...B...+...L...6...9...9.......9...+...'...)...B...6...9...9.......9...+...'...)...B.......X...6...9.......9...'.......'.......'...&...B...+...L...6...9.......9...'...B...+.......J...Hupsell_toast_handler campaign one: show campaign one - take_a_stand., do not show campaign* equal or greater than xml threshold 9upsell_toast_handler campaign one: client threshold .threshold_take_a_stand.tracker_take_a_stand.GetOption.SettingsDB.utilsdupsell_toast_handler campaign one: Only browser launch and new tab are allowed for campaign one.new_tab.browser_launch>upsell_toast_handler campaign one: User has WSS installed.info.log.core.is_suite_installed.utility......&...9.......X...6...9.......9...'...9...&...B...+...L...6...9...9.......9...+...'...)...B.......X.......X...6...9.......9...'...B...+...4...J...-...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell-logo.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	42124
Entropy (8bit):	7.989049214597359
Encrypted:	false
SSDEEP:	768:LJZubuFGvQ0hVNPAb14MPMrY0iJyMXbAjw15AIJgW/8QjzastNBmwQ:LJsbu0vQ0hje14M6iJy+sE15AegW/8c+
MD5:	6F1B48189D2C835EC68CC9C30BA53360
SHA1:	93D78939DA261C4D7CC06E8B8341D9B3D93CEEB3
SHA-256:	29ACC284AD48147B1B5FC3F6F8E79F8D7481002E12B7D0B631DF91D9D22E5749
SHA-512:	D47ADF288217FFC8AE2F6D9DE1A2FF5E240355EEF3E31F3B204C16A226ED7470D60021E23F155883A9F77275FD1712994565B58392694CEBDC4E28BE7F3AD1E3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......:.............pHYs.................sRGB.........gAMA......a....!IDATx....e.U...}.My.%.F..b.fK.%..........H..@../$\|.../...~.. 6.d06`.{U..{.......Y..g.....7..aKo..........7?@.B)....\|...w......}..X..Q......Ju{.k#x......sm...G.@...R...)./m().Q..mwM..'............w....z}.;Sk[Oj\;G........A+....X....g.U..}g%.?..z..U"..A....t.....F....i.4e..X...4..L..LZ.b.. _/J."..6.~.QJ.8EuB.."A~.....j......%VU.sF.i..;....m....\|@3.vJT.6...R.S.[.I.m.....=..D.6?...h...]...^^.........X..[.Z.0..BT!<a....TQ.xr...2K.......D. ...m...).xf..<.D.#.J.K......qY.;f.h.U..yfZZ..J.p=...R@3.E/..8..U.:t..W}.4.g=-....4.G7'g.:.\....5J&\4..Ip.....Pk7.........l..f)..G..yh.D...?~p.0..k5_0.UT..E.L\T.8q..\.>..Y.r...o.B..k.n...jV{....!...YH{U..Y't...b5.A...5..........9zZD$T../.F..Kue.....z......un.h..G..J.!$ru..2......0..n=........U.0.....Qu_.....M..7.@.4.v..3bQ..Q5..zB.}..0....^.L...V.!,.*...D.^.3..._j.....t.(PC6.... ..c.......M.P....H..A.x...........J.#

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1957
Entropy (8bit):	5.224489224997974
Encrypted:	false
SSDEEP:	48:xmp5UoZHx4Yli5FZSFIuMDWlYOlZiIpd3aT3Vh:xANxhi5FUAWlYOl5TgVh
MD5:	9258BA3600419406F7E183F94F771288
SHA1:	DEDF2D6A5292D401A0DCC9E45E8E0267C01ED721
SHA-256:	73ACF251FAFDFA292798592F76DF143DA316D5060D69BE6F0B27FE4F04E7F0BA
SHA-512:	2EA19EBEECFB261464E9C534784F23DEF54F9E1BBF81A5825ADF7590A9F13A9C901712A341E6F686057CA1B075F6435F70C8A1665A9539D6E41E64EC1D310CA7
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 16px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container /...balloon {.. overflow: hidden;.. .. width: 510px;.. border: 1px solid #ABB2C3;.. border-radius: 24px;..}.....balloon-I {.. height: 314px;..}.....balloon-II {.. height: 370px;..}.....balloon__card {.. background-color: #FFF;.. / height: 314px; */..}.....balloon__card-I {.. height: 314px;..}.....balloon__card-II {.. height: 370px;..}.....card__content {.. height: 100%;.. padding: 16px 20px 24px 24px;..}.....content__text {.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-weight: normal;.. font-size: 16px;.. line-height: 24px;.. padding-left: 24px;..}.....content__text > p:last-of-type {.. padding-top: 18px;..}.....content__text > h1 {.. font-weight: bold;.. font-size: 24px;.. line-height:

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2077
Entropy (8bit):	5.280478899465003
Encrypted:	false
SSDEEP:	48:oOjEJneCWIuCFf7P7d7DtIrINqIdmf925n:oAcNzh
MD5:	A697B2EBA55579E53AB8DB181464ACF0
SHA1:	5C0701C03F3116FF426A1DBD6462134F84A4DCBD
SHA-256:	41DAD7EB15C37B66EEE8468CE1B6EB4DACCEDA19DAFB443C63535F0417F2DF34
SHA-512:	6B5F8F2B9430BE930D4844BB71C5740B08C14893FAD5041A512F2AFD9A41F56C5F59B47339539DDC962FF15D977C7D4B700607ED041A9A1C32188752FA7D78AA
Malicious:	false
Reputation:	unknown
Preview:	<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-amazon-upsell.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-upsell-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-amazon-upsell.js"></script>.. <script type="text/javascript" src="wac

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	4.847133725834372
Encrypted:	false
SSDEEP:	96:4G3AXPfTEzni3R4uISETACySbd0SE13z8acglmVnIJ+BH/jyjsHbXk+S:4oAmMR4FfCSERz8k5ymIHbX8
MD5:	D6C8CC13701C775D284B64EE092E2F58
SHA1:	85A34878B9AF5DE6DA90F28F4BA594F1904B0449
SHA-256:	E97FC42096CFE51EBB08886EA5610BCA34CB32EF48E3467CE536DA5B672B31D6
SHA-512:	572ED0A8EAE0B3A2BA60C414C348E04EABFA13B243D2B55475047237A87FCE8259745BCBAFF864C5D801A40F1B7D9A6EF81C8C87A6C61BBC118B3A1EEBA84498
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Amazon Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI \|\| {});.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. balloonCard: $("#balloon__card"),.. headerText: $("#content__text-header"),.. contentText: $("#content__text-description"),.. contentText2: $("#content__text-description_2"),.. acceptBtn: $("#content__actions-accept"),.. declineBtn: $("#content__actions-decline"),.. footerLegal: $("#footer__legal"),.. };.... (show = function () {.. _window.ready(function () {.. var payload = JSON.parse(_external.getArgument("toast_data"));.. init(payload);.... _window.show();.. });.. }),.. (init = function (payload) {.. var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.UT

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.2570066123881105
Encrypted:	false
SSDEEP:	24:xmp5UoZR3xQpxVYHhLcY39U0M+mtFl2zZRVchpKIjvVCfnvv/UQsUMDDhZk:xmp5UoZJxDHF3uBjFloZKY+YfnHcQe5a
MD5:	6088A70C31A8B9134A2C6D529F839A3A
SHA1:	A75E579FF498A882C632F3858B0F9EF5B267F607
SHA-256:	0F281780F995BF68027C6B46748BA2D28FA7C5573EE3CD2EA5953020CAA62725
SHA-512:	4C4D8FB9F5698E9A3DDC94AB83702A839EA7BEC3B1E5070ABD86F38133C7DEB90CEFD13754057520868E29D8C8E0FBA83D68497AA9C53BA7E28D1B8188FDB048
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */...balloon {.. overflow: hidden;..}.....balloon__card {.. position: absolute;.. right: 55px;.. overflow: hidden;.. box-sizing: border-box;.. background-color: #FFF;.. border: 1px solid #E6E9F0;.. border-radius: 12px;.. height: 200px;.. width: 328px;..}.....card__content::after {.. content: ' ';.. clear: both;..}.....card__content {.. padding: 16px;.. height: 100%;..}.....content__header #wa-logo {.. height: 13px;.. position: relative;.. top: 2px;..}.....content__header #close-icon {.. float: right;.. cursor: pointer;..}.....content__text {.. margin-top: 12px;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-weight: normal;.. font-size: 14px;.. line-height: 20px;.. color: #5A6175;..}...

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1951
Entropy (8bit):	5.233556651781954
Encrypted:	false
SSDEEP:	24:+swDjYARGNVMr7xnVMr7EVMr7VMr/VMrlmVMrkANVMCqAedml3+u4wXRM4Zmm:NOjXxuneCnIJCa63+W7
MD5:	BA20DBA8B90703D038C65534AB91B4DF
SHA1:	8FE88D2A374B79A4AC402E4E272E5857BD688422
SHA-256:	7DBAA7CD21023FC0B42E8315699B823C2014E60C5AEE0537D85DE29892BB24E5
SHA-512:	48EAEC6A2225EE07F09DFBF8C2BA0DB55428D76728AE614ED4E12F33C97EB77C4B21BB65CF800BC663C9A08A6BE49529126F733E94C0D8CD68FCDE6A49C36D92
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-ch-store-overlay-ui.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-overlay-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ch-store-overlay-ui.js"></script>.. <script type="text/javascript

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.145604550339843
Encrypted:	false
SSDEEP:	96:cMAozDAQV9PqREed0kMTJo9QV9PKgMaGXQfq:vAODAQnTeurQQnzMaGXQfq
MD5:	925511DEEA2F45D1E40872CC5DE758A7
SHA1:	7A42C1CFD38BDEBDB043BF364AF44EE9D1505CAA
SHA-256:	7E0AF3865EB4318AD58A053F930325DB2C748548121DECDCDA35B471584787D8
SHA-512:	4B5731856034E0268398704817766A4BC18E6801E8326D6E449F6D0F42CB80EE291AA1DBDB5C491F4BC45DD09B44557CB91EC4856CB8643EDE4C568EB0ABF5F5
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. contentText1: $("#content__text-1"),.. contentText2: $("#content__text-2"),.. closeIcon: $("#close-icon"),.. },.... show = function () {.. init();.... _window.show();.... // Send telemetry 2.0 for dialog balloon showed.. var telemetryEvent = new OnboardingBalloon().interaction_type("Impression").browser(_instrument.getBrowserTypeCode()).balloonType("WAOverlayOnboardingOpenExtensionPage").Serialize();.. _instrument.sendTelemetryEvent(telemetryEvent);.... //Send Telemetry 3.0 for dialog balloon.. var browser_code = _instrument.getBrowserTypeCode();.. var screen_flow = browser_code == 'FF' ? 'firefox' : 'introduction';.. var hit_screen_id = browser_code == 'FF' ? '300.1.2.1-w

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist-risk.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	743
Entropy (8bit):	6.485906014360001
Encrypted:	false
SSDEEP:	12:6v/7MRUwaBLht3zHOuVKg7/6Tnpb+R2pi5IDyc1RX25gbhbzS5/IEMS:kwaZht3zuKKC/6jptpAIeEoglbzegEMS
MD5:	1ED7DBC29E984E621DB85633607A39EA
SHA1:	77CF88D52CB9A32A8EE377E37DC2CA70EBC79143
SHA-256:	C364887E094D6235A4FD5774D7CB5D9631A2983C8626998BAD8CA294BC446A19
SHA-512:	57CB41F770F5586041F9FCD9E934FEF894301AE8DDF8EFC498E2743FAD006D5C0D4AEF7D2A2086A9D3E60FC08B02AD2505D02E95B039786555522015EC9C41FB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............W.?....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE............................................................................................................................tt....WW.ZZ....[[................................r....%tRNS....#BSR$.7}....~9.k.....l.y....z.....>....bKGD...-.....pHYs.................tIME........uk....IDAT..e...0.D%....;f.@ ......,`.r.]..J.Z....jl.3..D...M..q.....(b.."I.6MD..=E...e;..{.<*..X."..$..}..r.el....-..z%..(.^#.f..H...07Up.S0u...a.8.r&#<.N......r9..H}..R4...R...]Y.).3...S.....U..TW..+.z.).3...(.....s..m.....5..3m8....&1@.....%tEXtdate:create.2022-02-18T19:30:12+00:00z.a....%tEXtdate:modify.2022-02-18T19:30:12+00:00........IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist-status.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.92410222781354
Encrypted:	false
SSDEEP:	6:6v/lhPW/ETnWvTVFX9ls1mDf0J7KzAvC7gnh+i25wp9M+S+N0XXnTp:6v/7uMTWrVFtW1mQJe7ib2uPSjX9
MD5:	527825CC6A463D4D1A8E7019B4773D02
SHA1:	C58CE479BCED1BA8B47339D6A9867E3D75A96672
SHA-256:	87A2C49BEFA3F59750E91A1FCE86FB9AC9BA928A04D4ABE1A7BDFFB25883EC2C
SHA-512:	38DFD2D59C8D8A9195BC9D45E45A71FAAA69AB3E7C4777F3A448C31A95D44AA3E97303EF3FABAF13B3BD4F7DA1BCC6269B8A6A668EC758E28EBADCE2F949D0DB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............V.W....gAMA......a.....IDAT8.....@.E.I@....V.AK..K..[.`..zQ<X...EP..&.a3D../..cg...a...o..v.38@.s.\|4.....`.;....a.G....k.m".....w........&...`.{..C.2q]jx...l<)OC%4.....'../H.+!y..S].,A..J..stM.^.M[.....2....^...T.(J..7.?.....t.QL..r.........IEND.B`.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2631
Entropy (8bit):	4.9856029228546825
Encrypted:	false
SSDEEP:	24:csYzTlGNVMz7tVMz7EVMz7VMz/VMz8AVMzjVMzlpeVMzkzAZZAVKkgrVMzksVMzR:3OTFMv26ITWBgkqlgPgOCF/ehQORDIa
MD5:	13E39F6CAB6B31C592941D965C8A8FC7
SHA1:	5A45023E46A54335BBE064EA4B794B85F573B474
SHA-256:	7D7E42F74B7C4A224AB14CAFDB594FD01FD4E3289D0AFD7351EEF10C6F1297FA
SHA-512:	A4D95B3C19C141234FD402CCD5488019E0C07ABE4634843BD9700963BE9AD97EAD229AFA99A3D8B0E15A97B781245B201EA204E5E08B79CF1CDCDCE802DB86A0
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-checklist-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-ui-dialog.js"></script>.. <script type="text/javascript" src="w

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-controller-checklist.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23342
Entropy (8bit):	4.07024810101501
Encrypted:	false
SSDEEP:	384:cD3PO1JLwhGbm4Ny+e8yfCwh/ZfiuLeeYjYWUUQo6La+Z13ej4:Y3PO1JLLbm4Nylj6uiuLaM5ZRV
MD5:	0B101968AAFF1F385EADA158A17913D7
SHA1:	98845CC992EBC85DB0554BD38FE4245229C4E34F
SHA-256:	31564A46047ED1FC8B6F106B026640B3BC638027ADB1341BA12EADBBDA5BE937
SHA-512:	1E0F8A3225FE08E3CD098BE63AE696FDE9415216CD8FA1F26EF3C5301418EAC78C17033B5A0D3AB97510A4D33975889ACE50116AED270FEDBB8CC056DBE86C3E
Malicious:	false
Reputation:	unknown
Preview:	/* CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _l10n = wa.Utils.Lang().checkList(),.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. var threatStateCss = "threat",.. infoStateCss = "info",.. greenStateCss = "green",.. waitImage = "wacore:mfw\\packages\\builtin\\white_timer.png",.. alertImage = "wacore:mfw\\packages\\webadvisor\\wa-checklist-risk.png",.. ignore = _l10n("IGNORE"),.. fixNow = _l10n("FIX_NOW"),.. defaultImageCss = "wa-state-img",.. alertImageCss = "wa-state-img-threat",.. keyMap = { "NUW": "WelcomeMessage", "UUW": "UpdateMessage", "CLW": "CryptoLearnWelcome" },

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	802
Entropy (8bit):	5.273846686579106
Encrypted:	false
SSDEEP:	24:xmp5UoZR3C3dDUUhiLKyFc43bZRmAmlpe:xmp5UoZJkxQ3SkCe
MD5:	7982B9C20165B033BE1F88883AFFA82B
SHA1:	4DE4FE6047572D42CCAEB853D3D1DFFF4DF98775
SHA-256:	076ACF0EEEC89A28E08C9096E024050AD9B430540B14BFE0FDCF0E26DBD8B354
SHA-512:	325A2D4B9BB08C74CC7376DB2A4BB2CB97771FB4D47475280E78DB5E218AF279DDD8FF9CD19C7FA493F780C056B0766D69455456FA94B1D8DC5D64EA38485925
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #454545;.. line-height: 24px;..}.....balloon-arrow {.. margin-bottom: -6px;.. text-align: center;..}.....balloon-main {.. box-sizing: border-box;.. background-color: #FFF;.. border: 2px solid #E6E9F0;.. border-radius: 24px;.. padding: 24px;..}.....enable-ext-btn {.. background-color: #4989EB;.. border-radius: 4px;.. border: 1px solid #EFEFEF;.. color: #FFF;.. cursor: pointer;.. display: inline-block;.. font-weight: 600;.. padding: 2px 8px;..}..//DE81568F6ED362F40C8AA13CCD4AA864BDD000DCD92046680306FAADD835D823DCB064C0CC61324739AF47CDD078C1CE6A50AAC20E82D6C3CB70C708DA1C31E0++

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1888
Entropy (8bit):	5.253488759268173
Encrypted:	false
SSDEEP:	24:+swDjYI2GNVMr7RHVMr7EVMr7VMr/VMrlTMNVMrkANVMCrnr8ymTQogY+ORMqOJK:NOjPOROneCZNIJCzsTQ++yPeGXJn
MD5:	27E7E89B1309E2B98AF7566A758A3158
SHA1:	FF30BDE28CF47D39E2583E004A62F4216348782B
SHA-256:	36149116DE6D38C83D0A25A8FD8B67A8A0F22DA3F00EF53B26FF0A64422538C0
SHA-512:	8ACB3E0888118DC56A8ED3A8EBF4035C78EC554E6DB32291B0721A3EA61A65B12F2C69E79D4F0250D25F2693F64A1FA015BB0B13F3A5061A760F3B6DE7ED20B6
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-dialog-balloon.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-dialog-balloon-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-dialog-balloon.js"></script>.. <script type="text/javascript

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dwtoast.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1653
Entropy (8bit):	4.925375952741318
Encrypted:	false
SSDEEP:	24:3JYmsL0yXFeRZ7kkbslksjsjjGbb+CDBXRDDNEVRK1tzZtg77OgKqDuGe2Tve/e:9ByXIcrH4fGbaYTEV6tk77OgypgT
MD5:	8333A157EC93C4BEC232C6F26A8FD583
SHA1:	BFEF15CE5A6CA45AA8C037BED585F999B28AF22A
SHA-256:	DC9A69C14E9E2B062613A635CD44DF4096D300305419F9D7BDCA527AA3DEBE95
SHA-512:	C9F0D0180E326D08BAE7BE15744304F8664D7616390568DFC6FF16399499F54644A991B7126947B660FDE742D5923F51AEF0A8E750277D561FD7243A79D9249F
Malicious:	false
Reputation:	unknown
Preview:	#wa-dw-toast {.. height: 245px;.. width: 425px;.. border: 1px solid #B1BABF;.. background-color: #FFFFFF;..}.....header {.. height: 20px;.. padding-top: 12px;..}.....content {.. border-bottom: 1px solid #E6E7E8;.. height: 132px;.. padding: 12px;..}.... .content img {.. margin-right: 8px;.. }.....content-header {.. margin: 0;.. color: #EA1B24;.. font-size: 14px;.. font-weight: 600;.. line-height: 33px;.. text-shadow: 0 2px 2px 0 rgba(0, 0, 0, 0.25);..}.....content-text {.. min-height: 32px;.. width: 99%;.. color: #53565A;.. font-size: 12px;.. line-height: 16px;.. margin-top: 8px;..}.....content-footer {.. color: #53565A;.. font-size: 12px;.. font-weight: bold;.. line-height: 16px;..}.....content .body {.. float: right;.. padding: 0 0 0 0px;.. width: 99%;..}.....footer {.. display: table;.. background-color: #F5F6FA;.. height: 56px;.. width: 425px;.. padding: 0;..}.....logo {..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dwtoast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	5.119582502459711
Encrypted:	false
SSDEEP:	24:V2sY0TYttGNVMz7tVMz7EVMz7VMz/VMzlGVMCqEjIYckUPiS6vw5n:3XT0tMv267CjjKkUPiSh5
MD5:	780203E1E2E92D762F56624CD1099FED
SHA1:	984F3F06630A6D46C019E4A829DD0156DB8C481E
SHA-256:	9FDF3A217679FBB54079213DA7FD8C9157F9D06F4E7192E9D9FD5128D11B7DB5
SHA-512:	41A036428F80A945A539BB5A65D742B98BE5A3FC345A271670BB6CF62352A3D987C292B2327200F8A99DC9526BFD4E139D8F119C6F7641FBD461C2C64B694FAA
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-dwtoast.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-checklist-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-dwtoast.js"></script>..</head>..<body oncontext

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2137
Entropy (8bit):	4.906784688797724
Encrypted:	false
SSDEEP:	48:UUzf2hkRg/q4HWcJ5/VFeICFeI75jYKubJsbnbIeIpq7Hfh5x:Uh2gy4HWw5/jC75jYbJUba87Hfh5x
MD5:	D795EE6A860972610929788A98B215A8
SHA1:	3D39927375C95ECA7F6B59A0FB39515B37A8F403
SHA-256:	39973EC6629D9EBD0C1687C2E76A0528D79DEA2905322697C39C0C0CD522B294
SHA-512:	DD50876C0FC00F45FEA84B2396B435B1A5B81680FAB97E7100C11C1DFF0888A47D56693DD1C84663814FD38B78870F5C053AC9DF25776DBE2B74016E06C97F04
Malicious:	false
Reputation:	unknown
Preview:	body {.. margin: 0;.. font-family: "Open Sans";.. box-sizing: border-box;.. background-color: #FFFFFF;.. border: 0.833333px solid #BCC3CC;.. box-shadow: 0px 0.833333px 8.33333px rgba(0, 0, 0, 0.254218);.. border-radius: 1.66667px;.. overflow: hidden;.. }.. .. h1 {.. font-style: normal;.. font-weight: bold;.. font-size: 16px;.. line-height: 32px;.. color: #383434;.. }.. .. p {.. font-size: 13px;.. line-height: 16px;.. color: #454545;.. }.. .. .main {.. text-align: center;.. background-color: #ffffff;.. height: 210px;.. }.. .. .main-logo-container {.. display: inline-block;.. }.. .. .main-logo-container .img-wrapper img {.. max-width: 105px;.. padding-top: 32px;.. }.. .. .main-divider {.. display: inline-block;.. margin: 7px;.. }.. .. .main-description-container {.. display: inline-block;.. text-align: left;.. vertical-align: top;.. max-width: 295px;.. height: 100%;.. position:

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2618
Entropy (8bit):	5.083657186997122
Encrypted:	false
SSDEEP:	48:3XTL/v26Tg88ChnR+5WbeIwEeIYOz+S2MN:9nXb1Dt2MN
MD5:	EFBC88E17FE44C149F377F31588BC494
SHA1:	CD9D378A679F50E622E163C0645E34F6CB14D90D
SHA-256:	CAD75AE3CEB6FF0AE2F00ED0B9264F69FA4E3DEA441059D6553142D4B11D7832
SHA-512:	3D8C8D3385EBB86A2AD420DF2C03FEF83D44E91A1F57E32C00CD31C55EE915452A389F59E0FF299D3150EB7E0D29AB3BC658EAAD242F16ECB67966C7C2C08F37
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-ext-install-toast.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-ext-install-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ext-install-toast.js"></script>.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4309
Entropy (8bit):	5.300966298097835
Encrypted:	false
SSDEEP:	96:nPT2likC/JkhmmVkH0zf6lui5TF2csEzkb0WDnt+lkz0tRZB7oq:SMvuhmmVXzf6gah2cBzzWDwlvtN75
MD5:	C48FDD6740B35066EDB87B6875A74347
SHA1:	916E9345E08C27BF1E4C380B76072543ACB305EC
SHA-256:	4794635A5B3C7179DCD6A9642F250914104C1CA16CE4F3F051905F3BE2208081
SHA-512:	F3763F476158084AF1492D722B864FC5BA692607069AC3E1E4A2874123E4A968A66E6B431046FE394510C62F5B14E9E11B4392E9AEA46513D2249F759D849021
Malicious:	false
Reputation:	unknown
Preview:	/* Download Warning Toast UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,... _instrument = wa.Utils.Instrument,... _settings = wa.Utils.Settings;.... ui.extension_install_toast = function () {.. var $el = {.... header: $("#wa-sstoast-heading"),.... description1: $("#description-1"),.... description2: $("#description-2"),.....acceptBtn: $("#button-accept"),.....ignoreBtn: $("#button-cancel").. },.... show = function () {......_window.ready(function () {..............// Set toast window size......setSize({width: "485", height: "265"});..........// Get settings data.....var toastCountSetting = "ff_extension_toast_count";.....var toastCount = _settings.get(toastCountSetting, "0") \|\| 1;............var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.WAIFF).get;.. .....// Initialize toast......init(lang, toastCount);.... _window.show();.......// Send telemetry for toast impression.....var settingTelemetryEvent = new Ex

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.947897963110471
Encrypted:	false
SSDEEP:	96:QSToxeyGItzC74o5BBiMAxI0Roty8QTzTuWjP4IMqQidjQFl1JuKOrzmdc4z+S3:QScxeyDtMzPBiMAxZtqIXQ6QhJZyS3
MD5:	F5D9337BD302C183FFE6B9613EA4E236
SHA1:	6C622ECF659AE65E7F6ABFED4FA831D230B51A02
SHA-256:	DDC6EC93BB8B7AE8C90D42476ACCC47CB7E9EE28B01A312346462AD54206151C
SHA-512:	40270893584E34AD27B7E89DE9466D08464A4A869D96D5CA414FADF7332BD02B7AD1F28725FA82D7EF8AF4A0973494CC8633A202F58F0A2E60933CF482591BF0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...~...h.....7.D.....pHYs.................sRGB.........gAMA......a.....IDATx...xT...G2..$<B...6.@?E...#.~U..b..Z.j......E........\...,.......A.V...A Iy.H2.y$s..g.'3.sf..$.{~.w..}.L....Zk..(A.....Q.&...`Q.n.@...j..Wz..2.I.....f...q. .%..[..x.:B...:.....F.a.,\....O...>.t:....`.Ut...Y..34.O'q.%<..b...B.I...q.%3.n....k..#..=F.J.5.9...;o.R.^...D.N_...9...i?..~A....k.%..l.kiU.\@....`...M.`.....9.L.n.%....t...9..;YK......aT......4-......yq.D.8...>1..."...v#.....]t..i$S..$..H.C)$...i-n.Q(5];S,.Utc......6.....4.WOr..%...-D6v.\.m.m.....r......@..6..1..fQ.......`z.e...J....I...At...0.;..B......?...,...0..8.. ...n...Y..o....r.6.b.......V...M.....v.J.d.K..y.Hq.\|....~...e.=_....x.t...x.x.z.i.%4..~.k>.n..$.&..^.S4s.c...!r...].3..}9M..Mz......u..\..6....=3N.=.#.N...SQ..i\...I.<M.~AdP...G.o....A=.}.L...N.R....N..[nQ<o.8..V.&...,......MMt..a...r.[^..F'9.Ix..t..N'.q.....N8.!.8..%...t...Q=..U[+..Lcs3..j...:r.\I.'S..."9....:Q...YR.WP5[<.w.A.m.0

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-options.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6632
Entropy (8bit):	4.866153600276078
Encrypted:	false
SSDEEP:	96:yH5SvRvxVoY2bZ8/C0jBkY52Q5YsYmgdFZR92QQ:yH5EvxVD2bSq4BksV5BLgd3a1
MD5:	D85127D3DE587FFAB5F4612C5AC0D3E0
SHA1:	FA8ECC74FD7542721B4B534D20C7AD58B8E6F083
SHA-256:	7CCF3BD2D7C7A9F622D9E5F610079BE908770E5CEAFAB34D0D4AB831DB9E23EF
SHA-512:	19A1F5960F0A83DE132FCE98363EDC5A5DF20026E4588569F2FC54AC8D0098F87BFF8CC610DC31CDDC3CCE2332DDAF3222D341CA23E7A95BE02924ECC64A0D73
Malicious:	false
Reputation:	unknown
Preview:	#bottom {.. bottom: 0;..}....#left {.. left: 0;..}....#left,..#right {.. bottom: 0;.. top: 0;.. width: 2px;..}....#right {.. right: 0;..}....#top {.. top: 0;..}....#top,..#bottom {.. height: 2px;.. left: 0;.. right: 0;..}....#top,..#bottom,..#left,..#right {.. background: #939598;.. position: fixed;..}....#wa-button-donttrust {.. font-size: 26px;.. right: 2px;.. top: 5px;..}....#wa-button-reset {.. background-color: #00AEEF;.. border-radius: 3px;.. color: #fff;.. font-size: 14px;.. font-weight: 700;.. height: 40px;.. margin-top: 12px;.. width: 145px;..}....#wa-button-trust {.. font-size: 24px;.. right: 3px;.. top: 4px;..}....#wa-close {.. padding: 8px;..}....#wa-options-about ul {.. line-height: 23px;.. margin-bottom: 0;.. padding-left: 12px;..}....#wa-options-content {.. font-size: 12px;.. overflow-x: hidden;.. overflow-y: auto;.. padding: 24px;.. width: 550px;..}.... #wa-option

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-options.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1526
Entropy (8bit):	5.25570253853118
Encrypted:	false
SSDEEP:	24:csY0TYJGNVMz7UAVMz7EVMz7VMz/VMzlQVMzkCZVMCmFgtH1ktGW0l3n0:3XT8sTv26ZgzCJtH+Gvn0
MD5:	81C70765140A8E9BE40807027ACF03A3
SHA1:	B38B00C29D5CCE9B7D952BCDE6ADC539B942157C
SHA-256:	55C67BC2845D164C2D705B446638C1CD8B5F1405C52EFAC385253E8F46D0C87C
SHA-512:	7EEEA12B002AB2150023E5866A7B4C8CE0F58C7B0B6E67BD8DE04A25E7DDD65ED7DC0CAA58F4BBBA1CBC4CA1B246B6CB20C9499B5DFF33AEC9E9A65BF3E99135
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-options.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-options-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-options.js"></script>.. <script type="text/javascript" src=

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	5.194228274529295
Encrypted:	false
SSDEEP:	24:xmp5UoZR3xQpxsVecZa95p4H3rn39UDSyPVhilb39U0M3JtEN8vWZRVcoPuVYyO7:xmp5UoZJxRVXw9n0gA3uBHEN8vWZLJys
MD5:	28D40C852249E8CCF2A2EF4C7B834322
SHA1:	443F58B4EAB82CE3E9210C436E0DE1544148FC35
SHA-256:	66189FF9558355C8A92FECB357A4CCEC9859D1A5D6F85471BA08A8BE5084AA65
SHA-512:	857419F2399CAB87E508974FBA1F59EE4352FB5BB3D67D500829F108DE667F1C9C1037A0FE27455A224EC67F77651AB9071BC712752F246CCFB6090F4CB9D503
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container /...balloon {.. overflow: hidden;..}..../ Arrow pointing up /.....balloon__arrow-up {.. display: none;.. position: relative;.. text-align: center;.. top: 8px;.. width: 440px;..}..../ Arrow pointing to the right */.....balloon__arrow-right {.. display: none;.. height: 130px;.. line-height: 130px;..}.....balloon__arrow-right img {.. display: inline-block;.. line-height: normal;.. vertical-align: middle;..}.....balloon__card {.. float: left;.. overflow: hidden;.. position: relative;.. box-sizing: border-box;.. background-color: #FFF;.. border: 2px solid #E6E9F0;.. border-radius: 24px;.. height: 130px;.. width: 100%;..}.....card__content::after {.. content: ' ';.. clear: both;..}.....card__content {.. ma

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	5.209091445837142
Encrypted:	false
SSDEEP:	24:+swDjYiRGNVMr7xnVMr7EVMr7VMr/VMrlwVMrkANVMCrAe+xdmn56+u0INBeRMCW:NOjPxuneCNIJCO06+PCBCB8l
MD5:	FB334AAAA3E3DBBD708554F436BD4B05
SHA1:	680EDC5F128241F2DF11EBDA7E08E09E3BF7F226
SHA-256:	6073F12EA4B71FBC0B66937B43319256A0BBD6DE3478FFEDF9F39524C2EE2371
SHA-512:	C30C2A5A72C838AEB97B319FCBBD0A1AB7DCCB82427D8A9753D61D796026CD47D62871D30CC2F117124BF6B779B393D0443DD9939EFF10FFB93F12D5A7A60D3F
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-overlay-ui.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-overlay-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-overlay-ui.js"></script>.. <script type="text/javascript" src="wacore:tele

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10010
Entropy (8bit):	5.211113023960669
Encrypted:	false
SSDEEP:	192:2Ar/3qYFqFmMKuhiXdeRh3tFuznLe7Q9HKmXxY:7SVIIh3tFc4QJrxY
MD5:	BA6916C132A7F76C263283D2BB7CFF25
SHA1:	D2CFC5C7BCF7D86EDF8360B38BB8B272CFA2A874
SHA-256:	F6E3E5231E66DF6F8A90391CA15587797C6BD28BD7280C5C6091E82604A8F0C1
SHA-512:	E453CEFDB60794A9240D01FE4E0C8060D2D1758C32473C4589772089A7FC7EDE3D2DFDCCE8F11D72D56F3860F682A1C9D636AD59885E1197BB7E1D2A8B093D55
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. arrowUp: $("#arrow-up"),.. arrowRight: $("#arrow-right"),.. balloonCard: $("#balloon__card"),.. contentText: $("#content__text"),.. cardImage: $("#card__image"),.. closeIcon: $("#close-icon"),.. waLogo: $('#wa-logo').. };.... var ENABLE_EXTENSION_OVERLAY = 0;.. var INTRO_OVERLAY = 1;.. var SEARCH_WARNING_OVERLAY = 2;.. var SETTINGS_OVERLAY = 3;.. var TOAST_OVERLAY = 4;.... var WA_EXTENSION = 0;.. var SS_EXTENSION = 1;.... var overlay = {.. types: {}.. };.... overlay.types[ENABLE_EXTENSION_OVERLAY + ""] = enableExtensionOverlay; // enable_extension_overlay.. overlay.types[

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2101
Entropy (8bit):	5.2439511062122754
Encrypted:	false
SSDEEP:	48:xmp5UoZJx7MdDjTPWfx9gczwPpCRulmzuQ:xArx7M5TPWfx9lzwsn
MD5:	4749C1B1FE040DB6A5557EBE8104F841
SHA1:	EB93C0501A8AB32DBD3EDA5807D65DC005E1CA30
SHA-256:	5B5334030A16E1F2176DF94B913C34157B09C1E4C9A3DFBE97107BE1A7A794BE
SHA-512:	AD3D5B0819079ABBBA8ACD0F34CDD002A1CF6F5B375BC0699957C384314E5DE32F16034D4C0E9386C28140E9B64FB4850988458E8F48EAA309705ECED5B38DE7
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container /...toast {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px; / Window width is 530px */.. margin-bottom: 6px;..}.....content__checkbox {.. margin-bottom: 16px;..}.....card__content {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}.....card__content #checkbox-question {.. font-weight: 600;.. font-size: 14px;.. margin-bottom: 16px;..}.....card__content .button__unfixed__width {.. background-color: #1671EE;.. color: #FFF;.. padding: 8px 16px;.. border-radius: 100px;.. display: block;.. margin-left: auto;.. height: 38px;..}.....card__content .button__fixed__width {.. background-color: #1671EE;.. color: #FFF;.. paddin

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2197
Entropy (8bit):	5.207114429879496
Encrypted:	false
SSDEEP:	24:AswDjYEZGNVMr71rAVMr7EVMr7VMr/VMrlEa0VMrkbAVMCrmglB7vURFWS4CicmX:DOjNlTneCp3IHCTRSFWSO7QmqPOcGcAR
MD5:	637A17B5F00228B37FC58B04FC386E05
SHA1:	49DB8B9A930B9390F00B27CAF0BBA1EEBC63A522
SHA-256:	24818AA6CF1742F90C9A11AC882EAC9593FA4DA3A982586C279AC7001A5936BF
SHA-512:	D1300C5574032FCF0D86D7E7152220A6399E32A98FD7B4F4A1457228672FB04438984027C1B0F4237496E78784321FD2670F0A812419878E062468A3580A81AC
Malicious:	false
Reputation:	unknown
Preview:	<html>....<head>.. <title>SS Toast Variant</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-ss-toast-variants.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-ss-toast-variants-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ss-toast-variants.js"></script>.. <script type="text/javascr

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.986982755466439
Encrypted:	false
SSDEEP:	192:lAGSRh8MezXoRYhsCSRyTe7TSlR2R1pUnoKWERjW18jEcYwNNGifXt:m3hFezXmYhncyTe7TSjg1unoKWyq18j9
MD5:	E6F75585EA76B898CA69E9113D847FDF
SHA1:	A263FD1812056DF7DEC35A00910BD3BE95A638C6
SHA-256:	2FC9150005A82BBB54CD35656D0D3BF024DCBDDC6888A74EC2EC2596C32FEC1C
SHA-512:	F68B473E3959FB3E9862AA5A2BE6B9F179BDAC188C10C4999EEFDDD837593D62767215A004A99647D85261712EDD1D02456B642564295AB7E8AA304ACD11E693
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. cardImage: $(".card__image"),.. cardContent: $(".card__content"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. checkboxQuestion: $("#checkbox-question"),.. checkboxInput: $("#set-secure-search-checkbox"),.. doneButton: $("#done"),.. toast: $(".toast"),.. setSecureSearchLabel: $("#set-secure-search-label"),.. };.... var variantsMap = {.. // Toast variation phase 2.. 1: {.. InfoTitle: "TOAST_VARIANT_1_TITLE",.. InfoText: "TOAST_VARIANT_1_INFO",.. Question: "TOAST_VARIANT_QUESTION",.. Label: "TOAST_VARIANT_CHECKLIST",.. ButtonText: "TOAST_VARIANT_BUTTON",.. T

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-bing.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1615
Entropy (8bit):	5.097559093205252
Encrypted:	false
SSDEEP:	24:UviN/rbeh3kskClt+GSq1lPDgrertqIKV5bZ0fDjA76VQ:UvitmrJpSqbb9AIKV52f/W6VQ
MD5:	35445629663CBAE768918FAEFE91CEE3
SHA1:	F9144262672142C849BE1B42EF31A65FC077EEB6
SHA-256:	4CE821A4DCB5AB1B256EF5EA8650A31B0FEF7A7491BE6BDDA2044269442B373B
SHA-512:	DF8A518311B7F23815A13537AFA3B115913C3B1DE38CFD3693A71EE3650E78232D8CACB2EC4AE612E8DBA19D9A03FA8D71FD6CF4F2B8E8B8B625569799626448
Malicious:	false
Reputation:	unknown
Preview:	body {.. cursor: default;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....#wa-sstoast {.. font-family: sans-serif;.. border: 1px solid #000000;.. background-color: #ffffff;.. height: 270px;..}....#wa-sstoast-logo {.. padding: 4px 0px 0px 10px;.. background: url(wacore:mfw\\packages\\webadvisor\\inst-top.gif);.. width: 100%;.. font-size: 17px;..}....#wa-sstoast-header {.. background: url(wacore:mfw\\packages\\webadvisor\\inst-warningbackground.gif);.. width: 100%;.. padding: 10px 10px 10px 10px;.. font-weight: bold;.. font-size: 15px;.. color: white;..}....#wa-sstoast-content {.. font-size: 11.5px;.. padding: 10px 10px 0px 10px;.. height: 142px;..}.... #wa-sstoast-content table {.. height: 132px;.. }....#wa-sstoast-content-caption {.. font-weight: bold;..}....#wa-sstoast-footer {.. padding-right: 5px;.. padding-bottom: 0px;..}....#wa-sstoast-content-check {.. padding: 0px;..}....#wa-sstoast-

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-bing.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2922
Entropy (8bit):	4.611967975501663
Encrypted:	false
SSDEEP:	24:x2sY0YYkGNVMz7OAVMz7EVMz7VMz/VMzl1urVMzkbAVMzkizVMCqU3jOB3+7f6Lg:jXu4v26mCgHgiKCe3JxON
MD5:	39AC2A85BB8632048148C3F42608EFC4
SHA1:	0E55AFEE8149AECF74D581C62DAAF78A6ECDE7AB
SHA-256:	54BB75E09495E6C5CC57F14C019A9B23BE4AE962882CE863D770922EA84FB6F3
SHA-512:	2B8C9EF3DEC5F3F347DCD3DCD2CDF1571DC345242B3CE55F2D67474FDF07753AA557242D5B0AA327F39639FBFD333B4CD64EDA2711D7C7FE7671E4789D4C9038
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>SecureSearch Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-sstoast-bing.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-sstoast-bing-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-sstoast-bing.js"></script>.. <script type="text/javascript" src="wacore:telemetry\\serializers\\Secure_Search_Toast.js"></script>.. <scri

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.108511289465179
Encrypted:	false
SSDEEP:	96:OWZxXMHRMrola7b6xEgPGquAED+Y8AAoYE9Yl5hpeA8h9Y/5hbqe51E5T9565Cg4:OW0H2zFguf+c9Ug9K7aO9Y1bMi
MD5:	730D7D17C9FD544EC2D9401D0F5CDD93
SHA1:	22D587C9C6341BC06333D6C17D6356D24017CFD5
SHA-256:	68E89F001569F2181BA3312C297DE67E09B9D4F66621F250B5209810C480A402
SHA-512:	543E5A0DDC82ED1A7297919FF274368B04DF33A83A00FDAF574482B3D73FA810E2245F3FA195ADF31C3F2B118682ABAF61406D79E0E0FD0862A82FF2B93BB75C
Malicious:	false
Reputation:	unknown
Preview:	/* version 2 3 /.. {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container /../ version 2 3 /...toast2_3 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;..}.....toast2_3_larger {.. width: 761px;.. height: 565px;..}.....toast2_3_smaller {.. width: 761px;.. height: 500px;..}..../ version 1 /...toast1 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px;.. margin-bottom: 6px;..}..../ version 2 3 /...card__content2_3 {.. background-color: #fff;.. margin-left: 297px;..}..../ version 1 /...card__content1 {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}..../ version 2 3 */...card__

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3957
Entropy (8bit):	5.047877816447989
Encrypted:	false
SSDEEP:	48:jMsaURv265bWgHZNY0TUYoAzgs3CZ4ea9S6ghD2QXIanv5DTuad:jjbLe9Yo2gs3JeacVDfXIanBvld
MD5:	F3BF07B08F64B3E1B75A7E14A0373F74
SHA1:	D09CDED055D1F3B57ADCE0FAE7A4F825C12E8B23
SHA-256:	DB20E6B3D532057A7FDCDB78613C911A7E2A2683188F83435AAAA5989F401A4B
SHA-512:	734B8A5FCFE5F37546972EB9CDA1D31AA59991571757CC8D15EB60759E4865402C254DE63432531341C120BB07BDD9F707958502A92273D74F9C240F862E34A8
Malicious:	false
Reputation:	unknown
Preview:	<html>.... <head>.. <title>WA SS Toggle Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap".. rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-sstoast-toggle.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-sstoast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\weba

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9376
Entropy (8bit):	5.150088451081154
Encrypted:	false
SSDEEP:	192:lAZ3m0aWPwT0JrrvG1zuLIhHQnJC16wZ+3Fo65DcwGWlgXN:mZ4j1yDJG+1opSsN
MD5:	ECE9ECD91B43062BFC70F6F4F6E84A26
SHA1:	89834CEB1B7D9983CEB0B54F5E09F2551D02596A
SHA-256:	912626A265E357CB623C9D4E5A94CEBFD875EA19A72BE6D421C0925BC4393049
SHA-512:	564C81FBACDCC927AEDF5EE4FAC267BB0E33B90EA70BA1BAAC4FF80F44DB9CB9958104951FDE384782696D010DD26445A4FB55D4F27C0C2C22E8BBAAE26473A6
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. cardContent: $("#card-content"), // different css for different versions.. cardImage: $("#card-image"), // different css for different versions.. featureDisabledSection: $("#feature-disabled"),.. progressPic: $("#progress"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. expiredSection: $(".expired__section"),.. expiredDivider: $("#expired-divider"),.. expiredLabel: $("#expired-label"),.. expiredName: $("#expired-name"),.. feature1Label: $("#feature-1-label"),.. feature1LabelContainer: $(".feature__1__label__container"), // dynamically change container if text is too long.. feature1Name: $("#fea

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2118
Entropy (8bit):	5.175938652982185
Encrypted:	false
SSDEEP:	48:UfqttN0I4H0m0UY60uR60BFvUIFaSvU49xRstVOvQ:UfqttmhR3F7aSp9O2Q
MD5:	E0BC2D78A9F494A46D290B0E8CDF8A45
SHA1:	D82A38BE072A5205A8067ECA63E16B62B3DF3CEE
SHA-256:	0F0E0677EC02FFAAF5014DADC60CF62D72E4882B7BE3579B526F90209F1E1B3F
SHA-512:	6EDA1C944D054AE36B93D0A7AF0BDE8D1DFDC35BD2C2FFEDDF93B33EDEC72164B8E7A24F5D9E685478D14017E6A8D640F4EDF4C5ADD8B8220D12E89AE1113139
Malicious:	false
Reputation:	unknown
Preview:	body {.. cursor: default;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....#wa-sstoast {.. font-family: sans-serif;.. border: 1px solid #000000;.. background-color: #ffffff;.. height: 270px;..}....#wa-sstoast-logo {.. padding: 4px 0px 0px 10px;.. background: url(wacore:mfw\\packages\\webadvisor\\inst-top.gif);.. width: 100%;.. font-size: 17px;..}....#wa-sstoast-header {.. background: url(wacore:mfw\\packages\\webadvisor\\inst-warningbackground.gif);.. width: 100%;.. padding: 10px;.. font-weight: bold;.. font-size: 16px;.. color: white;..}....#wa-sstoast-adblock-content-subheader {.. padding: 0;..}.....main-content {.. font-size: 12px;.. padding: 10px 10px 0px 10px;.. height: 118px;..}.....main-content table {.. height: 108px;..}.....main-content ul {.. padding-left: 13px;.. margin: 15px 0;.. padding-bottom: 10px;.. line-height: 17px;.. font-size: inherit;..}.....main-content ul > li {.. padding: 0;..}....#wa-sstoast-content-caption {.. font-weight:

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5592
Entropy (8bit):	4.099961219081125
Encrypted:	false
SSDEEP:	24:m2sYRYkGNVMz7eVMz7EVMz7VMz/VMzl5VMzkbAVMzkizVMCqU3jOB3+7D/6LG3BJ:SCxRv26GgHgiKCe3GyfmJb
MD5:	07193049A42E86AE5A4ED8ADF31D079F
SHA1:	DFFAB9ED64ADE07265B3AB3E329050D301E5FFEC
SHA-256:	8DF3543BF8003C36BD70856F750B0D7ED1660FBD1858997081E93A989BB4A585
SHA-512:	018A9FED6502FE5152ECC35F0894334921B507906CA21F7BE9D380B51DD259839C5FA79769733D11D96D3CABDDBCCDC0269A6A503712DFDB010D1FD6B8E59695
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head>.. <title>SecureSearch Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=8" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-sstoast.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-sstoast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-sstoast.js"></script>.. <script type="text/javascript" src="wacore:telemetry\\serializers\\Secure_Search_Toast.js"></script>.. <script type="text/java

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dialog-balloon.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3342
Entropy (8bit):	4.662005882373045
Encrypted:	false
SSDEEP:	48:B4j7B2AacfdwtxqA5JBbIVXjQB6UQVVPhPkzYOEbFQO0HR/1xRzi1CePNXDk5R:scAa+dwtDDRgVVPCxEeO011xReXDk3
MD5:	6029BF18CA747818FC2F39C6D4135575
SHA1:	A9B47B0514C06C7B148402A1967342B48B35A6F8
SHA-256:	C62B5EE272D469F56B1179DDAA15F1214A4A09D859A184E803B47FFB827D664E
SHA-512:	D273C81E3D1D3A8FDDD470C0D67D01E5183F42CAEC6F9B79FFC30D648679DE77F27780F0FB84D46B667ADEA3F99E2B903D9EFBB6F0F0C0F4C57AFFF249828993
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. button: $("#wa-dialog-balloon-button"),.. content1: $("#wa-dialog-balloon-content-1"),.. content2: $("#wa-dialog-balloon-content-2"),.. arrow: $("#mc-dialog-arrow").. };.... var telBalloonType = '';.... show = function () {.. _window.ready(function () {.. var settings = JSON.parse(_external.getArgument("overlay_data"));.... if (!settings.balloon_type) return;.... init(settings.balloon_type);.... _window.show();.... // Send Telemetry 2.0 for dialog balloon showed.. var telemetryEvent = new OnboardingBalloon().interaction_type("Impression").browser(_instrument.ge

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dwtoast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2413
Entropy (8bit):	4.802631613143108
Encrypted:	false
SSDEEP:	24:kvYp45+NkVjY2wHhFJzq/n2TLBvlbK1qXzeABoAK5m8IAKjdp0t9N56ZgNkwuuj3:H45ikVjkpq/nWp1qgVsk0HuKAh51nhun
MD5:	23187B264E8EAD4DA29E78DE49681B21
SHA1:	76CA2EE346F7CDAE520CF647739E7F1B756E1BB7
SHA-256:	E283EB634FF70222EDA16FE555A9957B8FC83F7BA9E2FF43FCBE661888D53883
SHA-512:	09D2D02B6CAEA58BEB65BE6C0A7662486A24F16B65DC58A8C6AEFA1E7A13912343EDD0331346F24ACFBA71D41C021C9965CE823AD554207BC498BD176FF2D974
Malicious:	false
Reputation:	unknown
Preview:	/* Download Warning Toast UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window,.. _dw = wa.Core.DownloadWarning,.. _wa = wa.Core.WebAdvisor,.. _l10n = wa.Utils.Lang().checkList();.... ui.DownloadWarningToast = function () {.. var $el = {.. logo: $("#wa-dw-toast .logo"),.. status: $("#wa-dw-toast .status>span"),.. content: $("#wa-dw-toast .content .body"),.. block: $("#button-ok"),.. allow: $("#button-cancel").. },.... show = function () {.. _window.ready(function () {.. var domain = _dw.getDomain(),.. fileName = _dw.getFileName();.... $el.logo.append(_wa.getProductLogoHtml("wacore:mfw\\packages\\builtin\\mcafee-logo.png"));.. $el.status.append(_l10n("PP_STATE_TEXT"));.. $el.content.append(.. "<p

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-options.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23745
Entropy (8bit):	3.8933965607220977
Encrypted:	false
SSDEEP:	192:LravuBFTv2stBHDiF9ymq4pnU5rnXEBF15hZOmvYkydOergIo4:PavuB92qBHDdmRBU5rXEBF1VJy9EIo4
MD5:	2E7D059760CFC206C7C33E0A0D1DAA31
SHA1:	52395E689ECE61074B5F024675764AA5235AD58B
SHA-256:	167CE8969EFE72D02EB543EA186B47CD596510AF9AB3F5BDFD50D9513016D560
SHA-512:	4D473C5C0A5F23301FF7867630CFF26F73F399B5911422449D788C552795A4ECA7D23647042903BF66BAD05BB27D7B6CE0C34388101FE5944D10F9FEB96E357C
Malicious:	false
Reputation:	unknown
Preview:	/* Options UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.OPTIONS).get,.. _core = wa.Core,.. _window = _core.Window,.. _webAdvisor = _core.WebAdvisor,.. _productNameHtml = _webAdvisor.getProductNameHtml();.. _external = wa.Utils.External;.... var OptionsMenu = function () {.. var menuItems = [],.. el = {.. $menu: $("<ul id='wa-options-menu'></ul>").. },.... toggleContent = function (id, delay) {.. $("#" + id, el.$content).. .fadeIn(delay).. .siblings().. .hide();.. },.... itemSelected = function ($item, delay) {.. $item.. .siblings().. .removeClass("selected").. .

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-sstoast-bing.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3660
Entropy (8bit):	4.763153836497376
Encrypted:	false
SSDEEP:	48:445jWijMxhfOx/2NdFobmZ5oncCl/QSt/QBmy/Qe5O43XlSq:bjv23F2+5onCFO43P
MD5:	62751FA12333224C02D83DBE55EADB20
SHA1:	05218698D535A43347EEB4E8EF0B885F95E6BB68
SHA-256:	7A5D556D985877157C9CAABD3B7C80E74ADABD99E660662CF063AA7C1B068695
SHA-512:	B3B2E7B071774DA1ACDE4617D55093A4E8CA182157D82945A399FC883D45249B87298FB34F0B7158661FD6896E98E5196A8E7C75A630A14C1B6FE62C801F5A1D
Malicious:	false
Reputation:	unknown
Preview:	/* SecureSearch Toast UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _window = wa.Core.Window;.. .. ui.SecureSearchToast = function () {.. var $el = {.. header: $("#wa-sstoast-header"),.. logo: $("#wa-sstoast-logo"),.. subHeader: $("#wa-sstoast-content-subheader"),.. caption: $("#wa-sstoast-content-caption"),.. subFooter: $("#wa-sstoast-content-subfooter"),.. submitYes: $("#wa-sstoast-content-submit"),.. submitNo: $("#wa-sstoast-content-bing-no").. },.... show = function ().. {.. _window.ready(function ().. {.. var toast_element = document.getElementById("wa-sstoast");.... if (!toast_element) {.. _window.close();.. return;.. }.. _window.setHeight((toas

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-sstoast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15681
Entropy (8bit):	4.873255379533328
Encrypted:	false
SSDEEP:	192:QODJo/vVNYs2ebppb08qb1WAWxJK8ku6sI098/CdQkrriKSpKKBS6aYSQwuHcBzM:Fi/vVNQeo8yCdI098+oYupqm
MD5:	32E0379BA8A34152B541919D243716EA
SHA1:	58AC68813AF4FEFBACBE94C677EFED33179DC601
SHA-256:	76B8937A0255718F964A966FFF03972A6A4DFA689523E99AF364F9FCC304AA6A
SHA-512:	642D193E3D238F3418C801CF28AA8BE6880A4360E31A3EC26F310FCC738A9FC0F1439F09468194A791B9708CEA6E61719EF7F306E9FA3B5D6792AC8AFB24BD64
Malicious:	false
Reputation:	unknown
Preview:	/* SecureSearch Toast UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI \|\| {}),.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _window = wa.Core.Window,.. _external = wa.Utils.External;.... var TOGGLE_COUNT = "toggle_count";.... ui.SecureSearchToast = function () {.. var $el = {.. header: $("#wa-sstoast-header"),.. logo: $("#wa-sstoast-logo"),.. mainContent: $("#wa-sstoast-content"),.. mainAdblockContent: $("#wa-sstoast-adblock-content"),.. mainMavContent: $("#wa-sstoast-mav-content"),.. subHeader: $("#wa-sstoast-content-subheader"),.. subHeaderAdblock: $("#wa-sstoast-adblock-content-subheader"),.. subHeaderMav: $("#wa-sstoast-mav-content-subheader"),.. caption: $("#wa-sstoast-content-caption"),.. captionMav: $("#wa-sstoast-mav-content-caption"),.. label: $("#wa-sstoast-content-label"),.. labelAdblock: $("#wa-sstoast-adblock-content-label"),.. labelMav: $("#wa-sstoast-mav-co

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-danger.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12312
Entropy (8bit):	7.968450241648148
Encrypted:	false
SSDEEP:	384:yRBdas2d1PJ4BYvAHpw+9zCUu3lsOgtPaITUL:6UdVTUoUTHs
MD5:	4FB51E8F6008C7C9C8F0A1075BED12A1
SHA1:	39C35D6482BF2D7B8A347991BC99F4EB408B7FE7
SHA-256:	866910A9732E353EDFE938958BF6F4B6FF03FFA6B90589BD03C44011D2E41C37
SHA-512:	6C39FDEB9036823547E8515A7F0505B41A519F5F70D55A1D2B51A10B9FAC6D8738EB3D78D2DE2BEE55666C5712A4753D72450760B69836C7F1B71577760FD99F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............4r.....pHYs.................sRGB.........gAMA......a.../.IDATx...\|....vyU.xO.. ..8.%!.8.PJ......t..RHx....@[.......@i...-.<..H..%....x..y.l-3.+.<.G.i...~>.F..5.9.=.\.,,tp.P...rr./~<...h......a........A?.i.m.R.y?9a.y....".......0.,0-........LS,!Y...al...G..k....V.a.NGQ....p8.o.A#..<...<...0.+.`..0.....!...k..Y.x..ax~-....T.8w.t.T^...`..&.a.#.h......}Z.8...(..4.^L2.....&X.M0<.....B.T....d..62......`....,...'f...I<R.....!..t.T..(,.e.."......x..9...Z..(0.BH.]...2....lS.D.'".h)$kU.. 0....:M...z..6`..1.1.\|.VI.%.9...3.B.NS&......i...G..i.mS..M...f....x2!.5.....:M......y(......V<...,.%....!.W.d........s.:.BJ.W0...WO.!#.b.E..Z.fP0..r./.j.....lq....M.u....L....3.2PLD.O.Ao.!,.!?.....2...iR.D..[Y...-,. ..d...cC[.%..,,..a..U.m.<.4!%D....`aa..d.L..%".."_.......,.YL.d.\|s{gp.L1.......Qv..I....38.q......*pH...j..0!.u..,..XXL.SV.j..p4..1...w...k....$.s...:.e^.Dd..`...g.>.dr......U.b.O.....&.Drr.."_..C..MV..."a\.V.."?.B`.3y.y....E.

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-risk.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9639
Entropy (8bit):	7.959929359756836
Encrypted:	false
SSDEEP:	192:8Sx+XNV33b9KE2nQId+RaxmxmDzMeRPGUhtGrnGyzcgJSzJKlkY+BjJJnjYdSPay:7SX9KbIRARfvRtklzcgJS1Ukz7hjYdJy
MD5:	0960D91DFEAF52DB02812BF775B62C55
SHA1:	125D3E9976B984B6BFDD698140626CB92D393722
SHA-256:	9E7C4BF9C4911967D24A948BFFE7268F5925A1B1E3DCD5D9CBEB7721DF32DF24
SHA-512:	C2AE53F305F34A3E6B0EF8E29A1E21A477C4A62F6AD27A69A91C7F1CD601A94DA1012341169F7E11C293D12AEC9B07B14CCB23185829A8C7F05FE0EDC718B681
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............!J.a....pHYs.................sRGB.........gAMA......a...%<IDATx..{t...._..j..%...`.....!..q.....&.N^..$....Hrv.....v...........l2I&..a.....O.[......l...WU...[.wwuwU...9..]...T..=.D".H$..D".H$..D".H$..D...DR.}}.@.-.iG.k...D........RH..\..&..r.M.\|..j:.M...a......a..Dkk....)$I.I.pU...w.C.P].p..ok..."bA....>..T.r.!\.&.....R..8..9...8.(..F........;..K..wp.N).rB.){...\gk0....$..]twd..#w.\...Bh.0.....j(.R..\....7..8.o!..B2-O=.g.}..),.0.....5'..{.).i.ZW5....UBrP@9..`w.b-....6!.]..O.B1.o[h..5B........r"\A.]..]..B....S{..\|....6.\(^B.4.n.o..g...Y+7.q]...N5.R.Hx.....H.Vz\?.....$3..l....Xr.....Z.{.bj".Y.=.v+d...z.J\..1;2...a.(.`].r....U....8..S..../{d1.A/@V..z..,.o-..MF....&.(.S'..p...V6.w..7.N7.z..i.Lx...vCB..P.(".,..K5pe...l<$q#....B.P..+,.=.H....d..fE.......].FL..I.H........7.G..$...W..>..D..EH.X....H...'....FT]H...9....[.\|.5..1.Yl...!...C.......TMHT..;...Z....:......q..I.I...G.N>TEHfrA..I.C...G. ....(.K&.$....

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-wss.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9195
Entropy (8bit):	7.974458734523204
Encrypted:	false
SSDEEP:	192:qSgxF7Rxse5mfaPumPCqZplpMCwhsoYl6Va1uaOyplM/0zPMyWEu0:lg77RxsRaJCqD/twhsFl6VaD5KyWEj
MD5:	985990E7B49221E68CA85928ABFB55B6
SHA1:	A625326AFC180A99526B9C1E36C85718A8AE4E53
SHA-256:	6FCA27CE0ADD2712EA1CBAF52291BBC2C9AA3E5B8411348DA4459082E53D456F
SHA-512:	AD415F9B2242675A26DFD9FAB9DCC9E2BA02191EDFB4B938C688458E92379263C9E1357EEDF8E97D4956E3A28E69D59A80C6FD23777371A33CC1A02D2AF45181
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......r........j....pHYs.................sRGB.........gAMA......a...#.IDATx..].`TU.=.M.d..R.%..{...M...(.k..UDqw.U..]uuw]...H.^..RB...u..3...L2.2....}.d......0..#.0..#.0..#.0..#.0..#.0..#.0..#.0..#.0..#.0~.h.v..W..#..%....]..M....e..rA.iI.>q8...E......qI.Y...T. ...Hr..]..{.V;.....G...S.J.........Z.Y.6...(...Dv.%%l"`..`.%X...m...a...J.#...,.....G%..:]...I.^9z..-."#.......B...%(a..0:t.0.`<.@.K:?!G.@...42.`..%..X..\>z.3R..N..}.b..%..:A.N.B..>...d.H0X...C..H0"...,..m.EQ...t....N....Fi.v.Z"y#SE..U?M.....mv...S...T.[.7.'.T.0<.,..E..%:.ce.Go..g...&G.U.A......;.m.E.k6...%..2.tt..#J.w...\|X~.R)h.g.a...6.(c........U.UZ..$.1a.........Pq...+.%....`....p8.6..ZNoWl...8.....$.#.$I{.m4.+`.7...0..B...SC.e............2....;..E..A.H3.^.}.W..E..9.....).Bs.b....K.. .q....q. (...... ..........`.....*..s.........C s..6oJ..Q...F.I.&..Q.N;v..... M..~D..P..Z'Ga.<..{%.....<l...')....A..."..ATT..x.z.c..B...A.q.k.....;...M....0....5.6n.P.7.......w.(,.%..

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	5.140156593981553
Encrypted:	false
SSDEEP:	48:Uk73uxPuaasQ8+FQv2xfdleIileIjOmkRlYWBheIpJqqeGzeNeIp5eNeIIlWK:UDj+aOxf7KjiRlYWBxadt+tO
MD5:	A8E51966D283CC0F19798CF64913E287
SHA1:	147AE708F8919983C25358D7019652C83FF60C57
SHA-256:	B07E793B017088D130D111ECD8C5A0C84F3A11CCE260C38E28D28B575F445F1C
SHA-512:	315923FADA49DF24610343B9693C608DA30B2267600A7A5877C0099FFD3F5F6C7D93E09DE5464201B065841A31946F1ED93965731FFF1274459649A94CB2D761
Malicious:	false
Reputation:	unknown
Preview:	body {.. margin: 0;.. font-family: "Open Sans";.. box-sizing: border-box;.. background-color: #FFFFFF;.. border: 0.833333px solid #BCC3CC;.. box-shadow: 0px 0.833333px 8.33333px rgba(0, 0, 0, 0.254218);.. border-radius: 1.66667px;.. overflow: hidden;..}....h1 {.. font-style: normal;.. font-weight: bold;.. font-size: 16px;.. line-height: 32px;..}....p {.. font-size: 13px;.. line-height: 16px;..}.....main {.. text-align: center;.. background-color: #ffffff;.. height: 220px;..}.....main-logo-container {.. display: inline-block;..}.....main-logo-container .img-wrapper img {.. max-width: 128px;.. padding-top: 32px;..}.....main-divider {.. display: inline-block;.. margin: 5px;..}.....main-description-container {.. display: inline-block;.. text-align: left;.. vertical-align: top;.. max-width: 295px;.. height: 100%;.. position: relative;..}.....main-description-container p {.. font-size: 14px;.. line-height: 20px;.. color:#000000;..}.....main-description-containe

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2634
Entropy (8bit):	5.07519212964497
Encrypted:	false
SSDEEP:	48:cXTxBv26HgOCe8+DSSqoFbeIwEeIYuA5kIt:L8zFb103
MD5:	771128AA0F125B6506E2BA7580C8F44F
SHA1:	D32EB9E37564CC31BCF242C3FD0CF0940E35983F
SHA-256:	C49BB7DEC6B7640D688844895C4E162CB2BE4D7B0D0D037C80F1B750177ECCB0
SHA-512:	52642D2CB5D2352419554416D93626232A398DFB3B304160AEB5D8AE651C8E5663D80E33430E2BAA0A66F4E4741F2679772E24BA5A1EB7EDC56D05118C763993
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-upsell-toast.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-upsell-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-upsell-toast.js"></script>.. <script type=

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12796
Entropy (8bit):	5.0590866608956935
Encrypted:	false
SSDEEP:	192:80/Pf4lTvqz3NbDdvSNOsxyVVXMT2OpbNg/0u:JPf4lTvECBxyHcTRfi
MD5:	BC93F971F8F5DD93DA7EA0DC34A5F367
SHA1:	B973969F2FAA8558FB4F1BAFF0C41BAEEEE9B109
SHA-256:	CFC6AB673202BF1FC95EB32071D604168EEB34A6691A59B22D7440CC19815571
SHA-512:	70CD245EFFE76340A502132AF3768FA638848CF2807A8BD234235CB2DA55D5A7569FCE388AFD6518652C49103FA5CD773DF588C0BD399A3B95A44FBBDFA18D5F
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings;.... ui.createUpellToast = function (toastData) {.. if(toastData.campaign && toastData.campaign !== 'none') return new ui.CampaignToast(toastData);.. .. if (!toastData \|\| (toastData && !toastData.cohort)) return new ui.AvScanToast(toastData);.... switch (toastData.cohort) {.. case 1:.. case 2:.. return new ui.DirectUpsellToast(toastData);.. default:.. break;.. }.. };.... ui.extend = function (Child, Parent) {.. Child.prototype = Object.create(Parent.prototype);.. Child.prototype.constructor = Child;.. }.. .. // ----------------------------.. // Base Toast Object definition.. // ----------------------------.. ui.UpsellToast = function (toastData) {.. this.data = toastData;.. this.lang = wa.Ut

C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\warning-icon-toast.png

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1793
Entropy (8bit):	7.876784630522941
Encrypted:	false
SSDEEP:	48:qaOARKiy6Zk/fIEJo8VsjZhQ78P49eiQgPO4sP/ulgafKd6c:/OATy6Zk/1x0TQg+wvPmlga1c
MD5:	0649B7E9A67DE6931312BDB5BE3FA6D6
SHA1:	285B792941D7CCB34ECC8749A367CAFE4A51D4B1
SHA-256:	CBB5964B1888A95703984990FBC9C71448ACBA8A5E19BC0A96E626C2129F7E22
SHA-512:	12B8E6C4F3EBFF51BA6CE1FE66D737461CD0C30F0B9E65443256886DDBF9E1518E3A26D9186CD8F2CA95EA09D35F910372558BE1C997073E0E26603C4DABC22E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.../..........\|p.....gAMA......a.....IDATh..Y]l.E....R....?.y.A@1.mi.)F.....#J.F.'..O.Q..#Q ......>hPH...X....b[b+..@.Q @....{w<g........W...9s.7...93C...7..e.b..\.d.....d!..'......G.....k...2.1J.a.6.1!.{.E.0..r...D.....I.5k.../.@..&QD.j.oW.....6...}.2...\O..,..f...q....U...1.....Lf..U....bs....:.0!..?Q...j.e..;...X...qN.JM.[..../....=..2T....T?..VcR...qFl.._.T@.s...rP.....L...3!1...L.Z..xlh0.....Tr3..D..V......^.^..t.....3O.ED....8j8....k.E.`...{.>....v8...R...@.8.R_.. ..\|&C..?.....rG..( .y....}.z.p.28w.....k..v.7.~.......7F\|.. .@.8"..,..L...Q....7.a......oI.z.f.{.j...`......}g.....!Y.... ..J2p..IJ...2...X..G8..Y.. N}..t...26.....M.._.....c...fs...{....)t[.,....e.&............t%.PX...W)..%..........t.`>.....7...H..s.CW..........u}.nS...~...&O..1...C}.....#..G.IH0.mjj(.._....M...=..C2..==..V&...~1..?...en..M...\.Q.%...B./.g.S...... .#.(......q...jb......p;../5.m.T..-...SE.h..(.\|le...[.*!...=:TJ..!m..q2..CI.$

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\custom-checkbox.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.398370766213392
Encrypted:	false
SSDEEP:	6:KYCutJFlCutfwEr+gCutF3GHFUUsMLR4SWJhZlQVoWvLLnMfn:lCu77CuuSCu3ZUsMLaJhU+Wng
MD5:	70E015F4BF2A1075DAC01A4B85102721
SHA1:	DCC6CB8CF7EE78207BB68F1F16CC0CAEF907AF9F
SHA-256:	E606B54AB3B9DA665BCB51E868E6B3D2FC3D5F323BAE58772626A5F4E6B7A178
SHA-512:	3187C334CD5077E1CF33E6F4B9383D7BD9A73B1C2BFD1A8B6B90ACDE731435DCBED930DE768F9391C59E421C87FC71E3DFF6C577DB637C91C344C19066A00D53
Malicious:	false
Reputation:	unknown
Preview:	input[type="checkbox"], input[type="checkbox"]:checked {...box-shadow: 0px 0px 0px 1px black inset;..}....input[type="checkbox"] {...accent-color: white;..}....//B3ACFA8980C72DAB04DA953D789A7B2385E82801166DEA22C6E23C8B50595E569A9ACF2AB15392FCB48598BF65766CC40BCBB38C872F66C3A1C039BA8CD5EB4B++

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\jquery-3.6.0.min.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	89637
Entropy (8bit):	5.297835496012865
Encrypted:	false
SSDEEP:	1536:ejExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1vK:eIh8GgP3hujzwbhd3XvSiDQ47GKM
MD5:	6FAC5DA12024D65BA4925C615D4784D0
SHA1:	EFB17740DF169E91A0E8C6A9653963C8150885AF
SHA-256:	FE757A4C53515A29CDBB4D49C82F3B15FBC39989363EE1EB6BEE03835DB24F2B
SHA-512:	132AB7A72B3BD6B01A3B7C88D5A9E23F76D01D0BFAA3C10F43C98BA54A5078F255E8D05324B57DB18EE13AD59E1D6A91EBCB2EC06EC523057EE2E3846CA74559
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-common.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	34187
Entropy (8bit):	6.0477937115799465
Encrypted:	false
SSDEEP:	768:E9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZt:E9DDI6thXjez1jtnc
MD5:	AED816962FB2FC71AF77DEDB42480127
SHA1:	BB86B01785AA598E893B976D0347E5ABEAB75452
SHA-256:	08243ED87F8CAEDED8CA4223E8554C67CDEDCAE733222F69626032653DF984F4
SHA-512:	9D042548C8839E72A4FB11A20D16A827BAB271A99E5F1AD61CF47254F35649A48DFF12DEE052FA26B9C9085EE32D1C8B0BFA9BF9D343D1553B5147797284EFD8
Malicious:	false
Reputation:	unknown
Preview:	/* Open Sans Regular */....@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXh

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-common.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	853
Entropy (8bit):	5.3199539768797655
Encrypted:	false
SSDEEP:	24:2B/hPp825C8dJK5VKv5iP5h158qESea0gUHRG:Y/h2P8dEnjPESUHRG
MD5:	C6A064710190EAF3CB91CFF0219E1887
SHA1:	0AD4A6D0CE911E9D06B88C14E3143306EE08CA8F
SHA-256:	97C4B850C1AD4B35B3F6E13605FF896F61FF84314A70D9393333753541124721
SHA-512:	48A53271421497B5BEBCCA8F7F764864606F0FA27EC0DF4F5A2210E837C0159BDB7BB03865771D31AD538294CDEB7B3D44E51CE8117A131EDD92017D3CEE19E8
Malicious:	false
Reputation:	unknown
Preview:	(function (wa) {.. var common = wa.Common = wa.Common \|\| {};.... common.getColorAndStatus = function(score){.. .. let color="red", status="WA_ST_SCORE_LOW".... if(score<400){.. color="red".. status="WA_ST_SCORE_LOW".. }else if(score>=400 && score<600){.. color="yellow".. status="WA_ST_SCORE_FAIR".. }else if(score>=600 && score<700){.. color="green".. status="WA_ST_SCORE_GOOD".. }.. else if(score>=700 && score<850){.. color="blue".. status="WA_ST_SCORE_VERY_GOOD".. }.. else if(score>=850){.. color="purple".. status="WA_ST_SCORE_EXCELLENT".. }.... return {color,status};..};....}(window.WebAdvisor = window.WebAdvisor \|\| {}));....//9C960C3390A50A391CD5EFFC84F365DB36ED5ECA3298FFCA78AA46A63F8B4AF0FF507660D9A100E12672C8A8F28346FD369B40C3D96EC2B1D00717309471E1FC++

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-core.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23487
Entropy (8bit):	5.12089992478463
Encrypted:	false
SSDEEP:	384:GZCfU5OMibTTqFf3+CyZRCDqRkaPUEgpLS5ueJw+dc0cbT4M/5cWal1fGR:GZCfU5OMiLqFf3+CyZRCDqRkaPUECLgA
MD5:	FA00F7D07559DC8EE12C71F2245DBC35
SHA1:	592C0F53259F769758F0DD415C49B9A267908D14
SHA-256:	814DE86ED11DAFC190560A927996E163A5CB50ED1BF69A459490AADDF0DD744C
SHA-512:	BB23C8A285D4D75E2825FF6FD064F8F8A091265809A38B6BF9D35B39CF4610E8A501686D681657834B4CFE0AFC1C675851948A9194E31DF3F8BFF51EA4BA6017
Malicious:	false
Reputation:	unknown
Preview:	/* Core */.(function (wa) {. var core = wa.Core = wa.Core \|\| {},. _settings = wa.Utils.Settings,. _external = wa.Utils.External;.. //Component. core.Component = function (name, status, key) {. this.name = name;. this.status = status;. this.key = key;.. this.isIgnored = async function (key) {. var isIgnored = false;. var startIgnore = await this.settings.get("startIgnoreDate" + (key \|\| this.key));. var ignoreDuration = parseInt(await this.settings.get("ignoreDuration"));.. if (startIgnore && ignoreDuration) {. var today = await this.settings.getToday();. var startIgnoreDate = startIgnore.parseBasicDate();. isIgnored = today >= startIgnoreDate && today <= startIgnoreDate.addDays(ignoreDuration);. }.. return isIgnored;. };.. this.isInFixGracePeriod = async function (key) {. var inGracePeriod = false;. var gracePeriodStart = await this.settings.get("fixGracePeriodStartDate" + (key \|\| this.key));. v

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-ui-checklist.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7998
Entropy (8bit):	4.69684087678637
Encrypted:	false
SSDEEP:	96:j8KiNn2zKMXjRIQIeTZmY2OToGF/8OJISRjla0mo9SWLpmUtpdcSbFn44j:IKiN2zKgyTeTEZzSRjg0jScmcdvvj
MD5:	496F9B41EC1335A99F7A5C68E5C77793
SHA1:	F9FC3D1DF9BECD9A9492F5A7C9389FF1CBD5D222
SHA-256:	46E5C70B4BED41FE8B67D7524F039894E00121BF8F1C48781C13BE642D667E50
SHA-512:	EF658D18388E52918F7BDF8612B52CADB15F127ADB752175126E05D86FFEB086FDC703173610D3A69DEDCE516A8A449C8FFAF5FECD5868C9541275181899659F
Malicious:	false
Reputation:	unknown
Preview:	/* CheckList UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.... ui.closeDelayTimer;.. ui.CheckList = function (options) {.. var el = {.. $checkListWrapper: $("#wa-checklist-wrapper"),.. $checkList: $("#wa-checklist"),.. $messageWrapper: $("#wa-message-wrapper"),.. $message: $("#wa-message"),.. $messageImage: $("#wa-message-img"),.. $closeWrapper: $("#wa-column-four"),.. $close: $("#wa-close"),.. $logo: $("#wa-column-one"),.. $state: $("#wa-column-three").. },.. checkDomLoadedInterval,.. animateDurationInMs = 400,.. self = this,.... setState = function (options) {.. el.$state.. .html(options.state.template).. .addClass(options.state.css);.. },.... setMessage = function (options) {.. el.$message.. .html(options.message.text).. el.$messageImage.. .html("»").. },.... setBorder = function () {.. el.$checkList.css({..

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-ui-dialog.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3536
Entropy (8bit):	4.498300075662501
Encrypted:	false
SSDEEP:	96:kZGJ5nzQQenlzN1vylhovKKHNLzpCZjeVBXfoiht:kZ8W0v8RHNLlCZjoJfoin
MD5:	073BD350D4DCB33C875472575EBFD579
SHA1:	CF1803794807A24422DD8A0D15B90E2E3EEBBBE3
SHA-256:	43E789DD22A446CBA010D7125005B803EC6489BEDE9836664BD096FFDC49ED11
SHA-512:	AC403FEFFBFF4AB8A928C96345A01AD68DFCED4E9467CEDBB2D1D830F328659B6471A94FBE781EE6175FBA96219639D288C21AE17222528FEED9A53327AF3963
Malicious:	false
Reputation:	unknown
Preview:	/* Dialog UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.... ui.CheckListDialog = function (options) {.. var animateDuration = 400,.. el = {.. $dialog: $("#wa-dialog").. },.... create = function () {.. clearDialog();.. createHeader();.. createContent();.. createButtons();.. },.... createHeader = function () {.. if (options.header) {.. el.$dialog.append(.. $("<div>", {.. id: "wa-dialog-header",.. html: options.header.html,.. tabindex:"0".. }).addClass(options.header.css));.. }.. },.... createContent = function () {.. if (options.content) {.. el.$dialog.append(.. $("<div>", {.. id: "wa-dialog-content",.. html: options.content.html,.. tabindex:"0".. }));.. }.. },.... createButtons = function () {.. if (options.buttons) {.

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-utils.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17296
Entropy (8bit):	4.4807553162542435
Encrypted:	false
SSDEEP:	192:BZwBjF3z+j5csy4h11lidEaCa3z46U2EW85xFYmah2OY9c8o9OQ/o:WJyj5csy4DIE3mU6URbFYmafQ
MD5:	618E7876274CFC0B3214FB134EB912AB
SHA1:	14F2EA29B8C0C776577C49A39AE77E27CE4CF7FE
SHA-256:	78D770FDD6213E9A952EB6523DB7C6320E0E05250B0DAAE724C6E2363F346360
SHA-512:	E10F770946141EF14113E2B2E09CEB711D75835D40D43585B930A64E384C40CA6DDD2EA22E09CFC8CD0B54FF4C9C728CD1BFB2E6E31C592160F122F6814D1F5B
Malicious:	false
Reputation:	unknown
Preview:	/* Utilities */..var _langResources_ = {.. checklist: (typeof _lrCheckList_ !== "undefined") && _lrCheckList_,.. options: (typeof _lrOptions_ !== "undefined") && _lrOptions_,.. shared: (typeof _lrShared_ !== "undefined") && _lrShared_,.. uninstall: (typeof _lrUninstall_ !== "undefined") && _lrUninstall_,.. sstoast: (typeof _lrSecureSearchToast_ !== "undefined") && _lrSecureSearchToast_,.. install: (typeof _lrInstall_ !== "undefined") && _lrInstall_,.. webboost: (typeof _lrWebBoost_ !== "undefined") && _lrWebBoost_,.. waiff: (typeof _lrExtensionInstall_ !== "undefined" && _lrExtensionInstall_),.. ut: (typeof _lrUpsellToast_ !== "undefined" && _lrUpsellToast_),.. overlay: (typeof _lrOverlay_ !== "undefined" && _lrOverlay_),.. newTabToast: (typeof _lrNewTabToast_ !== "undefined" && _lrNewTabToast_),.. ssToastVariants: (typeof _lrSSToastVariants_ !== "undefined" && _lrSSToastVariants_)..};....(function (wa, lr) {.. var util = wa.Utils = wa.Utils \|\| {

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\mwb\wa-controller-mwb-checklist.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	4.916947794924999
Encrypted:	false
SSDEEP:	192:O4n4gMn8LeQ1EU/AF5kSS3zwgFdliSQyglzMiqXjAMfxE7N:p4gMns48SS3znJiS0miqUMfxa
MD5:	09AD363559A046A1D93F064629F4D1E0
SHA1:	5C9E4EFFF7A9E8197018857F64B711C87F38A332
SHA-256:	58747720DB5DF9E225249D740EB808EC5D6498E7F153464CDDDAE4F684175163
SHA-512:	CBE025BA895A732ABB03308615B6A7A596ABC1985EC423B5D09DA8D992A39F11566CB866E13B33950C526F2F9A09BCC0050A9CFD2CD86AFD310D436434F3B0DB
Malicious:	false
Reputation:	unknown
Preview:	/* MWB CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.WEBBOOST).get,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. var self = this;.. var browser = ""; .. var wbShown = "WBShown";.. var wbLastShown = "WBLastShownDate";.. var installDir = "";.. .. this.update = function () {.. _window.ready(async function () {.. var args = JSON.parse(await _external.getArgument("template_args"));.. var isInitial = false;.. browser = await _window.getBrowserType();.. browserCode = await _instrument.getBrowserTypeCode();.. installDir = await _external.getInstallDir();.. if (browser === "FF") {.. wbShown

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\mwb\wa-mwb-checklist.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	5.134238882255609
Encrypted:	false
SSDEEP:	48:3Ox0xsUa3l363kKk+kUTkikfE5h2CYqOcqe5QORDBwC:32EAqOcq6QqN
MD5:	72CCBFBFD498B9914B18933E2AFFC3F7
SHA1:	8FFBB051B8FB8CE926E41F6853C2D20F26AFBCDE
SHA-256:	E3076D5AA823176935ECCD9851526B2A22EC6083164D3EA8D469EAE4499A4EC5
SHA-512:	621401D66FA72E76B337D19517195D229DFC3C98910BEBC8FBC97E8B6D70A665D92DBA56DF4EDAB0A3A8FD232C1EE22CAE484CC324AE996A72A4F4A4FB83453B
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-webboost-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-checklist-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript"

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\nps\wa-controller-nps-checklist.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24334
Entropy (8bit):	4.494667538847913
Encrypted:	false
SSDEEP:	384:CYEzX7WKuUDfpG7I85C6ylu6MJcDoGeDbC9dDMQk:3e7Wa806+w
MD5:	97294E70F24AC873E6E9D20F713F2AD3
SHA1:	D5E1C1021BDBB82B9835F8FAE705E598044B423B
SHA-256:	130D8EA323ECC21474B15ADBFA2E025B8E532052CFB195178DA84AA889B254B2
SHA-512:	83907AD784E133012EA398B904E499DBFECE8E678E11BBC873FE809CEAA5348554C613A8CBFAEC1552F949E225C19BEC6E7277003A7773BC6EB1F8FF72070233
Malicious:	false
Reputation:	unknown
Preview:	/* NPS CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _checkList = _core.CheckList;.. var browserCode = "(unknown)";.... ui.CheckListController = function () {.. var self = this;.... this.update = function () {.. _window.ready(async function () {.. browserCode = await _instrument.getBrowserTypeCode();.. var args = JSON.parse(await _external.getArgument("template_args"));.. if ((await $(window).height()) >= 630) {.. self[args.commandName]();.. } else {.. _window.close();.. }.. });.. };.... this.showNPSSurvey = async function () {.. var html = "";.. html += " <table style=\"border-collapse:collapse;width:450px; height: auto;font-family:Open Sans; color:#53565A;border:

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\nps\wa-nps-checklist.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2636
Entropy (8bit):	5.121410204094642
Encrypted:	false
SSDEEP:	48:3kx0xsUl363kKk+kUTkikChZhAFqOcqehQORDDy3m:O6qOcqiQqv1
MD5:	27CA3DA36B2FF15DE5DA3932BD4DEC40
SHA1:	5DF0DC35173A173A984EB7EDA5411AD49A26EF17
SHA-256:	8D431F52C49F223C594B0EA7F35FA5F52A254626CB4573486B2351B2AF74385C
SHA-512:	A70D122F88F8DDDCAFCCCFD81BA86ED2C89C9745EB0BF505577EF539DD528CF6977411602F819CB44CB1E7F5A9F6F4D5B4E601132EDFDB2214E9EE110A2EEEC6
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-checklist-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\bu

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-ext-toast.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	5.344034394218926
Encrypted:	false
SSDEEP:	48:xmp5UEWZp8xgC9WqJfW05NqIEp5NqIr+5NqUuxkxrxSrMq6x8zOGFqkmiZEqPeIs:xsW0xghYdNYNb0N1uxkxrxSrJ6xRGFqr
MD5:	E0D200C1F166E8DDB1F955C606E42398
SHA1:	78297894EE95BF86EE0721D12F6EB44955E737C5
SHA-256:	4EF9D035FB94E91A2C432B9B25A982C0910E605F36F46A062D159ABC6AA85BDA
SHA-512:	E67F0867609E3284C94F41D90E689CA8618047C8A6DE5E6FC27B27DB5CA9C9F6083B9DAED4A4AE1274BF92750272C239E7806A8BE84663D29D363EC10628AAFE
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}....#dialog {.. display: flex;.. width: 761px;.. height: 565px;.. background: #fff;.. border-radius: 24px;.. border:1px solid rgb(0, 0, 0, 0.12);..}..#card_layer {.. background: transparent url('file:///[WA_FILES]/mfw\\packages\\builtin\\women-on-laptop-features.png') no-repeat 0% 100%;.. width: 276px;.. border-radius:24px 0 0 24px;..}.. ..#progress {.. width: 173px;.. height: 173px;.. margin: 52px;.. background-image: url('file:///[WA_FILES]/mfw\\packages\\builtin\\progress_0.png');..}....#progress.enabled{.. background-image: url('file:///[WA_FILES]/mfw\\packages\\builtin\\progress_1.png');..}....#description_layer {.. padding: 35px;..}..#logo {.. background-image: url('file:///[WA_FILES]/mfw\\packages\\builtin\\mcafee-logo-1.png');..

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-ext-toast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2219
Entropy (8bit):	5.306616950793176
Encrypted:	false
SSDEEP:	48:qaaxily363k3k5kEhD7kCaCNcCgST20ixtSI:HsCgST2vl
MD5:	FFEA71C263F83D08481B5EA68FE929E1
SHA1:	F3F62208BA9A5230EAA8DDBE58978BFBD8E41161
SHA-256:	14DB57AD278143A3F0775A3B82F67A9ECD2D309B2E8D1F8EAFAE2C2889FD6DCF
SHA-512:	D94E7DD6BB77431C9E30FC05C4D708EC6A003D2347910A4AEB4E7413520857872B48984C9322AB7207058C77ADFB9488FAA831E73EF00D53E92BE2FFA861A264
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap".. rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/mfw\\packages_web_view\\webadvisor\\edge_onboarding\\edge-ext-toast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-sstoast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="fi

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-ext-toast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4043
Entropy (8bit):	5.15885534495579
Encrypted:	false
SSDEEP:	96:lAFMuLlxkllDE3zG6lsg9EYcvrEPwSYlZXo+:lAWuLlxkllDE3zG6ls5hrEulZXJ
MD5:	B98D67B9893DE220F6C3998F0059C190
SHA1:	179791D4EBFD1300B46F8B7841FA6AB203B31095
SHA-256:	40BF1E2435E385525F9772D5807E20CF7F40469CA3D0AD9F214047D1184B6186
SHA-512:	91FDC0C2BA4D93D1DC99B56DA5B59647113C1F317228B22A0829A92DD0F6FC9003162D2B605811AD1F75ECE5146149108127A42909BF4317B2206FB827ED3246
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {... ... var newToastDimension = {.. width: "761px",.. height: "565px".. };..... var $el = {.. progressPic: $("#progress"),.. checkboxInput: $("#set-web-protection"),.. title: $("#title"),.. desc: $("#content p.desc"),.. featureName: $("#feature_name"),.. featureType: $("#feature_type span"),.. featureDesc: $("#feature_desc"),.. doneButton: $("#done_btn").. };.... var stringMap = { // check for correct string.. InfoTitle: "SEARCH_TOAST_TOGGLE_VARIANT_1_HEADER",.. InfoText: "SEARCH_TOAST_TOGGLE_VARIANT_1_INFO",.. FeatureName: "SEARCH_TOAST_TOGGLE_FEATURE_1_NAME",.. FeatureDesc: "SEARCH_TOAST_TOGGLE_FEATURE_1_DESC",.. FreeLabel: "SEARCH_TOAST_TOGGLE_FREE_LABEL",.. ButtonDone: "SEARCH_TOAST_TOGGLE_BUTTON_SS_PROTECTED"..

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge_ob_telemetry.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.422952227171875
Encrypted:	false
SSDEEP:	6:2EmuogRreo9LClyqZy+cPupMrX9ElbFmFvH5XCgyoXm/o/7ZopsNAAE9Xj/oCh:2woUrXAyXprOlJmVJbCA1hE9XjwCh
MD5:	ABB274DD5620E2F7458477FF70C06527
SHA1:	88D1841D78E2286CDBE81E472026DDF04856533B
SHA-256:	1317D83FF8CE4FC2A377B834BEB46C7D1949268294A4A6B8BCFE722E99C8C6EC
SHA-512:	858A5F55DB2F1884D39014D7DD64B4F1E315360F984D9F7BA85E66C3AE12CC2A28A67B9578AB9C6FD9766F1819AAF2F9A0489B5510D2D10582E6FF36F63C1A38
Malicious:	false
Reputation:	unknown
Preview:	const send_onboarding_telemetry = async function (action, ui_type) {.. const event_obj = new EdgeOnboarding().action_type(action).type(ui_type).Serialize();.. await window.WebAdvisor.Utils.Instrument.sendTelemetryEvent(event_obj);..}..//CBE022F7DB128CB70BFBA73B9E5CA0F201F5694F12587BE5FD9B962BE9A6F72D1B31C2128ED8C6C6325FDAD9300A95753DB1322172697D9A916DC0DF1C5AF74F++

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_search\edge_search_ext_coachmark.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1497
Entropy (8bit):	5.168780559100173
Encrypted:	false
SSDEEP:	24:xmp5UEWZR78xQ/0elV7k1Ze+fkMFE1g60q30iTxhxs4P0Fu0xx0j000sT06bw0SG:xmp5UEWZp8xo0uOuHMFYg60q30Mx70Fe
MD5:	8105CD2225469DF72E5E296BD0120393
SHA1:	D0785A53C17DAC683C201D091877FF1D6EC5EB54
SHA-256:	B35C5FA45379755E16DB6C8557488D6F98513D8D10284D0475DCC294CE59C6AB
SHA-512:	C9626F42EB610681340264D577C82C3622DC1C6934980F12A835852F3F9F47237B0CE138A0A29094B30404B8653C90CE53EF0336E47B277EB7E897674820D3DD
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}.....main-container{.. width: 656px;.. height: 392px;.. flex-shrink: 0;.. display: flex;.. flex-direction: column;.. position: fixed;.. bottom:0;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;.. align-items: center;.. padding: 0px 35px;.. border: 1px solid #B2B2B2;..}....[class*="flex-item-"] {.. display: flex;.. align-self: center;..}.....main-container .flex-item-1{.. justify-content: flex-start;.. align-self: flex-start;.. margin-top: 32px;..}.....main-container .flex-item-2 p{.. color: #212934;.. font-size: 20px;.. font-style: normal;.. font-weight: 700;.. line-height: 28px;.. margin-top: 14px;..}.....main-container .flex-item-3{.. margin-top: 34px;..}.....main-container .flex-item-4 p{.. margin-top: 32p

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_search\edge_search_ext_coachmark.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3191
Entropy (8bit):	5.331921490117445
Encrypted:	false
SSDEEP:	48:wjRaxDlg+3kKk+kgkah2Cm5wEsCILQq5wEsCI2A5wEsCIIK1kaojVE9A:wjTdsT/dsTdsAxaoRyA
MD5:	C82DEBE68DEF59497A10807F8A00A4B1
SHA1:	6B14D986F48BBC346485806D1494706311FA77EA
SHA-256:	1A38BE88BAABCFC0E37A620AA051430240BE2FBB36C05D201116B84910283296
SHA-512:	5598BAFBC290AB95855D23E292BFAE95AB929F3A62DC031B4961795F9AE1D181BC490169E334FDE1A249071BBA18AB73B8838995C519548CF1352D763FFE8F6B
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head>.. <title>SecureSearch Score Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap" rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\edge_search\\edge_search_ext_coachmark.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.js"><

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_search\edge_search_ext_coachmark.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4447
Entropy (8bit):	4.886798873869758
Encrypted:	false
SSDEEP:	48:xe04JN7xWXXZ8NQK8E3NQKbk/5XNmsN4qBNINHN4qPdFe2FX1YYtuK1H6ItuNn1x:EPoHvOGX67qPqP2k1xafsmWa6Qiah6M
MD5:	AD9A446C106D5867A4DFF8A066601E4E
SHA1:	90A6BA05604634B54156B2CEE7F8E2809BC39BEF
SHA-256:	DC94D0C6CD248F7453757EDF4ABA5D6076C2327D8064526F48A1590B1A57F254
SHA-512:	42B2E801B7AF7CBEE1897589DA2464A8213BAB94CDAB327AFC3FDCF40569A578181454AD0A4AC0DE992BF7EAFD6CCB5024EC12843994111E2FF512D9298E0C48
Malicious:	false
Reputation:	unknown
Preview:	/* SecureSearch edge monetize phase -2 */..(function (wa,$) {.. let ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window,.. _external = wa.Utils.External;.... var browserCode = "(unknown)";.. var provider = "Yahoo";.. var windowHeight = 392;.. ui.SecureSearchTooltip = function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. show = function () {.. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. .. _window.setWidth("656");.. _window.setHeight(windowHeight.toString());.. .. let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.OVERLAY).get;.. .... chrome.webview.hostObjects.wa_external.log("inside ready");.... var json_to_parse = await _external.getArgument("overlay_data");.... chrome.webview.hostObjects.wa_external.log("after getting overlay data");.... if (!json_

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\new-tab-overlay.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	5.466172125369847
Encrypted:	false
SSDEEP:	24:+swDxNxulQeNVMr0+WrVMrLKWrVMrQzVMrQXVMrQdpVMrlANVMCrNM/QoguKORM8:NOxNx1/Y+3i3cKc+cGpJCEQgKy9n
MD5:	11C90E0E1226ED84012D4979854C9A67
SHA1:	66750CB596FBCE0225D71762B28C6B334DED1FF5
SHA-256:	38FBDC7B5C5A313CB09AB5456821FF6D6D48F50E3E1E3FDD292C016F99253089
SHA-512:	E92F7444BEAA0AF503CAF09861C69E75A1903B8BE17D02DD368F46B5447B145AC25DC760E0A113C29E7694E95A293036A1890C09906BF0CB246E86EAF59AD684
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\new-tab-overlay.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\new-tab-overlay.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4434
Entropy (8bit):	5.061667092400666
Encrypted:	false
SSDEEP:	96:T0AmdonK4uoNkCsVgV1PixEeB0NufP9SdaQbXkLS:AATK4bNrAg/jeCQS9bX4S
MD5:	9EA7950FB8EF13B3EAD1A78C3A0E1B17
SHA1:	0C636A86319B64BF2C3CC2C4D1AB58DB7929E742
SHA-256:	2B493C311CDA5CE4CD57C1D992D0E1673733651C0C6B7C831D0404CBDFCDBDE8
SHA-512:	0C0C78D93AD29B4DDEFFC6F832D123D91FE4A9B2D91254E5558168A777E5B317863D8C01A5CB91B894953572E7D3876D02D48E04708CC3A8AD9B0F8334213974
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI \|\| {}),.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. content1: $("#wa-dialog-balloon-content-1"),.. content2: $("#wa-dialog-balloon-content-2"),.. arrow: $(".balloon-chevron"),.. },.... show = function () {.. _window.ready(function () {.. var settings = JSON.parse(_external.getArgument("overlay_data"));.. var overlayType = Number(settings["overlay_type"]);.. var extensionType = Number(settings["extension_type"]);.. .. // Polyfill of isNaN for IE version < 12;.. Number.isNaN = Number.isNaN \|\| function isNaN(input) {.. return typeof input === "number" && input !== input;.. };.... // Validate toastCount is valid;.. if (Number.isNaN(overlayType) \|\| Number.isNaN(extensionType)) {.. _window.clo

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\new-tab-toasts.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2295
Entropy (8bit):	5.349411549312583
Encrypted:	false
SSDEEP:	48:NOxNxj/U3i3cKc+ccWCpnHCFAf2PKqAqIMImqIuck6:chkiJJmz7D
MD5:	45A109F8A197927BFD467B77580D10BE
SHA1:	8302CF6DA74AAEEC08CF9FFA70DA57004374CBD0
SHA-256:	7E7BADF648959591AA17B7902734646EF926D394984265B4D5E9F8762B81354F
SHA-512:	EFF6A8B71F656CDF9C13A1D6910DC783AAE6203465825703DFC508F75B1FA385F36CC06B735555F146F73026F96C05F59D38BDA5F4955E58A6CABA2F7B9133A9
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\new-tab-toasts.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\new-tab-res-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="fi

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\new-tab-toasts.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4089
Entropy (8bit):	5.133327457761815
Encrypted:	false
SSDEEP:	96:n3AXKffHguIKz1hauWSQ0RVflDh84bXk1Z:3AogosXiVfVh84bXEZ
MD5:	0BDF0372CBA979567B082FD039692803
SHA1:	A4C5332EEBDEFE4A7859940DF1D69E2E26BB990F
SHA-256:	D484D2982CB0859B66695F96C12A21AE5CC6B2EE79B27DF6E2304AF655C51A31
SHA-512:	6E48EABF1BA9AFF960C94731B63C6E47CA1F85FE9855BE09E4E451B6A1E0D72FF30564260209D22B62456A5388D15707AFC0DF79D2131FA003F85AFB64CC74F3
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI \|\| {});.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. balloonCard: $("#balloon__card"),.. headerText: $("#content__text-header"),.. contentText: $("#content__text-description"),.. acceptBtn: $("#content__actions-accept"),.. declineBtn: $("#content__actions-decline"),.. };.... show = function () {.. _window.ready(function () {.. var payload = JSON.parse(_external.getArgument("overlay_data"));.. init(payload);.... _window.show();.. });.. },.... init = function (payload) {.. var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.NEW_TAB_TOAST).get;.. var toastCount = Number(payload["toast_count"]);.... // Polyfill of isNaN for

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-confirm.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1604
Entropy (8bit):	5.270792586863798
Encrypted:	false
SSDEEP:	48:rp5UEWZp8xw942MDIjLMI6dSEkf3cdbOiQZwg00:LW0xwa2eIjLd6dSX3cdbOhGgJ
MD5:	5EC7FCBA4A5C5FBFF9D233581C521CF1
SHA1:	C2744BC0A456580F2C2EF11F2D52628BED2B8738
SHA-256:	E2D190380AF51DDD21119509476C879626993A862E32C6D4184282008458E6C7
SHA-512:	50F7BCC3A99CA7E18391D8DB2E7F8D067E8F06EC5DC646E4FB6AB227B6408DB75F7F801A5A767B3B355BEB6098770CB14BF71873D46B1B1E92984E522A399B48
Malicious:	false
Reputation:	unknown
Preview:	..* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}....#wa_score_toast_confirm.main-container{.. display: flex;.. position: fixed;.. bottom:0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;.... width: 365px;.. height: 326px;.. align-items: center;.. flex-direction: column;.. flex:1;..}..[class*="flex-item-"] {.. display: flex;.. width: 311px;.. justify-content: center;..}..#wa_score_toast_confirm .flex-item-1{.. justify-content: flex-end;.. width: 100%;..}....#wa_score_toast_confirm .flex-item-1 img{.. width: 13px;.. height: 13px;.. margin-top: 16px;.. margin-right: 32px;.. cursor: pointer;..}....#wa_score_toast_confirm .flex-item-2{.. margin-top: 17px;..}....#wa_score_toast_confirm .flex-item-2 h1{.. color: #383434;.. font-weig

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-confirm.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2144
Entropy (8bit):	5.413299065144493
Encrypted:	false
SSDEEP:	48:JjRax0x3m363kKk+k3shFhiKC+yxi8mG6yMm+ATFcq:JAm2ie6yGQV
MD5:	130647C232AB4DAE8316E6C2C1A7F778
SHA1:	D2AEE56A00A6A3EA1B14717B8025E06A709BB43B
SHA-256:	010A999D831640C90075D364A7D219A9113CC8B48541423399A3331C5BA1A6A9
SHA-512:	F3F016FA8ACD223DC78B7D58E00BA3F0C341727F935A9062AA48138E8A2570BBE939AAE342176F29CCD7DEE8809032BF21C1CD9956D66F6C8E1C81424D1AC59F
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>SecureSearch Score Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap" rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\score-toast-ui\\wa-score-toast-confirm.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-score-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <s

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-confirm.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2765
Entropy (8bit):	5.074437838766172
Encrypted:	false
SSDEEP:	48:Yj4Ji7xWXXRMNQK84lhNQK23NfGTNkAYi/zNQmnOtw/7tT/Bztn6TYOYEfNgpbj5:YhoH/C0Lln8qmncw/RT//D7EcPcvgd5B
MD5:	6D27ECEB5826A81650FA9F9183EC1B68
SHA1:	BF4B0F38D7568C2C77030544441990EB23DCBA24
SHA-256:	F6AE2BDDD8E1F5FD9B44C63141C560EB0369CC12E5BE8EB76E42EC7616043B0F
SHA-512:	C5E03C959FA35D47935FEB44127DD52A5A0E44E6687149BE6A736E4DF2911BCE17DD6AD2B25BBE7B064AA7AF72CB3B39240FE8D6DF136B7394085D057CEAB705
Malicious:	false
Reputation:	unknown
Preview:	/* SecureSearch Score Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window;.. _external = wa.Utils.External;.... var browserCode = "(unknown)";.. var provider = "Yahoo";.... ui.SecureSearchToast = function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. show = function () {... .. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.... _window.setWidth("365");.. _window.setHeight("326");.. chrome.webview.hostObjects.wa_external.SetDraggableOffset(20, 50);.... window.addEventListener("resize", (event) => {.. chrome.webview.hostObjects.wa_external.log("draw from resize handler");.. window.chrome.webview.postMessage("draw_background");.. });.... let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.SSTOAST).get;.... chrome.webview.hostObjects

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-increase.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6113
Entropy (8bit):	4.974236045099054
Encrypted:	false
SSDEEP:	96:xkWsYW9FbqA1eR0/DJgltvLtDmwJVNUNYNnYFaYoty55u7fn:xkWXWbqA3FgltvL5mqVNUCC3oku7fn
MD5:	4CC52A4AC1AD00E793AAA1991AE39048
SHA1:	1A7BF03CB3B7E29DF159E4FE69E0F6C451E02210
SHA-256:	A60349D863402EB4FBA87134E4AA1FF3FC2E982FFE266751701B57449AA0C44B
SHA-512:	1FA4E34F48AE33430217E1F199A229A400DA984E4D33E292FE5BD30CF5859CE8E9B7C7052DA1F628E1A87CD8F84415C10871BE007C22226B4D06950715029B0A
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;.. }.. .. body {.. color: #212934;.. line-height: 24px;.. }.. .. #wa_score_toast_increase.main-container{.. display: flex;.. position: fixed;.. bottom:0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;.. .. width: 761px;.. height: 283px;.. align-items: center;.. }.. .. [class*="flex-item-"] {.. display: flex;.. height: 100%;.. }.. .. #wa_score_toast_increase .flex-item-1{.. display: flex;.. width: 276px;.. justify-content: center;.. background-image: url(file:///[WA_FILES]/MFW/packages\\builtin\\wa_score_toast_increase_bg_left.png);.. flex-direction: column;.. align-items: center;.. }.. .. #wa_score_toast_increase .score-status{.. width: 205px;.. height: 60px;.. ba

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-increase.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2770
Entropy (8bit):	5.29703908299377
Encrypted:	false
SSDEEP:	48:JjRax0x3i3363kKk+kgk3ithFhiKC95ix8LStjLRjxk+ann43iAk:JseqjiHjtjBinx
MD5:	0EC997362D663859800D14960652714F
SHA1:	B3669DDE8E70DD5FDB2587F11D463C33D7171FCF
SHA-256:	639279E73C9AD05A14C16339B40197CB42D37F035BB68803F4858E24A5525BFE
SHA-512:	81B455EFF4D092AB0FDA17214D2902A2339591F794EF22AEAA17245C339265A690E5FC26E529A4F0FE5B1838435F3291E101F00990193F1078F8BCAF707DF84E
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>SecureSearch Score Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap" rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\score-toast-ui\\wa-score-toast-increase.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-score-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-increase.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5026
Entropy (8bit):	4.955964330667236
Encrypted:	false
SSDEEP:	96:YuoHAOGj0xqGgrVTWm03Sk457EcPQvNQoxVRz2T:JX4k7RTWmp57EcPQvN5/Rz2T
MD5:	F0CF97FA5129708D216747101A50FB0C
SHA1:	FDAF99B8CCF577399F046A256197AF593B86A85C
SHA-256:	CFC2DF209FF63BB55D2A47E1902E9AB74C7F095966469E9BB16B191525D00258
SHA-512:	104B9DFBF49771C6786D7BE49E4ACADFD911145A73AFCA60610D5C559A025D3F0C9F12B6B645AAE5C10E94FF14A7EC788F71105F28314DB16E84587CBE29F6B8
Malicious:	false
Reputation:	unknown
Preview:	/* SecureSearch Score Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window,.. _external = wa.Utils.External;.... var browserCode = "(unknown)";.. var provider = "Yahoo";.. var windowHeight = 283;.. ui.SecureSearchToast = function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. show = function () {.. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. .. _window.setWidth("761");.. _window.setHeight(windowHeight.toString());.. .. var toast_data_string = await _external.getArgument("toast_data");//json with score.. chrome.webview.hostObjects.wa_external.log("ready: toast data is " + toast_data_string);.. var payload = JSON.parse(toast_data_string);.... let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.SSTOAST).get;.... chrome.webview.hostO

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-main.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8459
Entropy (8bit):	5.154344834470699
Encrypted:	false
SSDEEP:	192:OW/al9Sqd0++Jx0ZBSaLR5YDm9eHnqWNRXz:OA+AaLR6HnqWNR
MD5:	BA573C8846D86670FA8AF33F1D4EAC0D
SHA1:	74E7BC7505C876B8B38CBE9E87BF7B77F4D4361A
SHA-256:	9C7A7791C9C9AD753D8238407BFD27DEC32E9D23BB16D274AF795D34BEBDBD81
SHA-512:	BD59BA5CA96955FFE287A0061DCF60BC5619C48B7A70E7A50A46ACA60374B44F7210857D0F32ECEDDBCE422E07C41CEED648E014596D25AC713A67C46A2096D5
Malicious:	false
Reputation:	unknown
Preview:	/* version 2 3 /.. {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}.....main-container{.. display: flex;.. position: fixed;.. bottom:0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;.... width: 761px;.. height: 565px;..}.....left-container{.. width: 276px;.. height: 100%;.. background-color: #F5F6FA;....}...right-container{.. width: 484px;.. height: 100%;..}.....inner-div{.. width: 100%;.. height: 100%;.. background:url(file:///[WA_FILES]/MFW/packages\\builtin\\wa_score_toast_main_bg.png);.. display: flex;.. flex-direction: column;.. align-items:center;..}.....variant_2_bg{.. background:url(file:///[WA_FILES]/MFW/packages\\builtin\\wa_score_toast_main_bg_v2.png);..}.....inner-div > div{.. display: flex;.. width: 100%;.. align-it

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-main.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4418
Entropy (8bit):	5.038538128490069
Encrypted:	false
SSDEEP:	48:JjRax0x3/363kKk+kgk31hHhiKCOGmBmKbTlVRWJ0IRVXhTAhc9CRj7SO1CCR21l:J+xmfb3Re0IPhTigCx7SOgCgCGF
MD5:	4CE80817B6F2885E29882D335F85D62A
SHA1:	DCFAA243686206DE9CDC720E90D6C12BA83B85A1
SHA-256:	43A080DC68A6D1D17635A1F51E51EB015C0E733B29716C867C94FF0159D8984D
SHA-512:	EE3BADFFC7F3C35481C878CD1E3C1D9A023564AC2B855EF811AA91FB7DA3EBEAA1A77D86D186E5C0C80E5C4D35B9C6873933283CF7E39D5FA19FA79D15E6D656
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>SecureSearch Score Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap" rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\score-toast-ui\\wa-score-toast-main.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-score-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <scri

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-main.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8673
Entropy (8bit):	5.018518462489992
Encrypted:	false
SSDEEP:	192:N9T16teT2I8GkkA7KQ23LGhmPvHVe7Ela7MLuLULxLQLnLJE7l:N9T16teT2I83kA7KQ6LGhmPvHVe7FMqI
MD5:	3AB21B7DDDE8F36D4C49AF4919F7CC73
SHA1:	CAC85CC366579D82D2FF63544DDB96D14B151A72
SHA-256:	870FA6037B687E8F740270F19ED4DFB49EACD3804280773889D0085EDE0E2748
SHA-512:	8094EBB2D723A077E9BBB3407A6DEEDFA7A23F8A64A505D1871AB701D3BD2EDBEC82B242DED5DEFF9575C5B840A0B13F2CF3B8D3B495A21B50B53166A5C44DBF
Malicious:	false
Reputation:	unknown
Preview:	/* SecureSearch Score Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _window = wa.Core.Window;.. _external = wa.Utils.External;.... var browserCode = "(unknown)";.. var provider = "Yahoo";.. var windowHeight = 565;.. ui.SecureSearchToast = function () {.... show = function () {.. _window.ready(async function () {.... chrome.webview.hostObjects.wa_external.log("ready: begin");.... var toast_data_string = await _external.getArgument("toast_data");//this is json passed from logic with cohort and score.. .. chrome.webview.hostObjects.wa_external.log("ready: toast data is " + toast_data_string);.... var payload = JSON.parse(toast_data_string);.... _window.setWidth("761");.. _window.setHeight(windowHeight.toString());.... let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.SSTOAST).get;.... chrome.webvi

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ch-store-overlay-ui.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	5.243805452626895
Encrypted:	false
SSDEEP:	24:xmp5UoZRqxQpxVYHhLcY39U0M+mtFl2zZRVchpKIjvVCfnvv/UQsUMNzjPX:xmp5UoZwxDHF3uBjFloZKY+YfnHcQe9v
MD5:	E0005DF5A2F91D11A160E7822B18DCA9
SHA1:	7A88A672721F61D0670AED8C57528C6F403E052D
SHA-256:	3B0F3FB67A67D2B45A6F1E47D0D79F36E124FD9FA733FD66C56151163DC11026
SHA-512:	B51F2F5A0745B2D5D2E7AC2E1AE57F7F38FD627A0F5B30937C7BD4FC70EFF628D6498E91D2C1787B5C9E6303A70D6A2D7A48ABB1B9D772F392D5B46FC785D05E
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. color: #212934;.. line-height: 24px;..}..../* Parent container */...balloon {.. overflow: hidden;..}.....balloon__card {.. position: absolute;.. right: 55px;.. overflow: hidden;.. box-sizing: border-box;.. background-color: #FFF;.. border: 1px solid #E6E9F0;.. border-radius: 12px;.. height: 200px;.. width: 328px;..}.....card__content::after {.. content: ' ';.. clear: both;..}.....card__content {.. padding: 16px;.. height: 100%;..}.....content__header #wa-logo {.. height: 13px;.. position: relative;.. top: 2px;..}.....content__header #close-icon {.. float: right;.. cursor: pointer;..}.....content__text {.. margin-top: 12px;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-weight: normal;.. font-size: 14px;.. line-height: 20px;.. color: #5A6175;..}.....content__text:last-child {..

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ch-store-overlay-ui.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2054
Entropy (8bit):	5.409297213142282
Encrypted:	false
SSDEEP:	48:N8xMxtUY+3i3cKc+cjpJCX6OK+punY6us3:J+9Dz3
MD5:	CBFF04AB4685F3B5279C89BEEB5826D3
SHA1:	31FB9A155CD139B2FFB3F177FCDDD8861C6A8AEE
SHA-256:	C44331B46FC9593F9B7554A897E90F95DFCA85913FEE28CB2608E3F92C5CF168
SHA-512:	7B9C8883EE0149F51A6DE7F8941B427D1719CD6BDAFFFCBC605BCEBD17953C96633E0312156C6CAC7A6805DE20201F26B3084279E3A721713412593C95219820
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ch-store-overlay-ui.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ch-store-overlay-ui.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3609
Entropy (8bit):	5.13975478960129
Encrypted:	false
SSDEEP:	96:cMA4qOTkC/pV9WqxEz0TnMTJo1CV9WE6KGXX:vAUr/pubwT8uCu1KGXX
MD5:	E800687A49845C2FA710CEBCC7713290
SHA1:	A7957339A4F23C848ED6BB1AF8F09A8604FCABEB
SHA-256:	C1514400DB7490623A527F6C4627AD83FBE20E419CFB6AEDF078D7F6CE87BB4C
SHA-512:	27D0D1C82A4BBCB247DEE5233E0CA5695BB604FB22AD56F6B7E453EEC0DA2A6D29E91A2DEDD78CB6777B6F82512E4198F4B1547DEA860C42B19E98F498604BCB
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. contentText1: $("#content__text-1"),.. contentText2: $("#content__text-2"),.. closeIcon: $("#close-icon"),.. };.... let browserCode = "(unknown)";.... show = async function () {.. init();.... _window.show();.... browserCode = await _instrument.getBrowserTypeCode();.. // Send telemetry for dialog balloon showed.. var telemetryEvent = new OnboardingBalloon().interaction_type("Impression").browser(browserCode).balloonType("WAOverlayOnboardingOpenExtensionPage").Serialize();.. _instrument.sendTelemetryEvent(telemetryEvent);.... //Send Telemetry 3.0 for dialog balloon.. var screen_flow = browserCode == 'FF' ? 'firefox' : 'introduction';.. var hit_screen_id = browserCod

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-checklist.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2823
Entropy (8bit):	5.1658658808280835
Encrypted:	false
SSDEEP:	48:3kx0xsUl363kKk+kUTkikthkxhlhPhOCCv/enQORDSp:OP8v/WQq+p
MD5:	F21FD4B4D31907A5996897E8C3665102
SHA1:	B6096831071696FF3DE41AE3038987B1F59C8FDC
SHA-256:	DC36FBA5083B9E9D75DFF341F97AD43037A248F0A325C6D9C354AD86E664D45A
SHA-512:	FA917E5636CD23DD2E7A177505ACF19259BAEB588905A707C779DF1FBE7797E47A75462036E51D96E66191ED80F289B381AE2B09676DEF7358828625432A91C4
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-checklist-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\bu

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-controller-checklist.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	19476
Entropy (8bit):	4.750838356862996
Encrypted:	false
SSDEEP:	384:cD7PaE5bXIDT2o1Cm+kYNTtazx/6x5o+72vY4jQWvHDsRFLFmZlP2Sv7:Y7PaE5bWT2o1CzksTcY5o+7GREjYZ5n
MD5:	16566D805C70C828185A9643FB384047
SHA1:	48325CCD13938ADF18EA24D30096334E055EF461
SHA-256:	D58F6822D2F1D22031D3222BC6FE0E2145A9991502BD75ADA89B07CB933C2A15
SHA-512:	B86EF78A20200C90F558DB174E039CE014D868369E9E47D880EF2600819BE8671362178CDBFE1A59967401FC3FA1BF76197D672A230DD8FFA2AD1049B621037B
Malicious:	false
Reputation:	unknown
Preview:	/* CheckList Controller */..(function (wa) {.. let ui = wa.UI = wa.UI \|\| {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _l10n = wa.Utils.Lang().checkList(),.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. let threatStateCss = "threat",.. infoStateCss = "info",.. greenStateCss = "green",.. waitImage = "file:///[WA_FILES]/MFW/packages\\builtin\\white_timer.png",.. alertImage = "file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-checklist-risk.png",.. ignore = _l10n("IGNORE"),.. fixNow = _l10n("FIX_NOW"),.. defaultImageCss = "wa-state-img",.. alertImageCss = "wa-state-img-threat",.. keyMap = { "NUW": "WelcomeMessage", "UUW": "UpdateMessage", "CLW": "CryptoLearnWelcome" },.. self = this;.. let browserCode ="(unknown)";.... this.update = fu

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dialog-balloon.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	772
Entropy (8bit):	5.278647416331974
Encrypted:	false
SSDEEP:	12:xW/FJLjFUoZdTrh8FwIjEHpbXTfMUGAtf8+IdKjjUK+xe+IqFcF143jhZZw22dSW:xmp5UoZRqC3dDUUhiLKyFc43bZt2dKc
MD5:	FDAB7A84A4A860B341BB95A263670F6B
SHA1:	BF43E5BEE93D7CDE996648D8EC9B556DC90BA0F7
SHA-256:	14ADA41E5808F3CDC11276695200F9E0213451008EB96B05CF46E1BDA86F813D
SHA-512:	B70550F989B2BF66DEFE5ABF2CEA64FFAAD5F23A9770320C1E37A4AA48CC95B92651D1E8CFA94EE7DCF0F398C076B415C6756AEBE8A8FABEE70DC63ABC795450
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. color: #454545;.. line-height: 24px;..}.....balloon-arrow {.. margin-bottom: -6px;.. text-align: center;..}.....balloon-main {.. box-sizing: border-box;.. background-color: #FFF;.. border: 2px solid #E6E9F0;.. border-radius: 24px;.. padding: 24px;..}.....enable-ext-btn {.. background-color: #4989EB;.. border-radius: 4px;.. border: 1px solid #EFEFEF;.. color: #FFF;.. cursor: pointer;.. display: inline-block;.. font-weight: 600;.. padding: 2px 8px;..}..//162F990F9B07BCE49F9C9259B5728AF03EE893C0DA90EB2435F53C210B4831C7621DC750F7EA23EC7C521910423A87E65A387B2AF07567D004C6E8B2CFF235DB++

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dialog-balloon.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1945
Entropy (8bit):	5.4286335049163075
Encrypted:	false
SSDEEP:	48:NOxMxG75Y3i3cKc+cdNpJCzd+TQgT+yVQut5:w7aAMTQI+xw5
MD5:	4CD1E437E04820D6E97E8D772054F06A
SHA1:	AFA07204E1C361B37062BF1D86343542868B69C1
SHA-256:	C7A9FDB1F4DF2406D06742E21FC7CEA2BE411F345C50A6D63F11ED1CDA713DFA
SHA-512:	8A2001981B878B400DEDD610C48710C1FB689E2B0810EBAC82AC0F95E57EC9D7C79FE5A7FA4707E12730A2B34F24B4A45D56298E48F2606E5D591E2E997BC2F1
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-dialog-balloon.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-dialog-balloon-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ui-dialog-balloon.js"></script>.. <scrip

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dwtoast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1617
Entropy (8bit):	5.275652049290845
Encrypted:	false
SSDEEP:	24:V2skx0xutt5WrVMzLKWrVMzQzVMzQXVMzQdGVMC8jIYcEWiFvKTH:3kx0xi7363kKk+knC8jK/svKb
MD5:	4B5209286CBC0B48D4E412D845A381E3
SHA1:	E02164F761079AC923B4A5AC185A6A74B30F9E00
SHA-256:	18376B809B5056E4ED00EDFE54D5C4C515564E354615B7F7AE3CBDB4C2975458
SHA-512:	EF68AA3052685E4A6A59E9B9BD4A3D07F552DCF4D91A744AEBB8D8BE89872827491B8964CE7F1F514E20ADBCAB0F758C561FD769A926DA325DE1B192620F620A
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-dwtoast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-checklist-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ui-dwtoast.js"></script>..</head>..<body>.. <div id="wa-dw-toast">.. <div class="heade

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ext-install-toast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2608
Entropy (8bit):	5.221729412099025
Encrypted:	false
SSDEEP:	48:7kxtxC363kKk+knh88CVr/R+5a5beIwEeIYOzC:U/Fb1De
MD5:	FBB96157B894F4D21601B277DB32F42C
SHA1:	C21733D77278861C8F46D750A99E1BD7E0A8CE53
SHA-256:	AB2A3AD51E77375CE894CCEB2B92AE4241DC395FF5C5C32F515CDF12DDAD9122
SHA-512:	3C278517DFC8C2E5C2648056E75293BADA1F46A105649E42F0B04FB2BA72455C139D9CBFFCEEBC5EC9CD3369CED8181DA7CD15C03ECF6E0E555CBD9DA23EBC1B
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>Download Extension Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-ext-install-toast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-ext-install-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ext-install-toast.js"></script>.. <script type="text/javascript" src="file:///[WA_F

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ext-install-toast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5574
Entropy (8bit):	4.85644203813916
Encrypted:	false
SSDEEP:	96:1zDsTVq7EIkY+0vTkE0oN6El4iTZTzwuFqEFDk00jl8arkM0d7XWPb:qc7EIV+UTq06ESGZ37Fq2DajlJryd7ab
MD5:	68B83CC1D529E2A132CE695C4AE13EB7
SHA1:	480907755332E34B340A661AF4FD6FC24E4AF6D3
SHA-256:	250DCB1B583D2620D0F513601E9312132074CF549566963801C3BA6D8C11A28F
SHA-512:	B2DC357B7B5565E0B72831BA4FDDAD089644F640D9EA55A8F0A9AAE8B8D35FE395898A580222013CB203D0C897668589434C3F09EE20E3C6DEC22F06FE717C1D
Malicious:	false
Reputation:	unknown
Preview:	/* Download Warning Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings;.... ui.extension_install_toast = function () {.... let browserCode = "(unknown)";.... show = function () {.. _window.ready(async function () {.. // Set toast window size.. setSize({ width: "485", height: "265" });.... // Get settings data.. let toastCountSetting = "ff_extension_toast_count";.. let toastCount = await _settings.get(toastCountSetting, "0") \|\| 1;.... let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.WAIFF).get;.... // Initialize toast... init(lang, toastCount, document);.... _window.show();.. window.chrome.webview.postMessage("draw_background");.. window.chrome.webview.postMessage("set_focus");.... browserCode = await _instrument.getBrowserTypeCode();.. //

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-options.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6769
Entropy (8bit):	4.973282245485115
Encrypted:	false
SSDEEP:	96:yH5SvRvxVoY2bZX/o0lhOY52Q5YsYmafFZR9h:yH5EvxVD2bJQChOsV5BLaf3V
MD5:	EB76FB862D6A2090FD2B60AD4372BDDF
SHA1:	BB203D78F96D545E497542165E72EE7D83DBB8F2
SHA-256:	E1C3BC6BCF565B8C0E96A266303BA445F89BA8BC155F145982CD8C7D90B55DFC
SHA-512:	4F453D51C85A16B380427F46B23C704AB6164E5B69661DCE23A1D397187BBD2A192C3B44D7C9081AF45BB9790065373A4DA12CB9BEC2564CA99A5A0ED1F210D8
Malicious:	false
Reputation:	unknown
Preview:	#bottom {.. bottom: 0;..}....#left {.. left: 0;..}....#left,..#right {.. bottom: 0;.. top: 0;.. width: 2px;..}....#right {.. right: 0;..}....#top {.. top: 0;..}....#top,..#bottom {.. height: 2px;.. left: 0;.. right: 0;..}....#top,..#bottom,..#left,..#right {.. background: #939598;.. position: fixed;..}....#wa-button-donttrust {.. font-size: 26px;.. right: 2px;.. top: 5px;..}....#wa-button-reset {.. background-color: #00AEEF;.. border-radius: 3px;.. color: #fff;.. font-size: 14px;.. font-weight: 700;.. height: 40px;.. margin-top: 12px;.. width: 145px;..}....#wa-button-trust {.. font-size: 24px;.. right: 3px;.. top: 4px;..}....#wa-close {.. padding: 8px;..}....#wa-options-about ul {.. line-height: 23px;.. margin-bottom: 0;.. padding-left: 12px;..}....#wa-options-content {.. font-size: 12px;.. overflow-x: hidden;.. overflow-y: auto;.. padding: 24px;.. width: 550px;..}.... #wa-option

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-options.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	5.422527653618424
Encrypted:	false
SSDEEP:	24:csY0xtxdJQeNVMznWrVMzLKWrVMzQzVMzQXVMzQdQVMzlCZVMCmFgtH4DE6H8X+:3Xxtxk/r363kKk+kNhzCJtH4DE+e+
MD5:	5D396B0577DFD6A4238021090BFC06FE
SHA1:	A734759019D6E3B7D5D300F9AA2D26D1FE101EC1
SHA-256:	253F99086DB440C8793FF15A30558A1AB85F202D2D57A7214E79313AC35FF297
SHA-512:	890F59B4C28E606CD6743204DD2E27D2111C01700CB1A2794CB7A63E0D9A217FDBCE82BBABDFDBABCEA1F693FE36B6E8B76185940048C3D179AB10A89BF12854
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-options.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-options-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/java

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-overlay-ui.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2339
Entropy (8bit):	5.380738551217695
Encrypted:	false
SSDEEP:	48:NOxNxS/Y+3i3cKc+cppJC3W0PK+ptCHJCeYvK:YFi2CxYi
MD5:	DB843FD06EA7EB950DC040F73A353487
SHA1:	8F2FCA47D5925E863AC39C0696A2F517B63B4269
SHA-256:	2FC9A3B519635C4618B1CAACB60141A08C6978D85205FE9ED6AEA95A7E23F140
SHA-512:	E8CE2D7810FF61D7B8AA7D135894763BA03D6344C6B8D9B9D6E22719DB29FFCCEAAB9175DEE2663781B1CFACFAB638CC6EED49705B024766A159D2A6C974AEC2
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-overlay-ui.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:/

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-overlay-ui.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10070
Entropy (8bit):	5.234835979741239
Encrypted:	false
SSDEEP:	192:2Ar/3q1FNFmMtuhVXdeWG3trDCpnb+LwlY7ZmXQ:7Q8XPG3tPqoQqUQ
MD5:	3951D2688FB8E756A9B9F8A291A24AE6
SHA1:	1135A01BA103594E016E3BB2E791DB35AF64090A
SHA-256:	05E33EB98A9ADD987BFF7BD21791A94DB03088D524AB6E8D7FE45090948712E2
SHA-512:	27150777E28D25B0A10432625399669FB7845816D8A8960F6958BC93A651BB4FC569DCF4382B9BA34FC53200C6132C67827448A72963DB427731F14BC3F095E1
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. arrowUp: $("#arrow-up"),.. arrowRight: $("#arrow-right"),.. balloonCard: $("#balloon__card"),.. contentText: $("#content__text"),.. cardImage: $("#card__image"),.. closeIcon: $("#close-icon"),.. waLogo: $('#wa-logo').. };.... var ENABLE_EXTENSION_OVERLAY = 0;.. var INTRO_OVERLAY = 1;.. var SEARCH_WARNING_OVERLAY = 2;.. var SETTINGS_OVERLAY = 3;.. var TOAST_OVERLAY = 4;.... var WA_EXTENSION = 0;.. var SS_EXTENSION = 1;.... var overlay = {.. types: {}.. };.... overlay.types[ENABLE_EXTENSION_OVERLAY + ""] = enableExtensionOverlay; // enable_extension_overlay.. overlay.types[

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ss-toast-variants.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2773
Entropy (8bit):	5.219151021756812
Encrypted:	false
SSDEEP:	48:xmp5UoZwx7MdDyTgWfx9gazwPpLDqELO1CX7EnulmCEys:xA2x7M8TgWfx9ZzwRqzkhs
MD5:	673281C45B2B048B7EDA310C81240563
SHA1:	7E750303228A0F3D5E2EE8C73C2E1607D7564CF2
SHA-256:	925711BD6ECCA6E8C4D625E5F1C7C8DB2DE64EAC25F8B186C953DD2E18571A7D
SHA-512:	015F4C82A6BF44FC4D1BF59973AE3FF816278BEF3F0497997784EF5BE0749E815E425B6748E6CFD1973B3677AF67B6D15B7F377C2566B7A23AE9053874F88B29
Malicious:	false
Reputation:	unknown
Preview:	* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. color: #212934;.. line-height: 24px;..}..../* Parent container /...toast {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px; / Window width is 530px */.. margin-bottom: 6px;..}.....content__checkbox {.. margin-bottom: 25px;.. display: flex;..}.....card__content {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}.....card__content #checkbox-question {.. font-weight: 600;.. font-size: 14px;.. margin-bottom: 15px;..}.....card__content .button__unfixed__width {.. background-color: #1671EE;.. color: #FFF;.. padding: 8px 16px;.. border-radius: 100px;.. display: block;.. margin-left: auto;.. height: 38px;..}.....card__content .button__fixed__width {.. background-color: #1671EE;.. color: #FFF;.. padding: 8px 16px;

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ss-toast-variants.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2674
Entropy (8bit):	5.347259359573244
Encrypted:	false
SSDEEP:	48:Ekx0xeexvU2363kKk+kF3hHCeYYUrOFfp6NnSmsPzxJzZ:5kCOFUNnRstP
MD5:	F58559DCA0208A198A9EF11C324F92DD
SHA1:	5928FF32F15E3283B3A0880FBD0C189730D2872C
SHA-256:	C9863CAF1EC5B86D1758B31DD6DB6E52CC29B4D1F8D516A85C755E74E9FC967B
SHA-512:	13C6C87D91CAC8AB9F4B26F5263B41A7872B5F6A14D66D559A89F274EC91372A599F21901DC26DD9AF4C66C63E186DF73462EC67A89BAB4DE2322E44FE4D6219
Malicious:	false
Reputation:	unknown
Preview:	.<html>....<head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\custom-checkbox.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ss-toast-variants.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-ss-toast-variants-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_we

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ss-toast-variants.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15842
Entropy (8bit):	5.047942511503827
Encrypted:	false
SSDEEP:	384:pBhtOz/WohfMaTGrTaTe1GXoK+iJIZ4t8g8BbLHLXz:nOyoiammeYokJIZm8g8BrD
MD5:	A8209B654F89B250084F67B5EA827546
SHA1:	BACA6B3770ED3DF2CA2F58AD9D36E692E82DCD95
SHA-256:	89C3907F24CDC54D4719101F6CA890E67322D2685D6CAA4C99E35D895C40A288
SHA-512:	85ECA7574517D1FE95D17DAB0F329E04C2E18EE395ADB3FDE2742B974590EA34168CF58009A3C6B6B2FA4B7A7A8FB817A71E942DE06C21EC1BDEBA9242801CC7
Malicious:	false
Reputation:	unknown
Preview:	./* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. cardImage: $(".card__image"),.. cardContent: $(".card__content"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. checkboxQuestion: $("#checkbox-question"),.. checkboxInput: $("#set-secure-search-checkbox"),.. doneButton: $("#done"),.. toast: $(".toast"),.. setSecureSearchLabel: $("#set-secure-search-label"),.. closeIcon: $("#close-icon"),.. labelDiv: $("#label-div"),.. };.... var variantsMap = {.. // Toast variation phase 2.. 1: {.. InfoTitle: "TOAST_VARIANT_1_TITLE",.. InfoText: "TOAST_VARIANT_1_INFO",.. Question: "TOAST_VARIANT_QUESTION"

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-bing.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1677
Entropy (8bit):	5.186028452208281
Encrypted:	false
SSDEEP:	24:UviN/rqfueEfu3kskCl8uGSq1lPDgrertqIKV5bZ066o9gDm2R:UvitOoWrJkSqbb9AIKV52jNtR
MD5:	241885732B6CE39CC3C428BD004A37B1
SHA1:	190F827B1B8FB159913753F0D1341BC2CCABBB21
SHA-256:	8C0284F1B830A397046B8CDE927C376F34C6CF840162D485F7C7CEEF1CDEDD43
SHA-512:	73C575F9BC0D89CB941BCC0F6065148BBA355A37DC40D5A3C0DAE77976F856B66FA508D7C8210018E4DDD99F302397717675E6563E738677D018BCABC1CDBB66
Malicious:	false
Reputation:	unknown
Preview:	body {.. cursor: default;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....#wa-sstoast {.. font-family: sans-serif;.. border: 1px solid #000000;.. background-color: #ffffff;.. height: 270px;..}....#wa-sstoast-logo {.. padding: 4px 0px 0px 10px;.. background: url(file:///[WA_FILES]/MFW/packages\\webadvisor\\inst-top.gif);.. width: 100%;.. font-size: 17px;..}....#wa-sstoast-header {.. background: url(file:///[WA_FILES]/MFW/packages\\webadvisor\\inst-warningbackground.gif);.. width: 100%;.. padding: 10px 10px 10px 10px;.. font-weight: bold;.. font-size: 15px;.. color: white;..}....#wa-sstoast-content {.. font-size: 11.5px;.. padding: 10px 10px 0px 10px;.. height: 142px;..}......#wa-sstoast-content table {.. font-size: 11.5px;.. height: 132px;..}....#wa-sstoast-content-caption {.. font-weight: bold;..}....#wa-sstoast-footer {.. padding-right: 5px;.. padding-bottom: 0px;..}....#wa-sstoast-content-check {..

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-bing.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3058
Entropy (8bit):	4.763148083290686
Encrypted:	false
SSDEEP:	24:x2skx0xdYk3WrVMzLKWrVMzQzVMzQXVMzQd1urVMzlbAVMzlizVMCy3juOB3+7qB:jkx0xT363kKk+kSChHhiKC8h3BsrVVQ
MD5:	2E8C49E814AABDC4AD0D9B28AE4FBAB3
SHA1:	8AFFAFB34393B9393E55E1BDA5EA9B7414A646A0
SHA-256:	DC19C3C5254ACEC3ABCC4E0CE6D9BC4433D48C69EC85A956C1D0BE7401BF7FDA
SHA-512:	044E5AC14C9EE2B1819B0F3B8530D8250B6BED127F9FAD9AE442194EE66FB0A585D2CAA6EBD06AE11F31715851F02C9D2075761A7ADC01C8BFDA8E8F871F77CF
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>SecureSearch Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-sstoast-bing.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-sstoast-bing-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ui-sstoast-bing.js"></script>.. <script type="text/javascript" src="file:///[WA_F

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-toggle.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7450
Entropy (8bit):	5.105888312752063
Encrypted:	false
SSDEEP:	96:OW0xXMHRMrola7b6xEgPGquAED+Y8AAoYE9Yl5hpeA8h9Y/5hbqe51E5T9565Cgw:OWlH2zFguf+c9Ug9K7aO9Y1bNH
MD5:	857D50C1C26AF38D1459BE49E6712C0A
SHA1:	DF40221495034021DE8DAB0C859549F3FDF1C1A3
SHA-256:	6916D408376D4664B2157D18CDF7CAF3B2C238B32D842C111F93612608EA3730
SHA-512:	0A0E5F82F3BD7D7E08051756D7379336E24514FC94860E6BBB9263478371E3560BC57C69CF8D93B2C29C95847D15CAAF7C659AA8B7ED2AE663B410E0F3CB74D3
Malicious:	false
Reputation:	unknown
Preview:	/* version 2 3 /.. {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}..../* Parent container /../ version 2 3 /...toast2_3 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;..}.....toast2_3_larger {.. width: 761px;.. height: 565px;..}.....toast2_3_smaller {.. width: 761px;.. height: 500px;..}..../ version 1 /...toast1 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px;.. margin-bottom: 6px;..}..../ version 2 3 /...card__content2_3 {.. background-color: #fff;.. margin-left: 297px;..}..../ version 1 /...card__content1 {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}..../ version 2 3 */...card__content .log

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-toggle.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4163
Entropy (8bit):	5.136475686937548
Encrypted:	false
SSDEEP:	48:raaxLly363k3k5kabWhHZhuvT0/qUYoAxT75CZUea9S64hV2QXDUanj5Q9nBb:fbYhYGYoq75Heac7VfXDUanl2b
MD5:	30199E1070E8D91186CBED6166B37EE0
SHA1:	4944F5E22867CBF6039A7004DEA33B507BF78A41
SHA-256:	5BBAB11AC27576298D8F2CB0005F171069A7F77736DC46695A5A6079743D711F
SHA-512:	FA4B4D611100FE08384955EC4C803A824751217E4E25A294883A99B3176878ADDDB9BA6D9D6BCA64859045BF45F16AF6B153303B1F367F64A6343A828EE4E56A
Malicious:	false
Reputation:	unknown
Preview:	<html>.... <head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap".. rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/mfw\\packages_web_view\\webadvisor\\wa-sstoast-toggle.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-sstoast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILE

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-toggle.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9943
Entropy (8bit):	5.156152247580407
Encrypted:	false
SSDEEP:	192:TAf3m0aWPwT0JrrvhGzuLIhHQnJs1a85seo65DUyIrEzU6lgXsm:8f4cGyDJgseoYIrasz
MD5:	25576EC7C0416C778945B26149DD3832
SHA1:	B762362DFCB519B5247ECE0D28DE7F4FBF6AF806
SHA-256:	0BC7EE98AF16EEFAD7495D25B4AC978E008C31B9C798E8EF8CE280CE9D51AE3E
SHA-512:	68637B8DF72D3F36E09D620D65995003CF1F0E47B32F416ED07EE09EF94A2947ECEC1905DF2A7BBC8C0975B2FE84035D4DC878889156A7DDC1991BA7DE470F2D
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.. var browser_code = "";.. var provider = "";.. .... ui.accept_extension = function () {.. var $el = {.. version2_3: $(".version2_3"),.. cardContent: $("#card-content"), // different css for different versions.. cardImage: $("#card-image"), // different css for different versions.. featureDisabledSection: $("#feature-disabled"),.. progressPic: $("#progress"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. expiredSection: $(".expired__section"),.. expiredDivider: $("#expired-divider"),.. expiredLabel: $("#expired-label"),.. expiredName: $("#expired-name"),.. feature1Label: $("#feature-1-label"),.. feature1LabelContainer: $(".feature__1__label__cont

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2195
Entropy (8bit):	5.238582171917092
Encrypted:	false
SSDEEP:	48:UfqM+IFN0I4H0UJ0UY60uR60BFvUIFaSvU49xRstVOTcz:UfqMXm5R3F7aSp9OTz
MD5:	5D2E698A6968F1314CA1C4C7C6539C94
SHA1:	9C19CAB9E2D9CC5687695411CD8956ED9F7BB103
SHA-256:	72861B708119855D825F477FCF6F6AB5C5C9068E0A431AEB0AAD0009C2B32030
SHA-512:	2991D8871A7B81068E2145772EED6DA2603C165104C1461D2CC78AC3F06557120E071A80024FB7313D408B8B7403BAF363F7CC31848FE8139BF353E51F517889
Malicious:	false
Reputation:	unknown
Preview:	body {.. cursor: default;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....body :focus{.. outline: none;..}....#wa-sstoast {.. font-family: sans-serif;.. border: 1px solid #000000;.. background-color: #ffffff;.. height: 270px;..}....#wa-sstoast-logo {.. padding: 4px 0px 0px 10px;.. background: url(file:///[WA_FILES]/MFW/packages\\webadvisor\\inst-top.gif);.. width: 100%;.. font-size: 17px;..}....#wa-sstoast-header {.. background: url(file:///[WA_FILES]/MFW/packages\\webadvisor\\inst-warningbackground.gif);.. width: 100%;.. padding: 10px;.. font-weight: bold;.. font-size: 16px;.. color: white;..}....#wa-sstoast-adblock-content-subheader {.. padding: 0;..}.....main-content {.. font-size: 12px;.. padding: 10px 10px 0px 10px;.. height: 118px;..}.....main-content table {...height: 108px;...font-size: 12px;..}.....main-content ul {.. padding-left: 13px;.. margin: 15px 0;.. padding-bottom: 10px;.. line-height: 17px;.. font-size: inherit;..}.....main-content

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5845
Entropy (8bit):	4.2556796306387605
Encrypted:	false
SSDEEP:	48:AkxeexbUy363kKk+kihHhiKC5h3ugf7W/UQ:+q/Q
MD5:	7457234C36A5954ECE88E9A9B376E0DC
SHA1:	24501D1AB910ABBFA2B970C92F2E3E73EC3A553E
SHA-256:	8C1157403230E992DDB4DB20930118AC24EC78F91978401F2F4A5FA1C6A888DF
SHA-512:	210F16DCB4F2B321067C5D2100E4F402022DCDDA05F6EFB77D80D6AA2D74490C4076544E0D7FD5B5E1EACC401FF838DCD524001B622D9FD83259A1901CAF34D4
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. .. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\custom-checkbox.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-sstoast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-sstoast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\w

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-av-report.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	4.712007692056846
Encrypted:	false
SSDEEP:	96:qkKi/9YE8TRrGQyvEy2oWp2Uop1VacU2/BPZnn41/qQmO:wCR5JBPNYCdO
MD5:	A90AF7CB20576C42BC39F194E64F489D
SHA1:	D1FAF0AB64129872556CF9ED0E9085C3EA474C94
SHA-256:	BC1A0A0BD4177E481261F494D18B66F6DEE1057BE17A306913F0BD6C6F241E14
SHA-512:	C7658A86E5A08D923DFBE0E88A75605EC64C647FE8307675DE1AC7F2DDB1B394D58DFC444855EB7CF2C40F546DA7A200569124A20588938ECAF2737492ECED85
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings;.. _lrt = wa.Utils.Lang.ResType,.. _l10n = wa.Utils.Lang(wa.Utils.Lang.ResType.UT).get;.. .. ui.AvReport = function () {.. var settingUrlBad = _settings.get("upsell_url_bad_scan", "1");.. var settingUrlDefault = _settings.get("upsell_url", "1");.. var url = (settingUrlBad == '' \|\| settingUrlBad == undefined)? settingUrlDefault : settingUrlBad;.. if(url == '' \|\| url == undefined){.. url = 'https://www.mcafee.com/consumer/en-us/landing-page/direct/aff/WA_MTP_StaySafe.html?affid=1523&ccoe=direct&ccoel2=campaign&csrc=wa&cctype=mtp_test5&ccstype=mini_vulnerability_scan_91277'; .. } .. .. open = function () {.. var data = JSON.parse(_external.getArgument("report_data")); .. showReport(data);.. _window.show();.. },.... showReport = fun

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-dialog-balloon.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.719782670297555
Encrypted:	false
SSDEEP:	96:+cAFwUkCTaVVPCxEeO0pv1xRsxIE3BXDXjZXGFQs:hASUrTafjetptxRIXDXjZXGd
MD5:	9EE575423491C3849418125F1CD1236D
SHA1:	815EADAC32775A687B7F2D98C0628ACC171D87A2
SHA-256:	4EFEB74659E165F1ED10FBFE1EDEF07DC6A3C9DA505E973CA96E3ABA38940963
SHA-512:	BA1CD57A134568CF9749FA295D84A12FCDB521CC0701B0B630CE16F4E23C4D5311FE7D2A8BFFACC8EECE343686709EC483A9F98F6CDFC4DA8A32130A9BF3ADE1
Malicious:	false
Reputation:	unknown
Preview:	/* Accept Extension UI */..(function (wa) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var telBalloonType = '';.... show = function () {.. chrome.webview.hostObjects.wa_external.log("inside show");.. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("inside ready");.. var settings = JSON.parse(await _external.getArgument("overlay_data"));.... if (!settings.balloon_type) return;.... init(settings.balloon_type);.... await _window.show();.... // Send telemetry for dialog balloon showed.. browser_code = await _instrument.getBrowserTypeCode().. var telemetryEvent = new OnboardingBalloon().interaction_type("Impression").browser(browser_code).balloonType(tel

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-dwtoast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2708
Entropy (8bit):	4.977093022666185
Encrypted:	false
SSDEEP:	48:N45ikP03NTwwiIw0X+Zgleg0q3nwYfwR3AhYeYEfTiNAE1ed1RNArA:RdUl3GsKirE0SsA
MD5:	9BA72A20BEF3C12F05F0151794BD5C04
SHA1:	E8C8D925B53C79D8E22434616C130ACD2E1B12FC
SHA-256:	1E2813777EB6C2CEF0845CE2C49E487D8E84D40735D0FCC9BAED4CF17A9B0016
SHA-512:	D4B3D278A2DC927058BCC570241F6727FA332DA7631E173F77DA6EDBDB6561A54A157DA6EB2D337A577912991A6D461E2E4094EB95C96AEAEED0B07BD0A15DD3
Malicious:	false
Reputation:	unknown
Preview:	/* Download Warning Toast UI */..(function (wa) {.. var ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window,.. _dw = wa.Core.DownloadWarning,.. _wa = wa.Core.WebAdvisor,.. _l10n = wa.Utils.Lang().checkList();.... ui.DownloadWarningToast = function () {.. .... show = function () {.. _window.ready(async function () {.. let domain = await _dw.getDomain();.. let fileName = await _dw.getFileName();.... document.getElementsByClassName("logo")[0].innerHTML = (_wa.getProductLogoHtml("file:///[WA_FILES]/MFW/packages\\builtin\\mcafee-logo.png"));.. //$el.status.append(_l10n("PP_STATE_TEXT"));.. document.getElementsByClassName("body")[0].innerHTML = (.. "<p class='content-header'>" +.. "<img width='20' align='middle' src='file:///[WA_FILES]/MFW/packages\\webadvisor\\warning-icon-toas

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-options.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23757
Entropy (8bit):	3.8953389177774893
Encrypted:	false
SSDEEP:	192:LravuBFTv2stTHDiF9ymq4pnU5rnXEBF15hZOmvYkydOergI5:PavuB92qTHDdmRBU5rXEBF1VJy9EI5
MD5:	C61746778B9CD906A40B483D4CE7A636
SHA1:	5962FA0990F25D85EE300F8E232406A4CFEA7DF1
SHA-256:	5190B820868B554F46379ACB4026C23A2D2E96DDE5AA367DDCC337A63B60556D
SHA-512:	6487C31D8E0FF99E9F6638C5BAEAB20311938848A650A78A03D5368BD8A569FC53103861A6C0C2596B609CD45D6F53E7F7E49CA3C85833CA222BAD6E3D1CB231
Malicious:	false
Reputation:	unknown
Preview:	/* Options UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.OPTIONS).get,.. _core = wa.Core,.. _window = _core.Window,.. _webAdvisor = _core.WebAdvisor,.. _productNameHtml = _webAdvisor.getProductNameHtml();.. _external = wa.Utils.External;.... var OptionsMenu = function () {.. var menuItems = [],.. el = {.. $menu: $("<ul id='wa-options-menu'></ul>").. },.... toggleContent = function (id, delay) {.. $("#" + id, el.$content).. .fadeIn(delay).. .siblings().. .hide();.. },.... itemSelected = function ($item, delay) {.. $item.. .siblings().. .removeClass("selected").. .

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-sstoast-bing.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3213
Entropy (8bit):	5.1663703089817155
Encrypted:	false
SSDEEP:	48:84J7WFAUE+tg/eQKS8HJhMfNANKTBd5cgEXQ6c+dTYOYEfNg+cQBcZ1cxuOnrs:YyDGhp6xz5clQSa7Ezl7nrs
MD5:	7D61832FAAF7E3763D6408BE26E420E6
SHA1:	9B07907632239F6AB14D770946F58FC035C40B17
SHA-256:	9AD460788B5DE33675AF17D73CE10784E4B6DA56CFB75F122F9BB21B58AB0370
SHA-512:	28276C00A029C2CFB712719A16C0FEC344366FF96D246E416908B2D536E2E5E983547408FA35F0DE78DA998B8A47E7E867AD2D8D347AC993590C670403E31EE0
Malicious:	false
Reputation:	unknown
Preview:	/* SecureSearch Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window;.... var browserCode = "(unknown)";.... ui.SecureSearchToast = function () {.. .. show = function () {.. _window.ready(async function () {.... _window.setHeight("294");.. let productLogoHtml = "<div class='logo'><img src='file:///[WA_FILES]/mfw\\packages\\builtin\\mcafee-logo.png' align='middle'/>";.. let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.SSTOAST).get;.... document.getElementById("wa-sstoast-logo").innerHTML = productLogoHtml;.. document.getElementById("wa-sstoast-header").innerHTML = lang("SEARCH_TOAST_HEADING");.. document.getElementById("wa-sstoast-content-subheader").innerHTML = lang("SEARCH_TOAST_SUB_HEADING");.. document.getElementById("wa-sstoast-content-caption").innerHTML = lang("SEARCH_TOAST_BODY_TEXT");.. let subfooter = document.get

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-sstoast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14386
Entropy (8bit):	4.956996071625848
Encrypted:	false
SSDEEP:	384:bEO/vVN2LiepMLoN07fVLE09/6H6HnHfn:bJ/vOLWL57FE09/f
MD5:	3800D78B3B4A19D1953F62E201FF7412
SHA1:	0853584B66AB39E7EB2618199443E5A233A931A4
SHA-256:	343D41222B0A15360A8193368815745A19365089EB1BD5C40AFCA1C4E0BEC6FB
SHA-512:	7D849CD999BB9A40ED7DB3E7211C241471C4CCB10D44BC39B3359E30F7E1B8B76458811A83DAD848A2FB024FE4117AE06DDF701023B991DB4F511EB82C3FF846
Malicious:	false
Reputation:	unknown
Preview:	/* SecureSearch Toast UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI \|\| {}),.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. browserCode = '',.. provider = '',.. metadata = 'render=web_view';.... ui.SecureSearchToast = function () {.. var $el = {.. header: $("#wa-sstoast-header"),.. logo: $("#wa-sstoast-logo"),.. mainContent: $("#wa-sstoast-content"),.. mainAdblockContent: $("#wa-sstoast-adblock-content"),.. mainMavContent: $("#wa-sstoast-mav-content"),.. subHeader: $("#wa-sstoast-content-subheader"),.. subHeaderAdblock: $("#wa-sstoast-adblock-content-subheader"),.. subHeaderMav: $("#wa-sstoast-mav-content-subheader"),.. caption: $("#wa-sstoast-content-caption"),.. captionMav: $("#wa-sstoast-mav-content-caption"),.. label: $("#wa-sstoast-content-label"),.. labelAdblock: $("#wa-sstoast-adblock-content-label"),..

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-upsell-toast.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2797
Entropy (8bit):	5.247866552733011
Encrypted:	false
SSDEEP:	48:3Xxtxc/4363kKk+krhOCe4T+DSSqor5beIwEeIYuAPKt:X8ztb1Xt
MD5:	0D3230A1187DEBE95CB52581ACD17796
SHA1:	4717F42C4B32CFD61FF89BBEAC069F3E6F809BDF
SHA-256:	4F2169F9DC59580BF62474C80FC450D7264EC6DBCCEDCD22C305F178B4938EE6
SHA-512:	EAB35BDD501992CEF621F12FFB95A4AD92879EC3FA2D73849AC0075513EF1826AAA3AD468F17431064D6279A1D0A5DE573C702BEA5C01EB1AB13029CBB75FED3
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-upsell-toast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-upsell-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script t

C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-upsell-toast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	5.111211412476876
Encrypted:	false
SSDEEP:	192:+0/Pf4lTvqz3NbDdvSNOsxyVcNvKTvY6TdR/OsxTtwXMT2OpU0g/0i:zPf4lTvECBxyuNvKTvY6TjBxWcTRxe
MD5:	EE91F0EB0F8ACD90552CEC2954DFF482
SHA1:	04029B74FBBFFF951A77726FF01145C115EBD948
SHA-256:	ADE71B547F72D8BC6514CFE904353363C1DEDD162E6E9685B7FF2BEE57229981
SHA-512:	A934C5B9AD127922DA65847861FD0CA549CFD62BAC7ABF71FB8C5DC6B7942BFE1CF99B6A547EE4AA428A3BF3EE6F284A694B6C7E43D2CCE396E6612625C3C804
Malicious:	false
Reputation:	unknown
Preview:	(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings;.... ui.createUpellToast = function (toastData) {.. if(toastData.campaign && toastData.campaign !== 'none') return new ui.CampaignToast(toastData);.. .. if (!toastData \|\| (toastData && !toastData.cohort)) return new ui.AvScanToast(toastData);.... switch (toastData.cohort) {.. case 1:.. case 2:.. return new ui.DirectUpsellToast(toastData);.. case 3:.. return new ui.GtiUpsellToast(toastData);.. default:.. break;.. }.. };.... ui.extend = function (Child, Parent) {.. Child.prototype = Object.create(Parent.prototype);.. Child.prototype.constructor = Child;.. }.. .. // ----------------------------.. // Base Toast Object definition.. // ----------------------------.. ui.UpsellToast = function

C:\Program Files\McAfee\WebAdvisor\analyticsmanager.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5375200
Entropy (8bit):	6.530065864886624
Encrypted:	false
SSDEEP:	49152:C9PMm/gtYM/mu9Ji0/R3WRGIXaqwQCMjPgSNd82Ga8wT2ik4lw0ft2kuIe2jX2l7:ze+YoNq3CMj48xVk49LVeW/w3xnxd
MD5:	A23F0EE9D64116F6C7147DCD1EF67C6F
SHA1:	131CE068E236F40546739938749ABAC4EED9CDDF
SHA-256:	6990FDA9F8D3D9DAD116AEFDEBE0AC442EF21D0C42B28E93BEF29F80F0CC1A50
SHA-512:	39466DCC78956B64220C5514A2B48232E68933B5214370D4C0D16ABA0082E3D0A05BC7AF0478C3993F0C63FA1F888E9BC151AA37C40C90E8B3034E71E0FB804C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......^.~.............Q...............................a...Q..................._....&..4...Q.......Q...=...............[...............-..................................Rich............................PE..d...o.>f.........." ...$..=..x........5.......................................R.......R...`A..........................................J.D...$.J.......R.p.... O......FP..... R..{...0F.p....................1F.(....0B.@.............=.......J......................text...c.=.......=................. ..`.rdata..xH....=..J....=.............@..@.data........0K.......K.............@....pdata....... O.......M.............@..@.didat..p.....Q.......O.............@..._RDATA..\.....R.......O.............@..@.rsrc...p.....R.......O.............@..@.reloc...{... R..\|....O.............@..B........................................................................................

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticscontextconfig.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3941
Entropy (8bit):	5.53133157158304
Encrypted:	false
SSDEEP:	96:YMh0MSMOM+MCd+QIAOYl93A3NVz3cVtubiQXXvPrMtXUZNWjpzCrh2Ot/GfAADS7:GkXVStWhXX7MNWW905Xh
MD5:	7071051612F0DB04FDB53533D5A05130
SHA1:	A400D0C06C25478021850CD309D36EAC741F5AAF
SHA-256:	4CB8F841897880738CF6D8E226AF8EC58016727EB4C7E193F90555031BCE8A5E
SHA-512:	F1157ED23BBCC288BAC22379B9F806266795DBCA5C770274ADE8F8BA37D3B76C6DFADDAED7E0E2C00331CB29FD3E0260E4128E43E418B5C8B16BA9647556A02D
Malicious:	false
Reputation:	unknown
Preview:	.LJ........>.b5.;.5...5...=...5...=...5...5...=...5...=...=...5...=...5...=...5...5...=...5...4...5...>...5...>...=...=...=...5...5...=...5...4...5...>...5...>...=...=...=...5...=...5...=...5. .=.!.5.".5.#.=...5.$.4...5.%.>...5.&.>...=...=...=.'.5.(.5.).=...5.*.4...5.+.>...5.,.>...=...=...=.-.5...5./.=...5.0.4...5.1.>...5.2.>...=...=...=.3.5.4.5.5.=...5.6.4...5.7.>...=...=...=.8.5.9.=.:.=.<.7.=.6.=.L....context_config.contexts....contexts..wa_mss_plus....handler.MSSpStatus.setting.context_wa_mss_plus.user_account_id....setting_name,CloudSDK.cache: GET /account/v1/details.key.account_id....handler.AnalyticsWPSSetting.settings.....property_name.accnt_id.handler.WSSSetting.db_name.vso.hash_id.IDENTITY....wss..wps..handler.AnalyticsWssWps.setting.context_user_account_id.product_productkey....setting_name1CloudSDK.cache: GET /subscription/v1/details.key.product_key....setting_name1CloudSDK.cache: GET /subscription/v3/details.key.product_key....handler.AnalyticsWPSSetting.settings.....proper

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticswpssetting.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1631
Entropy (8bit):	5.811626767238773
Encrypted:	false
SSDEEP:	48:SsyL8TKmNfeO96lrbNiFiuUDqKMZO58Aa4JlMqk:AL8+jOMEFsD5MZOs4fMqk
MD5:	0DDF132C720380BBCE6AA9EB8D30FC46
SHA1:	973320F560FC020DBC3E653D8365D82FA4475AE0
SHA-256:	0C2E10E502083EF9973D5121D2CFAE53FCD745DFC01D9F4EBCF890CDA6F70D59
SHA-512:	69E4E5FDF86504BB7F0C39616B4ABACB28F2500D25E5D082E6ED976ADE1C54BD0C448ADBF004440FC3845DDBC4133C037AA5E461770246F6E67B007A0EE5A312
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........U....X...'...L...6.......9.......B.......X...6...9.......9...'...B...'...L...........X.2.6.......B...6...9.......9...'.......&...B...6...9.......B.......X...6...9.......9...'.......&...B...'...L...6.......B...H...6...9.......9.......'...6.......B...&...B...F...R...8.......X...'...L...8...6...9.......9...'...6.......B...&...B...6.......D...,AnalyticsWPSSetting: value returned is . = .pairs.NO_WPS_KEY&WPSSetting: JSON parsing error - .decode.json_parser%WPSSetting: wps json setting is .tostring.NO_WPS_SETTING WPSSetting: wps nil setting.info.log.core.get_setting.wps_utils.NO_INPUT_SETTING........L...@.......6...-...B...X.......X...+...L...E...R...+...L......ipairs........D6...9.......9...'...B...5...3...'...-...9.......X.$.6...-...9...B...X...9...9...6...9.......9...'.......&...B...6...9.......9...'.......&...B...-...........B...........B.......X.......X...E...R...-...9.......X...........B.......X...6...9.......B.......-...9.......2...D..........format_output.lower.string.lo

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticswsswps.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.541787351344142
Encrypted:	false
SSDEEP:	24:64svoMGnu0xHB1bKNQnuEKSNAdoCsqXRb7UcVzoFsqXRAKJDMOrDYyMyJ11Uc7gn:1u0xjuE+oeXRJ1oLXRnJDMO3YnyJ3XM
MD5:	C771F301AE497265219A5F412F465666
SHA1:	B4BB147057493AEC5DA35B73A35F100059B61E56
SHA-256:	5D8591F392CF89355F567C34906AA8407C4441C0995131BD9157AC5C95D87B78
SHA-512:	BE4EB33743168334E6BB02220DFF799893E43A2FC9FF156017FAEB99FD063782B37FBA1FB277DD9D7B7F8DC78EA92EBE1F72D69B003250FFDC851388890E2F50
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........m-...9.......9...'...B...'...6.......9...B.......X.0.-...9.......9...'...B...-...9.......X...-...9...9.......X...6...'...-...9...9...&...B.......X...9...-...-...9...+...B...9...B.......X.=.-...9.......9...'...B...X.6.-...9.......9...'...B...X./.-...9.......9...'...B...-...9.......X...-...9...9.......X...6...'...-...9...9...&...B.......X...9...-...-...9...+...B...9...B.......X...-...9.......9...'...B...X...-...9.......9...'...B...L.........]AnalyticsWssWps: Expecting wss subconfig and wss handler in context config, but got nil.:AnalyticsWssWps: Nil wss context handler encountered..wss*AnalyticsWssWps: WPS is not installed]AnalyticsWssWps: Expecting wps subconfig and wps handler in context config, but got nil.:AnalyticsWssWps: Nil wps context handler encountered..err.get_context_string.new analyticstelemetry.context..require.handler.wps&AnalyticsWssWps: WPS is installed.is_wps_installed.wps_utils.$WssWps: main get_context_string.info.m_loggerR.......6...9...........B...3...=

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\browserinformation.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4878
Entropy (8bit):	5.7621823729885175
Encrypted:	false
SSDEEP:	96:/xhdYN4Ybm3g2LGC3Xov5TZ/yS5fCGIhKd+g:J93JLGC3YRTZ/7Ig
MD5:	847200416CB173F2A5CC6789090DBBBB
SHA1:	8B76DC84E3B8F0E30F4E5A980CFA885E0DDD65E7
SHA-256:	9548C938E80E45532A0968E9716725A46FF38B58B90136D4AC767E06CD8CD237
SHA-512:	59DC863D71427EDD5A08DA5C91AE57A734FD2C0F41BC4D8EBE7668707CE806300F0CBA75FD017D1261652F4975531ED4F788D57BA63703652F654695A72E50D0
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........(6...9.......9...'...B...5...5...=...5...=...5...=...7...6...-...B...H...-...9.......6...8...9...6...8...9...B...6.......9...+...-.......&.......B...F...R...K..........SetOption.settings.value.key.get_browser_version.pairs.reg_info.ed....value.version.key(Software\\Microsoft\\EDGE\\BLBeacon.ff....value.CurrentVersion.key%Software\Mozilla\Mozilla Firefox.ch....ed..ff..ch.....value.pv.keyNSoftware\\Google\\Update\\Clients\\{8A69D345-D564-463c-AFF1-A69D9E530F96};Inside Browser Information set_browser_version_setting.info.log.core........-6...9.......9...'...B...5...7...6...-...B...H...-...9...6...8...+...B...6.......9...+...-.......&.......B...-...9...6...8...+...B...6.......9...+...-.......&.......B...F...R...K............SetOption.settings"get_supported_browser_version.pairs.browser_ints....ed...ff...ch..CInside Browser Information set_min_max_browser_version_setting.info.log.core........<6...9.......9...'...B...-...B...-...B...5...-...=...6...-...B...H...9.......X...4...<.

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\browserversion.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	5.825645072091544
Encrypted:	false
SSDEEP:	24:69mArxdapks5OCYvn6RWv8KD8RwzQB69jQ7SOqyKRb9e3xVNQ:ax5z6R0jD8qzQB69jQ7SOqyObsNQ
MD5:	A4B5370F6A91516A7A036A1ACEDBE6DB
SHA1:	A2A51FC681E68B477CB47A3EDA83A0C85B549BA4
SHA-256:	FEAEF65B40968F5AAD6F884E0761969CC17F1BD04B5838A08DDD5FFD06EFAC2D
SHA-512:	BBF30052675FA26E97D477B8FEAFFC82E907C38AA60CD83DE09BC6CACCE14DACBE2A62CB78AE5E137FC6DD54C982CB5C72247A5C38A9306ED671F1FC4843F0B8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........Q4.......X...4...5...>...5...>.......X.......X...4...5...>.......X...4...5...>...5...>...5...>...5...>.......'...6.......B...X...6...9...9...9.......)...9...B.......9...B.......X.......9.......B...........X...6.......X...X...E...R...'.......X...6...9.......'...B.......X.......X...6...9.......9...'.......&...B...6.......D....tostringMCould not determine browser version. Returning default value. Browser = .err.log.%d%.%d.match.string.0.0.verion.QueryValue.IsValid.options.root.Registry.Win32.core.ipairs.....root.HKLM.options........root.HKCU.options........root.HKLM.options........root.HKCU.options........root.HKLM.options.....ie....root.HKLM.options........root.HKLM.options.....ffj.......'...6.......9...........B.......X...6.......B.......L....tostring.GetCurrentBrowserVersion.utility..........6...'...B...4...3...=...3...=...2...L...."get_supported_browser_version..get_browser_version.mfw.core.Win32Helper.require...//434786167618F27CDEC23EAB712D213574F516BE81368719EA0A944F46

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\contexthandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.250605664846192
Encrypted:	false
SSDEEP:	6:6lK3t4LqtAoIulNhWjGWA6q4Tf9q4Tf9qy/jmhSA5bbjISUBEnbrFplU/hO:6I9OuHhWqWBtJjmhzFb8P8PS/hO
MD5:	8C45BFD0DC70A6E3093EF2E6EFA349A9
SHA1:	5A15E4DEBA3224ADC0826D0CF33F062F707961DA
SHA-256:	7547EB82F7B07DCD7FBA335D49B819BD1D2AEDE04EFCF6588FE303C831152EAD
SHA-512:	7B89EDFBD0C97BEC366BE5288C54831A36254BAAB7172D9CA74CFD5B2D7FBE040CE9ABD1659190C5AA0BCA071D4F46EE88C6196D399B9A6F504F1177A03F42B4
Malicious:	false
Reputation:	unknown
Preview:	.LJ..@.......6...'...B...K...'get_context_string not implemented.error........-...L.................K.....x.......4.......=...3...=...3...=...3...=...2...L.....set_context_config..get_context_config..get_context_string.m_logger;.......4...7...6...3...=...6...2...L.....new.ContextHandler...//7D71C7EA711812AE1473C52F619B6568B4BA95D8E99EC5872D7B4B25DD71EAC7B5787AEAF2680AC8340E767DAC53C530FE55BC0C02A368EE63CC1B6379ABF2FB++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\externalutilityfunction.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	897
Entropy (8bit):	5.571995526352372
Encrypted:	false
SSDEEP:	24:68i5J1Gn4Lel9awpSLdVf507iDaXU0XlLRNMSJ1VzyG:ti5J1venD4Vf5Coj2RqSJzuG
MD5:	F7B72E88A57F08656AA62859CF14343E
SHA1:	01505A2A6A79AABB0D492BDDC93DCE01DFA7E326
SHA-256:	4152FBEF9FB7CA5B02EEF8EA81ADE08691D728EB9441FF577CCBE3B931DB5C6E
SHA-512:	35642DC6619925B8A11A17EC0C07A15721F6CD39EE8D9039E665EEDE5F2681B1B285E80A9EF65FE7F387E96C9A6F6475A79C28D23334703DCCE1EDAA162E7965
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........>-...9...B.......X...9.......X...9.......X...-...9.......9...'...B...'...L...6...9...+.......X...9...8.......X...-...9.......9...'...9...'...&...B...6...9...D...........B.......X.......X...-...9.......9...'...9...'...&...B...6...9...D...6.......D.....7) return invalid result. Returning default value...tostring0) does not exist. Returning default value. External utility function (.utility._G.defaultQInvalid configuration supplied to external utility function context handler..err.m_logger.func.default_no_value.get_context_configR.......6...9...........B...3...=...2...L.....get_context_string.new.ContextHandler.........6...'...B...4...7...6...3...=...6...2...L.....new.ExternalUtilityFunction.analyticstelemetry.context.ContextHandler.require...//4ED24C4A584E319C05F155B7080F0BBB0C915625693A319C084585D29AB128178983D3E2DEE020433BB5C88EA6B1B3EA7BD0CCA873C0C97E4AB97A9DCD561AB6++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\featuretrackingfeature.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6938
Entropy (8bit):	5.632365925951733
Encrypted:	false
SSDEEP:	192:ZdKqmniSFhKwEXL1IP2L59LfV/twUxYZX7XukNJK4wgcfCRKL1g+8/Wj:bmnPhKwEXL1i2L59LfV/twU+ZX7XHNJa
MD5:	CBB72B0FAF932A5E45CDEF3CFAA0E022
SHA1:	79DA235A5EAD941A71655707EB8B7F42FACA598A
SHA-256:	D7B715631E7B3483170AAAC525FC375F19CD2FE124514E0628B24E4E1B9AF140
SHA-512:	D0C086884BDB8E7B1E36CE9B135976C17CC90703F91EDDC96B177689A69B6BB07CC4A478F59858BEC143E0A9130B939B71BE850F0A3F4ADD5BC432665A4F7F59
Malicious:	false
Reputation:	unknown
Preview:	.LJ..V.......-...........-...-...8.......X...-...-...8...-...-...-...8...8...J...K..........d.......4...6...-...B...H...........<...F...R...6...9.......B...)...3...2...L.......sort.table.pairs.........P'...-...B...X.I.'...).......)...M.>.8...9...8...9...8...9.......X.......X.......X...6.......9...6...6.......9...........'...B...A...6.......B...A.......X.......'...&...X.......'...&...X...8...9.......X...-...9.......9...'.......'...&...B...X...-...9.......9...'.......'...&...B...O...........'.......'...&...E...R...L........=2) was detected when processing FTF dimension..Invalid information for (.err%) when processing FTF dimension.'Skipping version information for (.info.m_logger.version.0.1.GetOption.settings.tostring.IsMatch.regex_helper.enablementCriterion.enablementSetting.scope..,.........6...9...........B...6...9...3...3...=...2...L.....get_context_string..FTF_Registry.FeatureTrackingFeature.new.ContextHandlerj.......-...9...8.......X...).......)...M...8...9.......X...8...9...L...O

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\hashedmachineid.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	896
Entropy (8bit):	5.727296558205366
Encrypted:	false
SSDEEP:	24:65DAOPkmjLp1SdnfRFtWCkya0n5LllQGJ1gst9ToUi/L:cDTkKLPmlnE0LlhJr3ij
MD5:	6E8607836D00CE3CFFBA40614FB08D18
SHA1:	7784DA0738FA4BE0F8FC2057F59A786B58A04448
SHA-256:	7CE237C222A3F36E829FB9AD7D900BD196B48F56D686F8032D2C7FA5559675FE
SHA-512:	17FC7D051EF04FDE8D9950C0E2DA64909AF9133A3B5EEE3D428ABC95A1CC83494E92BB95B0370F339544ACF8866F558D68F3180845223033E8FE0CFBD0339F93
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........R6...9...9...'...'...)...*...B...'.......9...B.......X...6.......9...'...B...A...........X...'...'...6.......9.......B...........X...-...6...9.......)...)...B...6...9.......)...)...B...6...9.......)...)...B...6...9.......)...)...B...6...9.......)...). .B...'.......'.......'.......'.......'.......'...&...6...9.......B.......L......upper.}.-.{.sub.string.MD5Hash.utility.MachineGuid.QueryValue.tostring.IsValid.$Software\Microsoft\Cryptography.HKLM.Registry.Win32.core...w.......6...9...........B...'...3...=...2...L.....get_context_string%d41d8cd98f00b204e9800998ecf8427e.new.ContextHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.HashedMachineID.mfw.core.Win32Helper.analyticstelemetry.context.ContextHandler.require...//CEE727047D2E8DDBE02393EACFD367C1901202AF7EA033B18F76ABBB22D4BB14FF3F9A012F2C01BE641B41DB3397C5F0DF096309177EF15557239BD4B529ACCB++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\msspstatus.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2001
Entropy (8bit):	5.687746866803485
Encrypted:	false
SSDEEP:	48:o/c8lgG2qfCasDclRiXv59/y6yznlIJC6NO:R8lz2MzsEQp+nGoMO
MD5:	9C42C852EBBAD310D9C5114AFCEDED4C
SHA1:	685538B455600D0030863B0563F3ABC348BD5D88
SHA-256:	DA2A834265D905679F31590A14E92773C9B8EEEC4DE09401C9EEDD4398C3A58D
SHA-512:	AC88FD07DCFD6173D790B2BAF23174933D71822F7657DAAA6D4750BC75D0DD59FEE0EAACF466E6609E1CF4F6963605B5C38136D761E0EC0C9965B7DD18984C96
Malicious:	false
Reputation:	unknown
Preview:	.LJ..k...........9...'...B.......X.......9...'...B.......X.......9...'...B.......X...+...X...+...L....\|.&.%%.find........1-.......B.......X...-...9.......9...'.......&...B...+...L.......9...'...'...B.......6...9...'.......'...&...B.......9...'...B.......9...B.......9...'.......&...)...+...B.......X...+...X...+...L........Directory of .find.close.a.read." 2>nul.dir ".popen.io..\$.gsub%Unsafe directory path provided: .warn.m_logger........'...6...9...9...'.......)...*...B.......9...B.......X.......9...'...B.......X.......X...6.......D...X...-...9.......9...'...B...'...L...-...9.......9...'...B...+...L..... MSSp not found in registry..version_not_found1MSSp 'DisplayVersion' not found in registry..warn.m_logger.tostring..DisplayVersion.QueryValue.IsValid.HKLM.Registry.Win32.coreYSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\McAfee Security Scan............'...-.......B.......X...'...L...-...9.......9...'...B...+...L.......3MSSp default installation directory not found..

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\samrecoverable.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.698439958513745
Encrypted:	false
SSDEEP:	12:6AnVIk64YTXO2URYRBYBVxBjO8DVaaVoavoa7h4aVdZIfCij4MDCyjJWJJK0XOYN:6AnfqeIYFxO8waLvpV53SaTMzJ1kD
MD5:	18C0B032866F223DDBD53389D802682A
SHA1:	9B3E4D8184D15E4D2F54E3FF275C61A270040F92
SHA-256:	A585FCCE79AD3814C8DEBF2108F8DE2388E9911FE94294E50C193BB781C97222
SHA-512:	61C2704BAEC735F2732234730D2E724E952702891A9B2CC5C421C97017B4E2E36707412DBC27D0FBC30E819F597AE9582BC2A7092E609F52C158761372572C74
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........;)...6.......9...+...'...+...B...6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9...+...'...+...B.......X.......X.......X.......X.......X.......X...)...6.......D....tostring.oem_recovery_v2_disabled0DEFER_SEARCH_MINIMUM_DAYS_AFTER_WA_INSTALL3DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_UNINSTALL4DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_ACTIVATION0DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_EXPIRY.*ShowSearchSettings.GetOption.settings.R.......6...9...........B...3...=...2...L.....get_context_string.new.ContextHandlery.......6...'...B...4...7...6...3...=...6...2...L.....new.SAMRecoverable.analyticstelemetry.context.ContextHandler.require...//949D1348A1506D0C0B9B9E76CF9398799BE8D4A975CB544A29B6CCFCC796F0FC6F74A2A947F594699DD4F7D3A966A8A2FD7E54A79787F77A9554D400C9DEA4DB++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\sequencenumber.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.453522831802479
Encrypted:	false
SSDEEP:	12:6bkleqAuDPPVIVJn1qW9icHJXOefoij4MDrWjJWJJKs6j9NkyeoonMU:6AeqBcn1qW9icp+egTMvWjJ1TrkEqMU
MD5:	34683117AC3651B116E656FC588A1E0D
SHA1:	45D2731183CC1F9AB8C4157B6E7D3E2238579CA6
SHA-256:	39C611EF6C676235AD4808B55EB2D7FC80B7FC7D601A08B415A99B4BE7A2B7BF
SHA-512:	48676F5A6473805CAC88D9B895E87991B36F3D7ABBCD410EA03054A90C2C79551B8E51CDAFA7BEE1EB09AB550EA23797672AECAF4EDBFC3163147E9059A00DE9
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6.......9...+...'...+...B.......X...'...L...6.......9...+...'...)...B...6.......D....tostring context_product_sequence_id.0.*AnalyticsSequencingOn.GetOption.settings.R.......6...9...........B...3...=...2...L.....get_context_string.new.ContextHandlery.......6...'...B...4...7...6...3...=...6...2...L.....new.SequenceNumber.analyticstelemetry.context.ContextHandler.require...//14E215F2C4846F176AB30609FCF67A313D4BF9E128FE178F8A9E185774563269C0D91BD55106368C69DCF9154F2DF175151082389F1E11F7FFAEF367F87AA1D2++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\subscriptionexpirydate.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	594
Entropy (8bit):	5.622710665497949
Encrypted:	false
SSDEEP:	12:6uPWQZbCntmkkkkkaTzorpsV4M7RIJ+KB3of6Wv0Qp:6uP9bCngkkkkkNreKMqJ1hM0a
MD5:	A8FF794A350C837A94F14675AED56359
SHA1:	E795EAE10E83575B2802D0550EA71671A2644715
SHA-256:	0E88358163F453D1DE81E407FD6F1907A4F7D76F2E6E7C327B94D5F9C30D7F89
SHA-512:	9940B0824CC03231F5AB49D623495C30C62AE0937EB7A2CC113627FFDA0509F029D4240A82BE16292327722981DD474EB157A630F5BF0F5FBF65032F59C88F72
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........&-...9.......9...'.......&...B.......6...9.......'...B.......X...6...9.......)...)...B...'...6...9.......)...)...B...'...6...9.......)...)...B...&...L......-.sub.^(%d%d%d%d%d%d%d%d).find.string+SubscriptionExpiryDate: input date is .info.m_loggerI.......6...9...........B...3...=...2...L.....format_output.new.WSSSetting}.......6...'...B...4...7...6...3...=...6...2...L.....new.SubscriptionExpiryDate*analyticstelemetry.context.WSSSetting.require...//552D1D0F20756B441C24D08AD5FC073D34C8E1A849E0D69AC18C5161D4B2DAB5DBA56E869C7F6B0D0BF819E527C036A6B1A18328BE6D89DBE750800848743F71++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\subscriptionstatus.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.522103563394928
Encrypted:	false
SSDEEP:	24:68K9YrN+Iuz8f64CDopXVXHLhN8FlKCzqWb2lLzJJvUJ1X2q:FKuN+utpLhN87KCz52lLFJ8JF2q
MD5:	2B54260C09B8FA23AB42E46391F723B6
SHA1:	940776B8154252026FEBEB7EDBAC60BE8BF32020
SHA-256:	042F6788328E8E1A8BDD779C7EA8BF80D5EC48F8F01344479C96207CCBC71BA3
SHA-512:	256EDED7E4CB854601AF388487F9E1370586395E06C504487B9B1AB69B23BF433C6556CE478679AF9339B57F2013881FB79BCACBE3FAD55E80D26CD744AD0B30
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........J).......X.......X...6...9.......B.......X...6...9.......'...B.......X...)...L...6...6...9.......)...)...B...A...).......X...)...L...6...6...9.......)...)...B...A...).......X...).......X...)...L...6...6...9.......)...)...B...A...).......X...).......X...)...L...6...9...5...=...=...=...B.......L....day.month.year....day..month..year..hour...time.os.sub.tonumber.%d+.match.len.string..4.......6...9...6...9...'...B...C....!t.date.time.os.........-...9...'...'...B.......X.......X.......X...L...-.......B...).......X...'...L...-...B...'.......X...'...X...'...L..........expired.active..INVALID_DATE.UNSPECIFIED.NO_APP.NO_SUITE.settings.vso.get_sub_db_setting{.......6...9...........B...6...9...........B...3...3...3...=...2...L.....get_context_string...WSSSetting.new.ContextHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.SubscriptionStatusanalyticstelemetry.context.WSSSetting.analyticstelemetry.context.ContextHandler.require...//D5C0F64C0DC87E564D24EEEF

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\subscriptiontype.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	538
Entropy (8bit):	5.527429619817682
Encrypted:	false
SSDEEP:	12:6xnSlRXZQXFcg89rg0lr7JJvUJWJJKiRUj4VKLkKEP:6M1aOPDlnJJvUJ1lj4VKLkKEP
MD5:	C27A3267E47141AEF393F59C95B54174
SHA1:	5CFD283BBF9A1EAF62589AC78697506A4F3ECD60
SHA-256:	E5CFE80FE72551330316310980A2AE4562B9AB78B57D8282F6651F89A1D23F3E
SHA-512:	CBC391C9AB6388FB5AC978805AFABB79B28C692697B2653E6D4308720982D51BBF5521848010A72D78F06E2645AA87E826D7713FBF50A6ACF50F354A9D877937
Malicious:	false
Reputation:	unknown
Preview:	.LJ..l.......-...9...'...'...B...'.......X...'...X.......X...'...L......paid.0.1.free.trial.vso.get_sub_db_settingq.......6...9...........B...6...9...........B...3...=...2...L.....get_context_string.WSSSetting.new.ContextHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.SubscriptionType*analyticstelemetry.context.WSSSetting.analyticstelemetry.context.ContextHandler.require...//7EFBACB5F02BB1E514EE1286EB8A247059FFC6004BD4413ADFB8790A0C6DD67D4307743EF3BFCBF316405F0C8DB9681AF3847AC3F071DC38CD98B5841F2FC47A++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\suitestatus.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	857
Entropy (8bit):	5.581678502306121
Encrypted:	false
SSDEEP:	24:6LSgolbGXSPyKOq8s/le2l4xAGJ1P1fjy33M:+o1GiLRXtnl4nJd1feM
MD5:	B02068B62CC1ED905306F5C292AD67B9
SHA1:	8B7474C1D06B0509BF917903B31BE4DC9C1DA36C
SHA-256:	AA2A1955DF716BAE737D1223F7A6A0CCAF97153A7FD2758178B4C3C7A7F110FA
SHA-512:	FAF0DD49603102C95F2C1F1D70AC14C3F8FE359492E4FAAA13C2F8FDCA981769CD0E786385CE32B75A7622D00ECEB7B0D1AB8FC1A788BF546DD7AF1113A6E181
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........&)...6...9...9...'...'...)......B.......9...B.......X.......6.......9...+...'...+...B.......X.......6.......9...+...'...+...B.......X.......6.......D....tostring.Freemium.*Orphaned.GetOption.settings.IsValid5SOFTWARE\McAfee\MSC\Settings\ApplicationInfo\MSC.HKLM.Registry.Win32.core......Y.......-...9...B...6.......B...........X...+...L...+...L......tonumber.get_suite_status..&.......-...9...D......get_suite_status.........6...9...........B...3...=...3...=...3...=...2...L.....get_context_string..is_suite_installed..get_suite_status.new.ContextHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.SuiteStatus.mfw.core.Win32Helper.analyticstelemetry.context.ContextHandler.require...//9AEC2111B9A2228CA2A80488A96E11ABA52AB41182ED67ADD8A0826DB66EA362597FE6853E10E278E58FFEA6169618CE8758A882D65BF8846A3C8FB2F84FE194++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wpssubscriptionexpirydate.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	472
Entropy (8bit):	5.566895162293058
Encrypted:	false
SSDEEP:	12:6YkglNLnYklpsvcRu3U4M4rJ0NRu3pKR4eaPQA24j:6JglN7YkleZ35MSJ0NRu3kREQij
MD5:	DD082746A758811715B4101434657B04
SHA1:	32E38824B284798A8505EF9B8BE24061E7D79FE3
SHA-256:	413C162CE134347DEF8F36BF7F8EC1239562021AEB55CD9229A51F7D6E8835B0
SHA-512:	DF9A0B49333947586EC1466E19964DE074754CD445C23D89D3C543648DC7F8318210BDE3C3546FAEEA64F09B493399F9492F9544200E58E75FA7662D2C7173CE
Malicious:	false
Reputation:	unknown
Preview:	.LJ..m.......6...9.......'...B.......X...6...9.......)...)...B.......L....sub.^(%d%d%d%d)-(%d%d)-(%d%d).find.stringR.......6...9...........B...3...=...2...L.....format_output.new.AnalyticsWPSSetting.........6...'...B...4...7...6...3...=...6...2...L.....new.WPSSubscriptionExpiryDate3analyticstelemetry.context.AnalyticsWPSSetting.require...//E09E3C499F6CD0E7D64AC23A743BA261A138AF60711DC8CAC2D529BB3B95B19BB141D5B03805FF071E062228055F8422E04E0E53CA04972426B2F0C92D6131F2++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wpssubscriptionstatus.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	582
Entropy (8bit):	5.60372311209956
Encrypted:	false
SSDEEP:	12:67k+e+rvD2xZBzroBWpsvcRu3I4Mv1J0NRu3pKRRKkbx71Gr:6hVvD+ZB4BWeZ3NMv1J0NRu3k3Tb/k
MD5:	7BFB40E1817372E933DDC96608AF2084
SHA1:	F720DF83EA2445ED0BD5B70084AC94C570DBECB5
SHA-256:	94BD1C17CD9228DE0604B838DDDB5F14FB9AD8830CF9C9CD0C0D8D7BC58776C1
SHA-512:	F7A9F5D866B223C99B38712C717F66E06C572E9D24ED1C318CC4202D3FE54597ADB629408E28363C24FDD9ED8196EAA32993889D578CE08B9F1551EFBFFC455A
Malicious:	false
Reputation:	unknown
Preview:	.LJ...............X...L...6...9.......B...5...5...6.......B...X.......X...'...L...E...R...6.......B...X.......X...'...L...E...R...L....expired.active.ipairs.....trial-expired.paid-expired.....trial-active.paid-active.lower.stringR.......6...9...........B...3...=...2...L.....format_output.new.AnalyticsWPSSetting.........6...'...B...4...7...6...3...=...6...2...L.....new.WPSSubscriptionStatus3analyticstelemetry.context.AnalyticsWPSSetting.require...//4DAE7E267A093741C040D450DD775CD69031DFE1BF80A6A5661BDB291938CAB026AD849C6A1A21517A49FF3FD5A50374E9CD6025E12D260B33F69D5F82D4A9C6++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wpssubscriptiontype.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.5993286170051295
Encrypted:	false
SSDEEP:	12:6/kx+rvDcoK29ppsvcRu3m4M2YJJJ0NRu3pKgqvVTEigWF:6/kmvDdPpeZ3XM2WJJ0NRu3kgylgWF
MD5:	2EFE0815CBE75BF313952EAD0F38611A
SHA1:	1096D707DD6D3E4CA20D24400D8749EB377F3703
SHA-256:	662238CAB8BDCD764F23DCECF7564E796CF7B486070CD63376464AFDB19E700D
SHA-512:	3751A78054954181CF105146E8AB85436A7E83426FE16A762D8CA6DD4092E0400FBE13B2C44A9EE502CCA2775F458B5A509F8A0A7DA566F5574D4A5FA1D41C1F
Malicious:	false
Reputation:	unknown
Preview:	.LJ...............X...L...6...9.......B...5...5...6.......B...X.......X...'...L...E...R...6.......B...X.......X...'...L...E...R...L....paid.trial.ipairs.....paid-active.paid-expired.....trial-active.trial-expired.lower.stringR.......6...9...........B...3...=...2...L.....format_output.new.AnalyticsWPSSetting.........6...'...B...4...7...6...3...=...6...2...L.....new.WPSSubscriptionType3analyticstelemetry.context.AnalyticsWPSSetting.require...//B40053BD75037808FF757D7A4F1A80620B336B0ACFA46A047C7D62BB562B9801861F796675A11B7DC309DA9A6388935EE56E462CD118D077B7894DF4CEACDBF0++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wsssetting.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	5.803065974175878
Encrypted:	false
SSDEEP:	24:6x6wckmg85AjHwRf8FlNXqzngq4YlP+rYWbemAENhRVtBmwJMUJmPLn38LeZhXth:Y6wK5AzCU7ZuglvAElVtBmw+UJEnsCZB
MD5:	A9981851B407E18BB8C3E1AB5D9FACE4
SHA1:	540669625B05406342D21013E0DF4A6B25764EF2
SHA-256:	8FB38E7305805FFCB0F196155D2599846E793245CE5ECFC2263026A0792DB285
SHA-512:	F707DF94EE0810F758238C4E05BB06ED8497D9DA919501D708A833229C82FDCD79E4E03B7904ECBED146F4D4692FEC5354C9B6ED3DAF63BE8F70AAAE0971639B
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........L...........='...-...9...B.......X...9.......X...9.......X...-...9.......9...'...B...L...-...9...9...9...B.......X.......X.......X.......X...9.......X...9.......X...6.......9.......B...........X...-...9.......9...'...B.......-...9.......B.......6.......D......tostring.format_output?MD5 function incorrectly hashed data. Using default value..MD5Hash.utility.MD5.hash_id.UNSPECIFIED.NO_APP.NO_SUITE.get_sub_db_setting>Invalid configuration for the WSSSetting context handler..err.m_logger.property_name.db_name.get_context_config.UNKNOWN........('...-...9...B.......X...'...L...6...9...9...'...'...)...*...B.......9...B.......X...'...L...6.......9...........B.......X.......X...'...X...6.......B.......L......tostring.UNSPECIFIED.GetProperty.subdb.NO_APP.IsValid#SOFTWARE\McAfee\MSC\SubManager.HKLM.Registry.Win32.core.NO_SUITE.is_suite_installed.............6...9...........B...3...=...3...=...3...=...2...L.....get_sub_db_setting..get_context_string..format_output.new.SuiteStatusr.....

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wssversion.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	644
Entropy (8bit):	5.634233822231023
Encrypted:	false
SSDEEP:	12:6Ox2oFtgLNzzPYXxFvO/cQTlr7A01JzKZzhJ5vYT:6ZoFeLhzPQxFczTlZ1JmZVHAT
MD5:	3F1C33CDB43AC63F351AEF97AC7237BA
SHA1:	56BA0561A0E4F01D1109F4AD92DC89DD595FABC7
SHA-256:	52927499DD96A5D16AAA63A84E0713D650DD41BD81CAC2820D50C5BA5C9DF157
SHA-512:	57AE830460B2CCA34A9A78CD7D15FAFBFDCBD372CBEF693FAA9C4A85451D18D95261E9CA95D3D675D119C44D86CDED37200495FD86FD434DCF4715FD90231730
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........#-...9...B.......X...'...L...6...9...9...'...'...)...*...B.......9...B.......X...'...L.......9...'...B.......X.......X...'...L...6.......D......tostring..ReleaseName.QueryValue.no_ver.IsValid.SOFTWARE\McAfee\MSC.HKLM.Registry.Win32.core.no_suite.is_suite_installed...O.......6...9...........B...3...=...2...L.....get_context_string.new.SuiteStatus.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.WSSVersion.mfw.core.Win32Helper+analyticstelemetry.context.SuiteStatus.require...//72C9AB6E6058A61380E9ECB0332749BA68C616DAB622CF24869879A3EB2197549A4C15EDAA41C8FE26DD52859547060D9403D795A9635219934906620CD68CBD++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticseventhandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2311
Entropy (8bit):	5.5881355722742
Encrypted:	false
SSDEEP:	48:mkeaI12J4DXRBQJwyXJ/eJVMTbzscly3AZEhV6oEkiJAOtX251s:m3BdrQtXdeyrscw3FV6oEkyAOtX251s
MD5:	52C084EA51E42489633124B620FC0557
SHA1:	973147CFD5444FCE4FF6517B4C98699BEC3E2124
SHA-256:	ABDD2639B7EEC29CC1B60F52F98F4ABB65DA942BFBB4F817B492654FF779B1E4
SHA-512:	DDBF89AD1F657C866C1DEE60ACF5F2E0EE1E5310AE49F8C5DA0FF4376BE5B97B7C1D3EA874F902F01B3F65D6795727AEEFB5AC1F866E7ABA2CEC2FE5C668FF5F
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........'...6.......9...+...'...'...B...........9...'...'...B.......6...9.......'...B...X.......X...+...L...E...R...+...L....([^,]+).gmatch.string.%s+.gsub.analytics_deny_list.GetOption.settings.........M6...9.......9...'...B...6...'...B...6...9.......9...'...B...6...9...B...H.7.-...9.......9...'.......&...B.......X.%.9.......X.".9.......X...6...'...9...&...B.......X...9...-...9.......B...9...B...6.......9...+...9.......B...X...-...9.......9...'...9...&...B...X...-...9.......9...'.......&...B...F...R...K.....4Invalid configuration supplied for the context #Nil handler found for handler .err.SetOption.settings.get_context_string.new analyticstelemetry.context..setting.handler.Processing context .m_logger.contexts.pairsgIn AnalyticsEventHandler's process_context_attributes before for .. pairs(context_config.contexts)6analyticstelemetry.context.analyticscontextconfig.require:In AnalyticsEventHandler's process_context_attributes.info.log.core........-...L.................K...........

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticseventsconfig.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8021
Entropy (8bit):	5.422545506510877
Encrypted:	false
SSDEEP:	192:A4/aVWLtQg97IqzxgqBMcgFFaVFHJl+hwHD6:A4CV+f8qzxgqBMcg/aVZJl+h2D6
MD5:	053CB1C75FE305163F01BAC3A42F0D01
SHA1:	B81232E87C3B1AF8F02E0DEF40CCE77B430CEF0E
SHA-256:	83779B8F7885E635E4BB16241A08394D65C771C32BF8F2AA2B221B393A74C021
SHA-512:	190F3167D25834506197E4A93030E40142C7289427F93635EA4986DD59C53C6A94C2E7C572ACC3B18FB892C40C457E4037C4D3544B52EE083806BC5C1C218BF2
Malicious:	false
Reputation:	unknown
Preview:	.LJ...=.........5...5...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...5...=...4...5. .>...=.!.=.".5.#.5.$.=...4...5.%.>...5.&.>...5.'.>...=.!.=.(.5.).5.*.=...4...5.+.>...=.!.=.,.5.-.=...5./.=.0.5.1.=.2.5.3.=.4.5.5.=.6.5.7.5.8.=...4...5.9.>...5.:.>...5.;.>...=.!.=.<.5.=.=.>.5.?.=.@.5.A.5.B.=...4...5.C.>...5.D.>...5.E.>...5.F.>...=.!.=.G.5.H.5.I.=...4...5.J.>...5.K.>...5.L.>...=.!.=.M.5.N.5.O.=...=.P.5.Q.5.R.=...4...5.S.>...=.!.=.T.5.U.=.V.5.W.=.X.5.Y.=.Z.5.[.=.\.5.].=.^.5._.5.`.=...4...5.a.>...=.!.=.b.5.c.5.d.=...4...5.e.>...=.!.=.f.5.g.=.h.5.i.=.j.5.k.=.l.5.m.5.n.=.o.4...5.p.>...=.q.=.r.5.s.5.t.=.o.4...5.u.>...5.v.>...5.w.>...5.x.>...5.y.>...5.z.>...5.{.>...5.\|.>...5.}.>...5.~.>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...5...>...=.q.=...5...5...=.o.4...5...4...5...>...5...>...=...>...=.q.=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticshandleonnavigate.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	439
Entropy (8bit):	5.447303465542573
Encrypted:	false
SSDEEP:	12:6IWlL3uknxUyPpPD4M9CCDiEiMJsYJJKcDl61jmQtP:6bL3uu3P6M9HDiEvJsPAlYj1tP
MD5:	6E9144B0655982FB7AB3C6167C60D53E
SHA1:	F6D4F747432FDD87C1D2070D252FF3E86A4E3011
SHA-256:	7E161C22AFD2CB77258006DB5ABAF6A6B61D2E76DD95C5E73EB693A0F29F9871
SHA-512:	949BA7156DBD0993BC4F46C7011F69B35732227D58A203A54596164AE230C6E8938BE8BE3CCB961CB9F610332F2DD88B5F7E4D85D7631CB0B3A1C4974F5AEA68
Malicious:	false
Reputation:	unknown
Preview:	.LJ..>.......6...'...D...)handle_on_navigation not implemented.error_.......6...9...............B...3...=...2...L.....handle_on_navigation.new.AnalyticsEventHandler.........6...'...B...4...7...6...3...=...6...2...L.....new.AnalyticsHandleOnNavigate4analyticstelemetry.events.AnalyticsEventHandler.require...//F22342129B7DF96E59E23B38C880CFF301F81612C841992264ECCE653D99CAE6E8F0D5B96A5F12FB5E08D51369A66F9CAF78603505F4A38390C5720B0B2983FD++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticstelemetryhandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2050
Entropy (8bit):	5.6789481876619625
Encrypted:	false
SSDEEP:	48:3K1O3RnzJe0E/+dvxd4xzyA9JG0JbXS9mf+ZS9oFGtQt6MjG+VkJLrwbOh:Vex/0+fRiYd+QFuk18bY
MD5:	C863696DC71D4F09215DAF9C376314BE
SHA1:	2714C2D3A7BBD42F0B8B21E0A3409CF284FD95A6
SHA-256:	89FB1208A0BE0E652AA381EB5FE6AAAE192E1A14602BD416D93361A8AE41FA43
SHA-512:	9A0427A792C16774BC14A7BE3F0BCDA78F42C23F59BFFE59CB6BA128F2A9AD92D05CFEF51CD559835184D0257D1A2349E11A926F3337226DDEC8D073B985940E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........66...9...8.......X...8...L.......9...'...B.......X.......9...'...B.......X...'.......&...6.......9.......'...B.......X.......X...+...<...L...6...9...)...B...'...6.......B...&...6.......9...)...9...9.......B...+...L....currentline.short_src.Log.utility.tostring%Failed to load package. Error: .getinfo.debug..include.external.mfw..^core%..^mfw%..find.loaded.package......!...6...9.......9...'...B...6...9.......X...6.......X...6.......X...6...9...)...B...'...6.......9...)...9...9.......B...)...L.......X.......X...6...9.......9...'...B...)...L...6...9.......9...'.......&...B...6...9.......)...+...B.......X...6...9.......9...'.......'.......&...B...)...L.......X...9.......X...6...9.......9...'...B...)...L...6...9...9...8.......X...6...9.......9...'...9...&...B...)...L...9.......X...6...9.......9...'...9...&...B...)...L...6...'...9...&...B.......X...6...9.......9...'...9...'...9...&...B...)...L...9...6...9...........B...9...B.......X...6...9.......9...'. .9...&...B...)...L...)...

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\blockpage.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.703177503748301
Encrypted:	false
SSDEEP:	48:Oe7guhyIJ6flj14j6Q/DRRhQ00MuhXuS5g+i3BJ0sPJRK:Oe1FqjWb7RRC0ns3di330sPDK
MD5:	B2FB027DDA6444452DE85F5C477A32BC
SHA1:	F2FCA29B212586279DA859E16D98786B1E0C264E
SHA-256:	ADA50D8E60094F6AC37928D615D6564DAD613F94ED70FFE98322E8E7EC5D9C2E
SHA-512:	CEE258AA8444E0465099F46CA98697973AFE1F9FF9B18C76CF076F416E70D7A12377E9C3206090A9CD4C353285B21C117F7B8926CB91B8E308D742DAA7AF362F
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6.......9...+...'...)...B.......6.......9...+...'.......D....SetOptionInt"AnalyticsCounterPagesBlocked.GetOption.settings.........%+...6.......9...+...'...+...B...........X...+...L...9.......X...9.......X...6.......9...'...D...X...9.......X...6.......9...'...D...X...+...L...K....msad.ads.blocked.Frame.msad.sites.blocked.PublishMessage.wssEventSender.Top.level.Typosquatting._event_name.AnalyticsSendWss.GetOption.settings......).\|-...9...B.......X...-...9.......9...'...B...+...L...9.......X...-...B.......X...-...9.......9...'...B...-...-...B.......X...-...9.......9...'...B...9.......X.(.'...=...9.......X...'...=...9.......X...'...=...9.......X...'...=...9.......X...'...=...X...'...=...9.......X...'...=...X...9.......X...'...=...X...'...=...X...'...=...'...=...9.......X...'...=...X...'...=...5...9...=...9...=...9...=...9...=. .9...=...9.......X...9...=.!.9...=.".9...=.#.9.%.....X...'.&.=.$.-...9.'.....B...-...9.(.D............transmit_analytics_event.set_analytics_event.de

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\browsernavigate.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2034
Entropy (8bit):	5.6150835819471965
Encrypted:	false
SSDEEP:	48:UsDTHkRkQtT4vdeR6oJdULzkDeJe7gujLMsHiKfJJ5MJ30cbJok:Us/HVQh4vyALzkDme1j/C0JJ5A30cb9
MD5:	71B18D20CE73F564E31160C31AF062CD
SHA1:	D065FCC9454112E4F846CBEE45935D13D1D5A90E
SHA-256:	B11175EED661324F1814FDDC3140202A2EAA5CFD15CE6DE24A282532EA4AF586
SHA-512:	ED6F8B031BB03D8ABF5CE5C6DF58E8B1F164ED8D56F3CE3482F24154AF7E7A696BE6870EDA9FD61C800C95E94D9D033815F1FD26E947670C860D00164791AB1E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........*6...9.......9...'...B...-...9...B.......X...-...9.......9...'.......'...9...&...B...+...L...9...-...9...........B...9...B.......X...-...9.......9...'.......&...B...L.....'Failed to handle analytics event: .handle_on_navigation.new.handler. Handler: BBrowser Navigate handler does not exist for analytics event: .err.m_logger.get_analytics_eventIIn Analytics BrowserNavigate Handler's process_registration function.info.log.core........06...9.......9...'...B...6.......X...-...9.......X...-...9.......9...'...B...K...6...6...9...B...H...+...9.......X...6...'...9...&...B...........X...9.......X...-...5...=...=...<...F...R...K........config....handler..config..handle_on_navigation.analyticstelemetry.events..require.handler.events.pairseA global analytics configuration mapping analytic events to event handlers has not been defined..err.m_logger.g_analytics_configSIn Analytics BrowserNavigate Handler's build_navigation_registrations function.info.log.core.........6.......9...+...'..

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\commonlogicloader.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.799372595078755
Encrypted:	false
SSDEEP:	24:6NpCk+enQBwRdS0ZSF2j5G6n8VGLoL9m/eB+kJRiuWeTSKUZSFgT46A3nsj:qCvenawRdS0ZSw1F8VGLZGB+2CKUZSmj
MD5:	D349A2834A660A0A82BDC993B358D1E2
SHA1:	03E01B3EC983D3339E5225D504B1386BC89BE882
SHA-256:	CF5459D0494AF80DDD263D5B2FF9679112D6082C7D9D81DF845E1BFEEA583438
SHA-512:	55E915A13F7F1A7D1782B8DC6E8CC128FEB317A059AD9539E69398F9AA1C4C5944866D343201E28BE1D34545664F3C4B13D420A31F95045E2DDC4D742229BC8A
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...8.......X...8...L.......X...+...6.......9...............B.......X.......X...+...<...L...6.......)...B...K....error.include.external.loaded.package.........6...9.......9...'...B...5...'...6.......B...X...6...6...........B...E...R...K....requireFromLogic.pcall.ipairs.\logic\.....MiscUtils.providers_selector.base_provider.ss_logic.oem_business_logic.type_tag_utils=Inside Analytics's CommonLogicLoader's requireLogicFiles.info.log.core........]6...9.......9...'...B...'...6.......9...B.......&...6...9...'...)...B...6...9...'...B...6...9...9.......'...&.......B...9.......X.5.6...9...:...9...B...).......X.-.U.+.....9...'...'...B...6...9.......9...'...........&...B...6...6...........B.......X...6...9.......9.......B...6...9...9...........B...........X...6...9...:...9...B.......X...X...6...9.......9...'...B...K....loadSSProvidersCode end.FindNextFile.err.requireFromLogic.pcall.Loading script: ...luc.gsub.cFileName.string.handle.*.luc.FindFirstFile.Win32.WIN32_FIND_DATA[1].n

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailycounters.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2671
Entropy (8bit):	5.866185873613142
Encrypted:	false
SSDEEP:	48:Nv/cUjFEmVSJhJ2TqHsZHNJGoXWpFs9hEi20hjXnXOI0B2gzZ9i5JEpJSf/A:Np2h4TqH4zGRpKTbjnVga/Ep4/A
MD5:	297EDBA54313E1362B9CCD8D015F0248
SHA1:	080BB39DD64B2AC89850841315935E27D332880D
SHA-256:	5078DADB83FEF53B2FB7974767B1E10A1B8E888F59D4D51F0CE954EE33BCDF84
SHA-512:	44CBC46605494D0DC4821CEF3A724EA7020B1CDD776D4A767143AF68E4F238173B69293AFC9851AE4CEE9F0D21EA1E62C720BF9FFB7DAAD2A18F1A1D351F54D8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........d6...9.......9...'...B...-...9...B.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...-...9...B...+...)...'.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9...9.......X...9.......X...+...9.......X...6...9...B.......6.......9...........'...9...'...6...9...9...B...&.......B.......6.......9...........'...9...'...6...9...9...B...&.......B...+...L......SetOption.lower.string._.GetOption.settings.tonumber.default_no_value.in_context.prefixQAnalytics Daily counters handler called with an invalid event configuration..Analytics_DailyCounters.get_analytics_configBAnalytics Daily Counters handler was passed an invalid event..err.m_logger.triggerType.browser.get_analytics_event;Inside Analytics Daily Counters handle_analytics_event.info.log.core.......%...6...9.......9...'...B...-...9...B...+...)...+...'...5.......X...9.......X...9.......X...9.......X...9...........X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9..

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailyping.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2592
Entropy (8bit):	5.568760587813432
Encrypted:	false
SSDEEP:	48:q8RJ0a2Qh6wIHQB9NoCZJdxrLz+vFBLRN9Wh2h9lSeXXfRzjF3JKRjd+PJlOJRWc:q8/AQh6+LNJZZLz+9dpSe/pjfKPKlOZ
MD5:	97ECCC134923B16FE1AA54B6189A3EEF
SHA1:	0BBA9C2C29DCAFF102C0E1EC0F4BAD1189FCAB5F
SHA-256:	30B5F6B982D84B9B7BFD619B963976AC04AC5EE6A0D525655B4D6F56248ADD56
SHA-512:	89E1236E36A9FB248ADCAE2A80B02944F153AC9A32B7ABBDD98AF2FEE26193C10B8C0F08469E1803273F03A40742A5D18DF0A4ED627CC0B572BDFB5CB0815996
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........(-...9...B.......X...-...9.......9...'.......'...9...&...B...+...L...5...9...-...9...........B...9.......B...-...<.......X...-...9.......9...'.......&...B...L.......XTelemetry 3.0. Daily Ping's process_registration failed to handle analytics event: .send_on_ping.new....metric_value..extra..handler. Handler: CTelemetry 3.0. Send on ping handler does not exist for event: .err.m_logger.get_analytics_event.........4...6...-...B...H.......X...9.......X...9.......X...9...8.......X...9...9...<...F...R...L......metric_value.ping_metric_id.pairs.........6.......X...6...9.......X...-...9.......X...-...9.......9...'...B...K...6...6...9...B...H...+...9.......X...6...'...9...&...B...........X...9.......X...-...5...=...=...<...F...R...K........config....config..handler..send_on_ping.analyticstelemetry.events..require.handler.pairstTelemetry 3.0. A global analytics configuration mapping analytic events to event handlers has not been defined..err.m_logger.events.g_analytics_config........

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailypingbrowsernavigationcount.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	5.8963528014242765
Encrypted:	false
SSDEEP:	24:6UUM9qnTXtfq2BeVhrhjClvVvgP0VvAqScukUJdI3GgVv+vJ/vJ5yj7rhSATY:TOHEVhMEAAqSDdc3vcJXJUj7rhU
MD5:	642E9E5B029C75641DA778B408B072BD
SHA1:	1FC3353FB20C8BB05F235578902E392411354BC3
SHA-256:	2F095800D64123CCA12FDEAFC7F1D238E593B534B63AF39F291E83D7523C62B5
SHA-512:	6821DF08E0A768A6FBD2FF5941E86FE1AE7FEBE1B0E022161B07E91337DC5ECAF2E11F7B69B80513D77916E64F1AE89E54C4297924D174BA5BC911AF380EC6E6
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........?6...9.......9...'...B...-...9...B.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...4...6...-...B...H...6.......9...+...6.......&...)...B...<...6.......9...+...6.......&...)...B...F...R...9...=...6...6...9.......B...A...=...+...L........encode.json_parser.tostring.metric_value.ping_metric_id.SetOptionInt4ANALYTICS_BROWSER_NAVIGATION_COUNT_TODAY_PREFIX.GetOption.settings.pairs\Analytics DailyPingBrowserNavigationCount handler called with an invalid configuration..err.m_logger.ping_label.get_analytics_config:Inside DailyPingBrowserNavigationCount's send on ping.info.log.core.........6...9...............B...'...7...5...3...=...2...L.....send_on_ping.....ch.ff.ed4ANALYTICS_BROWSER_NAVIGATION_COUNT_TODAY_PREFIX+Analytics_BrowserNavigationCountToday_.new.SendOnPing.........6...'...B...6...'...B...5...7...6...3...=...6...2...L.....new$DailyPingBrowserNavigationCount....send_on_ping./analyticstelemetry.events.SettingsDBLookup)analyticstelemetry.events.SendOnPi

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailypingbrowserused.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1385
Entropy (8bit):	5.627307556794077
Encrypted:	false
SSDEEP:	24:6CelnIXFF/xolSVxjGJUkEdWyJYlvV3HVEguLuSE8GJV6vJ/vJ5roMBOpjvY:70IXn8IGy6eHLucbJXJJmQ
MD5:	2AE2EE24EBC0B75A877377E79176D961
SHA1:	91937BBBAA6939A2887E8309919D9B60F0CD686B
SHA-256:	CA88CF7B2B96C892F3CA5D607B01440C00D19D893EF7A3F17E18F6517E4A36E9
SHA-512:	3D87B5F8439E53E50178D813CD32BEFE9D481CEA98647868478827C5B38C9054E4BE92D2742B906DE961649958CB9A1EABE9B1BD162D1A8F51F5BD2E2571AA3E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........'6...9.......9...'...B...6...9.......B.......5...7...6.......9...6...8...B.......X...6...9.......9...'.......&...B...+...L...-...9...+...-.......&...+...D........get_setting$Process is running for browser .IsProcessRunning.utility.browser_processes....ch.chrome.exe.ed.msedge.exe.ff.firefox.exe.lower.string9Inside DailyPingBrowserUsed's get_browser_used_today.info.log.coreD.......6.......9...+...-.......&...+...B...K......SetOption.settings........36...9.......9...'...B...-...9...B.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...4...6...-...B...H...-.......B...<...-.......B...F...R...9...=...6...6...9.......B...A...=...+...L............encode.json_parser.tostring.metric_value.ping_metric_id.pairsNAnalytics DailyPingBrowserUsed handler called with invalid configuration..err.m_logger.ping_label.get_analytics_config/Inside DailyPingBrowserUsed's send on ping.info.log.core.........6...9...............B...'...5...3...3...3...=...2...L.......send_on_ping....

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailypingmetriccounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1533
Entropy (8bit):	5.585059609058571
Encrypted:	false
SSDEEP:	24:6qZ0GoJPeM2Q+ycfXlvVulvDJNn7IBTbWcB5f396BBqmkctcXlvV54SGXjuZwiJp:t0GoJWM2Q+yHJNnWbv96G1kSGa5JjFJx
MD5:	81D23EBA754BFB4831A74FC57BAD7FBF
SHA1:	DF6178B9FAB3738954E288744AB95F5527596989
SHA-256:	BE712B10036FF5A5574560B927975B2C1952FB1FCCECE5AE67E3587CBA3949D4
SHA-512:	2E48F9E5E56D55C02FF4A1F30588AE42FD70D8023FC01FBDE685E602D0B637AFDCEC3AE51CB8E3EE7C204562903692F11624AA8FC83F25E6F891C9DC1C78087F
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........C-...9...B...+...)...6...9.......9...'...B.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9.......X...+...9.......X...6...9...B.......6.......9.......9.......B.......9.......X...9.......X...9...6.......9.......9.......D......SetOption.max_value.GetOption.settings.tonumber.default_no_value.in_contextSAnalytics DailyPingMetricCounter handler called with an invalid configuration..err.m_logger.setting_name.ping_metric_idAIn Analytics DailyPingMetricCounter's handle_analytics_event.info.log.core.get_analytics_config.........O-...9...B...+...)...+.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9.......X...+...9.......X...6...9...B.......9.......X...9.......X...+...6.......9.......9.......B...9.......X...9.......X...9...9...=...=.......X.......X...6.......9.......9.......D...X...+...L...K......SetOption.metric_value.max_value.GetOption.settings.reset_count.tonumber.default_no_value.in_co

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\domainmembership.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4617
Entropy (8bit):	5.832947423413168
Encrypted:	false
SSDEEP:	96:GQEBjpEGPxKTKVUhwgf6avqws1aoibd6IKtoknBNlMvezeXryHeEnvxJwFvOcgQF:GQOEGPxKTK6hSaNs4Vd5Kt1bE1bREJWt
MD5:	D01A1C5C8B33848E4B81E1391F7F54C8
SHA1:	44F6288DCD877BC14906E2476527A1FC926D6869
SHA-256:	44A699B84C19A2E31FC042CDD5C4BC4148FBD8531C1A263B0431E0A5A321A434
SHA-512:	19666867B0A8A6D9A67FB3C960A1483BBD105B6544819A40C8C917E6AE0F83BF7C27580EA478E28DB2FA88C439F472D3D75A95E0EB3E0DA95A4B5363912BEDD4
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........5...=...=...=...L....hit_label_21.hit_label_20.hit_label_19....hit_label_21.._event_name.wa_domain_membership.hit_label_20..hit_label_19.^.......-...............B...9.......B...9...D......transmit_analytics_event.set_analytics_event........$6.......9...+...-...)...B...6.......9...+...-...)...B.......X...-...9.......9...'...B...+...L.......X...-...9.......9...'...B...+...L...+...L.........EAnalytics DomainMembership ver_to_send < ver_sent so not sendingEAnalytics DomainMembership ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......6.......9...+...-...)...B...6.......9...+...-.......B...K........SetOptionInt.GetOption.settings........<4...6...9.......B.......X...-.......9...'...6.......B...&...B...L...6.......B...X.$.6...9...........B.......X...-.......9...'.......'...6.......B...&...B...X...-...8.......X...'...5...=.......X...'...=...=...6...9...........B...E...R...L........insert.table.type.value..name....type..name..value..unknown.: .Error getti

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\domainnavigatedcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3032
Entropy (8bit):	5.868546907225372
Encrypted:	false
SSDEEP:	48:IWmazRGpYrvwvziT45n1y27j6F01AwQS0ZBdJ8ZeKIk7kyNcZcjCHVJ1gsN:IU4pWczlN7jUQPQSg8ZeK4y+ZcGHVzg0
MD5:	CE9F7AA0A2AC99C94C8A6D2D7F0B7CD4
SHA1:	DF722D995FDAD686516A32A5F3DA08529C2EB6A7
SHA-256:	9E71D07AD6C4E06DE2E791BC87BE43E02D4E965F5B4216CED850203D9A523AF9
SHA-512:	FA3F66C48F7C068FE3852A389634BCC38E77FA497A94F51D9ED65A570B936CB15A05A58C9D0C3E8A5E19EB5810F2D605AF078BF82816190D4BEF4E32FF220F0F
Malicious:	false
Reputation:	unknown
Preview:	.LJ..n.......6.......B...H...6...9.......9...B.......X...9...L...F...R...+...L....domain.urlMatch.match.string.pairs........+...L...........=-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...-...9.......9...'...B...+...L...+...)...-...9...-...B.......X...+...L...6...9...-...'.......'...9...&...B...6.......9...............B.......6.......9...............B...+...L............SetOption.GetOption.settings._.lower.string^Analytics Domain Navigated Counter handler was supplied a malformed event for processing..err.url.browser.get_analytics_eventOEntering Analytics Domain Navigated Counter handler's handle_on_navigation.info.m_logger.........D-...9.......9...'...B...+...)...+...5...).......)...M.4.)...-.......)...M...6...9...-...'...-...8...9...'...8...&...B...6.......9...............B...).......X...5...-...8...9...=...8...=...=...-...9.......B...-...9...B.......X...6.......9...............B...O...O...+...L..........SetOption.transmit_analytics_event.set_analytics_event.hit_

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\downloadscan.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1661
Entropy (8bit):	5.652032120956267
Encrypted:	false
SSDEEP:	48:oeQDKesU4NION1YmRj2AZGrZ+8JHlDiJelgJqC8U:oeXeN4NpRRjY40dyeSH
MD5:	969865A73B1D74822AC95106FA266546
SHA1:	834EA36F613DD307125BAD682C9F585D7BC916D7
SHA-256:	AE13D952C19D0107112C536CB3C26B853452934B692FEB5627ED67F1FAE1F70A
SHA-512:	28AF5313A1CC132C933C0741B30486B4B65CEA3EF268AB396189BEE3651015A6D1B69967276169BE98D813FED9C0DECE9BD0BB16EE751B9D27D75D371ACC611E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..X.......6.......9...+...'...+...D...&DownloadScanSendProcessTelemetry.GetOption.settingsU.......6.......9...+...'...+...D...#DownloadScanSendFileTelemetry.GetOption.settings........7'...+...9.......X...9.......X...6.......9...'...B.......X.......L...X.$.9.......X...9.......X...'...6.......9...'...B.......X...6.......9...+.......)...B.......6.......9...+...........B.......X.......L...X...+...L...K....SetOptionInt.GetOption.settings.msad.files.blocked&*AnalyticsCounterDownloadsBlocked.Blocked.msad.files.safe.PublishMessage.wssEventSender.AcceptRisk.interaction_type.DownloadBlock.name..........B-...9...B.......X...-...9.......9...'...B...+...L...-.......B.......X...-...9.......9...'...B...9.......X...-...B.......X...'...=...9.......X...-...B.......X...'...=...4...9...=...9...=...9...=...9...=...9...=...9...=...9...=...9...=...-...9.......B...-...9...D............transmit_analytics_event.set_analytics_event.ui_type.hit_label_24.colour.hit_label_23.hit_label_22.hit_label_21.browser.h

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\heronerrorslog.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2427
Entropy (8bit):	5.732144659562735
Encrypted:	false
SSDEEP:	48:6/W/iBelQ1lYQ0M7atJAaPpJ5JjWJHZF8ko8jVJPUmQrWDJXRgAn3JYR9:jlQlAJHJSD8k9jqa1XSg3+L
MD5:	288AC378D70569DF1EAFB0A2072C2D46
SHA1:	2538EA493928C427B14A6ABF73A275E739782473
SHA-256:	6AC9459CF65A194391AAC0965054E2B0EB5DA3F1C3EB123177D53ECAD72544A5
SHA-512:	FC3D9362F2ADEE5381D8F87938A333CD4A1ED6E634972910A61F4B207E0B7FA5E4161025A7522DF1ACDEFEB68894077994FC7BAE9DC644CE2376D14FEBBB4914
Malicious:	false
Reputation:	unknown
Preview:	.LJ........#...6...9.......9...'...B...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......9...'...B...+...L...-...9...B.......X...-...9.......9...'...B...+...L...+...9.......X...9.......X...+...'...9.......X...9...6.......9...+...-...+...B.......X...-...9.......9...'...B...+...L...6.......9.......-.......B.......X.......X...'...X.......'...&...'...9.......X...'...9...'...&...'...9.......X...'...9...'...&...'...9.......X...'...9...'...&...'...9.......X...9.......X...9...'...9.......X...9...'...9.......X...9.......X...'...9...'...&...'.......'.......'.......'.......'.......'.......&.......'. .....'.!.&...6.......9.".....-.......B...+...L..........SetOption.}.{.,"metadata":.,"line_number":.,"error_code":.,"error_type":.,"function_name":."file_name":.metadata.error_code.".null.,.[-HeronErrorsLog heron telemetry disabled..GetOption.settings.default_no_value..in_contextGHeronErrorsLog handler called with an invalid event configuration..get_analytics_configPAnalyt

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\installedextensions.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1361
Entropy (8bit):	5.713932538636906
Encrypted:	false
SSDEEP:	24:6iagPrR/Jr3yCJOxTnZBCjsVudeH3cKxQ6FF9K6FXyvjocu/yYXl3JB1J5doiiFO:hPrP3BsZBCjoshqK3joD/yYXbvJLz
MD5:	D938FE3A4659D94036A3FB2007F0A03C
SHA1:	8F5D29431BE8A8BE70AC6B8F4446B214DBC5F936
SHA-256:	0D24C833B371D20FABA6EA7D9A5733522CCD12C14CABCB272FCA4754EE0E0B44
SHA-512:	DE7F49AF9427DCA11B80ADE08B1DA8D770083C924948069C9B29A6C0B5CC3A3492FF74D7B069286AC3AC9279E257B26555049B43B499C58E2E33E3212D0C372E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........+...L...........V-...9.......9...'...B...6.......9...+...-...)...B...6...-...B...H.B.6.......9...+...-.......&...)...B.......X...-...9.......9...'.......B...X./.6.......9.......B.......X...-...9.......9...'.......B...X. .-...9.......9...'.......'.......&...B...5...=...=...=...-...9.......B...-...9...B.......X...6.......9...+...-.......&.......B...F...R...K............SetOptionInt.transmit_analytics_event.set_analytics_event.hit_label_21.hit_label_20.hit_label_19....hit_label_20..hit_label_19..hit_label_21.._event_name.wa_installed_extensions. is *extensions json payload for browser: ANil installed extensions payload so not sending for browser .get_extensions_info.browserSettings8Ver_to_send <= ver_sent so not sending for browser .pairs.GetOption.settingsHEntering Analytics InstalledExtensions event handler's send_on_ping.info.m_logger.........6...9...............B...'...'...5...3...=...3...=...2...L.....send_on_ping..handle_telemetry_event....CH...ED..1Analytics_Installed_

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\lowsearchusertargeting.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3307
Entropy (8bit):	5.670242931913642
Encrypted:	false
SSDEEP:	96:p9hLYo14yWoUDkcqroiNpKs+5ahLiD70tWQrdkp1t:9PTWoUDqUD7Kd4t
MD5:	5AD098C6A7034EAF3E3C7DFE5E10786B
SHA1:	C1FC292FBC965D0E80E854036A22507D433BB627
SHA-256:	2284E6F124D86484C77ADF43A664B911A99930509FBAEE1B73D593C2A9A01D29
SHA-512:	FF55CD08015B7CA4AB2EFD94B88EA4DE516893E99B63F23F7D3A3DD658865FF10FD6F541AFE146454C083D27A2EA04DDA06EF8F322AEC7C5794CDC07C9B40F45
Malicious:	false
Reputation:	unknown
Preview:	.LJ........0...6...9.......9...'...B...'...6...6.......9...+...'...)...B...A...6...6.......9...+...'...)...B...A...6...9.......9...'.......'.......'.......&...B.......X...6...9.......9...'...B...K...6.......9...+...'...+...B...6.......9...+...'...+...B.......X...'...X.......X...'...6...9.......9...'...6.......B...'...6.......B...'.......&...B.......X...6.......9...+...'...)...B...6...9.......9...'...6.......B...&...B.......X...6.......9...+...'...)...B...6...9.......9...'...6.......B...&...B...6...6.......9...+...'...)...B...A...6...9.......9...'.......&...B...6...6.......9...+...'...+...B...A.......X...K...6.......B...6...9.......9...'...6.......B...&...B...6...6...9...'. .....B...A...6...9.......9...'.!.....&...B...5.".=.#.=.$.=.%.=.&.=.'.6...9.......9...'.(.B...-...9.).....B...6...9.......9...'.*.B...-...9.+.....B...6...9.......9...'.,.B.......6...9.......9...'.-.....&...B...6.......9...+...'.......B...6...9.......9...'./.B...K.....9send_low_search_user_targetting_telemetry() exitin

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\navigatedtoday.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.5656951735067155
Encrypted:	false
SSDEEP:	24:6j+e/agXgQCWpI4M6JUhheWdJs1bWWSAJWIKY7jJw8JNHuuZJvJZHrRO2vJsKH4l:u+e/vPNMEUhhfdcb3VA7Y3Jw8JzZJv3M
MD5:	EE2843403649BFCE8EA9AD5CBDCADC07
SHA1:	716E6CA4736E116C4C7E4C615B5ADD268FCE4E5A
SHA-256:	A72D9898569BF323C3561362557F377267CED8B94C95FF4EFDEDDF54656BD05B
SHA-512:	4489B8DF79691991EEF6ACE3E93E485728039505A095803D24CE21566834D9D672B20049CE2F01E57C513F4AF104594529BE2E0DC7E0E3A0CC5C4E6948F8554D
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........M6...9.......9...'...B...-...9...B.......X...9.......X...6...9.......9...'...B...+...L...6...9...9...B...7...6.......9...+...-...6...&...+...B.......X...6...9.......9...'...B...+...L...6.......9...+...-...6...&...)...B.......6.......9...+...-...6...&.......B.......X...6...9.......9...'...B...+...L...+...L.........aNavigatedToday Telemetry 3.0 handler unable to increment BrowserNavigationCountToday setting.SetOptionInt.GetOptionXNavigatedToday Telemetry 3.0 handler unable to set BrowserUsedToday setting to true.SetOption.settings.lower.stringXNavigatedToday Telemetry 3.0 handler was supplied a malformed event for processing..err.browser.get_analytics_eventAIn Analytics NavigatedToday Handler's handle_analytics_event.info.log.core..........6...9.......9...'...B...-...9...D......handle_analytics_event?In Analytics NavigatedToday Handler's handle_on_navigation.info.log.core.........6...9...............B...'...'...3...=...3...=...2...L.....handle_on_navigation..handle_analytics

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\pushnotification.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3033
Entropy (8bit):	5.649470533677633
Encrypted:	false
SSDEEP:	48:REIVPXKEKVUIc7JExkuuujJBjqb87lzXdM2LCkPTbxY4eSZrlMWuar7uLnU/Xaj8:REGPXKEKVUN8ukBjk8XMCCovbeK5MxnI
MD5:	1B705AF001B0664EB37FFD5AB3E8C51B
SHA1:	A24C5A85202153CE99FBD41D610753C8D8C5DCAF
SHA-256:	EE042550DD33A1677618F5BE2317BEA4D74CD130E00023763795DDDF9E66CA9F
SHA-512:	FA7BFB1B1EA44A59272C05E770B3BEC386BE8A3339807092FE61908C05083186B9D0DCA6C37CBA5EABFF897B7D923F5582D4CEC7097A1CB0B9AE11E5C7AD584F
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........$6.......9...+...-...)...B...6.......9...+...-...)...B.......X...-...9.......9...'...B...+...L.......X...-...9.......9...'...B...+...L...+...L.........EAnalytics PushNotification ver_to_send < ver_sent so not sendingEAnalytics PushNotification ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......6.......9...+...-...)...B...6.......9...+...-.......B...K........SetOptionInt.GetOption.settings.........'...6.......B...X.......'...6.......B...'...&...E...R.......X.......9...)...)...B...........'...&...L....].sub.",.tostring.".ipairs.[........()...4...6.......B...X.......9...'...B.......9.......B.......9...'...B.......9...).......B...........X...6...9...........B.......E...R...-.......B...........J......insert.table..:.sub.//.find.ipairs..........5...=...=...=...L....hit_metric_0.hit_label_21.hit_label_19....hit_label_19.._event_name.wa_push_notifications.hit_metric_0..hit_label_21..hit_label_20.ch^.......-...............B...9.......B...9...D......transm

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\remapattributes.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1278
Entropy (8bit):	5.5972532358448905
Encrypted:	false
SSDEEP:	24:6fW8dwKf88usGQE5KlQjbvEWYHhtaH30eS69gxuuHJjMfJsPzbaWCb61:c7Df7ufQEHjLAb+gx9HJQfJfT61
MD5:	5F025C27A30F601987A34A05D7E0A5A0
SHA1:	13D3D849C3876E820516652544A20C564B9EFD16
SHA-256:	95FE52D3A214C7C7E6749D7EA2755BD8D86BB83C83F250DC41345E7E5F5D5A99
SHA-512:	3282E461F9815DE3AB3A5082BE827B00769C7D32697F722AA0BEF535616D9CDF53054A2B1119FADD51E1D7E950A0302F85EA40A23F20C6E3B35D0D37F5B2929B
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........r-...9...B...-...9.......X...-...9.......).......X...6...9.......9...'...B...+...L...9.......X...9...=...5...9...=...9...=...9...=...-...9...........X...9.......X...-...9...:...=...X...-...9...:...=...-...9.......X...)...-...9.......)...M.(.-...9...8...........X...6...9.......9...'...B...+...L...-...9...8...:...8.......X...6...9.......9...'...B...+...L...-...9...8...:...-...9...8...:...8...<...O...-...9.......X...-...9...=...-...9.......B...-...9...D........transmit_analytics_event.set_analytics_event.hit_screen8Malformed event passed into RemapAttributes handlerNRemapping part of config passed into RemapAttributes handler is malformed.remapping._event_name.Impression.hit_label_20.browser.hit_label_19.hit_label_18....hit_label_20..hit_label_19..hit_label_18..name.interaction_type.action_type9Malformed config passed into RemapAttributes handler.err.log.core.event_names.get_analytics_event..a.......6...9...............B...3...=...2...L.....handle_analytics_event.new.Analytic

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\searchreset.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3387
Entropy (8bit):	5.51809323714341
Encrypted:	false
SSDEEP:	96:+cEGPlKkKVUr0/VjzpzRILXFfj2vIWjRN5RlDk9w03ngpYjdI26VNPNBYwixtPmI:PEGPlKkK6gRzpzu0fPu91nYXHW3
MD5:	1AC6FB590ED89E1C61DF139AE215BF33
SHA1:	E219026213922B70A5004BC4FB529DF91D25E231
SHA-256:	95B413BF96F7577426BD3D57EF0DB136878F004A11D63E6C2703BD7D4DD1F43D
SHA-512:	0A1DF828B571B6F70C07B138D48BC68AEB309762A83C9A35D58627BCC6887DAD1B57B1E15693B2C91A2621F1AA698EC9A25492C87EE965A0713CFD68442A916E
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...6...9...'...B...A...6.......9...+...-...)...B...).......X...)...L...!...L......GetOption.settings.!*t.date.time.os........$6.......9...+...-...)...B...6.......9...+...-...)...B.......X...-...9.......9...'...B...+...L.......X...-...9.......9...'...B...+...L...+...L.........<Running processes ver_to_send < ver_sent so not sending<Running procceses ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......6.......9...+...-...)...B...6.......9...+...-.......B...K........SetOptionInt.GetOption.settings..........-...9.......9...'...B...6.......9...+...-...+...B.......X...+...L...-...9...B.......-...9.......X...6...9...6...9...'...B...A...6.......9...+...-.......B...6.......9...+...-...)...B...+...L...6.......9...+...-...)...B...-...9.......9...'.......&...B...-...9.......9...'...-...9...&...B.......X.O.-...9.......X...-...9.......X...-...9.......X.C.-...B...).......X...-...9.......9...'...B...+...L...'...-...B.......X...6.......9...B...........X...-.

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\searchsuggestcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1653
Entropy (8bit):	5.805792226422415
Encrypted:	false
SSDEEP:	24:6Byx1SqTDVYwm11tUaIHP/zAWUlijyVudQ5ewccH3ZTqqyFAZzOTScud+WOJJAAg:JDSzV16a2/zAij2Hacz8SDAJJEyJOynO
MD5:	FC7E748053BB272803291FB0B56B6A8C
SHA1:	AE59D5DCF51769D2E300CAEA3E85E5ADE383ABDB
SHA-256:	26B2DA4C0D48C058A01936931830324E0CDEFE8A1B5073687F6683DD80E22429
SHA-512:	F63B417393F3D3AF90AF5C7BB049C52F0DAEDD39C8DA9B3BFE06E76BD2F227917E8A21C29204F37A289269AB158CB7FC8C6623A0E03B1D0CD14F0E6E016BA31F
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........A-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...+...)...6...9...-...'...9...'...9...'...9...&...B...6.......9...............B.......6.......9...............B...+...L........SetOption.GetOption.settings._.lower.stringHAnalytics SearchSuggest Counter handler was passed an invalid event.err.search_type.interaction_type.browser.name.get_analytics_eventDEntering Analytics SearchSuggest Counter Handle Telemetry Event.info.m_logger.........J-...9.......9...'...B...+...)...+...5...5...5...).......)...M.8.).......)...M.3.).......)...M...6...9...-...'...8...'...8...'...8...&...B...6.......9...............B...).......X...5...8...=...8...=...8...=...=...-...9.......B...-...9...B.......X...6.......9...............B...O...O...O...+...L........SetOption.transmit_analytics_event.set_analytics_event.hit_metric_0.hit_label_21.hit_label_20.hit_label_19...._event_name.wa_search_suggest.hit_metric_0..h

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\searchterm.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5468
Entropy (8bit):	5.687289107640217
Encrypted:	false
SSDEEP:	96:vEc6Kr6/joo1pKtk8LhEPeL4wM9IKV1BkU+DdZdgg9Jtzvejk:vBZr6cq8txNMKKrOU+RZdpJBmo
MD5:	6A4E22D3623993D1C7A627007DC09409
SHA1:	2CE4E0A3458EE2F6116290B41FF73CCDC82CC9CB
SHA-256:	E5035E36C936E124D014B474BEA4804652382E0521E3BB4CE6653701DE7F670F
SHA-512:	FD71E99A79F1DBEAA55DCD4C5A8A500C8EB11C1BA15B9DFF776C3FC47898903FD2FA5E0281B043F34951936486CEAD67A6830D248623F24E556076307C181D00
Malicious:	false
Reputation:	unknown
Preview:	.LJ..8.......6...9...6.......)...B...C....tonumber.char.string+...........9...'...-...D......%%(%x%x).gsubc.......6.......B...H...6...9.......9...B.......X...L...F...R...+...L....urlMatch.match.string.pairs........06...9...........B...7...7...6...9.......6.......B...6...9.......'...B...7...7...6.......X...6...9.......)...6.......B.......-.......B.......6...9.......'...'...B.......6...9.......B.......L......lower. .+.gsub.first2.last2.&.sub.first.last.find.string.2.......-.......-...8...9...D........firstIndicator........F'...6.......B...X.>.+...6...9...B...X...+...6.......B...X...6...9.......'.......'...&...B.......X...+...X...+...X...E...R.......X...+...X...E...R.......X...6...9...B...X...6...9.......'.......'...&...B.......X...+...X...E...R.......X.......X...9...X...9...'.......&...E...R...L.... .category.exclusion.%f[^%w_].%f[%w_].match.string.inclusion.ipairs.........+...L.............-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...-...9.......X...-...9.......9.

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\securesearchhit.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8197
Entropy (8bit):	5.708887498543069
Encrypted:	false
SSDEEP:	192:UD2A/mLB7AVWy/c9AbQLW/rNwGYFLB6Yf/x:gPAUVWyc9AbBeGYhfZ
MD5:	2E8E088B6F21282579A705824B6CF8E2
SHA1:	0945021E562D7CFC8280A5429C7E3796F1C4BEC3
SHA-256:	7774524BF6C913AD7EED483A4B02C65A7965F0359717053737FC3F43F45ABD04
SHA-512:	5731336ECA2BFDEAC450DFA05F7EEB049656EEE5F5337995FE0FF920CCEB97E39C8F5DAF27790BA0A3221E25E26FD3A5D8989A9A328DA8FD3011685F31D18899
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...6.......9...+.......)...B...A...6...9.......9.......'...6.......B...&...B.......6.......9...+...........B...K....SetOption.tostring. - count: .info.log.core.GetOption.settings.tonumber.........$6...9.......9...'.......&...B...9...9... ...).......X...U...........X...6...9.......9...'.......'.......'...9...&...B...5...=...=...9...=...L.......month..year..day..day., day: ., month: /Secure search hit add_month result, year: .month.year-Secure search hit add_month, num_month: .info.log.core..........!6...9.......9...'...B...6...9.......B...6...9.......B...6...9...........B...6...9.......9...'.......'.......'.......&...B.......L...., difference:., target_time: /Secure search hit days_until, start_time: .difftime.time.os!Secure search hit days_until.info.log.core...........~6...6.......9...+...'...)...B...A...6...9.......9...'...B.......X.f.6...9...'.......B...-.......)...B...-.......)...B...6...9...-...........B...A...6...9...-...........B...A...6...9.......9...'...B...6...

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\securesearchtoast.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.774607329945961
Encrypted:	false
SSDEEP:	48:QsSiaIqULiwOSJJWkGb2xvsXjjQtu7jULso2X16RYDQJ8v029vJQw/oIDu:QsRaIqx9gJWkGb2lEjcDL6IYDk8v029w
MD5:	DD276E140DB5F9E9C384EA3F9B394724
SHA1:	016FB236E9463715C5D4BA090F47B06F07F8775E
SHA-256:	898D80FE116CDB628988FC0430FD6E99B4D6AD765467F722EA2302B90A477450
SHA-512:	6E3B88DBD07E33941E889D17C09730E52D56A942585C0C3A9FFC464AE450547164A933C82B9FCD44907C8BB09DFF5E6702610F04F0D02F2A824E4A9A9EB33CD9
Malicious:	false
Reputation:	unknown
Preview:	.LJ........>...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...'...'...9.......X...9.......X...9...9.......X...9.......X...9...9.......X...6.......9...+...-...9...&...9...B...X...9.......X...9.......X...9.......X...6.......9...+...-...9...&...'...B...=...6...9...B...-...9.......9...'...6.......B...&...B...6.......9...+...'...+...B.......X.A.6.......9...+...'...)...B...)...'.......X.#.6...9...!.......B...6.......9...+...'...)...B...-...9.......9...'...6.......B...'. .6.......B...&...B.......X...-...9.......9...'.!.B...'.".....X...'.#.....&...X.......'.$.'.#.....&...-...9.......9...'.%.....&...B...'...9.......X...6.......9...+...'.&.)...B.......X...6...9...!...B...).......X...6.......B.......6.......9...+...'.&.)...B...X...6.......9...+...'.&.....B...5.(.9.'.=.'.9...=.).9...=.*.9...=.+.9...=.,.=.-.9.......X...6.......B...=...6.......B...=./.-...9.0.....B...-...9.1.B...-...9...B.......X...9.......X...9.......X...-...9....

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\sendimmediately.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	571
Entropy (8bit):	5.370010420896111
Encrypted:	false
SSDEEP:	12:6t5LzIKSSj3d2k0uknxFJ+PF4MVIRMJsYJJKhEfPanWn:6t5Pj3MbuuHJjMVtJsPh8i2
MD5:	1C910B0C831928349867F8896B9E17BA
SHA1:	9AC4C324E524AB94B35B05D347AA3DAFD9C31E1F
SHA-256:	C8D2630A63DDD14F2F96ACD7DA5769362D6AD37D35DD6EB0A636A922191A0FEB
SHA-512:	052B4096EA4CBB1A44E550FF149917C7C16803C079D9876BED8B043BC7F7D9B992FE66297EB843A17EA06FD0332911FAB9DE5DE194DF4C8C2F608BC5F9230A1D
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........-...9...B...9.......X...+...=...9.......X...+...=...9.......X...+...=...-...9.......B...-...9...D......transmit_analytics_event.set_analytics_event.flags.timeout.analyticsSDK.get_analytics_eventa.......6...9...............B...3...=...2...L.....handle_analytics_event.new.AnalyticsEventHandler.........6...'...B...4...7...6...3...=...6...2...L.....new.SendImmediately4analyticstelemetry.events.AnalyticsEventHandler.require...//989324A47ACAD37B5E1BE6DBD17194B4D5434A13805D0D54956EE097E16373C630A290819EA12AFC584D1F8B1501157580A9F4C8D43CDE129BBE35532E5CD6D4++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\sendonping.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	407
Entropy (8bit):	5.411704563258671
Encrypted:	false
SSDEEP:	12:6AWHuknxcW7NPl4MXFQMJsYJJK74o9s8NwMvqda6k:6FuuOMXFZJsP74whvvma6k
MD5:	E330903D028A26994C905635457FA2C9
SHA1:	A79229A27DB1B51C2378F4735E2B0043C2D3D5AD
SHA-256:	D3AA6EC80B0515A400BA504FB6B3EB855468654EDB0A7F38C1307DE5ABEC3036
SHA-512:	16FADB5FB57DBEB2083D690FA44D82E286A5934F56092A7E4B2F1197A48A3F0A4696409DA2D2C32E6AB2A8A6000F19AF619341C504FBC16088A9C7B8C59843B9
Malicious:	false
Reputation:	unknown
Preview:	.LJ..6.......6...'...D...!send_on_ping not implemented.errorW.......6...9...............B...3...=...2...L.....send_on_ping.new.AnalyticsEventHandler{.......6...'...B...4...7...6...3...=...6...2...L.....new.SendOnPing4analyticstelemetry.events.AnalyticsEventHandler.require...//40B6634B216868086C07AD17D2552313876C77417F703D901D7430B325B222DE1F382962119DD9E8D4AF613F34E5B0671130188F59B1036B9B0660460BFE3035++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\settingsdblookup.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.511545073381916
Encrypted:	false
SSDEEP:	12:67klvhpCl2IWm7RYvfOH6eaA0JAkGmqcpuoO:6EeJViWH6bqjAO
MD5:	0DFF7294953EB5852595E7BC0B5790E6
SHA1:	2A95BA0163C8CC56CBE1E2DBCA6B196909759119
SHA-256:	6A24A43D5EF5F5249CA03BE98729F8FE54778650E686FD50EDA6DE160B1F46A5
SHA-512:	6F905CA6A813994B203030A6C86748B5AEC5464300C1A140A1D3CDC7DF4938C3E4C45782BD77A55889BFD1757C977E9E30F1A9D97246AC9D07DB9ECB8A511B36
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........'.......X.......X.......X...6...9.......9...'...B...X...6.......9...............B...........X...'...6.......D....tostring.GetOption.settingsAInvalid parameters supplied for get_setting helper function..err.log.core.(.......4...3...=...2...L.....get_setting...//D6323AC3E3CDF103B54E25F322DA07E675845663BF231A2D5DB068C0C8C13E81349BC4CECB6AB1DB379484A37CBF8C7B88B246BEA38F86DCEA61054520061155++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\smareputationcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	5.812636146799877
Encrypted:	false
SSDEEP:	48:CiDSFhorowIgf3Nah9LbjM1qj69dXoiz8SDAJJKrkJ1ck:PujxRgfE7bjM1qjsdXz8W0JKY7h
MD5:	297178FBFDB617CDE151740C4A56593B
SHA1:	9D5F220F802DA880B7695B7F1ED203945328FB76
SHA-256:	1BA7BC0C3A83E8D662BBA9D5D9BC1791540E9BA8FB7774A7020E99753167DF06
SHA-512:	1E9AAA8DFD93502684AE18F5A23C607FE330517B3526740B6511E123438F6DB60E64FDD26236154506FDB3BD595A8276BB20918491732AA0DCAC09E2B5C84A1A
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........C-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...+...)...'...6...9...-...'.......'...9...'...9...&...B...6.......9...............B...9... ...6.......9...............B...+...L........SetOption.GetOption.settings._.lower.string.defaultFAnalytics SMA Reputation Counter handler passed an invalid event..err.count.color.site.browser.get_analytics_eventEEntering Analytics SMA Reputation Counter Handle Telemetry Event.info.m_logger........Q-...9.......9...'...B...+...)...+...5...5...5...5...).......)...M.>.).......)...M.9.5...8...=...8.......9...B...=...+...).......)...M.".6...9...-...'...8...'...8...'...8...&...B...6.......9...............B...8...<...).......X...+.......X...6.......9...............B...O...-...9.......B.......X...-...9...B...O...O...+...L........transmit_analytics_event.set_analytics_event.SetOption.GetOption.settings._.lower.string.hit_label_20.upper.hit_label_19....hit_la

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\wssanalytics.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	856
Entropy (8bit):	5.552992103124313
Encrypted:	false
SSDEEP:	24:6SrbpJ87HKzQTSJ9AnuZ+nzwEvcunhlSJgwM1tJsP+OUJkxB:Drbpu7dTSJMuZ+zzvDnmJU1tJdOwkxB
MD5:	5F87A5D28DBC14A2F92A158B3114CCB9
SHA1:	95AA34926B111F2E1C35D6D2359E5919C4E0DF5B
SHA-256:	5613A46FC0F1E97D43E3263676A657822D158709CC6BEA5755B720A94F8BE562
SHA-512:	B514770B18695D117142791CBF29BDE76F4C3B22CBF1E9CB1187DFB5B4FFAAC830AA892857B9AA7BE98CF326B9FAD92F3DDC910CA9F8615AB69A8F749D057584
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........0+...6.......9...+...'...+...B...........X...+...L...-...9...B.......-.......X...-...9.......9...'...B...+...L...-...-...9...8.......X...-...9.......9...'...B...+...L...6.......9...-...9...D..........PublishMessage.wssEventSender>Invalid message passed to WSS Analytics analytics handler.messageQEmpty analytics telemetry information returned when processing WSS Analytics.err.m_logger.get_analytics_event.*AnalyticsSendWss.GetOption.settings.........6...9...............B...5...3...=...2...L.....handle_analytics_event....msad.files.safe..msad.sites.safe..new.AnalyticsEventHandler}.......6...'...B...4...7...6...3...=...6...2...L.....new.WSSAnalytics4analyticstelemetry.events.AnalyticsEventHandler.require...//FE3409BA851EB05E9ABC44C8500A6DB78B3ADBC32F90283F302228F62F016250B6574B3A625B7FC75084263BA246F851EA56F75AA3F4D3D6A728C1F905356CCF++

C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\wssanalyticsraw.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	705
Entropy (8bit):	5.56117527697094
Encrypted:	false
SSDEEP:	12:6cDVIgpo+ktBbHB6WfEFyi9AnuyzRu+nGpIjbpZIf01uknxFJ+PF4MaoMJsYJJKQ:6Wbpn6bhcyi9AnuZ+nzwc1uuHJjMaRJn
MD5:	DA7F912C49765456E56B661E0B72C4FA
SHA1:	9D34DDB9BFCA453BBB5CF31388E71BD3A3BC51D9
SHA-256:	3569B71B765AADC58E237A4A4ADB24D06CC72182B15C45A6431B075542F322B1
SHA-512:	568C9E5C3CED1F89298B6AD71723F92D02115F870E930C9E2D0EE7F82ECEB75A64FE7A0267855D2DFB883CF832D385EE0F569F0C5F7ADB8DB4EEB8D19580C0F2
Malicious:	false
Reputation:	unknown
Preview:	.LJ.........."+...6.......9...+...'...+...B...........X...+...L...-...9...B.......-.......X...-...9.......9...'...B...+...L...6.......9...-...9...D........message.PublishMessageRaw.wssEventSenderQEmpty analytics telemetry information returned when processing WSS Analytics.err.m_logger.get_analytics_event.*AnalyticsSendWss.GetOption.settingsa.......6...9...............B...3...=...2...L.....handle_analytics_event.new.AnalyticsEventHandler.........6...'...B...4...7...6...3...=...6...2...L.....new.WSSAnalyticsRaw4analyticstelemetry.events.AnalyticsEventHandler.require...//EDB531AD1726F3A22189DAD2A0A660D442D757B0E7A960910AC953980842FC549B800E01844E62AF041DFE289AF09809A8F35BB8AB054A850F266E8217870A22++

C:\Program Files\McAfee\WebAdvisor\browserhost.exe

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3694472
Entropy (8bit):	6.532876150684731
Encrypted:	false
SSDEEP:	49152:FiCH26EmD5lINIBF7ncXjuqnpl/C4tcoWrIXj/z3li5QC6I:+6BTCbnRNW0Xjq
MD5:	6F01DA65F11F0C33BC0C24CC3FB2BEFD
SHA1:	44AD6A5AB22F91C20007824CA53D2F31657CEA81
SHA-256:	258B95AFD6078D1415CEC477F7C7BFADC870A0C0F527A0F3C5F651DA84DD25DE
SHA-512:	455C9CFBD7E68AF02F2726C6440459E7B7932C3883BB1039B3267F6F29B9724543929B587A22157962FB975B25487262FFEDF4DE08217D3D6FBB7902F675137F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......y.M.=.#}=.#}=.#}v.&\|..#}..'\|/.#}.. \|7.#}..&\|D.#}v. \|0.#}v.'\|'.#}'.&\|<.#}..&\|..#}..'\|/.#}..'\|<.#}v."\|..#}=."}..#}..&\|..#}'.*\|..#}'..}<.#}'.!\|<.#}Rich=.#}................PE..d.....>f.........."....$..(..........."........@..............................9.......9...`...................................................3......P9...... 7.d.....7..M...`9.\|q..<.0.p.....................0.(.....-.@.............(.....@.3......................text.....(.......(................. ..`.rdata........(.......(.............@..@.data........03..t..."3.............@....pdata..d.... 7.......4.............@..@.didat.......09.......6.............@..._RDATA..\....@9.......6.............@..@.rsrc........P9.......6.............@..@.reloc..\|q...`9..r....6.............@..B........................................................................................................................

C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5985656
Entropy (8bit):	7.997073443075553
Encrypted:	true
SSDEEP:	98304:T+PQByUNM+wti12AJyTJs6mEzHohlciWocwyJ6TW9TFIfvxzNfuTeaFfPzemlu:i4ByU6+JyTKbEDoXciWoSdF+vhNf4TeV
MD5:	EFADC0D22983A99516DDBFBA3FD6F1A5
SHA1:	A64D75E07B8535FC7F71F33684CEB852E6784FA9
SHA-256:	B4F29215D91B81325283EA358CB73753D53392874637C501F3009F0718091461
SHA-512:	479F98D3D2C868F7189F09669A92F941979679F60525229F917F8B351BFCDEC8873E8D69D3153515F660A80D666E5F4A0DF8CC00F59EC1B423AE1DFD48C8B6E8
Malicious:	true
Reputation:	unknown
Preview:	PK............................app_launcher.js\|Uak....._1..?.,r\...x.4.B.>..O.R......2;.+\.........Z.v.sfV^..... ...ww......Ow.........>.....{..-C^......<.7......#...!..j.:...G...`..........h....k.s.B...@q..@...HV...M.a'..~."E,'.N].."%.9[.O.R.O.....h@.j...,o',.9...../.^bLR.0i3.'.....)D........=K..M.V...B.;1.#`.Ta......3;;va...Hq..N...E..<.d.O%<...XX.2..`....FI.+W.H.t...`l3Fc.v6me.E....!1.5...O.e..c..]w.L.M........N.c.B.U...6.`..H...H.<D..&.S...1L."t. ..Q3zVg..k..A.-.X.....i'h.Y$..p:l..i/=. Y.i$B.]....Is&U.......H...I.....J.l....Q`.x.Gh......H.l..n\|.!<u.....5...]b..T....F..W....u.7'......\|-<s,.....p}.....&.?...;. ....@..%%T...v.[.jz........Tk..p.UA..T.P.jvu..T..*....:SU.\|..2....../..4.X...\....w-.^;\...y.bPTR.Rz&.K..f...C._.v..\|~....0Y.y...W......u......fC.~..}..i.vL.]...+.cS.s..s.(.P...Cxm..?.4.c..:j..\>..9Iz.\-...}.\!pT.,...W..Fw..K..p(..P.}9..E.(..Hf..*M.UP'.\.OC._.rm..y.P.....~.....;.8....a...O.,.Xe:S\(.r.%..."y...Ynu...G...@..#VY.(.

C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor.json

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	358
Entropy (8bit):	4.783729084285157
Encrypted:	false
SSDEEP:	6:3FF2b4FPeee/KabRVdUvFFyFlLulkNCZDZKMjeQoFeNCBHu4H4WsNCHERN2l7Y:1YJKadislLAj+9QoFdBOKjkRN2l7Y
MD5:	4BCE68B8CBF044EB70958BC6018D0F01
SHA1:	46B4482884D6062CF15E618B8035BD1E675A3EA9
SHA-256:	FE5A9A409388CD8E5D6AF76E3FC8E8708F697F2577886BC3B826B4D591CB4306
SHA-512:	0F3E86AEB29E202E2E36E4E1859AFED3F17CE65246E90291CA8413287B94798A42309EB27E5CFB67A0B48A8C6D14174FBFC3F36EBE25B7BD8D7800BB78671047
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "siteadvisor.mcafee.chrome.extension",.. "description": "webadvisor",.. "path": ".\\BrowserHost.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://fdhgeoginicibhagdmblfikbgbkahibd/",.. "chrome-extension://dbghilognjpbmkdcpjgodiieiflmlaeb/",.. "chrome-extension://iiloambhgijcaodolaknfhmcficdnaca/".. ]..}

C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor_v2.json

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	357
Entropy (8bit):	4.7907114893123115
Encrypted:	false
SSDEEP:	6:3FF2Eas4FPeee/KabRVdUvFFyFlLulkNCZDZKMjeQoFeNCBHu4H4WsNCHERN2l7Y:17aWJKadislLAj+9QoFdBOKjkRN2l7Y
MD5:	BEEC1609B6AA63B29247C7C4805CBF32
SHA1:	A9AF06A9D648857FDFBB8BD0D1B6A49840FF0232
SHA-256:	BFFE531435235BF8801946B9BC8654A79727FD6D591DBB7BE173BE9A55FC6974
SHA-512:	36BBB47F67D2B112AF77759E637318CD79560156B3B5A1007FEE0CB0A9FDE3E26C99D980D2160DF0A730304A43D3D16D2F28742E44A5303B81C0FEAE78A176FA
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "webadvisor.mcafee.chrome.extension",.. "description": "webadvisor",.. "path": ".\\BrowserHost.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://fdhgeoginicibhagdmblfikbgbkahibd/",.. "chrome-extension://dbghilognjpbmkdcpjgodiieiflmlaeb/",.. "chrome-extension://iiloambhgijcaodolaknfhmcficdnaca/".. ]..}

C:\Program Files\McAfee\WebAdvisor\eventmanager.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4519144
Entropy (8bit):	6.566626256285646
Encrypted:	false
SSDEEP:	49152:3aFzCa4w+jR0pvF/AHtvoS4IfCMjvp1ZupuPkoM7rp0eGhfhTjYHHbLTCPI5Y0GW:6h+jR0pu4ICMjB13wQfOHHPRu0sn1/m
MD5:	522D3A1BA6CA58A669D0DE49F731ABFD
SHA1:	4E4301A5F4D3931F74E6445ABC20F3B0BF1D1133
SHA-256:	A07411B12627EB0A121D451C3406CDB1C37DD04141A763FA775BEA9D6E63CA9C
SHA-512:	162854D2847C547C28F3E05C56E3ADAE26A3910D22EF1CC9F8D7F3DD8088B60BB7D8CA9ACC97FE0C44FE519071A3C1E71BBCD13434D79A6EC8BC6A82CEDC8241
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$......./C=.k"S.k"S.k"S. ZV.."S..\..j"S..\W.{"S..\P.a"S..\V.."S. ZP.r"S.q]V.j"S...V.E"S. ZW.O"S..WW.j"S. ZR.\|"S.k"S.j"S..WW.8"S.k"R..#S..WV.\"S.q]Z.."S.q]S.j"S.q]..j"S.q]Q.j"S.Richk"S.........PE..d...M.>f.........." ...$.83..>.......o+.......................................E......pE...`A........................................p(?.@....7?......PE.`.....B..j...pC.....`E..h..,.;.p.....................;.(.....8.@............P3.@....#?......................text....73......83................. ..`.rdata..*....P3......<3.............@..@.data...lR...`?..J...H?.............@....pdata...j....B..l....@.............@..@.didat.......0E.......B.............@..._RDATA..\....@E.......C.............@..@.rsrc...`....PE.......C.............@..@.reloc...h...`E..j....C.............@..B........................................................................................................

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.456870049611267
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLp/XPJf:7rrSOX8BC0Bj5dXEC0BjyKSYPt
MD5:	B78DB2B2A35FEB05711A2940F8D1466B
SHA1:	7EE3A6D2A7C44F36972069580CCF510DB6237B89
SHA-256:	4F01E1C72B93E4DA1BD24705F8859469B7CCD013D1D837D9F05A3A5C37A9B54E
SHA-512:	D6237779C3D700D82DBDED54EEA81FC5AC6F00C3D730FBB807E3760FE6F1AA9CA53E6808C2689C2E7FBDCE052B34567745974E9217A08ABB36E6E44C57331228
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//93277DEEA5A528ECB1F6DE1A870833D110F5E01EAE82C9F257BCBEFD07B1B741FCB9F14AFE3A09D91510302347AFD4581E82304FE54DBC3B6B21C3466395B5E4++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.457640405943752
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynL4sRCTAS:7rrSOX8BC0Bj5dXEC0BjyKSDCCTAS
MD5:	3B81C86F6BDEF968D8D56F5F5A158790
SHA1:	65BD82944558CCE80285B4AA8BFA0B820446FB2F
SHA-256:	B67135786478ED6473591DE0883456FD930E4337A95DE711247DE172D260726C
SHA-512:	686B6C31C16B85DBC2E5502976BFFAE8B744C2DD555047EAA73BBBA57A9F70B77BA4924F5CA6CB2711222D816AADFDA5FE32D51F9070F5BE27A7E703A31FE31B
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//1E8BB43CEAAF0048FB2C9AF5BED96816B1DE579CF58619B19704969837B98705523EFC1BE2D3B53E83EC1ABFBEE59F6A5FA7BC4DEB4715882824045EB7467D38++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.4671225990955135
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynL7YCrd8cVW7n5A:7rrSOX8BC0Bj5dXEC0BjyKStaG5A
MD5:	09685215032AF14FA526946B43415EB7
SHA1:	9D576CE3A144F17835E9245FFDA464479053B0B6
SHA-256:	A9792A3847D37BA06F06E2E7FB83845F7E65341B102FE3A2A4741774BCA6A833
SHA-512:	C5FB3275E81D6A9AA80F1E869AF4946A5FC2825D2E46468839B68EF9DA3FB2A5F988CAA952D7A49F5D8350ADF0A2FD8322D9331D7379EAD2B41E74573C0EFE6F
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//FA3DDB264F03DDA4F4F976A7A89EE2B58D685379752749673637D845A8E314959EF33247A0DF8EED5262F3A6E509975B6B47ACE0234611BEB0AFC356561C4719++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.451643590103223
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLGRYo1afUEqkZ6qP:7rrSOX8BC0Bj5dXEC0BjyKS+oWUkZ6qP
MD5:	554A67838F08648946A38101DE1C3C41
SHA1:	9D67A8439ED87B814FA806575704A213D8B56AA9
SHA-256:	AA297D2E51F56D28686EB24A5E4E0EF4113B7B97812789BE3FE644A0FBCD18C5
SHA-512:	8D2E0DE63899AD521AAC03DF1F428FAB73DCF29840B486E6F58E80039982CD42B2A53D36D6B37FAD3A3D2827BCC11EA2A2B3DF165E07FC97577F2B47C617E509
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//F18F133005D0A2A50DAFD82E8AC75461442FF1AC63A4F2602557F10F3965FDF54027AF0A6ADFF62FABE9E3AF449ED6426E2DE4D0B8B552DD8B82D2CF84AC4064++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.481559167867403
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLDxnVFXF+ihFsUtn:7rrSOX8BC0Bj5dXEC0BjyKSwRTF+5q
MD5:	AF980A1FECB4CBF0BA720D72E78B00A6
SHA1:	8A66252323966BA31528D8100397C26B693CAB16
SHA-256:	E2FB05F5DFA8F0E904331A18080C7F2D1F70F65CC1A3FFD23A6E7330BC33ACF7
SHA-512:	2A3AD476A69D8BAC183332801E6D21919A7AB2F9778BE9BD25E66AE3DBC0F05FE7001702865760528C308EC6D610B647B84979BC591061F3F99D5CCBD7DA956A
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//9038B59EF7A5C57EB64B74A823377441D0B3F7B8D68B7667C74F289C3D4EC99081AFBBC609C3AA58398956FAC3FB563156D160F4800924154BEF9412A0CF8F5A++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.475992243112246
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLyOdssO:7rrSOX8BC0Bj5dXEC0BjyKSLgsv
MD5:	3A131E5003F161A7D72A686104A7BE0B
SHA1:	104B531A7BD3DFB723A5FF8551AC9351A25A7709
SHA-256:	978003FB55B9B43C4BC12F95E62C4269F28FC92574A96E825B3847982F57E458
SHA-512:	5AC203C8D5F961AA75A0D165F3500BF1DAEF337D846BA519B9EAADF24018F9E1D64A5460A46519611757EB7E13367F8908AF73B187E38F901C2E394D2A35581F
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//F930A90D9EF70FB30C17B577A6D133EB42F2A1C2F22155F8CB80C069837A188466EFD0B172FD55731CF51850DF0FE2E5E0AD55C2A51F6FE64F80643534374D07++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.477458147632825
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLf3dWSwbBQ8:7rrSOX8BC0Bj5dXEC0BjyKSQ3dWNV
MD5:	8A5DC5F0CAEE50BA6D5F600019972930
SHA1:	E5951027A37EB79ED9B814592928F5062D2289C9
SHA-256:	7905440CB4BBAF4013EF822DA5E485EA41658794040F4C72E2F97A470103768B
SHA-512:	FF8732FCA4C150A495D4B8F275CF8538A660B0610A7C0B073E5C33EB055766FD44E228B24960EC6DE46C604EDDCD4BFC57B5AA262248D215F8274C28D6C7BA36
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//8383AB73F54805BFFA0EB895ABA9A086197271370F7762332F72D210F6749759D4A6FC9F0B4ADBDB4E2671F221BB57DB12151617475952E4872C026DA345D12F++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.4681631267021595
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLdAmH4nkXIHk:7rrSOX8BC0Bj5dXEC0BjyKSNmYnkXF
MD5:	0EDCCBEBB95B26FC76D42A2CECBAA764
SHA1:	F76ADD96CE496FBC4EE5B2AFBA2A84AE2B9B2489
SHA-256:	A77F1B24EC2192EFB8AE6633F59CE635EE4503474B0A3E764D3FC5150BCB8712
SHA-512:	25BC6742FCD0C2F5EC62EAFA0FE535FC9844A71CEF6C72F940AE7F8075E8E7565036760F71BFB83E93EB99A42C029723B84F8BB6139F417BE824B6E3BF75BE89
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//87961B9173F2D94D4B74ED2FCD63AE66A1C472919AA1359815474BFF6C322F96EA29AB1C71123EE095141ED564CF4C070082082667A8378CBBA4AF4642FE50B6++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.4640340211071345
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLFnSYZ6efJx:7rrSOX8BC0Bj5dXEC0BjyKSGnSYZ6ehx
MD5:	43629103D5C59E676091DB97595EA4CD
SHA1:	D1E643970315142CCB7EF2BE85DD12C9E2266236
SHA-256:	C50BF073086761F18E4C19F6CF6760F1A5866862A6FDE41FFBC6DC1414C82AED
SHA-512:	868DD80EB6B9D35D6E17A2405722CBDC8DDC80B7643601ACCCF0851015A4C1C09C434061F0430202E4DEB7FE93A7EF7EADF21D9A3F11C0440A746FD28DFD10D5
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//6C715F00592C9A8E12BEDE7BB80E795FE67C395D193DCBC8E7993AA8FDDB284AB854045C405D4DC58AAF66284CDF6E8279BE540FF7468D2FB3B2BD06F6202FAE++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.460044162924
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLUyi4nz4YkJgr:7rrSOX8BC0Bj5dXEC0BjyKSYik5Ygr
MD5:	B64D112D31F22B90E016390858A9DBE2
SHA1:	A59720785D185E863D4AA86C415124EEDDEA4C66
SHA-256:	E1168E60ED4A0A27938EEE8255346F8C878300C3939F8DE2A932029820A44D64
SHA-512:	A82B8DDE5D27FAC85AD6625321FFE88D1E1D159EC8AC63556970E88ED10061BC02B03CFEDC75950A4566DA585AC3ECD004AE27A0C74885D9C21A3DD3D0F2AC61
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//049ED71187DC9C7F5E3BDC3358CD2F55E578D8CFE7B26C32E470096F6E0A88D36EF91B91E153E72629A186668812AE45833C3CCAFFE672BDAF788087AF1B5A7D++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.468365047833703
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLNoUZ+TKCtbjgt:7rrSOX8BC0Bj5dXEC0BjyKSJ0+uCVjgt
MD5:	92109842597EEA630DF20C9C91BDB8B1
SHA1:	47A480BCF91B4C8C2554516C8A51A294382E9194
SHA-256:	2F95C1FCC662384D4E2602B44A337E8205A55F49E944F9AA841C1D5B15985D60
SHA-512:	A6C8ADDB4509812141799ACEE0FC6E5023A9EFCA39102B999FCE148FA939D049D834571FA8B122A820761B5D65006CB5B3C45B585604E6C2C9B47725BC19AE44
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//46300D8C516DF8B344F807A56743331BD8C57B2D46D9D7A680EE27B5B5114D56A35CEC648769583B5A35D68FFD4E4B8EB1742ACE38D98BF824AF5D3FE3740C24++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.476171696681836
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynL3PwrOGTnQEpD:7rrSOX8BC0Bj5dXEC0BjyKSoQOWnQEZ
MD5:	FBCF94DD7558E4ABC25D445C2B855038
SHA1:	AE0BB326AB407AEED6D298F2269AE9393ED3463A
SHA-256:	BBFC0137200C374E859418D6081F4DD0AD9693D4598428C8CB424B4287F3F0DF
SHA-512:	53701D5F8717C0AA869EC69391DFD96D6628B6200BFEB7A685A15335079557CE83CB2F82403873E4AD952102900295DEF74338CB2B4FFD1471DED76B38213CAC
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//778E5A4E3320F55FDB941C098D28E947DFD49810F40C5A094A541D1911F98C01E0B83309EC0997DC5FD367330C59B306E34DFB0262234C8ABD9B4F4FA5B22E27++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.455769630259385
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLhQkuDgK8Q:7rrSOX8BC0Bj5dXEC0BjyKS2qVX
MD5:	1FDD86842BF5AA25335F2A1D280CE6D6
SHA1:	3318D8CB64B173ED79FC9B3ACA92899EE9CBDD76
SHA-256:	06A89845ECB9AFEEFB68D753172B48FCB6D2C55923E5C0593A69FB18D8FA8039
SHA-512:	5281C0B22141D6B6F2136E7E689F6B326B5C30FB6189A9A2F7512F2675E6245A528E16213FB75CF479D48D2D60930969F6C0C15743D73741F26E99514CED41C1
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//8BA00D1026CDF80196137FE38F707DEB372BED1C5FC8A5BA9DB5E41F76A6B2C3A80E4DB2DF8F22F85DA7A0B192B5730AE6889296E815023EA46FF2815E66D08A++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.458084367122415
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLFarozROn:7rrSOX8BC0Bj5dXEC0BjyKSfoo
MD5:	64480BC326C67955F6F0A51024DA850D
SHA1:	ADD98D1CF69F478EA85484E9BD91B453762E5275
SHA-256:	9784D51583F47BBE01082ABF2EAC886790A949902651B7F49120E93748B96109
SHA-512:	33CB12B5632CC93819CD8D818A47040F333687C5F0E8CCA9DC8FE2EF18F9AE6ABDD5065C1685F53F19AA35821122ED9FBA1727A7EAC5A172A1C92033E3EF4C85
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//4EBFCF0494610E38E98779A04A90096BF15F24DF4CDE6D5DD2FD2EE30D6408D4C40C071B0654E5CE7D42D712F71987D68B2DFAA49FEF3E528CB7A5D5BC5CFBAE++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.479222570670271
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLvbtCKyr9yO:7rrSOX8BC0Bj5dXEC0BjyKSvJyO
MD5:	C551CC2A5800AE6BC17FF064B3D51E9D
SHA1:	DA6387D8CCF66C1E99EC9DFD602F85D7F1D9C644
SHA-256:	FB3D85A984AFDDA575E080F3FB43E7348A507B8666C39A0890F3E9889375038C
SHA-512:	E5660838E3A00A3C76B979763B81D5256E3A2B5A9887AA190D7AA1E3E462774ECC97660D43A291477A15A87AE35A31890BBF9592FC24605449E171DDCE1DEAE0
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//CD6C720C935358F945C79BA5C48234725982A56B3E893F7459E6ADBDAFD18E1DF17690901C93B8D3CE9326066ECD7C1823B75E70C5054A20092428A16C31092F++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.465216358204473
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLQKpWB04LoGRADZ9O:7rrSOX8BC0Bj5dXEC0BjyKSjKpWB0m8s
MD5:	731AC54F710AA4B9C54B2CB3754D2046
SHA1:	E2DB19679344200E6EA7EA3A5549CC2261B34DDD
SHA-256:	C384B7F70C5E47F113ECC2C6327ED464E153192BE3B9D25585AD9C844AA008D3
SHA-512:	9589BD0BBA538C9FDD9EDFF6C598FDB41541EE2E30386FE9F055EAD268239FE220A8194ADEAD2E5C04EDFFD46DDEF2A6A82BB6CA8CD390C4085AEB7D0613753D
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//0C6F55AD15B3081131C7DA5D55DA212FED171688DBDF5D3C45FC2736DE73807CCD0BB862CFBD341B88F289BAD6A3803CA894D38BA04ACA5541670CEE565839F7++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.452339886868324
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLj25wLFDZA:7rrSOX8BC0Bj5dXEC0BjyKS6zF6
MD5:	872ECC831BCF8BF2919EF7187AC62D1C
SHA1:	30EF273634C9C86E5BC317F852A8911D197ACF70
SHA-256:	B2EC6F8A8DD3B0D38D2C81F6133CD69A0A560B15F289BE2CEB852316D8B31178
SHA-512:	23233D20B16BC41C7C1B38C94ED72275FEDC9FABBB82484EA4A210858274DDFF7583EFABDBD4845C54DE0785C0F5159715FC772B051FFD0D35570B428450C47D
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//12748ED71E97987E51969D12D77BBEEBB06433E03AEC7E512D10F2B32910B4C7800BCA5330B920F784887E5E23885148BD76917E823FA99921EB3E8FBA709C18++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.4688230129151405
Encrypted:	false
SSDEEP:	24:7rrSOX8BC0Bj5dXEC0BjyKSohckB5+iSr8:um8BC0d5dXEC0dyKSohj0iM8
MD5:	BB59C56DB2112B203176F01540BA19C1
SHA1:	6DC11B8E00216FE2928FA5F513D773906233AB0D
SHA-256:	610DAA025533ECB85A3CB9742C2146EDBC4A59B753E41D75C78BE43057A51211
SHA-512:	93ECA7D80A1C1FDE57FB7AFFCE3F8E71D3BD22AABFF27CC594CC87B4F9FA6CB28507BDE0809AEA58B05DC40BE12735B127DF4313FE6BBB83581A542662EF96FE
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//FE4E8692B6ACD523E8A52AD267020BD32B27F78052F344D621DAF878683548D74C4B5826EF8AA74764F4F83985119BA165ED7B1212CA1A9E100122DF433FF758++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.478222120972604
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLB7OS9VqfY8iyS:7rrSOX8BC0Bj5dXEC0BjyKSc7OzfY8i1
MD5:	8148B34B88B5367B0B0D27C11713FE37
SHA1:	C840B2BCC77E6CBEAAE6BAE5E95436496C0CF8A9
SHA-256:	607A7EB193F77B9856FFC7FA0A584AFBD272FD2FC2AB4605093A2CD5958EB965
SHA-512:	3F70DA8EC5E18FC2B395120241C349BC3722A913A215FEED6F1ED0376B41D0ADD73895BEDB7F7F6B88EEE664B2DD5CD39A4ACCE6AAD1F175A101E5BA09E4C7BC
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//C72AB1F44FF0E7317CF3A63C40C3385222E0CFB77E4B0D06CDB0E3180F349B4F33C9812CEE85B9453786DD1114675419B127BE0C3F6CCA0FB608F5F466953341++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.4666527476313655
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynL5ppr3DF33jB:7rrSOX8BC0Bj5dXEC0BjyKSYdB
MD5:	B9F8F2F22FD42FFAA28A1388F098BF8F
SHA1:	D20D9DB4E7FE7FDEF75C50EAA4E5063CFBFBCF93
SHA-256:	7F60CBF3E246A7D987F67831F254968323C1C243FAFE8C20C0823DABFC005A47
SHA-512:	744048B7B79314727928410FDFEAEEB0172376C44A5F603C452AA10D38CB56FCB28DAFF4468CCB11AE48C1F46232335AD31183EB0B3D678EA950ABE898A75886
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//0BABEC8393ABFB82A84C43F759190E41600DB4795F370878B13F36486FEF8CC9E979363BF4D9D5679D3364C6FE889B429AE19A08B186F0968813F6A56E534CAE++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.437639129023183
Encrypted:	false
SSDEEP:	24:7rrSOX8BC0Bj5dXEC0BjyKSg/QcB2p/4+:um8BC0d5dXEC0dyKSNLv
MD5:	3521B8617F2497173CDEA2C608EBCE79
SHA1:	1B2CEC8CC5FC553B195746643CB65ABFA385BFAB
SHA-256:	253995B18377DF697F155B21B1436B45E2B755CC9EF3904C569CDBFFCA40C790
SHA-512:	261D412B168177D9DDB3A8A98F247738811C08ACB9EB0BEF4F6E02E961895CBFBCBBBABFF0FC8DFB1030397DAB701A240EE9EDB6FBB04DCFD0D4C46928E2CB5F
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//587348052A00EFF6022DAE5EAA3EEC1BD3748E68209E91471E49125D304FB1FBDAE1ED817223AA2B0A85A74DEF861DCC0E161E1E2C1DF4BFD5B24AE67ACFC695++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.472280457591171
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLDn5I3ndm0G0+3RkLX:7rrSOX8BC0Bj5dXEC0BjyKS2sTERkr
MD5:	EDDB82C4C3206EE3AD61604B7D0C1AEF
SHA1:	0B9D5CC2424480F20CE8437EDC7FD6C171F65C08
SHA-256:	5BBC81C6BFDE88B7A23A63AC9138A24CB4C934543DDA91A662BF8D13B4C4D79A
SHA-512:	926FAF735DFC4CCA49896867472646DF519FE995587DB3B94D9F050974FFD7ECE776277DAC7838C5AE7528690611C700DC2A7DA2CF6C245207C1D52A22C1B819
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//C2DB7E45678F5B4C989E5D0B5CF1A76DF7268450AD159735B6BB1F01AF2F90925818BEF97EA8D7D2446AB8FC4D5D4105D3F89D643C188DF964B4A0EA8B65C08B++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.473198819030462
Encrypted:	false
SSDEEP:	24:7rrSOX8BC0Bj5dXEC0BjyKSjlkcfvgRVKc:um8BC0d5dXEC0dyKSjSc35c
MD5:	BAF685FF0C6C5A2FF48E482B6F06535B
SHA1:	9082F40F4D999F79887B18A6A26120FAF9457FDD
SHA-256:	7384E13D41C5BC2CC27264D50FACF1A6ECBF9B976966B36EB1FA051C994064C8
SHA-512:	0BDCF4B96D96C75D3D06ED5C76CF22C066561841A39C9228824149E49911F2FD842D17C4E9BF02C98DFDD54168B6B8F91844FC3DB8387D9C036BC2F83D807449
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//456758CFF398E625FED4ED9998009BAAE2FB51433E43F689F7A8F173E78232F3B41033D633E4A08FA7520F7B93169B8B544161679A714A25E02A3D59D10F3725++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.467933683241321
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynL0MejR4XzSM:7rrSOX8BC0Bj5dXEC0BjyKSV4XzD
MD5:	FF0157CB7CA478ABA29C229DC7FFF2F5
SHA1:	6016116641EE09001AE6C215EA0778DE7F908EF7
SHA-256:	5AA374813101912BF8681265E2B3DFF89C83FF384A402E6388FE118FFD2026D7
SHA-512:	3508618FAFE39023588F03F354AC77B3EAC9102CAE6872D57190926B802724FC2E025FAF39186B177AD505A83E1C9E9CF98D0BC5DAC629BD7D875E500F2CDEF3
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//89443ECFFC69C3950B7E45124F2E1B9CB9543D5FFE09B562BB5FCD8D323562FD5909FBED63340F33ED88865BAE9BC85753CDCE676E815C2AE7EC69FC16D0D940++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.484054657480116
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLvxSN7R5+o2O:7rrSOX8BC0Bj5dXEC0BjyKSXR36O
MD5:	664AB83CA569917EE20048DB7E2ADD33
SHA1:	BE73B09B4B6D22FEF134BBC800B90612C89C2F8C
SHA-256:	5E8995EE749BA3A370C9108DFCECDD1D9CEBB7A78F441E5994E037ABE654F08D
SHA-512:	50F919182F838E93C2E9C9B160B5D9E78D105E32E2C072B3C5574D443291C153289A0A7BED7D59A5F853863DEAAEEF35162562C9AA637E890C61952D53F357A8
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//B0820A251882C93809480740BF887950076CBC76074056EC968A1B35519E8688E2A99831CB5CBFB3EAF844FD035776698FD36DB988F155387F94732B833F431A++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.467854846870318
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLvlVYNQWeQG0A4hhNEU:7rrSOX8BC0Bj5dXEC0BjyKSYVZNsNZ
MD5:	9A8C3FB1C6134B00D85ABB0A3022E867
SHA1:	36E41EB2BB19DA9171D6CD389A7D280E3FC2AA18
SHA-256:	46579E9DE225DCDFAED614BF0741B09888A89089FD71B5C103CF8B8C46614379
SHA-512:	A8D8FCCF56D2D401BA4C91A13E9182E90802AB1C1E8A7414DDF266310B4CCB15294B179A8D4E7DEAED4F136E1BD8E8BE33261D9F695B11D36F666F577983BFC7
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//083A77309DC49B2536060DCBA9B611C37166AF85980A2EDE4686D5AFB2CDC5F2CC074E9B3269EC81B60EF6DF6F674347F5EC041C039CD86C32857C53AA9E68BE++

C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.45628552610538
Encrypted:	false
SSDEEP:	12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLY8cqrn3h:7rrSOX8BC0Bj5dXEC0BjyKSycqbx
MD5:	93BA5421BF2594302976857A390BD5DB
SHA1:	5BDCD1B03227B7555FEDCAF6B4199ABF4DBEB0C1
SHA-256:	6BE4E73AA50737C25C591576CADA00EC21D9AA7F833125254B0F5ADAF0512209
SHA-512:	8426B2D4646C759AD6EBD43EB7C54AB1959E9E5790EB47C30E4802ABCEBB52F3AE9AA661D954BE3318B9E61F3B41F7F42D4CE72FC8A65BE4E8C420D9BF3E1599
Malicious:	false
Reputation:	unknown
Preview:	var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//AB612EB0E93BEDD126B6FA11CB3E439753F759BB3BB4A4F945DD4096E3179EC7D6614FE23D8E6FEBE4FDC8A987349C03B8C73A3203275C4010064A27A1971E11++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5377
Entropy (8bit):	5.641647665637404
Encrypted:	false
SSDEEP:	96:WQVBazY8QxuorbT6roQ/CZwmBrqtXNMDUaGCrW+NlaVy98ZDcT7ek81p:WQvaz3AumireG6HYVygDcTqh1p
MD5:	4907A6CC8D9A389E260E43986E997942
SHA1:	48DECF20FC76CAB37A0565595DCA7972433B75CC
SHA-256:	A4F74FB2DC45ABBAA5A7F7A73196E6C48DEE50F9CC011852B1249144AC4B800C
SHA-512:	A188A6C7BC40C8C87518B153DBF03DEC0FB6B75F28B5E7B657D81FDE9643C92C1EAB3D56EA90149B07989DB0E717C49DEF3B527DD922BA8BC11B33D62FECC4E8
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Prob.h. skenov.n..",.. DL_SCANNING_MESSAGE: "Soubor, kter. chcete st.hnout, pro jistotu skenujeme.",.. DL_BLOCKED: "Zablokovan. stahovan. soubor",.. DL_SCANED: "Skenovan. stahovan. sooubor",.. SS_ON_STATE: "Bezpe.n. vyhled.v.n.",.. SS_FIX_MESSAGE: "V.born.! Tyto zm.ny provedeme p.i p...t.m restartov.n. prohl..e.e.",.. SS_OFF_STATE: "Je vy.adov.na akce.",.. SS_OFF_MESSAGE: "Upozorn.n.! Ka.d. des.t. hled.n. obsahuje nebezpe.n. odkaz.",.. SS_OFF_DIALOG_HEADER: "P.idejte k v.sledk.m hled.n. hodnocen. rizika",.. SS_OFF_DIALOG_CONTENT: "Ov..te bezpe.nost odkazu d..ve, ne. na n.j kliknete.",.. SS_SEARCH_OPTION: "Nastavit slu.bu Bezpe.n. hled.n. jako v.choz. vyhled.va.",.. THREAT_OFF_STATE: "V.straha zabezpe.en.!",.. THREAT_OFF_MESSAGE: "Po..ta. je vystaven hrozb.m, ale m..eme v.m pomoci.",.. AVFW_DIALOG_HEADER: "Antivirus a br.na fire

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5126
Entropy (8bit):	5.339901939683557
Encrypted:	false
SSDEEP:	96:uZb3Bdp2fhG5TrVo8Ybuoo/tFCld/lwrYeCEUVlku/TzmV9S9hSFmUihZL:QCfhwrrYbuoG4Z+VchgmZL
MD5:	ABCC949F3B27EFB5F5D6022BC58B4D30
SHA1:	39B9B69A2DF8986F559B452430B00A19CF720E5A
SHA-256:	FB964FBE9C761ABC20AAC64DDB2C8EABD2A33ACBEB84BAA0B5A7CD61AF13039A
SHA-512:	29323D14E1CA9B5BC0B2F648917348BA2339447B415F5EAB0D7A0F62DBC903A0CDDAA8FABEC35075975C8B27AC75F3323BF07DA2BD7A05C438808F5FC13A1208
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scanner .",.. DL_SCANNING_MESSAGE: "For en sikkerheds skyld scanner vi overf.rslen.",.. DL_BLOCKED: "Download blokeret",.. DL_SCANED: "Download scannet",.. SS_ON_STATE: "Sikker s.gning",.. SS_FIX_MESSAGE: "Fint. Vi foretager disse .ndringer, n.ste gang du genstarter browseren.",.. SS_OFF_STATE: "Der skal udf.res en handling.",.. SS_OFF_MESSAGE: "Advarsel: 1 ud af 10 s.gninger indeholder et farligt link.",.. SS_OFF_DIALOG_HEADER: "F.j risikobed.mmelser til dine s.geresultater",.. SS_OFF_DIALOG_CONTENT: "F. at vide, hvor farligt et link er, f.r du klikker p. det.",.. SS_SEARCH_OPTION: "Brug Sikker s.gning som standards.gemaskine",.. THREAT_OFF_STATE: "Sikkerhedsadvarsel",.. THREAT_OFF_MESSAGE: "Din computer er i fare, men vi kan hj.lpe.",.. AVFW_DIALOG_HEADER: "Antivirussoftwaren og firewallen er ikke sl.et til",.. AVFW_DIALOG_CONTENT: "Ca. 864 millioner stykker personlige oplysning

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5366
Entropy (8bit):	5.333207392444786
Encrypted:	false
SSDEEP:	96:F20O91pUKtemTKjnkGzgUIzeRF9DQ8YMLOeaTkHzp1E9Cm6uUUZJ:F29CKteQKjnkGzwzeRN8hA1EEtBaJ
MD5:	79E48401581302DF0AA154212DCAC69E
SHA1:	400D9750ECC5B20C00BDC5C661DA61DDC3496A9C
SHA-256:	E24A21D80C88AE6DE71B01D02761DF343D88017A4D624700B83D1FB77A28A004
SHA-512:	733E66CC4A3CA0BF52B9D2B3DF04317A90321B5FD00EC0D917B861C72F13C7237904480E5440E8E11AC4D7768FDCBB4D5D828294A52BD9E0DB5D6C89F174C811
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scannen...",.. DL_SCANNING_MESSAGE: "Wir scannen den Download zu Ihrer Sicherheit.",.. DL_BLOCKED: "Download blockiert",.. DL_SCANED: "Download gescannt",.. SS_ON_STATE: "Sichere Suche",.. SS_FIX_MESSAGE: "Sehr gut. Die .nderungen werden .bernommen, sobald Sie Ihren Browser das n.chste Mal starten.",.. SS_OFF_STATE: "Handlungsbedarf!",.. SS_OFF_MESSAGE: "Warnung! In 1 von 10 Suchergebnissen ist ein gef.hrlicher Link enthalten.",.. SS_OFF_DIALOG_HEADER: "Risikobewertung f.r Ihre Suchergebnisse hinzuf.gen",.. SS_OFF_DIALOG_CONTENT: "Erkennen Sie gef.hrliche Links, bevor Sie darauf klicken.",.. SS_SEARCH_OPTION: "Sichere Suche als Standardsuchmaschine festlegen",.. THREAT_OFF_STATE: "Sicherheitswarnung!",.. THREAT_OFF_MESSAGE: "Ihr Computer ist ungesch.tzt, aber wir k.nnen Ihnen helfen.",.. AVFW_DIALOG_HEADER: "Ihr Virenschutz und Ihre Firewall sind deaktiviert",.. AVFW_DIALOG_CONTENT: "Seit

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8385
Entropy (8bit):	4.965396187680861
Encrypted:	false
SSDEEP:	192:BYz3hNXL4xrlON0pOqxptk2xgthUE6wfOhLQva:ULXUlObqTC2xgwmOhcva
MD5:	A8EFEB1C107D9193D0ED0350A2D57D4D
SHA1:	1AFF195231B3518332C0B51B14A57094DF4E07F3
SHA-256:	CAD6A50DFB58CBBAD929E6395FB35B7D6DDB614002EBF791429C8971D43402B6
SHA-512:	BA973F676DEE196775ED3BBD90950E1402551295C2E2C7778716705632D7966A18541762A58622AA8BFCDFA27A24F1E6A07681CB66BF565585D7592312466B07
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: ".........",.. DL_SCANNING_MESSAGE: "......... .. .... ... ... ...... ..........",.. DL_BLOCKED: ". .... ............",.. DL_SCANED: ". .... ........",.. SS_ON_STATE: "....... .........",.. SS_FIX_MESSAGE: "......! ..... .. ....... .. ........... ... ....... .... ... .. .............. .. ......... ...........",.. SS_OFF_STATE: ".......... .........",.. SS_OFF_MESSAGE: ".......! 1 .... 10 ........... ........ .......... .........",.. SS_OFF_DIALOG_HEADER: "........ ............. ........ ... ............ ..........",.. SS_OFF_DIALOG_CONTENT: "...... .... ........... ..... .... .........

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4755
Entropy (8bit):	5.33837511405271
Encrypted:	false
SSDEEP:	96:uU3x9/eMjflrS5xsyoBkXqLB+Qz/Q1wU9pYOosphegh:3x9Jjf2Kkm8GQ1NPjV8O
MD5:	C64AF74760FBAEF0F40E6F4A73DA76E0
SHA1:	629FFF8203F2E48CA77390766238A591CDAEB577
SHA-256:	1048BEF13EAFE85D79231CD443D51D1B890BEFA3FC2C332AF1D0E19596AB6230
SHA-512:	8F7C52109F179A6C6267B43C37D25921A78624C2B6AE52E27E6C3E7DBB5AE8D145CBE49A145816D49E78289BFE805C5E83E8027B409B1B4E6302ED1EE4484C14
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scanning...",.. DL_SCANNING_MESSAGE: "We're scanning your download just to be safe.",.. DL_BLOCKED: "Download blocked",.. DL_SCANED: "Download scanned",.. SS_ON_STATE: "Secure Search",.. SS_FIX_MESSAGE: "Great! We'll make these changes the next time you restart your browser.",.. SS_OFF_STATE: "Action needed!",.. SS_OFF_MESSAGE: "Warning! 1 in 10 searches contain a dangerous link.",.. SS_OFF_DIALOG_HEADER: "Add risk ratings to your search results",.. SS_OFF_DIALOG_CONTENT: "Know how dangerous a link is before you click on it.",.. SS_SEARCH_OPTION: "Make Secure Search my default search engine",.. THREAT_OFF_STATE: "Security Alert!",.. THREAT_OFF_MESSAGE: "Your computer is exposed, but we can help.",.. AVFW_DIALOG_HEADER: "Your anti-virus and firewall are off",.. AVFW_DIALOG_CONTENT: "About 864 million personal data records have been compromised through data breaches since 2005.<br/><br/> Don't browse

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5193
Entropy (8bit):	5.30010006130118
Encrypted:	false
SSDEEP:	96:dRey5rMscODKKai5iihhi6VnRSyLK3yAEK9WOM0CKAXN:dUWr+ODhai5SknRSkNKPM0Vi
MD5:	839E82A59DCA6539F9104EF226AB12B5
SHA1:	531F958928821034D667E56FA40AB8F56D587EE9
SHA-256:	94ADB603E0D02B063CD0854B6B7B4ECC7A99BAE32BA29EB0146492808A7F27CC
SHA-512:	B87A56D7012FFFEDE9D074FB94AA3FB7A0208415426E3ACC08E683E6F2E2BFE5EAC8AAFCAC5EEF8F69406C0F552AB80D80DDC63F54AE16FD319D287E39207428
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Analizando...",.. DL_SCANNING_MESSAGE: "Estamos analizando la descarga por motivos de seguridad.",.. DL_BLOCKED: "Descarga bloqueada",.. DL_SCANED: "Descarga analizada",.. SS_ON_STATE: "B.squeda segura",.. SS_FIX_MESSAGE: ".Genial! Aplicaremos estos cambios la pr.xima vez que reinicie el navegador.",.. SS_OFF_STATE: ".Debe tomar medidas!",.. SS_OFF_MESSAGE: "Advertencia: 1 de cada 10 b.squedas contiene un v.nculo peligroso.",.. SS_OFF_DIALOG_HEADER: "A.ada calificaciones de riesgo a los resultados de sus b.squedas",.. SS_OFF_DIALOG_CONTENT: "Conozca el nivel de peligro de un v.nculo antes de hacer clic en .l.",.. SS_SEARCH_OPTION: "Definir B.squeda segura como motor de b.squeda predeterminado",.. THREAT_OFF_STATE: ".Alerta de seguridad!",.. THREAT_OFF_MESSAGE: "Su equipo est. expuesto a riesgos, pero podemos ayudarle.",.. AVFW_DIALOG_HEADER: "El antivirus y el firewall est.n desactivado

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5216
Entropy (8bit):	5.313902280964203
Encrypted:	false
SSDEEP:	96:zyErLx7VO33aiG/qshhi6VnRfylmDiP2QuyMLii9j0OsKbKk:zXrXO33aiiMknRfyp/Haiitfz2k
MD5:	9049FF294A992AEF9345CAFA6A091F9B
SHA1:	D7DB2B214C26C2BBA3E3D6700E3D7C624EAC640F
SHA-256:	33335130D6AC24CAA2BDC2D559A77E7258C262AB83CB38A57DAF761E742D9774
SHA-512:	00286C6D76F7043A999E5580CE6F4C7A0D5FE1CAC41DF415F0B66FB1A2639FCCE41EEEE8579C055ACEFF06089F582060A030E3D93E35B1ED2D8355BE4DD5988C
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Analizando.",.. DL_SCANNING_MESSAGE: "Estamos analizando la descarga por motivos de seguridad.",.. DL_BLOCKED: "Descarga bloqueada",.. DL_SCANED: "Descarga analizada",.. SS_ON_STATE: "B.squeda segura",.. SS_FIX_MESSAGE: ".Excelente! Aplicaremos estos cambios la pr.xima vez que reinicie el navegador.",.. SS_OFF_STATE: ".Se requiere acci.n!",.. SS_OFF_MESSAGE: ".Advertencia! Una de cada diez b.squedas contiene un v.nculo peligroso.",.. SS_OFF_DIALOG_HEADER: "A.ada calificaciones de riesgo a los resultados de la b.squeda",.. SS_OFF_DIALOG_CONTENT: "Conozca el nivel de peligro de un v.nculo antes de hacer clic en .l.",.. SS_SEARCH_OPTION: "Establezca B.squeda segura como motor de b.squeda predeterminado",.. THREAT_OFF_STATE: ".Alerta de seguridad!",.. THREAT_OFF_MESSAGE: "Tu computadora est. expuesta, pero podemos ayudarte.",.. AVFW_DIALOG_HEADER: "El antivirus y el firewall est.n desac

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4959
Entropy (8bit):	5.310989114654901
Encrypted:	false
SSDEEP:	96:5ZZ4vNUD1ns7pqxqkRKk/eFt+2jiLRQoYWzZ0pu96M1cEC:PZ4vNlq4kRKkGSRcpuw4M
MD5:	6791985A7778CB6DDB716ED5DBFCC87C
SHA1:	8E2ABD344EAE69130A305F607925B0765DF1C1DA
SHA-256:	8EE1B851A66E10AA7282A50D11156D14ED2D4AFB6D835137953169B24247137F
SHA-512:	4C34F09E4613799F4546068066CB55FF3ED6187EC82985C017AC537C5DCCF7C208546FAD4636C51D0938815ADFC03EF3AA7C00326AED1661535C6443D71E88DF
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Tarkistetaan.",.. DL_SCANNING_MESSAGE: "Lataamasi tiedosto tarkistetaan varmuuden vuoksi.",.. DL_BLOCKED: "Lataus estetty",.. DL_SCANED: "Lataus tarkistettu",.. SS_ON_STATE: "Suojattu haku",.. SS_FIX_MESSAGE: "Hienoa! Muutokset tulevat voimaan, kun seuraavan kerran k.ynnist.t selaimen.",.. SS_OFF_STATE: "Toimia vaaditaan!",.. SS_OFF_MESSAGE: "Varoitus! Joka kymmenes haku tuottaa vaarallisen linkin.",.. SS_OFF_DIALOG_HEADER: "Lis.. hakutuloksiin riskiluokitus",.. SS_OFF_DIALOG_CONTENT: "Luokituksen avulla n.et ennen linkin napsauttamista, onko se vaarallinen.",.. SS_SEARCH_OPTION: "Aseta Suojattu haku oletushakukoneeksi",.. THREAT_OFF_STATE: "Tietoturvavaroitus!",.. THREAT_OFF_MESSAGE: "Tietokoneesi on alttiina uhille, mutta voimme auttaa.",.. AVFW_DIALOG_HEADER: "Viruksentorjunta ja palomuuri ovat pois k.yt.st.",.. AVFW_DIALOG_CONTENT: "Noin 864 miljoonaa yksityist. datatietuetta on jout

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5692
Entropy (8bit):	5.305547418395284
Encrypted:	false
SSDEEP:	96:0MxyhGiDkpQQrrENOqplZuFfrYnWv6HScq48Ky6o9Q+W55fTsr:0ZhGVQQrrENOqYIH2V6o/W5g
MD5:	A1435246B2737313DF1A554BF9560796
SHA1:	1B14398A75FA4E6568E8C8FD5730B36E43AEB491
SHA-256:	ECD13B5D66F793747747F2A6D3F5AB7E54F12C70C558F07CFC778915F6D22B0E
SHA-512:	9BCD40400EC3F4FA0AA99E6DCE441A9979111DFF99DBA245D62B0C1FB1C7581D874373E97B2B25FDA05FD0DD70ABF32FD2A2F4AA9E7DE303C873E7095235F820
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Analyse en cours...",.. DL_SCANNING_MESSAGE: "Nous analysons votre t.l.chargement par simple mesure de s.curit..",.. DL_BLOCKED: "T.l.chargement bloqu.",.. DL_SCANED: "T.l.chargement analys.",.. SS_ON_STATE: "Recherche s.curis.e",.. SS_FIX_MESSAGE: "Tr.s bien! Nous appliquerons ces modifications la prochaine fois que vous red.marrerez votre navigateur.",.. SS_OFF_STATE: "Intervention requise!",.. SS_OFF_MESSAGE: "Attention! 1.r.sultat de recherche sur 10 comporte un lien dangereux.",.. SS_OFF_DIALOG_HEADER: "Ajoutez des cotes de risque . vos r.sultats de recherche",.. SS_OFF_DIALOG_CONTENT: "Connaissez le niveau de dangerosit. d'un lien avant de cliquer dessus.",.. SS_SEARCH_OPTION: "Ajoutez Recherche s.curis.e . mon moteur de recherche par d.faut",.. THREAT_OFF_STATE: "Alerte de s.curit.!",.. THREAT_OFF_MESSAGE: "Votre ordinateur est vuln.rable, mais nous pouvons vous aider.",.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5621
Entropy (8bit):	5.3156344705208065
Encrypted:	false
SSDEEP:	96:yp99a4ffmtaCS1mELq47byJXGUmytipUS22d9h+/ijfTEqZ:yXAaCpELq4Fr2c/2it
MD5:	E5B0EA0245FB6CBAAB8C4D3A08C393B0
SHA1:	A31DA25DF14733B0D70226907E71C71CB26A6B49
SHA-256:	9F02BDF4628C45E7ECEB7A5FE8ADBB7F1419A56BC64DABB3A266DC70E8100EB1
SHA-512:	8D0AF6205301C91613A08A5DFB193C5447133EC1EC8FF6CA7FD56C62DB5554CDC4F6B0539F6E232206305ED8CD5921804D229F7563FA8D8B3F3E9216788BD6D2
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Analyse en cours...",.. DL_SCANNING_MESSAGE: "Par pr.caution, nous analysons votre t.l.chargement.",.. DL_BLOCKED: "T.l.chargement bloqu.",.. DL_SCANED: "T.l.chargement analys.",.. SS_ON_STATE: "Recherche s.curis.e",.. SS_FIX_MESSAGE: "Tr.s bien. Nous effectuerons ces modifications au prochain red.marrage de votre navigateur.",.. SS_OFF_STATE: "Mesure . prendre.",.. SS_OFF_MESSAGE: "Attention.! Une recherche sur dix contient un lien dangereux.",.. SS_OFF_DIALOG_HEADER: "Ajouter l'.valuation des risques . vos r.sultats de recherche",.. SS_OFF_DIALOG_CONTENT: "Prenez connaissance du danger que repr.sente un lien avant de cliquer dessus.",.. SS_SEARCH_OPTION: "D.finir la recherche s.curis.e comme moteur de recherche par d.faut",.. THREAT_OFF_STATE: "Alerte de s.curit..!",.. THREAT_OFF_MESSAGE: "Votre ordinateur est expos. aux menaces, mais nous pouvons vous aider.",.. AVFW_DIAL

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5041
Entropy (8bit):	5.412768950482965
Encrypted:	false
SSDEEP:	96:W82DDbczNyMnf3MeFH+JDxk/zay9SIhFO8DF84sSbuoU0zDub9FONkd3V/p5RPo:W34zwMfceFHSDxa1FcZbLONslh5K
MD5:	BF9C06BC82347C4226E83618E45E0ECD
SHA1:	1BB74A3680E9D973B29B99EE482FC5C22FE15D85
SHA-256:	EE84CA9451E450B17F3FF42981F1159304BE13FF4976DC79740DAD6E90C7E577
SHA-512:	4C491DB0FE54FD64CDFE9876AFDBFE49D88F1F9C012ED9AD9644B85ED192AC93AD033D5FFCAC35C0661358526F92803BEAB2F8CBD0DAFE83A32CB8831E02C011
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Pregled...",.. DL_SCANNING_MESSAGE: "Pregledavamo va.e preuzimanje za svaki slu.aj.",.. DL_BLOCKED: "Preuzimanje je blokirano",.. DL_SCANED: "Preuzimanje je pregledano",.. SS_ON_STATE: "Sigurno pretra.ivanje",.. SS_FIX_MESSAGE: "Sjajno! Ove .emo promjene uvesti sljede.i put kada ponovno pokrenete preglednik.",.. SS_OFF_STATE: "Potrebna je akcija!",.. SS_OFF_MESSAGE: "Upozorenje! 1 od 10 pretraga sadr.i opasnu vezu.",.. SS_OFF_DIALOG_HEADER: "Dodajte ocjenu rizika rezultatima pretra.ivanja",.. SS_OFF_DIALOG_CONTENT: "Saznajte koliko je veza opasna prije nego .to kliknete na nju.",.. SS_SEARCH_OPTION: "Postavi Sigurno pretra.ivanje kao zadanu tra.ilicu",.. THREAT_OFF_STATE: "Sigurnosno upozorenje!",.. THREAT_OFF_MESSAGE: "Va.e je ra.unalo izlo.eno, ali mo.emo vam pomo.i.",.. AVFW_DIALOG_HEADER: "Isklju.eni su antivirusna za.tita i vatrozid",.. AVFW_DIALOG_CONTENT: "Oko 864 milijuna z

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5401
Entropy (8bit):	5.530601362994458
Encrypted:	false
SSDEEP:	96:cDlYr1MDbtVqXiZgRRGXtsXPG8sZT15INx7h6X9mwu9Dvymc+cE0AHBN//:hZYHqXiL8y5WzN6gwuBKmzP5Hr/
MD5:	F7502F5266899395B3AB919B9BA50564
SHA1:	58559A24F7030C7CCDD7BDFB878925AE1BE055F9
SHA-256:	8E403D65811F0AF8B86AFD7B61E539920C3D7C4F97CE99E6BC826997E9401F0F
SHA-512:	64E8CC9B193C21A3D0906C5FEB4F3DB02F5C293598D063E7AFDF7434B152412F8A7C0F42DFDD5EA5C6F6A4CAFA39BBA929682D14A27FEBE1FB70434D18096274
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Vizsg.lat...",.. DL_SCANNING_MESSAGE: "Biztons.ga .rdek.ben .tvizsg.ljuk a let.lt.tt f.jlt.",.. DL_BLOCKED: "Blokkolt let.lt.s",.. DL_SCANED: "Megvizsg.lt let.lt.s",.. SS_ON_STATE: "Biztons.gos keres.s",.. SS_FIX_MESSAGE: "Rendben. A b.ng.sz. k.vetkez. .jraind.t.sakor v.grehajtjuk ezeket a m.dos.t.sokat.",.. SS_OFF_STATE: "Beavatkoz.sra van sz.ks.g!",.. SS_OFF_MESSAGE: "Figyelem! Minden tizedik keres.s vesz.lyes hivatkoz.st tartalmaz.",.. SS_OFF_DIALOG_HEADER: "Vesz.lyess.gi besorol.sok megjelen.t.se a keres.si eredm.nyek mellett",.. SS_OFF_DIALOG_CONTENT: "Ismerje meg a hivatkoz.s vesz.lyess.gi besorol.s.t, miel.tt r.kattintana.",.. SS_SEARCH_OPTION: "A biztons.gos keres.s legyen az alap.rtelmezett keres.motor",.. THREAT_OFF_STATE: "Biztons.gi riaszt.s!",.. THREAT_OFF_MESSAGE: "Sz.m.t.g.pe sebezhet., de seg.thet.nk.",.. AVFW_DIALOG_HEADER:

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5110
Entropy (8bit):	5.2259082446153595
Encrypted:	false
SSDEEP:	96:ZDrBAuuEnhYJMxwmH77265IcUNspZPBDNMTix+wwyHTd9H7pmC2eN:drLnhYJ2wmHf2MIcUYQw1HJR74gN
MD5:	9113F8E064FFC5DE68DCE1F9824EF11C
SHA1:	B438C3E5223A6C57B69D5099665FF9950CFB1A6F
SHA-256:	5E702F758B7F5A02763953C4D51ACDF367E62514FFB9214AE414415232307318
SHA-512:	782C20090FFE7C565C826958DC56C708353E0701925D1B6112598C62309A50153C4F02F6A0E8892BD22BEA2AAB05968CFD878A1C81052DF4996E68A4D212082F
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scansione in corso...",.. DL_SCANNING_MESSAGE: "Stiamo eseguendo la scansione dei download per verificare che siano sicuri.",.. DL_BLOCKED: "Download bloccato",.. DL_SCANED: "Download scansionato",.. SS_ON_STATE: "Ricerca sicura",.. SS_FIX_MESSAGE: "Perfetto! Apporteremo queste modifiche al riavvio del browser.",.. SS_OFF_STATE: "Intervento richiesto.",.. SS_OFF_MESSAGE: "Avviso. 1 ricerca su 10 contiene link pericolosi.",.. SS_OFF_DIALOG_HEADER: "Aggiungi le classificazioni dei rischi ai risultati di ricerca",.. SS_OFF_DIALOG_CONTENT: "Conosci la pericolosit. di un link prima di accedervi.",.. SS_SEARCH_OPTION: "Imposta la ricerca sicura come motore di ricerca predefinito",.. THREAT_OFF_STATE: "Avviso di sicurezza.",.. THREAT_OFF_MESSAGE: "Il computer . esposto a rischi, ma possiamo aiutarti.",.. AVFW_DIALOG_HEADER: "Antivirus e firewall sono disattivati",.. AVFW_DIALOG_CONTENT: "Dal 2005, circa

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6573
Entropy (8bit):	5.724191230398909
Encrypted:	false
SSDEEP:	192:NTUsvaiozLJ9h9yY4smsT7h0O71Kw1JFi:esv4J9HyY4smsT7h0O7Pvc
MD5:	95F4F07FCAEFD0F191DB1AF3660F987D
SHA1:	C5233B770A8E6E5B6411E10375AAFB94F9EA4D65
SHA-256:	A2F3D794CE3A032F2C8AB49E937387EDC7B0E62D2C836B02BBBB117C88A5D2EC
SHA-512:	8FA51C644A954B3EF9A3F888DBF874F8B405C5E40ECE3D69A907792F201B0730AC1259856BFBE23E67F086451269BE07E39FB144893BDA7C52CDB58720C9CD1D
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "........",.. DL_SCANNING_MESSAGE: "..................................",.. DL_BLOCKED: ".............",.. DL_SCANED: "............",.. SS_ON_STATE: ".....",.. SS_FIX_MESSAGE: "....................................",.. SS_OFF_STATE: "..........!",.. SS_OFF_MESSAGE: "... 10 .. 1 ......................",.. SS_OFF_DIALOG_HEADER: "...................",.. SS_OFF_DIALOG_CONTENT: "..........................",.. SS_SEARCH_OPTION: ".......................",.. THREAT_OFF_STATE: ".........",

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5497
Entropy (8bit):	5.849839332018994
Encrypted:	false
SSDEEP:	96:A4T4OfEAmKkUvLS/fDa8s9If8LNaSkXLwjk2XEgvR6z0O739OBqKkLHtNqa:Bff7Jk3a8iNaSEKtODYBqKoNNt
MD5:	E867DE3330202FF6383BE8974C1A65E4
SHA1:	E29CE7C32BC63EA538C10BD12C70BE46953B1454
SHA-256:	2B3F3701936D5EF7E201EFF182D226D5711E5808999350DE90FD626BF76CA702
SHA-512:	037D69A7476F786277C278E5632A1E306C50E659EE0F53D51181BCCBDC9625787C4F024DEA20BCDBE34ADB6FC396C6DB79D9B5C0AAC5A3ACDFC982A12F3AA905
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: ".. ....",.. DL_SCANNING_MESSAGE: "... .. ..... .. .....",.. DL_BLOCKED: "... ....",.. DL_SCANED: "... ....",.. SS_ON_STATE: ".. ..",.. SS_FIX_MESSAGE: "....! ..... .. .... .. ... ......",.. SS_OFF_STATE: "... .....!",.. SS_OFF_MESSAGE: "..! .. .. ... ... ... ... .. 1/10....",.. SS_OFF_DIALOG_HEADER: ".. ... .. ... .......",.. SS_OFF_DIALOG_CONTENT: ".... .. ... .... .. .......",.. SS_SEARCH_OPTION: ".. ... .. .. .... ..",.. THREAT_OFF_STATE: ".. .....!",.. THREAT_OFF_MESSAGE: "... .... ...... McAfee. .... . .....",.. AVFW_DIALOG_HEADER: "...... .

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4937
Entropy (8bit):	5.338801804814231
Encrypted:	false
SSDEEP:	96:iith6b8IIs/ySd0vgZwxwud8eWgwbYeCCVKduaN3z559JBhoAsUnxUh/:J36nR1swuD8boN951hvsUnxI
MD5:	D32CD86E9F87A1BA10425730152DDC20
SHA1:	CF0C3540AFCFE3D901B176D24A16DCB209E95B6A
SHA-256:	1F3DDDCA9026492CCEB90483D089B3C7F77C2A24F523CCA7C344D4B1A1ABC07A
SHA-512:	814BD41F897495BB92EE8ECD305839F66727F87EC99934F8E0AA1F905196F0CC3B24D2DC17667D2366126D406175FB8F3F668C9CCCA151900B4C52826C202F68
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Skanner..",.. DL_SCANNING_MESSAGE: "Vi skanner nedlastingen for . v.re p. den sikre siden.",.. DL_BLOCKED: "Nedlasting blokkert",.. DL_SCANED: "Nedlasting skannet",.. SS_ON_STATE: "Sikkert s.k",.. SS_FIX_MESSAGE: "Flott! Vi skal gj.re disse endringene neste gang du starter nettleseren.",.. SS_OFF_STATE: "Handling kreves!",.. SS_OFF_MESSAGE: "Advarsel! 1 av 10 s.k inneholder en farlig kobling.",.. SS_OFF_DIALOG_HEADER: "Legg til risikovurderinger i s.keresultatene",.. SS_OFF_DIALOG_CONTENT: "Vit hvor farlig en kobling er, f.r du klikker p. den.",.. SS_SEARCH_OPTION: "Gj.re Sikkert s.k til standard s.kemotor",.. THREAT_OFF_STATE: "Sikkerhetsvarsel!",.. THREAT_OFF_MESSAGE: "Datamaskinen din er eksponert, men vi kan hjelpe deg.",.. AVFW_DIALOG_HEADER: "Antivirusbeskyttelsen og brannmuren er av",.. AVFW_DIALOG_CONTENT: "Omkring 864 millioner oppf.ringer med personopplysninger har havnet

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5046
Entropy (8bit):	5.304070450754554
Encrypted:	false
SSDEEP:	96:IHFRCH1qpecUFhzJizV+kE1XGwRZYzg0u0Qu2OOkMCJuzXvu9odS+daUmhKS0:IHFRCVqpAFh4zV+kol56Q1EJ2vufCaLc
MD5:	4F2F0235C6B56B0EE2F3B2D0F92C6A54
SHA1:	E51899D9E6214D545AB1491CD96779A4CC1373EF
SHA-256:	0A793BDD3C3B200EDEBFF314381E8ECEB527288676279939AB6266025DF65109
SHA-512:	46A8F092629B3C120FDE2A9AD77EE23D167869C5F183C33D5232ED78FB88B14B0A44E65F3DE87D8C85C935D688A55C4968FBE5008192813DA7410C84F435EA6C
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scannen...",.. DL_SCANNING_MESSAGE: "Uw download wordt voor de veiligheid gescand.",.. DL_BLOCKED: "Download geblokkeerd",.. DL_SCANED: "Download gescand",.. SS_ON_STATE: "Beveiligd zoeken",.. SS_FIX_MESSAGE: "Fantastisch! Deze wijzigingen worden ge.mplementeerd wanneer u uw browser de volgende keer opnieuw start.",.. SS_OFF_STATE: "Actie vereist!",.. SS_OFF_MESSAGE: "Waarschuwing! 1 op de 10 zoekopdrachten bevat een gevaarlijke link.",.. SS_OFF_DIALOG_HEADER: "Voeg risicoclassificaties toe aan uw zoekresultaten",.. SS_OFF_DIALOG_CONTENT: "Weet hoe gevaarlijk een koppeling is voordat u erop klikt.",.. SS_SEARCH_OPTION: "Maak Beveiligd zoeken mijn standaardzoekmachine",.. THREAT_OFF_STATE: "Beveiligingswaarschuwing!",.. THREAT_OFF_MESSAGE: "Uw computer is blootgesteld, maar wij kunnen u helpen.",.. AVFW_DIALOG_HEADER: "Uw antivirus en firewall zijn uitgeschakeld",.. AVFW_DIALOG_CONTENT: "Sinds 2005

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5241
Entropy (8bit):	5.553403468878537
Encrypted:	false
SSDEEP:	96:qUIwsXVPIcXdt1qJZHybN1qfWl9my9bpE3TiYv5YTKSjzxj4dsd9DFsxeei:q1wsXVgcHoZHu2OlqukURj4di5tei
MD5:	BDCBE2B46E0F8E42CB382F92046C8755
SHA1:	D170ADD8DC587CA9D9409028712408DFCA70EC9B
SHA-256:	3850ADDB1FBC970EB24DCC13A3DA4C1E90DE51FE6A78EFE02A227C98F612CFFA
SHA-512:	E10B7038BDC7F321420E31F17284FD22EC29A7E3968204EB5E84F8AE988D40C72C2E9DD700A5ED6D3387E93244E18929FF4476A622A8432478DB0559C2A5D36E
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Skanowanie...",.. DL_SCANNING_MESSAGE: "Na wszelki wypadek skanujemy pobierany plik.",.. DL_BLOCKED: "Pobieranie zablokowane",.. DL_SCANED: "Pobieranie przeskanowane",.. SS_ON_STATE: "Bezpieczne wyszukiwanie",.. SS_FIX_MESSAGE: ".wietnie. Zmiany zostan. wprowadzone po ponownym uruchomieniu przegl.darki.",.. SS_OFF_STATE: "Wymagane dzia.anie.",.. SS_OFF_MESSAGE: "Uwaga! 1 na 10 wyszukiwa. zawiera niebezpieczne ..cze.",.. SS_OFF_DIALOG_HEADER: "Dodaj oceny ..czy w wynikach wyszukiwania.",.. SS_OFF_DIALOG_CONTENT: "Dowiedz si., czy ..cze jest niebezpieczne, zanim je klikniesz.",.. SS_SEARCH_OPTION: "Ustaw Bezpieczne wyszukiwanie jako domy.ln. wyszukiwark.",.. THREAT_OFF_STATE: "Alert zabezpiecze.!",.. THREAT_OFF_MESSAGE: "Komputer jest nara.ony na zagro.enia, ale mo.emy Ci pom.c.",.. AVFW_DIALOG_HEADER: "Antywirus i zapora s. wy..czone.",.. AVFW_DIALOG_CONTENT: "Od 2005 r. bezpi

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5076
Entropy (8bit):	5.345477894463682
Encrypted:	false
SSDEEP:	96:hzqsY64tGeMe1EjJDQYz8VMntBYv4tBg9Wq90Qp:hWnjE7e1iJl44BgD9t
MD5:	C8128AB2639F3C1430F6768D16EF1BBB
SHA1:	74DFE8DEBC898F21DD1E7CB57B4FCB0A2A48F4A7
SHA-256:	AA19F424D66AFEF6469A3239DB13A15968BB6A5ADF57FADC72346F3E395D6F71
SHA-512:	70D92B306E0343F7D70FF418247630910096B9E4ECDA86F62F8B39BD2D21A6292564941E3D778C883AC140012E62C5AD8395F87826A5A9703574D9C0CA195043
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Varrendo...",.. DL_SCANNING_MESSAGE: "Estamos varrendo o seu download apenas por seguran.a.",.. DL_BLOCKED: "Download bloqueado",.. DL_SCANED: "Downloads varridos",.. SS_ON_STATE: "Pesquisa segura",.. SS_FIX_MESSAGE: "Excelente! Implementaremos essas mudan.as na pr.xima vez que voc. reiniciar o navegador.",.. SS_OFF_STATE: "A..o necess.ria!",.. SS_OFF_MESSAGE: "Aviso! 1 em 10 pesquisas cont.m um link perigoso.",.. SS_OFF_DIALOG_HEADER: "Adicione classifica..es de risco aos seus resultados de pesquisa",.. SS_OFF_DIALOG_CONTENT: "Saiba qu.o perigoso . um link antes de clicar.",.. SS_SEARCH_OPTION: "Tornar a Pesquisa segura meu mecanismo de pesquisa padr.o",.. THREAT_OFF_STATE: "Alerta de seguran.a!",.. THREAT_OFF_MESSAGE: "Seu computador est. exposto, mas podemos ajud.-lo.",.. AVFW_DIALOG_HEADER: "Seu antiv.rus e sua firewall est.o desativados",.. AVFW_DIALOG_CONTENT: "Cerca de 864

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5194
Entropy (8bit):	5.339695100553609
Encrypted:	false
SSDEEP:	96:L60E2K+GRZAEbZoyh5Mj+WkfVptFa9GqDXyIf:L6SKhDAmlk+bVLFaXDr
MD5:	54D3163A3DF7B90F2128DECDAEAAD24C
SHA1:	4A7ED30A2EA49F4FCEB5279B7F08C8CE008E453B
SHA-256:	57B2DBE0EE13BFD55BEE986BA1CC88CC28D0490379954156FA6EBE3AFDA9A941
SHA-512:	72A48893AEFDCE823E157EDD8461B5463B313CEE374614489D1562AA2C41769D76E220002E7556212684DBA03C0D0162C2A7A6B7A6DA9A5EB7FD81480CDDE40C
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "A analisar...",.. DL_SCANNING_MESSAGE: "Estamos a analisar a sua transfer.ncia para garantir a m.xima seguran.a.",.. DL_BLOCKED: "Transfer.ncia bloqueada",.. DL_SCANED: "Transfer.ncia analisada",.. SS_ON_STATE: "Pesquisa segura",.. SS_FIX_MESSAGE: ".timo! Aplicaremos esta altera..es quando reiniciar o browser.",.. SS_OFF_STATE: "A..o necess.ria!",.. SS_OFF_MESSAGE: "Aten..o! 1 em cada 10 pesquisas cont.m uma liga..o perigosa.",.. SS_OFF_DIALOG_HEADER: "Adicione classifica..es de risco aos seus resultados de pesquisa",.. SS_OFF_DIALOG_CONTENT: "Conhe.a o n.vel de perigo de uma liga..o antes de clicar.",.. SS_SEARCH_OPTION: "Tornar a Pesquisa Segura o meu motor de pesquisa predefinido",.. THREAT_OFF_STATE: "Alerta de seguran.a!",.. THREAT_OFF_MESSAGE: "O seu computador est. desprotegido, mas podemos ajudar.",.. AVFW_DIALOG_HEADER: "O seu antiv.rus e firewall est.o desativados",

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7499
Entropy (8bit):	4.998188336397494
Encrypted:	false
SSDEEP:	192:J8/c1QuytDV2s488V+TtWHkWUIU9RyVXM:J8/c1Qu+DwgWlUf9AV8
MD5:	4519FA0D609964498B3ACE9EBBEB62AE
SHA1:	E131EB5EDCA9144868E79D0DAC56297281D3724C
SHA-256:	AE356B2B740F9D603B8F199756156B83FE8C3D2DA947AB4812923E249BFB82CD
SHA-512:	1F37B0AE14475BCDEF283187C6E58E7E5DF4EDE8AAA3A22BEFE6A1F2A6930814E8D0624B7797306EFE715E25765C2F74464B75577DF0FB035C05D3CBA1950254
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "...........",.. DL_SCANNING_MESSAGE: "........... ............ .........",.. DL_BLOCKED: "............. ........:",.. DL_SCANED: "......... ........:",.. SS_ON_STATE: ".......... .....",.. SS_FIX_MESSAGE: ".......! ......... ..... ....... ... ......... ........... .........",.. SS_OFF_STATE: "......... ........!",.. SS_OFF_MESSAGE: "......... . ........... ....... ........ ...... .... ....... .......",.. SS_OFF_DIALOG_HEADER: "........ ....... ..... . .......... ......",.. SS_OFF_DIALOG_CONTENT: "..... ......... .. ...... ......., ......... ... .......",.. SS_SEARCH_OPTION: "....... ........

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5398
Entropy (8bit):	5.643322055021691
Encrypted:	false
SSDEEP:	96:jTm1b9h9okCKuoXx9byC6n+Ih6hXV7ILNadt6rDSczFk9HVXrSQ:jTob/9SKuqbyC6nYhScSicBk5BSQ
MD5:	21AE9DD870D0395CDF679CC778C7406B
SHA1:	077DFBEBE42D14A825AD4CC9368575B0EA44B8A4
SHA-256:	B9D8D83C1BEAB63134289FCCC7F129D8EAD78D928E2FDE9A655057A56C552B3F
SHA-512:	8961A01FF1FE2AF16942A4C08BADE209393BFB55048750756BE2E333D29B79991E8B193C51DE65468D3A119866B2655B24EE7ABC36A376F0A801CECB41E5E40B
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Kontroluje sa...",.. DL_SCANNING_MESSAGE: "Stiahnut. s.bor sa kontroluje, len pre istotu.",.. DL_BLOCKED: "S.ahovan. s.bor bol zablokovan.",.. DL_SCANED: "S.ahovan. s.bor bol skontrolovan.",.. SS_ON_STATE: "Zabezpe.en. vyh.ad.vanie",.. SS_FIX_MESSAGE: "Skvel.! Zmeny sa uskuto.nia pri najbli..om re.tartovan. prehliada.a.",.. SS_OFF_STATE: "Treba kona.!",.. SS_OFF_MESSAGE: "Upozornenie: 1 z 10 vyh.ad.van. obsahuje nebezpe.n. odkaz.",.. SS_OFF_DIALOG_HEADER: "Pridanie hodnoten. rizika k v.sledkom vyh.ad.vania",.. SS_OFF_DIALOG_CONTENT: "Sk.r ne. kliknete na prepojenie, mali by ste vedie., .i je nebezpe.n..",.. SS_SEARCH_OPTION: "Nastavi. slu.bu Zabezpe.en. vyh.ad.vanie ako predvolen. vyh.ad.vac. n.stroj",.. THREAT_OFF_STATE: "Upozornenie zabezpe.enia:",.. THREAT_OFF_MESSAGE: "V.. po..ta. je v.ohrozen., ale m..eme v.m pom.c..",.. AVFW_DIALOG_HEA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5115
Entropy (8bit):	5.424447298391993
Encrypted:	false
SSDEEP:	96:a7um49Rmkzg/G5dK+J8tkaUnSlBS2DFA4s+roJGEUuzvYb9NKNvt3w/yhD:3VNzgOWS8ttFFV/b3KNlgqhD
MD5:	23D1E57C5E6801C3A395E8FE822B3EA1
SHA1:	8A7B2D19DFECE3B147AC66F12D38E71B1143E41F
SHA-256:	10C985EFB183280E09884C0CF075FB5EC9AEEC43150C5D5ECD82B9DC50AE57C7
SHA-512:	3121BA113C7CDF72270A79BF86FF30CFDE9661086C7E329519B5D2AC6EE385DC467EE83B464519902D8E22B8E51F7792ED55834521EE9558AC101568509F80F1
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Skeniranje...",.. DL_SCANNING_MESSAGE: "Skeniramo preuzeti sadr.aj radi va.e bezbednosti.",.. DL_BLOCKED: "Blokirano preuzimanje",.. DL_SCANED: "skeniranje preuzimanja",.. SS_ON_STATE: "Bezbedna pretraga",.. SS_FIX_MESSAGE: "Odli.no! Ove izmene .e biti unete kada slede.i put pokrenete pregleda..",.. SS_OFF_STATE: "Potrebno je preduzeti odre.ene korake!",.. SS_OFF_MESSAGE: "Upozorenje! Svaka deseta pretraga sadr.i opasnu vezu.",.. SS_OFF_DIALOG_HEADER: "Dodajte ocene rizika u rezultate pretrage",.. SS_OFF_DIALOG_CONTENT: "Saznajte koliko je neka veza opasna pre nego .to kliknete na nju.",.. SS_SEARCH_OPTION: ".elim da bezbedna pretraga bude moj podrazumevani pretra.iva.",.. THREAT_OFF_STATE: "Bezbednosno upozorenje!",.. THREAT_OFF_MESSAGE: "Va. ra.unar je izlo.en pretnjama, ali mi vam mo.emo pomo.i.",.. AVFW_DIALOG_HEADER: "Antivirusni program i za.titni zid su isklju.eni",.. AVFW

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4882
Entropy (8bit):	5.407373336741728
Encrypted:	false
SSDEEP:	96:fl+hIZSmigy7tw5va0ZPYVhH9lSIkMKJU9xIGRQtVRTE:d+hIZC7twtn8HQJJUQGRITE
MD5:	37847F32CB29BA0E0979E7064E0C011D
SHA1:	F3E9AB1006A8C2CE39647D7924254CD0DB314E58
SHA-256:	8B0CFC737B5DF8A6229093D0DD8A442267C56DD2A7E9860B6C5A6A5D2B52F3E1
SHA-512:	729B4F0EBB22CBE34859BF5CFAF8433369385AE3DD4E6318735B04E2D96E2A9769066B3EF1248B648D4DF03035ED013A03F62B84177624A2F16B6F8C6C788B57
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Genoms.ker...",.. DL_SCANNING_MESSAGE: "Vi genoms.ker h.mtningen f.r s.kerhets skull.",.. DL_BLOCKED: "H.mtning blockerad",.. DL_SCANED: "H.mtning genoms.kt",.. SS_ON_STATE: "S.ker s.kning",.. SS_FIX_MESSAGE: "Perfekt. Vi utf.r .ndringarna n.sta g.ng du startar om din webbl.sare.",.. SS_OFF_STATE: ".tg.rd kr.vs!",.. SS_OFF_MESSAGE: "Varning! 1 av 10 s.kningar inneh.ller en farlig l.nk.",.. SS_OFF_DIALOG_HEADER: "L.gg till riskklassificering i dina s.kresultat",.. SS_OFF_DIALOG_CONTENT: "Du f.r veta hur farlig en l.nk .r innan du klickar p. den.",.. SS_SEARCH_OPTION: "V.lj S.ker s.kning som standardalternativ f.r s.kmotorer",.. THREAT_OFF_STATE: "S.kerhetsvarning!",.. THREAT_OFF_MESSAGE: "Datorn .r utsatt f.r risk, men vi kan hj.lpa till.",.. AVFW_DIALOG_HEADER: "Antivirus och brandv.ggen .r inaktiverade",.. AVFW_DIALOG_CONTENT: "Cirka 864 miljoner personliga da

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5273
Entropy (8bit):	5.491521575119149
Encrypted:	false
SSDEEP:	96:THxCtJRQDY8NoBGZOpo/n2ovqXm/IwjfdZ1zT4x9hEKHCnAzvwy:7xCtANoBGnR/TdZJ4xEsvd
MD5:	CA8D764BC6C0C0E7213CCDC0D64B7586
SHA1:	34015112D0FDD49C2D0FDAA3D21F84BD0BA243DF
SHA-256:	8AD9D5E386269FADC001AAFD2D640711ACFAE912CA4B213F66C2CA2BA7903670
SHA-512:	424FF71D902737B654527F0788F0ECE4220022D19505B4E8EA8B25ACB7A3F6C8BFD18047F86F01E57A8FB5C1E999CC1FCDBFA9CDDB088202A2BCF565CCBE51FE
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: "Taran.yor...",.. DL_SCANNING_MESSAGE: "Her ihtimale kar.. indirmenizi tar.yoruz.",.. DL_BLOCKED: ".ndirme engellendi",.. DL_SCANED: ".ndirme tarand.",.. SS_ON_STATE: "G.venli Arama",.. SS_FIX_MESSAGE: "Harika! Taray.c.y. bir sonraki sefer ba.latt...n.zda bu de.i.iklikleri uygulayaca..z.",.. SS_OFF_STATE: "Eylem gerekli!",.. SS_OFF_MESSAGE: "Dikkat! 10 aramadan biri tehlikeli ba.lant. i.erir.",.. SS_OFF_DIALOG_HEADER: "Arama sonu.lar.n.za risk de.erlendirmeleri ekleyin",.. SS_OFF_DIALOG_CONTENT: "T.klamadan .nce bir ba.lant.n.n ne kadar tehlikeli oldu.unu bilin.",.. SS_SEARCH_OPTION: "G.venli Arama'y. varsay.lan arama motorum yap",.. THREAT_OFF_STATE: "G.venlik Uyar.s.!",.. THREAT_OFF_MESSAGE: "Bilgisayar.n.z savunmas.z ancak size yard.mc. olabiliriz.",.. AVFW_DIALOG_HEADER: "Vir.sten koruma ve g.venlik duvar. kapal.",.. AVFW_DIALOG_CONTENT: "2005'ten

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4673
Entropy (8bit):	6.274707877991155
Encrypted:	false
SSDEEP:	96:THIWI0hyh/2vKsPMP0VIQUuGOPpBM9Yc81vzNVv:T5Qh/Yq9joBMGz1pZ
MD5:	EEBBD5F74D8CD14AF8A7E8E331718D33
SHA1:	357203402B62970B06EBBEA35E81DA1B7BD57A03
SHA-256:	580EF1F4FBF83671178D5BFFF3EB02B917378BDCCD39EF53BD23E7121E0BC882
SHA-512:	2170E6F3EB1CA7F0581208F994593E902B1BF4C0731B308CE1AA1FA2BD8B94A1A795D55637535959CFA20B30EE925F11A336AA7E280E0C3D0D326DB37E2AA3CF
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: ".......",.. DL_SCANNING_MESSAGE: "..................",.. DL_BLOCKED: "......",.. DL_SCANED: "......",.. SS_ON_STATE: "....",.. SS_FIX_MESSAGE: "...! ....................",.. SS_OFF_STATE: "....!",.. SS_OFF_MESSAGE: "...1/10 ............",.. SS_OFF_DIALOG_HEADER: "...........",.. SS_OFF_DIALOG_CONTENT: "...................",.. SS_SEARCH_OPTION: ".............",.. THREAT_OFF_STATE: ".....",.. THREAT_OFF_MESSAGE: "...................",.. AVFW_DIALOG_HEADER: "............",.. AVFW_DIALOG_CONTENT: ". 2005 ....... 8.64 ..................<br/

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4704
Entropy (8bit):	6.283296298210526
Encrypted:	false
SSDEEP:	96:+54tUIE58+sUHLz4111bAmwqkFvHOVJXBxC7RP9LX9Qom/6tYXi:+utkVAdAm8uf0X6/StCi
MD5:	A212B894B297E2D84BFEB9919E972DCD
SHA1:	A0BB17299A6441B9673F5F4B89F081CCDB427B23
SHA-256:	9DA285DBCD3BB6D4B3124CD71D4B9E89AAE497114E1D8F548E1072FAC41D0C47
SHA-512:	CD3B7E4CFD7234F4293E5B4FA537EC659CB067EC88EFFF7EFC34A816E12D42AB07299BD92CBC3C173CD2669C87DA473E6E7FFDB39F37FCCB560999FD9EB4869A
Malicious:	false
Reputation:	unknown
Preview:	var _lrCheckList_ = {.. DL_SCANNING_STATE: ".......",.. DL_SCANNING_MESSAGE: "..............",.. DL_BLOCKED: ".....",.. DL_SCANED: ".....",.. SS_ON_STATE: "....",.. SS_FIX_MESSAGE: ".......................",.. SS_OFF_STATE: ".....",.. SS_OFF_MESSAGE: "...10 ..... 1 ........",.. SS_OFF_DIALOG_HEADER: ".............",.. SS_OFF_DIALOG_CONTENT: "..................",.. SS_SEARCH_OPTION: "...............",.. THREAT_OFF_STATE: "......",.. THREAT_OFF_MESSAGE: "...................",.. AVFW_DIALOG_HEADER: "...........",.. AVFW_DIALOG_CONTENT: ". 2005 ...... 8 . 6 . 4 ...................

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	5.73579018012565
Encrypted:	false
SSDEEP:	24:7HTt2GGq0IQDhhlGGqg4o1GGGqUdVkrN0/Fq9eA0dmUNsmagG8gP:w3q0Fhl3qg71G3qUvkrNeq9f0dmUNs7n
MD5:	B9350CD4143A11CA939B4336E9F7F7CA
SHA1:	977C8812B64AC6F2BE3DEA06E04CED72404131B7
SHA-256:	8F68CBF6D79664180AC7F018D7F3CEF867324A55C1195CF3455168AD0D4E6A99
SHA-512:	6A530392193BF5A2FEF0C4089F1F99E2B69850A180DD18F4DDB2D5146B00BB04FFF00B55F468C73EEE67ACEE3DD8893BF42315DCEB25C74E58EB355BDA60534A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Z.skejte bezplatnou ochranu p.i proch.zen. internetu od spole.nosti McAfee kliknut.m na mo.nost {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Povolit roz...en.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "Pomoc. mo.nosti {0} zapnete tyto funkce vy... ochrany: Bezpe.n. hled.n. McAfee., Blokov.n. reklam a Blokov.n. sledov.n..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Povolit roz...en.",.. ADBLOCK_SEARCH_WARNING_CONTENT: "Pomoc. mo.nosti {0} budete d.le chr.n.ni online d.ky t.mto funkc.m vy... ochrany: Bezpe.n. hled.n. McAfee., Blokov.n. reklam a Blokov.n. sledov.n..",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Ponechat zm.ny",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "Pomoc. mo.nosti {0} programu McAfee. WebAdvisor zapnete tyto funkce vy... ochrany: Bezpe.n. hled.n. McAfee., Blokov.n. reklam a Blokov.n. sledov.n..",.. ADBLOCK_PERMISSION_ADDED_CONT

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1414
Entropy (8bit):	5.535728885027179
Encrypted:	false
SSDEEP:	24:7HTEz6tBWYCISc5ciWzCISNOFBWYCISrrVpz92w56WYaFFcTU6GG:U4nCISc5cvCISNOFnCISrxRmWnFhS
MD5:	5EE8C3C305D4913F1192DBCF6D661D7A
SHA1:	7C01430241E1C549238CE8B62DEF2BDEE9457FF1
SHA-256:	EFBB8AA78F9F3CEA7ABA0E42B139BFBB65E6FC08D29B1F70E09BD816469DA1FE
SHA-512:	F76E3E53DAF8A2F6DBD5AA783F12550C5D910021EA406F97138A2BD71B6D916EAD5C67A59CF36030DC4BD7CD2FC561278E490F12D7CCE2B0FB387D3C90FE0F20
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Hent den gratis webbeskyttelse fra McAfee ved at klikke p. {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktiv.r udvidelse",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} for at sl. disse ekstra sikkerhedsfunktioner fra McAfee. til: sikker s.gning, blokering af reklamer og blokering af sporingsfiler.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktiv.r udvidelse",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} for fortsat at v.re beskyttet online med disse ekstra sikkerhedsfunktioner fra McAfee.: sikker s.gning, blokering af reklamer og blokering af sporingsfiler.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Behold .ndringer",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor for at sl. disse ekstra sikkerhedsfunktioner fra McAfee. til: sikker s.gning, blokering af reklamer og blokering af sporingsfiler.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Tillad",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Ak

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.531276701871135
Encrypted:	false
SSDEEP:	24:7HTjZ+CqIYh/aCCqIYVdQvTMzTIAc7HQmKnCqIY4DMEIWljVRmRF:zZ+lxVlxVebMzTEQmKnlx4DO+JURF
MD5:	780769B29D2D4A294E42D29774A7592F
SHA1:	641506E186463122F055E1F16DFC282EFBB895AE
SHA-256:	5DD61A8ECB1FA3443D40E7AD5A8CDC31B0E7C93305D324EA3CE05AFE5D6ABFA5
SHA-512:	59C95092A1A77697A536268895705F7AD141939CAEC7A386A49CEB35154560299B4D0E644F02F44413DA0394E618FCE37306C31CDAD15921D7C63381E5692226
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Nutzen Sie den kostenlosen Web-Schutz von McAfee, indem Sie auf "{0}" klicken.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Erweiterung aktivieren",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "Klicken Sie auf "{0}", um die folgenden Funktionen des zus.tzlichen Schutzes zu nutzen: McAfee. Sichere Suche, Ad-Blockierung und Tracker-Blockierung.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Erweiterung aktivieren",.. ADBLOCK_SEARCH_WARNING_CONTENT: "Klicken Sie auf "{0}", um weiterhin mit den folgenden Funktionen des zus.tzlichen Schutzes online gesch.tzt zu bleiben: McAfee. Sichere Suche, Ad-Blockierung und Tracker-Blockierung.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: ".nderungen beibehalten",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "Klicken Sie f.r McAfee. WebAdvisor auf "{0}", um die folgenden Funktionen des zus.tzlichen Schutzes zu aktivieren: McAfee. Sichere Suche, Ad-Blockierung und Tracker-Blockierung.",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2138
Entropy (8bit):	5.217106004209873
Encrypted:	false
SSDEEP:	24:7HTYCoYrWTMeJ3P/oYeITMeJ3Pq2dnzgWTMeJ3P+PPvKoYC0EDdX0y2wyiKX3w48:TWRpEIRpq2dzgWRp+Pt0EDdZMX8
MD5:	7C811EEF90BE62C1372F9B6D5C9C79E3
SHA1:	A9D44321A6E2782F8F081B9BB38CFEFEA374B23B
SHA-256:	D232EE84B69B1F936742470A4627B4D4EDA72B5C2D9C33547C6F106C31C40DCD
SHA-512:	6B4721F2A4488EB723833520EE9A83C14EBF3D061A69437B6BD3C76A62DD4F5F85217CEF439A112A03FB4D6B6B4023B18C8FAF8C8DD664CE5064137FBD529A08
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "......... ...... ......... ... .. McAfee ........ .... ... {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "............ .........",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} ... .. .............. ..... ... ........... ......... ..........: ....... ........., ........... ........... ... ........... .......... ... McAfee..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "............ .........",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} ... .. ........... ........ online .. ..... ... ........... ......... ..........: ....... ........., ........... ........... ... ........... .......... ...

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1249
Entropy (8bit):	5.475466071763099
Encrypted:	false
SSDEEP:	24:7HTBv4lHkVKlHNEAkulHrRH/T5fLU3XxTL:V4lHkVKlHNpkulHrRH/hUxTL
MD5:	45AB7513DE22E7BF777F54BF5DAA1D5A
SHA1:	E773CF7D8D7ECD68DA6F801E3C717607D42488E3
SHA-256:	F7D3FEA1A54E02D2819779BD5C744EA593DF1C4922359611F19981D363B3C961
SHA-512:	01D81EEF7FDB584D7AE632B880FD2DD643C15B9003A9A762496E678DA0DC6324E3FBA171282918D80F15923D39A4FCE3013B621183BBB5B636CC1EBA9BEBE110
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Get your free web protection from McAfee by clicking {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Enable extension",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} to turn on these Added Protection features: McAfee. Secure Search, Ad Blocker and Tracker Blocker.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Enable extension",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} to continue staying safe online with these Added Protection features: McAfee. Secure Search, Ad Blocker and Tracker Blocker.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Keep changes",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor to turn on these Added Protection features: McAfee. Secure Search, Ad Blocker and Tracker Blocker.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Allow",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Enable extension",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "to finish setting up WebAdvisor.",.. CHROME_ENABLEMENT_GUIDE_C

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	5.4842748555333385
Encrypted:	false
SSDEEP:	24:7HT81my6MaXBldRzVenBldR+MQOAz/HQ2BldRiud91QHIc0x81mHIy4YzgtBpxb:M1m/MaRlXVeBlKMQOAz/HZleudEr0O1n
MD5:	10C64A2D24DD2762BC54D27747C91B2A
SHA1:	4CA6C8D029251F07A7E154898CE96D0D5F258928
SHA-256:	0DE43E89236A63EFF98D360DC674B0A4D0CA553723B9C6A8EB35EDF774BC6B39
SHA-512:	CE52479A2C742C9648E95D2D75AE4E7B85E040B807A135A0B84E91051235A2A29E22227591B5C813D55B9A8FF5EDB4D22C040E621E99372E555E745BF09CB6CC
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Disfrute de la protecci.n web gratuita de McAfee haciendo clic en {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Habilitar extensi.n",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} para activar estas funciones de Protecci.n a.adida: B.squeda segura, Bloqueador de anuncios y Bloqueador de rastreadores de McAfee..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Habilitar extensi.n",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} para seguir estando protegido en Internet con estas funciones de Protecci.n a.adida: B.squeda segura, Bloqueador de anuncios y Bloqueador de rastreadores de McAfee..",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Conservar cambios",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} WebAdvisor de McAfee. para activar estas funciones de Protecci.n a.adida: B.squeda segura, Bloqueador de anuncios y Bloqueador de rastreadores de McAfee..",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Permitir",.. CHR

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	5.489369059184306
Encrypted:	false
SSDEEP:	24:7HTBWmy6caQmDdJVe9mDdsMQOAzdmDdQ0a0yLh1mHiRiNRPD3sLO:Em/caQs/Ve9s6MQOAzdsuPRLh1mHVNRf
MD5:	65643821443DFC716EE783319FCB4B10
SHA1:	8DE147EDAD27F8F596533A1EF3CB398A6E9BF153
SHA-256:	241ED6E6626F3E39E0911461C472E5D160C5716048EAD05198F887B21F290347
SHA-512:	489D92FD3677E5028D133B5228732719CBC75C2D6A1F4073C085C1851CB2D5E7F31F2C7E0079129A10EBCCFE4893B7A816FE08E33F15A511E60578A4CCBD4544
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Obtenga su protecci.n web gratuita de McAfee haciendo clic en {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activar extensi.n",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} para habilitar estas funciones de Protecci.n Adicional: B.squeda segura de McAfee., Bloqueador de anuncios y Bloqueador de rastreadores.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activar extensi.n",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} para continuar seguro en l.nea con estas funciones de Protecci.n Adicional: B.squeda segura de McAfee., Bloqueador de anuncios y Bloqueador de rastreadores.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Conservar cambios",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor para habilitar estas funciones de Protecci.n Adicional: B.squeda segura de McAfee., Bloqueador de anuncios y Bloqueador de rastreadores.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Permitir",.. CHROME_ENABLEMENT

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.527092072237777
Encrypted:	false
SSDEEP:	24:7HTigoQ6AHPXTSgVCPP3TOcJ9PgTKTSzogH07RQuzSZCsQJwzi+zMKZO:PZtXbVQ3qcJt3+zVUVXXN2m+NO
MD5:	48EB26DB3C75A7E90D9BA8D27EE99B1B
SHA1:	6DF05E52A6940199C1B605EE4D1A2DE464B3FE93
SHA-256:	B8ED498A1B7A7480BD5ACBA66B48C6BA5E2D42FF6893CF3ECC5E818E5D46B177
SHA-512:	50DE7A4DA7B432C2558C985B31C53E3C14527B68D7F92FA4C96B086210FB00C49646321BAA96A49BE9DA6BB2E732D3C8E205FCF47B863985BAFAC1BD3411CF5D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Hanki McAfeen verkkosuojaus maksutta napsauttamalla {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ota laajennus k.ytt..n",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}, jotta voit k.ytt.. n.it. lis.suojausominaisuuksia: McAfeen. suojattu haku, mainosten esto ja seurannan esto.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ota laajennus k.ytt..n",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}, jotta pysyt jatkossakin turvassa verkossa n.ill. lis.suojausominaisuuksilla: McAfeen. suojattu haku, mainosten esto ja seurannan esto.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "S.ilyt. muutokset",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0}, ett. McAfee. WebAdvisor ottaa n.m. lis.suojausominaisuudet k.ytt..n: McAfeen. suojattu haku, mainosten esto ja seurannan esto.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Salli",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Ota laajennus k.ytt..n",.. CHROME_ENABLEMENT_

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	5.482993460723332
Encrypted:	false
SSDEEP:	24:7HTBU39MC7soZ8JyVt0oZ8JVuh6oZ8JTm6Tb41mgEyKUXznoUPN:S7BasV3aT6HahmKU1PnDoUPN
MD5:	080EE4CBF54D56B59FB1BD0B929926C4
SHA1:	EC000084EE2917267D4879E808F8586D7316A42E
SHA-256:	0EAFA34B72C8E39228AFB1EBA4A9DE498CB964CA40049DD0C57D6934CADFD4F6
SHA-512:	5E6E64E5E518D2477C16EE11D81A8F26CF3BF0E02FBFDF0404E28603C19C914C5080497DEEA947EB7A89FC618B4E410287CBCFFBDE06DF7C85B9B0F3F9140973
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Obtenez votre protection Web gratuite de McAfee en cliquant sur {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activer l'extension",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} pour activer ces fonctions de protection accrue: recherche s.curis.e McAfee., Bloqueur de publicit. et Bloqueur de localisateur.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activer l'extension",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} pour continuer . .voluer en ligne en toute s.curit. gr.ce . ces fonctions de protection accrue: recherche s.curis.e McAfee., Bloqueur de publicit. et Bloqueur de localisateur.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Maintenir les changements",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor pour activer ces fonctions de protection accrue: recherche s.curis.e McAfee., Bloqueur de publicit. et Bloqueur de localisateur.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Autoriser

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	5.515796144361116
Encrypted:	false
SSDEEP:	24:7HTCKMC7mZ8yHVt2ZGNZ8ysMQu0Z8yQjSFbV+bzFtWrsIXnRS:yq7ma0VwSa7MQu0apeFMpmhM
MD5:	C3B83F57C5DB793F62179CFE863652D9
SHA1:	F98A26E85363AF4270C91221E11670401C24EB72
SHA-256:	029ECAE2C857E16E66B2D03044F35FA9CF077ED773EC55D194721B7C87759C09
SHA-512:	608C11C7C9F59CCDF72BAA749F398A1AFD4CC6836C1446E1A9BB5844032B4754490F05F562352DD8B86FB1224C1938AC84B2A5CEDDA828ED256534FAADBD303D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "B.n.ficiez de la protection web gratuite de McAfee en cliquant sur {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activer l'extension",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} pour activer ces fonctionnalit.s de Protection renforc.e.: Recherche s.curis.e McAfee., Bloqueur de publicit.s et Bloqueur de trackers.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activer l'extension",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} pour continuer . .tre prot.g. en ligne avec ces fonctionnalit.s de Protection renforc.e.: Recherche s.curis.e McAfee., Bloqueur de publicit.s et Bloqueur de trackers.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Conserver les modifications",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor pour activer ces fonctionnalit.s de Protection renforc.e.: Recherche s.curis.e McAfee., Bloqueur de publicit.s et Bloqueur de trackers.",.. ADBLOCK_PERMISSION_ADDED_CONTENT

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1402
Entropy (8bit):	5.617957341369353
Encrypted:	false
SSDEEP:	24:7HThh5mCPPDSIuREwP3ycRCCPPDmetuqELFbiFKwu:Rh5mCPPDSI6xP3ycRCCPPDm6pELFOFKP
MD5:	45FF7A82FC7AB39C9F05998D651E3F0D
SHA1:	452F0735A200E27254251E740963BB794BA65F26
SHA-256:	4651A05474899F22C51FFDBD7272A63B9E095EE1D1BD77467F8F103DB7F6AFCA
SHA-512:	E65978795D1FCE8778B6DB9C8DDD5A45F0ED4BF54FC2DCB469542AB94BF7AD9578A25C66C2257697EBCBD55ECAA0387213F2AEFD17C5D4AB063528BA5960E73C
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Dobijte svoju besplatnu web za.titu od McAfee-a klikom na {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Omogu.i pro.irenje",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} da biste uklju.ili ove funkcije za dodatnu za.titu: McAfee. Sigurna pretraga, Blokada oglasa i blokada alata za pra.enje.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Omogu.i pro.irenje",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} kako biste nastavili biti sigurni na mre.i s ovim dodatnim zna.ajkama za.tite: McAfee. Sigurna pretraga, Blokada oglasa i blokadu alata za pra.enje.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Spremi promjene",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. da biste uklju.ili ove funkcije za dodatnu za.titu: McAfee. Sigurna pretraga, Blokada oglasa i blokada alata za pra.enje.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Odobri",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Omogu.i pro.irenje",.. CHROME_E

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1518
Entropy (8bit):	5.690876771225287
Encrypted:	false
SSDEEP:	24:7HTt3WD/Pwd03L7mtPsJePwd0kYGc8hQwde/WCpeT4zAsjWNl25oBKodn:5EP20bStUwP20kYGcIQ2e/JYeAsyC5o3
MD5:	34B510FA2617AA7C2D4DB39E727A25EE
SHA1:	4540482C8911FBB317AB27A7557F714838CE1DB5
SHA-256:	12A2D8E80634E3935E95CB72AE5DDB5273D1BC222CCD7E87E9817064E40A259F
SHA-512:	E29D2D792299050A5AC3E373795FBE4552CC9114C2116993DA9BF8F28392E96BEB02EF07099A2426FB2AC4365605D9CF805C703F8517185789DB322EA82766D0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "A McAfee ingyenes webes v.delm.nek ig.nybe v.tel.hez kattintson a(z) {0} elemre.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "B.v.tm.ny enged.lyez.se",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} a tov.bbi v.delmi funkci.k, a McAfee. biztons.gos keres.s, a hirdet.sblokkol.s .s a k.vet.blokkol.s bekapcsol.s.hoz.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Enged.lyezze a b.v.tm.nyt",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}, hogy tov.bbra is biztons.gban legyen online a tov.bbi v.delmi funkci.k, a McAfee. biztons.gos keres.s, a hirdet.sblokkol.s .s a k.vet.blokkol.s r.v.n.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: ".rizze meg a m.dos.t.sokat",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0}, hogy a McAfee. WebAdvisor bekapcsolja a hozz.adott v.delmi funkci.kat a McAfee. biztons.gos keres.st, a hirdet.sblokkol.st .s a k.vet.blokkol.st.",.. ADBLOCK_PERMISSION_ADDE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1405
Entropy (8bit):	5.477748197455182
Encrypted:	false
SSDEEP:	24:7HT1z0nFTVKnrpGpcJVKnrpGNG7FTVKnrpGrjQDej2lDuzg+5ZZiv:Fz0FTYrpGpcJYrpGNGBTYrpGrjQCj2lV
MD5:	3E13B6FFA1DF56F2E6E9C557BD44C235
SHA1:	8A576E14BD22531BB6055A7A33051308C8B2546E
SHA-256:	5FE696817A76C84F40C95982885A8B283940FFB60D2715338249D4C6A077A14C
SHA-512:	2C9B2555480019ED63398F5A16B3B139C10A31D943E8CADE2DAB08D0869DD2461D9E9ED9BFCBE8398AAB58CFE03A7DA744C53B2C8CA61A5D7DD80294855AC9F2
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Ottieni la protezione Web gratuita McAfee facendo clic su {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Attiva l'estensione",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} per attivare queste funzionalit. di protezione aggiuntiva: Ricerca sicura McAfee., Blocco della pubblicit. e Blocco dei tracker.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Attiva l'estensione",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} per restare protetto online con queste funzionalit. di protezione aggiuntiva: Ricerca sicura McAfee., Blocco della pubblicit. e Blocco dei tracker.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Mantieni i cambiamenti",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} a McAfee. WebAdvisor di attivare queste funzionalit. di protezione aggiuntiva: Ricerca sicura McAfee., Blocco della pubblicit. e Blocco dei tracker.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Consenti",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Attiva

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	5.7635131481206905
Encrypted:	false
SSDEEP:	48:x8H0vGRwMvNaRw8CvrbQRwA8vxvovyZWHU2:a2UwuewDrWwA+pyqW02
MD5:	F6C303151ECB2A64E3B4F10017383242
SHA1:	2A56C8ED24195EBEEE91EAD74BCDBE12E81DC3D2
SHA-256:	C35DD47CF24418B17F19DBE066173D077525D78390BD481D7C5F7D746F0CBD5A
SHA-512:	ABB35DD0F3AB9A9B517E2FE25A6C74A1D5C05F8D738C44FDAA7DCA4BDBA968BEB79550B907E20CA59F1AEFB0439398CE529753606D4F58F64A794EB2FF3AD0AC
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "{0}................. Web ............",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "............",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}.......... .... ..........................................",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "............",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}.......... .... ..........................................................",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: ".......",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "...... ..........{0}.......... ...

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	6.013580409926289
Encrypted:	false
SSDEEP:	24:7HT5dVhbu+vNh0/p7OvmksBv01I+vqNhGjB+Xx2vT6xw:pXvkJOvmdBvAvq5B2vT1
MD5:	930B6DC453EAD2619F890AF365827A4D
SHA1:	217B96E54F84EBF66696E64BE8D31A8F6DCB1D43
SHA-256:	F427DB4C58CA1D68D5E205C5379B313A9B56E4C330B9F14D8955EDBC61BE9A42
SHA-512:	5F68BF8010C031A5032F01DC5AF6968A610D3FDAA549935B45D2394BEE6DC9F40664EFDF73FEE6E89750EA622FB65D6B51EDF31E4609AF6F0C4350AB59DF74FD
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "{0}. .... McAfee. .. . ... .....",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: ".. ..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}. .. .. .. .. ... .... McAfee. .. .., .. ..., .. ...",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: ".. ..",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}. .. .. .. .. .... ... ... ... ..... McAfee. .. .., .. ..., .. ...",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: ".. .. ..",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "McAfee. ....... {0}.. .. .. .. ... .... McAfee. .. .., .. ..., .. ...",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "..",.. CHROME_ENABLEMENT_GUIDE_BUTTON: ".. ..",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	5.557002184576427
Encrypted:	false
SSDEEP:	24:7HT7bqCaYyGIG3aYEgdXCCaYIRSPuA9/3QFSgknL:rWCaPQ3a3gdXCCa1oPuAN3KSgknL
MD5:	AE96F0EB7B6A0114ADDDB671A02D436F
SHA1:	4C9D1FF8417C558F717B4BC42AC78D927473393B
SHA-256:	D3DE3302208DF87A7129CD7C6F9CEA510934570C230CFF02F110F0656E02C654
SHA-512:	AFDBCD96159CE17DD91C2CEA561FA757CFB13F0BCDDDA655120FADA74AC8BE4DBCE9650FC323365083ECD78640EBF82F72293FA6FD0F3564E8885B00DE6A6E8E
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "F. kostnadsfri webbeskyttelse fra McAfee ved . klikke p. {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktiver utvidelse",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} for . sl. p. disse funksjonene i Ekstra beskyttelse: McAfee. Sikkert s.k, Annonseblokkering og Annonsesporingsblokkering.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktiver utvidelse",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} for . f. uavbrutt nettsikkerhet med disse funksjonene i Ekstra beskyttelse: McAfee. Sikkert s.k, Annonseblokkering og Annonsesporingsblokkering.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Behold endringer",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor for . sl. p. disse funksjonene i Ekstra beskyttelse: McAfee. Sikkert s.k, Annonseblokkering og Annonsesporingsblokkering.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Tillat",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Aktiver utvidelse",.. CHROME_

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	5.484157922194386
Encrypted:	false
SSDEEP:	24:7HT+2CwmVpm7KECQc6WpV6LqKECh6zhpTnKECZ6BMcpS3KfwDwzxFRbOrRjA:ulHXQc6CVsph6znTCZ6BMIS3KQAxFRbr
MD5:	8A306DDC26F816873BC14BD321287937
SHA1:	B888B66AC1F4AEC7AF79A26AEDCBE0B08F53B9B0
SHA-256:	70F7A0C61F508C0F5E3CE16AD8CDD34A4FDA3B232135E16477FB651FCD2909E6
SHA-512:	E62D0439F3A3D89FFC4F9D596DC1D98D67805C8F50B3DF038E703BFFC9B52BF71EB78FA6DC42DF10442DE787929B774F3CD211D43F5070323380C4D087D727C6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Activeer uw webbescherming van McAfee door op {0} te klikken.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Extensie inschakelen",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} om deze functies voor Extra bescherming te activeren: McAfee. Secure Search, Advertentieblokkering en Trackerblokkering.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Extensie inschakelen",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} om online veiligheid te handhaven met deze functies voor Extra bescherming: McAfee. Secure Search, Advertentieblokkering en Trackerblokkering.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Wijzigingen behouden",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} dat McAfee. WebAdvisor deze functies voor Extra bescherming inschakelt: McAfee. Secure Search, Advertentieblokkering en Trackerblokkering.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Toestaan",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Extensie inschakelen",.. CHROME_ENAB

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1445
Entropy (8bit):	5.700658362217022
Encrypted:	false
SSDEEP:	24:7HThG9K7qoBXUUyTNHyAoBXs0W17ZGoBXQLVTEaWjNwc4ukTtW4wmP:xG99IXnkHyAIXs0W17ZGIXQLVoaKNwc8
MD5:	918B3D85C7BAB54488133F892D405957
SHA1:	892401F7AE231A9ECFF64D922BFF2C9357E84B1D
SHA-256:	AD610B240853C7680D28CEC557E3E8741A85577F17361EC13667BC3034793D36
SHA-512:	B53A073C24986A6B71187252DE492F15A998E5561364D77CF249999ADB110C7080D6CA251A3FCB67B13C528723BAD89A7F0381B6134915067881B2D84EDE1645
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Otrzymaj bezp.atn. ochron. w sieci Web od firmy McAfee, klikaj.c {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "W..cz rozszerzenie",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}, aby w..czy. funkcje Dodatkowej ochrony: Bezpieczne wyszukiwanie McAfee., Blokowanie reklam i Blokowanie .ledzenia reklam.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "W..cz rozszerzenie",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}, aby zachowa. bezpiecze.stwo w Internecie dzi.ki tym funkcjom Dodatkowej ochrony: Bezpieczne wyszukiwanie McAfee., Blokowanie reklam i Blokowanie .ledzenia reklam.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Zachowaj zmiany",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} programowi McAfee. WebAdvisor na w..czenie funkcji Dodatkowej ochrony: Bezpieczne wyszukiwanie McAfee., Blokowanie reklam i Blokowanie .ledzenia reklam.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Zezw.l",.. CHROME_ENABLEMEN

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	5.499240169006433
Encrypted:	false
SSDEEP:	24:7HTBsKJqk3NnebNgHbrxkHjFRt7Siu44fRZsXSPdB:yaqk3NnebNg7rxCFq44jPr
MD5:	6D4F0D3F25AA3C20385146CEFA2875F6
SHA1:	C442A3FF67D72D66E60ECEB1C87E823BC2CCE258
SHA-256:	B071D3F93FD9FF724AA2A6ED20EB28331504959A40C89687D6B1A2899FCE38F2
SHA-512:	177EF9F35B3BCF4B6E4F6BA587FA6DB9D08C906D41A1944B7C861622086CD7C5576C9F73144250364F04D3710D0D65B2E322C591641F1364C6754C12FF83372D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Obtenha sua prote..o gratuita na Web da McAfee clicando em {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ativar extens.o",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} para ativar estes recursos de Prote..o adicional: Pesquisa Segura, Bloqueador de an.ncio e Bloqueador de rastreador da McAfee..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ativar extens.o",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} para se manter seguro com estes recursos de Prote..o adicional: Pesquisa Segura, Bloqueador de an.ncio e Bloqueador de rastreador da McAfee..",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Manter altera..es",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} o McAfee. WebAdvisor para ativar estes recursos de Prote..o adicional: Pesquisa Segura, Bloqueador de an.ncio e Bloqueador de rastreador da McAfee..",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Permitir",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Ativar extens.o"

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1439
Entropy (8bit):	5.5232815708931575
Encrypted:	false
SSDEEP:	24:7HTBV0k3gQWF3+be0GQWF3+hgoQQWF3+vxkHjJYPJWkVHKFgH:D0k3gQWObe0GQWOhgvQWOvxCJuW+qFq
MD5:	3A6CCD236774E94692D8831D1095E28D
SHA1:	40AC8C7E618E57D55CBA198196F6F443D596A8C2
SHA-256:	DF634E07E19FD468B8752405ACCECD4CED512E7B21296EC453C5CD9D36A6EA79
SHA-512:	CCEDBFB624A0276C6D649CB66802B34D201AF7FB7AAC8FEDB89D263BC6C6CC85B1601638018C1E1B1FC458F9FAF44147A0690B10874368A7DC80272C5450FBD9
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Obtenha a sua prote..o Web gratuita da McAfee clicando em {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ativar extens.o",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} para ativar estas funcionalidades de prote..o adicionais: Pesquisa segura da McAfee., bloqueador de an.ncios e bloqueador de monitorizadores.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ativar extens.o",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} para se manter protegido online com estas funcionalidades de prote..o adicionais: Pesquisa segura da McAfee., bloqueador de an.ncios e bloqueador de monitorizadores.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Manter altera..es",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} que o McAfee. WebAdvisor ative estas funcionalidades de prote..o adicionais: Pesquisa segura da McAfee., bloqueador de an.ncios e bloqueador de monitorizadores.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Permitir",.. C

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2030
Entropy (8bit):	5.2555078939473105
Encrypted:	false
SSDEEP:	48:cjVIb3DoC64sVmb3D1tazjVIb3DzImiLvyxvMxo:QVi3Z2VM3enVi3v2vy5
MD5:	49116B4586ADAD085BACF5816F43CCFF
SHA1:	134CDEE381A624BFC09FE15FAAFF1C7897640AD7
SHA-256:	A074E87B4C8CB8B43E5A44FD314B88FA26B10B82FAF69172B798D529F261924E
SHA-512:	3FB449422772D272A3FF42CA5BEB290BA0D95C19D62196FE6D43D0C1AFFBF1B5B4BD9E420B5291FCEDDED41A7B746B0F3BFE27FFFBDEF5431ACDAEA9701392C6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "........ .......... ...-...... .. McAfee, ..... {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "........ ..........",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}, ..... ............ ......... ....... .............. ......: .......... ..... McAfee., ........... ....... . ........... .........",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "........ ..........",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}, ..... .......... . ............ . ......... ......... ............. ......... .............. ....... ......: .......... ..... McAfee., ........... ....... . ........... .........",.. ADBLOCK_SEARCH_W

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.8082208936198585
Encrypted:	false
SSDEEP:	24:7HT/iSRyjWeDvEPpRK2NF1I5DyjePD+hCf3c4kcWVmEG:P3YSeYpccF1Ic6Chm3jca
MD5:	C6C03AB9C27D537A39384631C8862D1C
SHA1:	1F496B05499701B2B062F7EEFB504755E33C9C64
SHA-256:	0C3F20AE72B99E39B3DA815175EBB52D3803FDF777FEE84A8CBA803A41B60079
SHA-512:	D429EB9DB550BB156995C329B694AC492CFD05A9FB31C1712D00036CCA86CF8E360D0201D3B51CD3CC5EBC718D5CFFBB92EA0686F1016EBC4FE2105E0A97A0AC
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Z.skajte bezplatn. webov. ochranu od McAfee a.kliknite na mo.nos. {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Zapn.. roz..renie",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} a.aktivujte funkcie zv..enej ochrany: zabezpe.en. vyh.ad.vanie McAfee., blokovanie rekl.m a.blokovanie sledova.ov.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Zapnite roz..renie",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} a.nestra.te ochranu online v.aka funkci.m zv..enej ochrany: zabezpe.en.mu vyh.ad.vaniu McAfee., blokovaniu rekl.m a.blokovaniu sledova.ov.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Ponechajte zmeny",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor a.zapnite funkcie zv..enej ochrany: zabezpe.en. vyh.ad.vanie McAfee., blokovanie rekl.m a.blokovanie sledova.ov.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Povo.te",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Zapnite r

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1338
Entropy (8bit):	5.638254403296148
Encrypted:	false
SSDEEP:	24:7HT4eGvvtCawa+dCIHrFwa+Npp1mCawa+rUoDOGnDksYKC0U:IeCvtCawa+dCIBwa+NVmCawa+rUoDOGe
MD5:	7ADB0F79C46E50DF5CF9A16EEB0ECC77
SHA1:	D1D559D0D6CDE2FE2D5860061224561E6C1A00E5
SHA-256:	5327D46ECD92286BE152D7BB1B423179C39C29EB7FF2BA8EEE98FBD9251450F3
SHA-512:	06A31B4B1E3674F1A039B6322108777E1288EE198333CB30DDE89E58642E41E80E130F1E87530CDD9D6C6E63707914F2EEC90BD90EC730735ECC4C4542A81093
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Ostvarite besplatnu veb za.titu kompanije McAfee klikom na {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Omogu.ite ekstenziju",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} da biste uklju.ili ove funkcije Dodatne za.tite: McAfee. Bezbedna pretraga, Ad Blocker i Tracker Blocker.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Omogu.ite ekstenziju",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} kako biste ostali sigurni na mre.i uz ove funkcije Dodatne za.tite: McAfee. Bezbedna pretraga, Ad Blocker i Tracker Blocker.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Zadr.ite promene na",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor da biste uklju.ili ove funkcije Dodatne za.tite: McAfee. Bezbedna pretraga, Ad Blocker i Tracker Blocker.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Dozvoli",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Omogu.ite ekstenziju",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "da zavr.it

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1361
Entropy (8bit):	5.648778534988783
Encrypted:	false
SSDEEP:	24:7HT7ecjfypbD4qpbD02gVpbDYX/P33zMc2YSUi:rDOpbD4qpbD0JVpbDYX/P33zd2vUi
MD5:	3D15C21CFF5E3ECC5336CCE7D4B1A2A2
SHA1:	EBE7CC5AC8D1AA223C0D43711021E37380DD7901
SHA-256:	BF0BC9B3AD2463911818262737C9FCB53307407CFD214266E3CA389A6FEE10C5
SHA-512:	C3F4B6C869E471D3B3F05F643C49298602997171F86D06921F44C8B080DA543CB47144F6B7C0187A46F73AA6F9881346A139F366A2F48D30F5B1418BDD21D2BA
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "F. kostnadsfritt webbskydd fr.n McAfee genom att klicka p. {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktivera till.gg",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} f.r att aktivera Ut.kat skydd-funktionerna: McAfee. S.ker s.kning, Annonsblockering och Blockering av sp.rare.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktivera till.gg",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} f.r att forts.tta h.lla dig s.ker online med Ut.kat skydd-funktionerna: McAfee. S.ker s.kning, Annonsblockering och Blockering av sp.rare.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Beh.ll .ndringar",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor f.r att aktivera Ut.kat skydd-funktionerna: McAfee. S.ker s.kning, Annonsblockering och Blockering av sp.rare.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Till.t",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Aktivera till.gg",.. CHROME_ENABLEMENT_GUIDE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1404
Entropy (8bit):	5.679619166920541
Encrypted:	false
SSDEEP:	24:7HT3Nd7QUN3Z/UVXMJgYZ/v94oIuZ/Nc7I4dBng5cFolHxQGh:tBQUNGVcDxBc7HTFW6w
MD5:	EC51F4B2B1976323B1039E57972E2920
SHA1:	D88C401BA821A0D2946B75C15974E05CFD9BECC7
SHA-256:	1FFFC6F32412ABA1D9C38344F04DDF42AC9D7232F29D793749BDCB581DFBCBCF
SHA-512:	73DA279D5A0732B6272929848231215FDDAF7798DDE098F3E95E2001E65E4046AEE78255B6C21CB871FC13B0639B2686CF211BB956E4827C7C4E2F62144E2CE3
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "{0} .zerine t.klayarak McAfee'den .cretsiz web korumas. edinebilirsiniz.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Uzant.y. etkinle.tir",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "A.a..daki Ek Koruma .zelliklerini a.mak i.in {0}: McAfee. Secure Search, Reklam Engelleyici ve .zleyici Engelleyici.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Uzant.y. etkinle.tir",.. ADBLOCK_SEARCH_WARNING_CONTENT: "Bu Ek Koruma .zellikleri ile .evrimi.i g.vende kalmak i.in {0}: McAfee. Secure Search, Reklam Engelleyici ve .zleyici Engelleyici.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "De.i.iklikleri kaydet",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "A.a..daki Ek Koruma .zelliklerini a.mak i.in McAfee. WebAdvisor'. {0}: McAfee. Secure Search, Reklam Engelleyici ve .zleyici Engelleyici.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: ".zin Ver",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "WebAdvisor kurulumun

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	6.298795891595002
Encrypted:	false
SSDEEP:	24:7HTjjZ8CKz+1CaxNs/CthZvG7qXduRnIT4:pQzaxmahZv9q
MD5:	D4901609161D89F6C7D773EBBB7A0188
SHA1:	5077376A6B5FEF6FC370B792DE326F05234E9C4A
SHA-256:	D207C071672564CE3523290BDC65FD6714DFBA0AC211C216E76430760C585779
SHA-512:	520CDE96410E936516ABDBE7B474D40610189B60118007D63CCDE6E5B0133C9C3571A05CE83D6B33A47CF467CDFEC108C13A79A052F31881DCCF89C633B7EF68
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: ".. {0} .............",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "....",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} .................. .....................",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "....",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} .................. ..............................",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "....",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} .... ...................... .....................",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "..",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "......",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "......

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1249
Entropy (8bit):	6.293694275315816
Encrypted:	false
SSDEEP:	24:7HTAOzmcPZeSlGkyTDnZZeSlGCGtDcPZeSlGW17/10lQZ0GbLeOUpO:dzmkCkyTDn/CCGtDkCW1HFUpO
MD5:	9C66A62095B0DF5F7988B3C28C7F42C4
SHA1:	966FE0C650EB1E98809380C6777DA2B6B47740DB
SHA-256:	8CB1C010BB5012FE04032047EB561DD29C0877836A85CE25120D908319DC525E
SHA-512:	47AFE6E11F7684906E3EBD8171CBF8468509816F9ED3E7C55830CC1C05EB2D78D271D4DD447B255FCE1F092F6273537E5C71DFB350538A59B3951EF60FA7A4B2
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: ".. {0} ..... McAfee Web ...",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "......",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}............McAfee. ....................",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "......",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}....................McAfee. ....................",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "....",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor ...........McAfee. ....................",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "..",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "......",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "... WebAdvisor ...",.. CHROME_ENABLEMENT_G

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1048
Entropy (8bit):	5.754294961570996
Encrypted:	false
SSDEEP:	24:7uGY406vV41eK+59CpMSqKBgvtdUeniGdZIVsPbG4p:24e+59YMdZZ5bG0
MD5:	F499F5DDE3467291EBD659DDD43E9EC6
SHA1:	E178D4BC80B2E0483AD657C92BB8CEF1F0DFF185
SHA-256:	CA9C04AD75EC56C766F5EC69262EE72EAD8B6343032E6F8DA165C62EAD203507
SHA-512:	4EE4163EC70F65BEF0415F384A34C093C9353E0652C14A89771A22C8AB45A4CCC74A7A51152E572CC2C8E0023C5B6CAD52805B27B943CDA9FD030C5A133A8E6E
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Zajist.te si ochranu v digit.ln.m prost.ed.",.. WAIFF_TOAST_DESC_1_COHORT_1: ".kolem n.stroje McAfee. WebAdvisor je chr.nit va.e osobn. .daje, aby se nedostaly do nespr.vn.ch rukou.",.. WAIFF_TOAST_DESC_2_COHORT_1: "A. ji. nakupujete, vyu..v.te bankovn. slu.by nebo proch.z.te web, na.e bezplatn. n.stroje v.s pom.haj. chr.nit . a kyberzlo.inci nebudou m.t .anci.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor je bezplatn. n.stroj, kter. chr.n. va.e osobn. .daje, aby se nedostaly do nespr.vn.ch rukou.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Povolte n.stroj WebAdvisor a zajist.te si ochranu p.ed viry, malwarem a dal..mi hrozbami pro va.e online zabezpe.en..",.. WAIFF_BUTTON_ACCEPT: "Zajistit ochranu",.. WAIFF_BUTTON_REMIND_LATER: "P.ipomenout pozd.ji",.. WAIFF_BUTTON_DECLINE: "Ne, d.kuji"..}..//104A189D876E9195DD18C7DB90C41FBB5173731BF7A3B4FF4C3D4267252A3A877FCC645A3AC84AECBD

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	986
Entropy (8bit):	5.446975642041266
Encrypted:	false
SSDEEP:	24:7uG92vXRwV/YIehPFXc9vLfcRwV/YIeSP/GIi7dZMVIa/CxXX:nVYC9rVYttZy69X
MD5:	E72490BE10EE3C477AA9FEF0C8E415FD
SHA1:	8E5833CAD027BF061DB29525339A068AD99A40CE
SHA-256:	61BCD8179381585A846772537BF936217ACB1FEEBBAB449C17FBC0FC4CE3BE09
SHA-512:	2F1614374913CBBD01E271604D6E9C5AE6CDE00B7FC2AD60158BA747B5CB486ECD2D2DBA17153AB80CFCB547634A4E4275163B50205335CEC8985E3B1EA13232
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Beskyt dit digitale liv",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor beskytter dine personlige oplysninger og forhindrer, at de falder i de forkerte h.nder.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Uanset om du bruger internettet til at shoppe, g. i banken eller bare surfe, holder vores gratis v.rkt.jer dig i sikkerhed og beskytter dig mod cyberkriminelle.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor er et gratis v.rkt.j, der beskytter dine personlige oplysninger og forhindrer, at de falder i de forkerte h.nder.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Aktiv.r WebAdvisor for at beskytte dig selv mod virus, malware og andre onlinetrusler.",.. WAIFF_BUTTON_ACCEPT: "F. beskyttelse",.. WAIFF_BUTTON_REMIND_LATER: "Sp.rg mig igen senere",.. WAIFF_BUTTON_DECLINE: "Nej tak"..}..//6C9C81551C4DC11C16BFE0D67100C65C53A242649922DC37DCC7B4AFE00C5C96CE49E48EA9F623A15BC63905A192DF6280193F93DCAAAEC060DC7F5AFC9377D7++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	5.433867966058985
Encrypted:	false
SSDEEP:	24:7uG+QvxOeGg/OA9kNlv1VOe3F0Sui7xQd/y/QVZSjjn:QWX9GftF0SJxMa/uSjjn
MD5:	76422299E1FA73E582A10AC91522F8A4
SHA1:	6C95479E55742AAB2A60F93A4353AEC1BA14823B
SHA-256:	1F826A593AA6D2288750A3023C93AACE004A43B039B5B1C84C8ACDBA5425D4A2
SHA-512:	0144AE3278DCB9B9DF2430BE91FC6B787A5769DA56AD9A630654CE74A10736D80B9EE8D720BC53E1F7889D36D711D455F66F0CC3AFFCD8D7F2575BB45CB6F539
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Sch.tzen Sie Ihr digitales Leben",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor hilft Ihnen, zu verhindern, dass Ihre pers.nlichen Daten in die falschen H.nde gelangen.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Ob Sie nun im Internet einkaufen, Bankgesch.fte t.tigen oder surfen: Unsere kostenlosen Tools helfen Ihnen, sicher zu bleiben, damit Cyberkriminelle keine Chance haben.",.. WAIFF_TOAST_DESC_1_COHORT_2: "Das kostenlose Tool McAfee. WebAdvisor hilft Ihnen, zu verhindern, dass Ihre pers.nlichen Daten in die falschen H.nde gelangen.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Aktivieren Sie WebAdvisor, um sich vor Viren, Malware und anderen Bedrohungen Ihrer Online-Sicherheit zu sch.tzen.",.. WAIFF_BUTTON_ACCEPT: "Schutz einrichten",.. WAIFF_BUTTON_REMIND_LATER: "Sp.ter erinnern",.. WAIFF_BUTTON_DECLINE: "Nein danke"..}..//52E6F9FAB6999A5332DB0B65A715C9023BBDD2DE94E2D1CEFB5969DB0F6A4EBD1465666AE540BE6DA779E4906689966CDD08FF6D

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	5.131561741827058
Encrypted:	false
SSDEEP:	24:7uGwvlT6DePnEHleEnM+na8cEseDrXHrRvu1QGRXePoEHlesD3ir3rwqDijGduag:4HEHXnjKEXDrXrgKeEHXbirDduDBwa
MD5:	399D2D13722FAACB773C922FCD5C9BFB
SHA1:	75DF79D1539DC7C62D09F69E6AD87709607B3ADD
SHA-256:	39CF37193CD4F8171310548E099B5794D1C56C8EAB9940E2CB48D6D5715BED1D
SHA-512:	511048EFAAF9C39510848BE63945C2A1D192CC4746529010A102C599F414313CF9F72DBE4C3DFC0720DC003C618D74504C7C952F4CE4F066BA94BACDAB7E575D
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "......... ... ........ .... ...",.. WAIFF_TOAST_DESC_1_COHORT_1: ".. McAfee. WebAdvisor .... ..... .. ... ......... .... .......... ........... ... .. ...... .. ..... ......",.. WAIFF_TOAST_DESC_2_COHORT_1: ".... ............... ......, .......... .......... . ........... ... web, .. ...... ........ ... ....... .. ... ......... .. ........... ........ ... .. .......-........... ... .. ..... ..... ........ .. ... ...........",.. WAIFF_TOAST_DESC_1_COHORT_2: ".. McAfee. WebAdvisor ..... ... ...... ........ ... ........... ... .......... ........... ... ... .. .. ...... .. ..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	915
Entropy (8bit):	5.4868103858896475
Encrypted:	false
SSDEEP:	24:7uG/4Iv74Ge+uVfWMhCHJHvU0hGecZrD5i9dwdS/VrdeHvm6mh:l4guUMgHJM06ZSdsSNdbhh
MD5:	916BFB2901BA75CF716C5871FC0FEF28
SHA1:	53C2F6D276C5E34AB0FF39C8177220B22B5D41C2
SHA-256:	E71B0ADFD689246D30021EE9F2190B2EEF6A80663780BEFB563DC3F3EF3020E4
SHA-512:	5E58E7AD4B903F22CBB4F9A31A71D9443E53B618A42205EDD4281E6E16AA34DE9AD2762BDFFBDA0D83FB44D37911EB22511548A2817F3097CCC00A0D2DF03D22
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Protect your digital life",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor works to safeguard your personal info from falling into the wrong hands.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Whether you shop, bank, or browse the web, our free tools can help keep you safe -- and cyber criminals won't stand a chance.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor is a free tool that safeguards your personal info from falling into the wrong hands.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Enable WebAdvisor to protect yourself against viruses, malware, and other threats to your online security.",.. WAIFF_BUTTON_ACCEPT: "Get protected",.. WAIFF_BUTTON_REMIND_LATER: "Remind me later",.. WAIFF_BUTTON_DECLINE: "No, thanks"..}..//CE6DCFB8995929B04A23BFC78141867FA975135219C46A8ADE765324EBB73B970D0F3DCA40C69F81E2875A3A126037940A41C7A6402D410441F67E19E266EB9E++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.417004963784236
Encrypted:	false
SSDEEP:	24:7uGKvMwKimzpe4sTtkAFvZxR/mzpeWLdvRYjiOdSXkHVSxUmx:V/RcKkxspJYbSXk6Umx
MD5:	5F9975DB2D2A13094F6F71B74D03A9BC
SHA1:	5D5D1142B64E8DD760F152CD8D82A8BF6E7A8FD7
SHA-256:	63C186F12E44053196E82784F84440281D23E3C2FB012C01628E08F6294F29A5
SHA-512:	E9C526B5B43CDA4028D13C33E50A677E3F60522ED4224CD75DEB776CE3A10246056F6D07F59CBCBE27D84142BE31AEFFF674150219F574DCEABA67495B4D9914
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Proteja su vida digital",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor est. pensado para evitar que su informaci.n personal caiga en malas manos.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Nuestras herramientas gratuitas pueden protegerle al navegar, realizar compras y gestiones bancarias. Los ciberdelincuentes dejar.n de ser un peligro.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor es una herramienta gratuita pensada para evitar que su informaci.n personal caiga en malas manos.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Active WebAdvisor para mantenerse a salvo de virus, malware y otras amenazas para su seguridad en Internet.",.. WAIFF_BUTTON_ACCEPT: "Protegerme",.. WAIFF_BUTTON_REMIND_LATER: "Record.rmelo m.s tarde",.. WAIFF_BUTTON_DECLINE: "No, gracias"..}..//EE9AFAA2C097E0D19660D706B76369720B6BE26ACE9C49F34BFCE271FAABBB418AED0E3C18A14E6A98951CC8967CD281ED942A3112ED814434E26BBDDF60011E++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	938
Entropy (8bit):	5.463464862847338
Encrypted:	false
SSDEEP:	24:7uGSvyUpep4n0OlvZxxzpeWLZV2iadSXkHVhcgNrYY:R4nHxP9KSXkMgmY
MD5:	E6D04B0C20BF52B2F9A4E64A16682820
SHA1:	90206612AA0EAA7DAEA9E60D9014CBD19797ECEF
SHA-256:	C1EC4C1A4DD40B5CF689CBC32F46D7119D40F8ED4CDC6A9F221DB624FDE7484F
SHA-512:	5816E2757D1353F5997721CB2828C83D24417605058C60C27C64F31285C15493D8DED6FFA71B73AF254F0878D561706DE374E000AC875A5D7A68588F36CB2152
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Protege tu vida digital",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor trabaja para evitar que su informaci.n caiga en malas manos.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Sea que compre, haga operaciones bancarias o explore la web, nuestras herramientas gratuitas ayudan a mantenerlo seguro, y a derrotar a los cibercriminales.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor es una herramienta gratuita para evitar que tu informaci.n personal caiga en malas manos.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Active WebAdvisor para protegerse contra virus, malware y otras amenazas a su seguridad en l.nea.",.. WAIFF_BUTTON_ACCEPT: "Prot.jase",.. WAIFF_BUTTON_REMIND_LATER: "Record.rmelo m.s tarde",.. WAIFF_BUTTON_DECLINE: "No, gracias"..}..//6A7B81B69A41786B20EA5FC78543F463F2A5C4AAF7EC76507913639B0794EE36C3C5F16601981124A4C954527FDBEA0B6573F68DF8C4E93AF5360BEC9935FDE8++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	992
Entropy (8bit):	5.539031316790054
Encrypted:	false
SSDEEP:	24:7uGrvpj8feM9FkTJ/XvQEbJjZjeX3EliRDd8tmQVBmcYIwet:3qF4Z59lQEmdJc7wet
MD5:	330C44CDFF643E5CCEB37E8CB36999F1
SHA1:	8D064AE344E88634C85745AC60E106084A9E3840
SHA-256:	9EBA8FFF04A6F52AD7C0B7F126CE9D3E3633B91E17C619B2DE54EBACD8166663
SHA-512:	33EF6F4F7673469A06C398244FBB0CDA4358E84A60694FF1346F97E19243B44625E3C9EACC56A0CAE8C1A0BED224CB1A5F7616228AD402593C550A39469B9582
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Suojaa digitaalinen el.m.si",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor pyrkii est.m..n henkil.kohtaisten tietojesi joutumisen v..riin k.siin.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Miten tahansa viet.tkin aikaa verkossa . ostoksia tehden, pankkiasioita hoitaen tai sivustoja selaillen . pysyt turvassa maksuttomien ty.kalujemme avulla. Kyberrikollisilla ei ole mit..n saumaa.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor -ilmaisty.kalu est.. henkil.kohtaisia tietojasi joutumasta v..riin k.siin.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Ota WebAdvisor k.ytt..n suojautuaksesi viruksilta, haittaohjelmilta ja muila tietoturvauhilta.",.. WAIFF_BUTTON_ACCEPT: "Hanki suojaus",.. WAIFF_BUTTON_REMIND_LATER: "Muistuta my.hemmin",.. WAIFF_BUTTON_DECLINE: "Ei kiitos"..}..//F56C28AB5BE6B24340A55AB82857287DBD42DD5618A957F2188683FFB6EEF732CBD90926254ACF4F40963FD847965050909C198EB0A30B36F162D449B1989A91++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	5.441765638431357
Encrypted:	false
SSDEEP:	24:7uGNwvlMmlPcePzFzW0AvZrONq2lPce+XRKjwihGyAdCVqPPKIawFm:SMmlxpq0YrR2lkRKRUpP0x
MD5:	773077FD7334622ED682E19C77A08373
SHA1:	45F9C28B11EA06F2DAEF75BCF119EF9F72B72630
SHA-256:	E8EEF9CAE944BDFA697AEE6696B3D7A16C012AB4039945EA6D3A7687B09A2459
SHA-512:	01DD1C8FDC0744755F6C6E7F2D079A540D45EDFA5C7EA0CA574D9E64BB957F0438277B665DC743E5BAA3C12CEEE7672E883DEA023138273CF883B744F5E47C8C
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Prot.gez votre univers num.rique",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor oeuvre . s.curiser vos donn.es personnelles et les emp.cher de tomber entre mauvaises mains.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Quand vous magasinez, effectuez des op.rations bancaires ou parcourez le web, nos outils gratuits contribuent . votre s.curit. -- et les cybercriminels n'ont aucune chance contre vous.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor est un outil gratuit qui s.curise vos donn.es personnelles et les emp.che de tomber entre mauvaises mains.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Activez WebAdvisor pour vous prot.ger contre les virus, les logiciels malveillants et d'autres menaces pesant sur votre s.curit. en ligne.",.. WAIFF_BUTTON_ACCEPT: ".tre prot.g.",.. WAIFF_BUTTON_REMIND_LATER: "Me le rappeler plus tard",.. WAIFF_BUTTON_DECLINE: "Non, merci"..}..//B5FA92D010C8648573816560898B86C73DDC139321F592FB

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	5.416067733817426
Encrypted:	false
SSDEEP:	24:7uGmowvBtNhlFsceiA/6FVFzupllnF4vZrJ5NhlFsce+XvJ+wiZQdqVqoy+hL:eNhllA/6FVFOlOrJ5NhlNUM6yW
MD5:	42C9DB30A7DEA555F66B490E3428AC1E
SHA1:	C0D3803F5E043851BFE59CFC0EA7B0335FF2CB2D
SHA-256:	068E5D0641C6E30E56040F5073B0E11783343430EC862C59BA430144A89F3063
SHA-512:	446941D15565A3B5BD0900AB550580445D1482FC461591824C3810E5BD7221B4D724BEBB32CB54031BED3BBCE3A6913143AC982A57D3F8A0D32401B84A1191F6
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Prot.gez votre vie num.rique",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor s'efforce de prot.ger vos donn.es personnelles pour les emp.cher de tomber entre de mauvaises mains.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Que vous fassiez des achats en ligne, effectuiez des op.rations bancaires ou naviguiez sur le Web, nos outils gratuits vous aident . rester en s.curit..: les cybercriminels n'auront aucune chance d'arriver . leurs fins.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor est un outil gratuit qui prot.ge vos donn.es personnelles pour les emp.cher de tomber entre de mauvaises mains.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Activez WebAdvisor pour vous prot.ger contre les virus, logiciels malveillants et autres menaces pour votre s.curit. en ligne.",.. WAIFF_BUTTON_ACCEPT: "Obtenir une protection",.. WAIFF_BUTTON_REMIND_LATER: "Me le rappeler ult.rieurement",.. WAIFF_BUTTON_DECLINE: "Non, merci"..}..//21

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	970
Entropy (8bit):	5.53672570509657
Encrypted:	false
SSDEEP:	24:7uGjvA5v/6FewAv/dHvav/6Fe0QhJ4Mmi6dwVrdAUFb:S5vyAvlSvSG2M0sFb
MD5:	623E9D7261579F2DC8D5139471C86CE4
SHA1:	36FE02A952595E0ABF443D205F2F34ED14A9084C
SHA-256:	A511F56531A96536DAA610469281E4734CAEB18FAFCB6D6D050808F539A09E07
SHA-512:	60472DF0042DC429CFE38AEF556A2E1103128007216BF66D388A747AA6B738F14151FB2131E6C31136B9E27888B10D4F6D3E66CC39D00D064DDD99DC72D12188
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Za.titite svoj digitalni .ivot",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor djeluje kako bi za.titio va.e osobne podatke od pada u pogre.ne ruke.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Bez obzira da li kupujete, bankarite ili pregledavate web, na.i besplatni alati mogu vam osigurati sigurnost - a cyber kriminalci ne.e imate .ansu.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor je besplatni online alat koji .titi va.e osobne podatke od pada u pogre.ne ruke.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Omogu.ite WebAdvisor kako bi se za.titili od virusa, zlonamjernog softvera i drugih prijetnji va.oj internetskoj sigurnosti.",.. WAIFF_BUTTON_ACCEPT: "Za.titite se",.. WAIFF_BUTTON_REMIND_LATER: "Podsjeti me kasnije",.. WAIFF_BUTTON_DECLINE: "Ne, hvala"..}..//106927A791426D5EE8E56003EF8DCFC892B2E51CDF1625364DB1625D0FB9CD860E42D28766CB5A038D334622780A3CD8B6ADEC9F0FD84BE0ADAA74D7BD055ABA++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	5.597035620289851
Encrypted:	false
SSDEEP:	24:7uG7bmvSr5Mycde/FsuaVvQG2Qe5MycdefYasTyrikPId7r6QVbTzfe0T3arUh:RTUju5UJ3TyVE7NzvT0Uh
MD5:	51E9CED60AD61C8B37F31E7F3D955F40
SHA1:	9DA02CFCCE9C438EEE7C89C32FBEFAF06DC9B6B9
SHA-256:	C8C3EF8245997F7845243A308CD73B576363B59328917E639952C4643C6D90AD
SHA-512:	94B40689B5D8FD62D176B62A02C7471F5AF8B6C636366A398A456EAD6AF477CA4ECDDC433D3216B65D151C36C943AE9DCF0ED35B6D8FED2152932A030F05788C
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Gondoskodjon digit.lis .let.nek v.delm.r.l",.. WAIFF_TOAST_DESC_1_COHORT_1: "A McAfee. WebAdvisor megakad.lyozza, hogy szem.lyes adatai illet.ktelenek kez.be ker.ljenek.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Ak.r v.s.rol, banki .gyeit int.zi vagy b.ng.szik online, ingyenes eszk.zeink gondoskodnak v.delm.r.l, hogy az internetes b.n.z.knek es.ly.k sem legyen.",.. WAIFF_TOAST_DESC_1_COHORT_2: "A McAfee. WebAdvisor egy ingyenes eszk.z, amely megakad.lyozza, hogy szem.lyes adatai illet.ktelenek kez.be ker.ljenek.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Enged.lyezze a WebAdvisor funkci.t, hogy biztons.gban legyen a v.rusokkal, a k.rtev. programokkal .s az egy.b vesz.lyforr.sokkal szemben, amelyek online leselkednek .nre.",.. WAIFF_BUTTON_ACCEPT: "Gondoskodjon a v.delemr.l",.. WAIFF_BUTTON_REMIND_LATER: "Eml.keztessen k.s.bb",.. WAIFF_BUTTON_DECLINE: "K.sz.n.m, nem"..}..//232D5A00089B8BB7B61

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	978
Entropy (8bit):	5.3744908013197366
Encrypted:	false
SSDEEP:	24:7uGKk2vkvtdeLny8MK9GEreLYvl6lvtdeVHD/ikdCeitVlqCJG:tBQxMK7eLjYCeZ+G
MD5:	DAC1FFEB7065B677932EC33912B2DDDC
SHA1:	6817A9F7F0EE6F04FC10CC2DA8B5E59CF22E5089
SHA-256:	8F9FFD1977BB5B8D02702D04A9209733E1C210367FCC45DE317A4A2CFCEA092E
SHA-512:	2D22AC567E219F849B8B07B77A3EDCA2C4CDF97549D86A40CD91C39B30CC226F1A75511A1A3D75D99C141187E2ECD628365A7538DC20AA98D3895F3ABE316398
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Proteggi la tua vita digitale",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor impedisce alle tue informazioni personali di finire nelle mani sbagliate.",.. WAIFF_TOAST_DESC_2_COHORT_1: "I nostri strumenti gratuiti ti aiutano a restare protetto e tenere alla larga i criminali informatici quando fai acquisti, esegui transazioni bancarie e navighi in Internet.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor . uno strumento gratuito che impedisce alle tue informazioni personali di finire nelle mani sbagliate.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Attiva WebAdvisor per proteggerti da virus, malware e altre minacce alla tua sicurezza online.",.. WAIFF_BUTTON_ACCEPT: "Proteggiti",.. WAIFF_BUTTON_REMIND_LATER: "Visualizza in seguito",.. WAIFF_BUTTON_DECLINE: "No, grazie"..}..//D10217E906D7949B03A9A1679D1F69ECBD058541E926DC4ED6695604F6DE13C40C04C702D67BC6501C3D7793851410C4E2360FD7D5277BCA8C175864E0BAC70D++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1220
Entropy (8bit):	5.721227001060117
Encrypted:	false
SSDEEP:	24:7uG7QvTYRFqOqeEnckuxTvlRFqOlesuhxkOQihdPvIVbMx56:ZQYRFqkZrRFqcuzBvPvbx56
MD5:	D4CFE0C7880BB6C2E405808703F823B3
SHA1:	CBB6309A21221E68CAAACDC5B6796BDF6FCB7659
SHA-256:	CBCAD81AA937FA79EC443C66040D965C8B61A2ED2493729CE39C1F945F5BD9D8
SHA-512:	729AA8E39082289F6DE9E2931F4409CB5F4B1C0D9323A23911A0406C37230D96195D7B4D54E6EE84D6CF15635C9550153AEFB3662B08627819CACF0A063D402A
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: ".... ...........",.. WAIFF_TOAST_DESC_1_COHORT_1: "...... ......................................",.. WAIFF_TOAST_DESC_2_COHORT_1: "..... ............ ................................................................",.. WAIFF_TOAST_DESC_1_COHORT_2: "...... ............................................",.. WAIFF_TOAST_DESC_2_COHORT_2: "..........................................................",.. WAIFF_BUTTON_ACCEPT: ".....",.. WAIFF_BU

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	986
Entropy (8bit):	5.991772625561834
Encrypted:	false
SSDEEP:	24:7uGqSv513heSk6BcSVpFrhjvG13DaJe/MhCowW/irdijVAJv6e4:0cdFvrhqD0QRPii6e4
MD5:	436AB9FE9B7F870E66E3BB1DE9F8FD5A
SHA1:	96CD6E19BB6ED690E51551320F410F12264A9ED7
SHA-256:	5FD75C3FEB4D94F06511C0B51F013FA80627281DCC59144CD53AC1DF5985B938
SHA-512:	703A618CE6FFAC63CAB9688E4AF36C5DC0B11217E32C9B0DFF97733D938F1B2B7973084B61316AEF3B2F45DC36A3F62A8319373B6828CE332A41FF0BF6342431
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "... ... ..",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. ....... .. ... .... ... ......",.. WAIFF_TOAST_DESC_2_COHORT_1: ".., .. .. . .. . .. ..... McAfee .. ... ... ... .... ... .... ... ... . .....",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. ....... .. ... .... ... .... .. ......",.. WAIFF_TOAST_DESC_2_COHORT_2: "....... .... ...., ... . .. ... .. ...... ......",.. WAIFF_BUTTON_ACCEPT: "....",.. WAIFF_BUTTON_REMIND_LATER: "... ..",.. WAIFF_BUTTON_DECLINE: ".. . ."..}..//739CE786B84ECBE5162F8327FE9774DDBBD7966A40F2DDC27A164FE12F88CAF35973DD4DBED9143E9C6873259272BB849F23B84D1B20DDFF69ADC251BDA3F422++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.468603330970894
Encrypted:	false
SSDEEP:	24:7uG9IvAh1IerDGuH9tvIzzh1IeLkGAlIi7dkVpLSUvfH:fLd+LtkHtSe2/
MD5:	C0C7054DBE460E2AA24A570DBCC682BE
SHA1:	CC21AD2332DFC62D9487E1FB20059ABAF66C0C71
SHA-256:	9FCA5DA76F329FBCF913648954DE53466F902754E182CEE1FF4978ADEFBB4ABA
SHA-512:	49EE69445B4DF37151507A69CC86232E11CA556B192DB1AFDAAB75137E9FF5AAC36A10648FE206B2F4F30A2C2FC88E11398B687C60A714DBEF97272560D00C44
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Beskytt det digitale livet ditt",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor bidrar til . forhindre at personopplysningene dine havner i gale hender.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Enten du handler, bruker nettbank eller surfer p. nettet, kan de kostnadsfrie verkt.yene v.re holde deg trygg . og nettkriminelle har ingen sjanse.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor er et kostnadsfritt verkt.y som bidrar til . forhindre at personopplysningene dine havner i gale hender.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Aktiver WebAdvisor for . f. beskyttelse mot virus, skadelig programvare og andre nettrusler.",.. WAIFF_BUTTON_ACCEPT: "F. beskyttelse",.. WAIFF_BUTTON_REMIND_LATER: "P.minn meg senere",.. WAIFF_BUTTON_DECLINE: "Nei takk"..}..//8408B4E4298CC26552C9F710EBCA43F659AF624B2B88F9BE8C7EE76BA476BAC72D7C26606ECEC6E4BC308B0350980E07214F5BFBDC3C829E74B64DFDF9E01116++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	5.383677635023662
Encrypted:	false
SSDEEP:	24:7uGCbQvNQ/JHeGLwpBgvNTHUQ/JHeHgjQui8QydMiQVFMm24LJphn:wbE+JjwpMU+JeaQuHxWlLfh
MD5:	16A75E11A55764D81F88C6D1E37CEF87
SHA1:	D2DB337E8122056A00FAC68AA78F69805B6E9ED2
SHA-256:	68DA03C51BA0E4EFF5C046A431AC9635DC1279950D00C0C241E854C6DC204E24
SHA-512:	62ED7E8088A717D2582704D2D241FDC97BB94EB4AE290B006A789AA4BE4F7C553B9530B45A2C3CE206C7D266CE7403AB28F4BBD87013C880473216FDF0CB507E
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Bescherm uw digitale leven",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor beschermt u door te voorkomen dat uw persoonlijke gegevens in de verkeerde handen vallen.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Of u nu online winkelt, bankiert of surft, onze gratis tools kunnen u helpen om uw veiligheid te handhaven. Cyberciminelen maken geen schijn van kans.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor is een gratis tool waarmee u kunt voorkomen dat uw persoonlijke gegevens in de verkeerde handen vallen.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Schakel WebAdvisor in om uzelf tegen virussen, malware en andere bedreigingen van uw online beveiliging te beschermen.",.. WAIFF_BUTTON_ACCEPT: "Zorg dat u beveiligd bent",.. WAIFF_BUTTON_REMIND_LATER: "Help mij herinneren",.. WAIFF_BUTTON_DECLINE: "Nee, bedankt"..}..//AB9283191B4A33D41DA5D86B32690A7BCD9B879E28E304C2E411D1BFA13753CE0CCD94FA746AD7AFB700CCAF4DCC87F8FBA636C42BA596BEA72B20F424

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	5.6498547897368265
Encrypted:	false
SSDEEP:	24:7uGVNFvLnLYFCeTKTv0vmNGHKZYFCeoVmPbYCjisi2d8VVN2/v+4wje:PnLaKTvdckXVmPbvUO8cnhYe
MD5:	B78B35E5EA55BA9273C9D246543037CF
SHA1:	8555F0D433DED82688B6D8DD2151E2EDA8CF2136
SHA-256:	88B5AAF3D4345C350C2E46513C91C3398FB13525DAFC8D4D6EDACEA205DDD7B6
SHA-512:	21E564C783FA6AF4BF471BE370B665AAD02C50FC19EC71FB1259F45532824B93447BBD96ACE10AA729827EF2E14FB1D5B7E5CD7C94883F5949DB0B507488A277
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Bezpiecze.stwo w cyfrowym .wiecie",.. WAIFF_TOAST_DESC_1_COHORT_1: "Rozszerzenie McAfee. WebAdvisor dzia.a w celu zabezpieczenia Twoich danych osobowych przed wpadni.ciem w niepowo.ane r.ce.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Nasze bezp.atne narz.dzia pomog. Ci. zabezpieczy. przy zakupach, korzystaniu z bankowo.ci lub podczas przegl.dania Internetu . cyberprzest.pcy nie maj. szans.",.. WAIFF_TOAST_DESC_1_COHORT_2: "Rozszerzenie McAfee. WebAdvisor to bezp.atne narz.dzie chroni.ce Twoje dane osobowe przed wpadni.ciem w niepowo.ane r.ce.",.. WAIFF_TOAST_DESC_2_COHORT_2: "W..cz rozszerzenie WebAdvisor, aby chroni. si. przed wirusami, z.o.liwym oprogramowaniem i innymi zagro.eniami dla bezpiecze.stwa w Internecie.",.. WAIFF_BUTTON_ACCEPT: "Skorzystaj z ochrony",.. WAIFF_BUTTON_REMIND_LATER: "Przypomnij mi p..niej",.. WAIFF_BUTTON_DECLINE: "Nie, dzi.kuj."..}..//3CEFF0D219400EF2E772F7DD517B9B2BAF326

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	5.482919574516214
Encrypted:	false
SSDEEP:	24:7uGWvGqe4TqfWHvxYLqeo3L9iGdtHVN0+PMhR:JsTmLA3LNtoSMD
MD5:	5000AAC8F0023D7461A6D2A14E74A249
SHA1:	0CED03322476C5D4507E8EDF9C0308632F3BA9EC
SHA-256:	95BC979A46C7466619895EA357B7F1727B311E8CC91ED79079793775BD378831
SHA-512:	C470C892EAA908B27F4D41356DF6B72EC12C6434E475ED5FEF48CBF7AED77F8A5617EA49C7337D63553C75186D0042017375E937B7F5EBF401F4602CB67CA10A
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Proteja a sua vida digital",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor trabalha para impedir que suas informa..es pessoais caiam nas m.os erradas.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Seja para comprar, fazer transa..es banc.rias ou navegar a Web, nossas ferramentas gratuitas podem ajud.-lo a manter-se e seguran.a -- e os criminosos cibern.ticos n.o ter.o a menor chance.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor . uma ferramenta gratuita que impede que suas informa..es pessoais caiam nas m.os erradas.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Ative o WebAdvisor para proteg.-lo contra v.rus, malware e outras amea.as . sua seguran.a online.",.. WAIFF_BUTTON_ACCEPT: "Proteja-se",.. WAIFF_BUTTON_REMIND_LATER: "Lembrar-me mais tarde",.. WAIFF_BUTTON_DECLINE: "N.o, obrigado"..}..//2151AAB785EE6EA3BEF2B969565F44C064A909CC0CB316CA3993C72490791AD109EBF6C2D1E1C67244FFC28C88F164AAC1DF57978FF738A2102919649E1

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.4453506972063455
Encrypted:	false
SSDEEP:	24:7uGWvXqemtvxo8lo8Fv0YYqeorp9i7d0HVD5:munlVYArpm0b
MD5:	7D09DD65BE6C260DCAF75AF8C8C91ED4
SHA1:	F112768790FB0FA6AA69A0D997350DDC3D3F67CC
SHA-256:	157FB70A429065A4009BDAC2796AD6CB98E125B23838C3FEAF59789A55E74421
SHA-512:	88B8B2F0331FECF9BA241AA2288D3F6873AAA28E13B18E2C001A04B7FAB3302443CEF74CCF658E87B9FFCD824EFEA26DB05F6D795C213F48BB5A8281B804DE87
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Proteja a sua vida digital",.. WAIFF_TOAST_DESC_1_COHORT_1: "O McAfee. WebAdvisor trabalha para impedir que as suas informa..es pessoais caiam nas m.os erradas.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Caso fa.a compras, realize opera..es banc.rias ou navegue na Web, as nossas ferramentas gratuitas podem ajud.-lo a manter-se em seguran.a, e os cibercriminosos n.o v.o ter qualquer hip.tese.",.. WAIFF_TOAST_DESC_1_COHORT_2: "O McAfee. WebAdvisor . uma ferramenta gratuita que trabalha para impedir que as suas informa..es pessoais caiam nas m.os erradas.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Ative o WebAdvisor para se proteger contra v.rus, malware, e outras amea.as . sua seguran.a online.",.. WAIFF_BUTTON_ACCEPT: "Obter prote..o",.. WAIFF_BUTTON_REMIND_LATER: "Lembrar mais tarde",.. WAIFF_BUTTON_DECLINE: "N.o, obrigado"..}..//925C3D4C1E4B26D90C170C43D2A3D0CF72E059E4F1AE06E600A312A879A45534B3425AA599559AE1B64ADBE53397

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.221989024507171
Encrypted:	false
SSDEEP:	24:7uGgmLHv4r6HeS0WPHH7XQfOc5TwvFovr6HeyHiM7avIixQd3ImlVyQIJXf:amMm7Uh2zaq4dQAP
MD5:	109D89B4C94CDD9010BA309A36E66EE3
SHA1:	C8991ACA2106BCE52D631079D942E520E4EA009D
SHA-256:	C02BB01EB9B2FE16FA749BA0E05626E24644D9129A21CCB089C5B3AFA69473EF
SHA-512:	2DFFE49A74D54ADC7D81D7461E08BCC56CD4A37E77696AA0D162C3C0EB07A33BE2DFC0F0359B1054EF19562F4B123C9D3C610ED0E12718C7412B11FB68A709C4
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "........ .... ........ ...",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor ............ .................. ..... ...... .......",.. WAIFF_TOAST_DESC_2_COHORT_1: ".......... .. ...., .......... .. .. ......., .......... ........ ... .............. ...-........, .... .......... ........... ....... .......... .... ...... .. ..... . ..................",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor . .......... .........., .............. .................. ..... ...... .......",.. WAIFF_TOAST_DESC_2_COHORT_2: "........ WebAdvisor, ..... ........ .... .. ......., ........... .....

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.792782971881207
Encrypted:	false
SSDEEP:	24:7uGqvUTke2+u4Z2M2vtd2keuEAvECuiFdCVtg3bgFP:s2OvpJgFP
MD5:	854B92770B25816C3101B45506733AB5
SHA1:	F2ECB88D93AE84592B3D8990AEDCC6FAF3F0D749
SHA-256:	90BD1626DABF841DB7DB0AEDCB4D704FA497DAE379BAFADFE3B19454B822BD88
SHA-512:	DA3E296A3662D1BF448FA51D9684DCA1B1B87B483C3A70E6660C7C9C720068396C08DC573FA59425E42A1AEE299D3C0B6B0D0A8012BD1D7253068BE8278EB2F2
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Chr..te svoj digit.lny svet",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor v.m pom..e ochr.ni. osobn. .daje pred ne.iaducimi osobami.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Na.e bezplatn. funkcie v.s ochr.nia pri nakupovan. online, elektronickom bankovn.ctve alebo prehliadan. webu a.nedaj. .ancu kyberzlo.incom.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor je bezplatn. n.stroj, ktor. ochr.ni osobn. .daje pred ne.iaducimi osobami.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Zapnite WebAdvisor a.ochr..te sa pred v.rusmi, malv.rom a.in.mi hrozbami, ktor. na v.s ..haj. online.",.. WAIFF_BUTTON_ACCEPT: "Z.ska. ochranu",.. WAIFF_BUTTON_REMIND_LATER: "Pripomen.. nesk.r",.. WAIFF_BUTTON_DECLINE: "Nie, .akujem"..}..//054F59544E87874B9FE9A912D9B9EA0B6CD47101FD1CDF624935BDC00569097F0FB1000C5F6977641CD87A733A7F605C6B3D33E7E25963DE380F4ADD2F60DC48++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.599519177835905
Encrypted:	false
SSDEEP:	24:7uGjvY4FembeVgtvKSFe0WLmLTlwFi1dAVVSS:mlQJnlH0
MD5:	0D9BC3AEA3B2ECE9C13DC91765CC08D6
SHA1:	4D41D9B6B24B6E007839C6915F1394F8EB52C038
SHA-256:	011DE0E980D9401FDEADFE5A44FEE9D9DEDC6B77726852EE2606250149B741C6
SHA-512:	AB8D882A7D1E7BDDC44D37295A299066F80860002C728370B2326F78ED55A5CECBE63F7CA5264C472429139406DD35874FEA4326D1D1CFFCEF8CEC8C70360D39
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Za.titite svoj digitalni .ivot",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor radi na .uvanju va.ih li.nih informacija od padanja u pogre.ne ruke.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Bez obzira da li kupujete, koristite bankarske usluge ili pretra.ujete veb, na.i besplatni alati mogu sa.uvati va.u bezbednost-- a sajber kriminalci ne.e imati .anse.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor je besplatan alat koji .uva va.e li.ne informacije od pada u pogre.ne ruke.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Omogu.ite da vas WebAdvisor za.titi od virusa, malvera i drugih pretnji po va.u bezbednost na mre.i.",.. WAIFF_BUTTON_ACCEPT: "Za.titi me",.. WAIFF_BUTTON_REMIND_LATER: "Podseti me kasnije",.. WAIFF_BUTTON_DECLINE: "Ne, hvala"..}..//9532B41C2A7965B5481247D9F811C72DFFFB47B79668E3661708C693084E38C84F503335617BE9E2B98985E10D327859793ADD3FFBC0228B4AD93259916C21CC++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1002
Entropy (8bit):	5.515745154315555
Encrypted:	false
SSDEEP:	24:7uGKlvc49IeIuZR6/Otvo6WT8E9IehgNMxi72dUVIMgWkf4:Y9au+2M8E9nqMSOsg/f4
MD5:	D988050053B7EF738FC41E5B7014A199
SHA1:	9BA692A6E6879EE845014E2F48E0554CD2E69429
SHA-256:	7EC3D94DD1D7AA13B6BEE47E09A0CDA5AF35DFE9347BC9AB42E164BECB98284A
SHA-512:	C2FEDDD1B9FAAAF3D7FA1F06CBE5C39D21C4DE1724BEC23D1C5FA9A7D99E7CC066F0A87DC3A2933034A26E7121B649F0CEEE803CB450F2DBF5B828755CB09ED3
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Skydda ditt digitala liv",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor jobbar f.r att f.rhindra att din personliga information hamnar i fel h.nder.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Oavsett om du shoppar, utr.ttar bank.renden eller surfar p. internet kan v.ra kostnadsfria verktyg hj.lpa till att h.lla dig s.ker -- och n.tbrottslingarna kommer inte ha en chans.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor .r ett kostnadsfritt verktyg som hindrar att din personliga information hamnar i fel h.nder.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Aktivera WebAdvisor f.r att skydda dig mot virus, skadlig programvara och andra hot mot din s.kerhet p. internet.",.. WAIFF_BUTTON_ACCEPT: "Skydda dig",.. WAIFF_BUTTON_REMIND_LATER: "P.minn mig senare",.. WAIFF_BUTTON_DECLINE: "Nej tack"..}..//E39491D304978BACD9070562E0A6EEE651A98CF6837F1DB2468B9C7E0CC6375A44644A24FA97350CC007188E7C576FC514EAE331457E92269C12BA773718F5F5

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	5.641484195960407
Encrypted:	false
SSDEEP:	24:7uGS2QvNaIeIse0jz0CtBsvzCOvje4DFkNHiNQd1NHVtwKf7knlI:PaahjzHtWbnZMHfxf7knq
MD5:	DDDD98CBEB0B4CAA3EBD07A5E0CB1E66
SHA1:	B0BE8D31697E77F8B380A8C8744BFEDBB1D6FED5
SHA-256:	539E992BF9283E7846071EF37D49262DCA453C35E1F3D5083D62C6401FD85CEE
SHA-512:	D6E1643AF322A9EBF61A20844C1878C0190101063AAFB196392F302159073AA7DB31A6DD14CEFB0AD4F2C0AAABD90283CCA8A45685475A23AED1EB5DC20A96F5
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Dijital ya.am.n.z. koruyun",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor ki.isel bilgilerinizin yanl.. ki.ilerin eline d..mesini engeller.",.. WAIFF_TOAST_DESC_2_COHORT_1: ".ster al..veri. yap.n, ister banka i.lemi ger.ekle.tirin, ister web'de gezinin, .cretsiz ara.lar.m.z g.vende olman.za yard.mc. olur; siber su.lular.n hi.bir .ans. kalmaz.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor, ki.isel bilgilerinizin yanl.. ellere ge.mesini .nleyen .cretsiz bir ara.t.r.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Kendinizi vir.slere, k.t. ama.l. yaz.l.mlara ve .evrimi.i g.venli.inize y.nelik di.er tehditlere kar.. korumak i.in WebAdvisor'. etkinle.tirin.",.. WAIFF_BUTTON_ACCEPT: "Kendinizi koruyun",.. WAIFF_BUTTON_REMIND_LATER: "Daha sonra hat.rlat",.. WAIFF_BUTTON_DECLINE: "Hay.r, te.ekk.rler"..}..//90C4BC23F401D54C761EB4F5C9C37A9A8E3B6C4B4121D48AD1B98270647BEFFDB7E3D

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	917
Entropy (8bit):	6.338403140080997
Encrypted:	false
SSDEEP:	24:7uGFvQsaInleBd82wvxsnInlehoyliIodS8Vq99NZwFaN:RaI4i2ZnI9OXZwwN
MD5:	DC6DAF97B9DC13B3E898E6A5A787E3BA
SHA1:	74B37D418300292F280096EB57FE95B9BFFB871A
SHA-256:	599630556936E8F8473153F205CAC57CCB91FA23C33DA69F7078044C99DBE791
SHA-512:	3A3B5806A153416D0C847FE72E57D5B07CEB873597BB31F2D4CB216E563C0384BE9F44B97CEB3975B66A379D7B7906E621C40B20D464A144416A75D849C6FBED
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "........",.. WAIFF_TOAST_DESC_1_COHORT_1: ".... ...................",.. WAIFF_TOAST_DESC_2_COHORT_1: "........................................................",.. WAIFF_TOAST_DESC_1_COHORT_2: ".... ............................",.. WAIFF_TOAST_DESC_2_COHORT_2: "................................",.. WAIFF_BUTTON_ACCEPT: "....",.. WAIFF_BUTTON_REMIND_LATER: ".....",.. WAIFF_BUTTON_DECLINE: "...."..}..//5D540ED2997AD3923C0C63D702CC355961BF56FD4341F724E9BF3638107BE27CB27A92330BA3EC6D0C56110ADE4387F6CBD7AEFC331292A60A2E4CE2B78C8775++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	915
Entropy (8bit):	6.359291283545329
Encrypted:	false
SSDEEP:	24:7uGYvJeiCCpqKvZeedNsyinkdSgVq4cUyd5r5kP:GJRNxPy/r5kP
MD5:	CCB489D76BC04DBC638C5820F1A8E08A
SHA1:	891CBAE5DA51CA90B3EF926EA6ABA13270900929
SHA-256:	5B8BB1EB6E70C2FC24553267F6030491DC3AFF3457013638F1AB3681B9057160
SHA-512:	CE1946F142C98EDCFB111183E12EF8D68E08F1AB56F6D9A984916A6D92349C2289F33CB31AA0F8E9FF0840F965FD2C9134B7C5FA2EA1DB9161938ED953183FC2
Malicious:	false
Reputation:	unknown
Preview:	var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "........",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor .....................",.. WAIFF_TOAST_DESC_2_COHORT_1: "...............................................",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor ..........................",.. WAIFF_TOAST_DESC_2_COHORT_2: ".. WebAdvisor ...........................",.. WAIFF_BUTTON_ACCEPT: "....",.. WAIFF_BUTTON_REMIND_LATER: ".....",.. WAIFF_BUTTON_DECLINE: "......"..}..//A53A1D176110E16229498D10D83EC45A343D44AF4D96555DD63EDE071FFE3FA817E6EC66B631ECE9CEDED1E7A8AD700568C3E0A87E2E434C413361E53E8BB43D++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4962
Entropy (8bit):	5.653261060794862
Encrypted:	false
SSDEEP:	96:Ht5PSpPUGEAopoM4odOR9EPH1h1bTzUXToCnqIK92n4laxOQDgmA:rqpcGEAQ54ROdhlTCTXqIKM4lansmA
MD5:	8DF9D2513C2B79AB08C8C4AD6F7677C6
SHA1:	CA6978CA05314803D5B3E1CA65F951B2D23823FE
SHA-256:	6CA4BE72D71942C3E833E18980E2A0E4373DD6F959800B8BE3CF589095B48C72
SHA-512:	071B22D7412CFF0266A1FF53E0736A6C175DB504482443D4A4F7840F106DFA3C7A211B11F5C5E25ECEE00C9A7D96A7F49E4B1E462C742477D084D196FDA3E260
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Dokon.ete svoji ochranu na internetu . ZDARMA!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Jen tak d.l!",.. OEM_TOAST_VARIANT_INFO: "M..ete se na internetu c.tit mnohem bezpe.n.ji. P.idejte zabezpe.en. vyhled.v.n., abyste dokon.ili ochranu p.i proch.zen. internetu McAfee a zv..ili sv. bezpe.. na internetu.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Aktivov.n.m zabezpe.en. vyhled.v.n. jste dokon.ili nastaven. ochrany p.i proch.zen. internetu McAfee.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Zku.ebn. verze antivirov. ochrany McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Ochrana internetov.ho prohl..e.e",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Ochrana prohl..e.e je va.e linie obrany proti nebezpe.n.m webov.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4454
Entropy (8bit):	5.392312635713834
Encrypted:	false
SSDEEP:	96:Hud7h5xpL1yuPQacJspPbkwriNTSwcvEFyFQFgWr0:M7hTpByuodJspPbrriNmwcvkZFgWY
MD5:	A085A7DC8F71332B1EE6E5C2C547766A
SHA1:	01D051FFFC82C520DA6BADECD24C7842539CDB19
SHA-256:	AEC41D4D1F594B178C635BF9C92FA22E18DF23D1D5DB31E1B43AFE9470F34441
SHA-512:	F44E42EDFF79D232553E70089D48A88E8B6EB343C0C76B941D85F802677B6AEF66B8CE3E9D8C02A50375A888E94A44359C2CC55C05EC4E23183F81F9365B62F5
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "G.r konfigurationen af din onlinebeskyttelse f.rdig . GRATIS",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "S.dan!",.. OEM_TOAST_VARIANT_INFO: "Du kan have en endnu bedre beskyttelse online. Tilf.j s.gebeskyttelse for at g.re konfigurationen af McAfee Web Protection f.rdig og forbedre din sikkerhed online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Du har afsluttet oprettelsen af din McAfee Web Protection ved at aktivere s.gebeskyttelse.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Pr.veversion af McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Online browserbeskyttelse",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Browserbeskyttelse er din f.rste forsvarslinje mod usikre websteder, links, downloads, malware og meget mere.",.. OEM_TOAST_VARIA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4525
Entropy (8bit):	5.360098805453375
Encrypted:	false
SSDEEP:	96:Hu7HbtZh8r8XUawmvah/R70a0+PNIk02+qjdLcSpQkHDm:yHbF8rbme/RRpOk02+QtcSuka
MD5:	0F20449C6A646A4C5B52C12329032082
SHA1:	D2B1610A94E44239C86FAC7E0627D083B6139A97
SHA-256:	34B3DE122E45991A24FE3985C3F329212B6C52BD3DC088096FFEBC6DBDE7CEA1
SHA-512:	2EA327537878068947CEFACA02A175197B515D23158E76B3819CADA4DA6E729039E23F471557982F8846F820616E963EE1CEE10A34DFD4D7D057BD0BDE49448F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Komplettieren Sie Ihren Online-Schutz . KOSTENLOS!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Sie nutzen nicht alle Funktionen!",.. OEM_TOAST_VARIANT_INFO: "Ihr Online-Leben k.nnte noch viel sicherer sein. F.gen Sie Online-Suchschutz hinzu, um den McAfee-Webschutz zu vervollst.ndigen und Ihre Sicherheit im Internet zu erh.hen.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Sie haben den Suchschutz aktiviert . der McAfee-Webschutz ist jetzt vollst.ndig eingerichtet.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee-Testversion",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Browserschutz",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Der Browserschutz ist Ihre erste Abwehrreihe gegen unsichere Websites, Links, Downloads, Malware und mehr.",.. OEM_TOAST_VARIANT_F

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6944
Entropy (8bit):	5.100770852336955
Encrypted:	false
SSDEEP:	96:HwrU5F9ob1w9r4vQZEiH/MkCyf9Wxi8+cw2tV9fnozQRfQ7oR3r:QrU5FixMrp/MksxbhtV91I7oRb
MD5:	95EA2A80364715217C7DDE840FE3D462
SHA1:	7246F52A2EFE698337A6FC0D4D4244F98742AE39
SHA-256:	94C5146CDD2C457E7B528FC83B36D040F1D0236093314EAA6A3B8B7CFDA6A2C6
SHA-512:	DE4DBE388079E214FE1E85B5237BB7D7A4DA93DE8581EFC1A2B5BF2D54FD20ED518E41F81E6FD794E5EFB7DDE08FB70550B2FF798D387256E8D981563003450E
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "........... ... ........... ... ......... . ......!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "......!",.. OEM_TOAST_VARIANT_INFO: ".... ........ .. ..... ... ........ ... .......... ......... ... ......... .......... ... .. ............ .. ........... ... ......... McAfee ... .. .......... .. ........... ... .........",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "............ .. ....... ... ............ ... .......... McAfee .............. ... ......... ...........",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "...... McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABL

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4727
Entropy (8bit):	5.362226940627459
Encrypted:	false
SSDEEP:	96:HVm7IJTUE/c0dnhD6HaTKz+cfItWHMtDJHRLWyk7mEQheMxBu:IYUcno6mpbONH5Wt7mPheMxBu
MD5:	CF7E8691DB656D2A455232008F2D5499
SHA1:	85CCCF6A9B6B25B45CA9D1003D97A1E583BD6831
SHA-256:	2D0665CD7FF4C21DA2C5A9305013A569F6681DF864D06B48BA66A28001AB2A87
SHA-512:	1406E7D9995BA0102D5CB18B92E3F7316366B1609758FB0567E0F7FA157043675774FA0E6E3866E86CE989BF8C3820A021CE7F3E989E5AB31B73B44F08681828
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Refuerce su protecci.n online GRATIS",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ".Muy bien!",.. OEM_TOAST_VARIANT_INFO: "Puede navegar con mucha m.s seguridad. A.ada una capa de protecci.n a sus b.squedas en Internet con McAfee Web Protection.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Ha terminado de configurar McAfee Web Protection con la protecci.n para las b.squedas.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Versi.n de prueba del antivirus de McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protecci.n para navegar por Internet",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protecci.n del navegador es su primera l.nea de defensa frente a sitios web, v.nculos y archivos de descarga poco seguros, adem.s del malware y otras amenazas.",.. OEM_T

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4645
Entropy (8bit):	5.370734830236917
Encrypted:	false
SSDEEP:	96:H+uLpSRLUr0y8YDhD5MkLb6kyoRV41uRyrF4QVzpmM:euLiQgu4kLbLyqMuRAFjV8M
MD5:	B4BADA60479585FC51970242851DFBCE
SHA1:	A4105A7C966647FBE1F0C8004ADC89C9E1F6B91D
SHA-256:	27A21B7806748B574738996E34452C432C93099569CE4F1CDAD0C978AA5A5865
SHA-512:	B983B7DE8F17CAB93171458840C63A3D228F35EA433E8A186A111D5401ED181CD6E68D3EAA2DC03BB0BFDF287BFE7493505BF45F8743179C0A2C1B745FDD8E15
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Completa tu protecci.n en l.nea. .GRATIS!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ".Fant.stico!",.. OEM_TOAST_VARIANT_INFO: "Puedes estar mucho m.s seguro en l.nea. Agrega la protecci.n de b.squedas para completar McAfee Web Protection y mejorar tu seguridad en l.nea.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Has completado la configuraci.n de tu McAfee Web Protection activando la protecci.n de b.squedas.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Prueba de McAfee AntiVirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protecci.n del navegador en l.nea",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protecci.n del navegador es tu primera l.nea de defensa contra el malware, los sitios web, las descargas y los v.nculos inseguros, y mucho m.s

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4369
Entropy (8bit):	5.38535014315059
Encrypted:	false
SSDEEP:	96:HCY1buqqISrqXmaENWWAyROr+DTVgjifdQhyXEi1:i2bURGOAlyROrWgjCChEF1
MD5:	A385C19F5D51E3AADE4ECE527CEC23CC
SHA1:	05F0E93A29B2F89240B205DAFE98BA389E9FBD7E
SHA-256:	997E842550F5578AAEEA2E9273538F4B21BDECD564760F900A45C254B7C9B913
SHA-512:	5A88BC87A43C4B9C73484509F07B33B0FBB4446F8EFD5E8CB866993490CB393E1F33108B318329A9C03B49F3023301C5D3970935D425DA6800A1AB40FC0BEB3A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "T.ydenn. verkkosuojauksesi . MAKSUTTA!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Hienoa!",.. OEM_TOAST_VARIANT_INFO: "El.m. verkossa voi olla turvallisempaa. T.ydenn. McAfeen verkkosuojaus hakujen suojauksella ja paranna turvallisuuttasi verkossa.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Viimeistelit McAfeen verkkosuojauksen ottamalla hakujen suojauksen k.ytt..n.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee Antivirus -kokeiluversio",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Selaimen suojaus verkossa",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Selaimen suojaus on ensimm.inen puolustuslinjasi muun muassa vaarallisia verkkosivustoja, linkkej., latauksia ja haittaohjelmia vastaan.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "Hakujen suojau

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5002
Entropy (8bit):	5.357317440955675
Encrypted:	false
SSDEEP:	96:HZzGKZjPEluOR2wzvjc8/MWaAE+XZKn3mTvARBdphbmbQQQJA3jqtQjQ7ceO4:lVEzx/Zk3uvAdfdJo1jzeO4
MD5:	52A4698F37724F10151BE3C096FBE2F7
SHA1:	B426BD001FFEB7DE0E7D09C49DD77FC068E73510
SHA-256:	1697BF0B33AABE52BFAD66776DEF2768C91542C5A022B3802B4B3186D6055F1B
SHA-512:	F2E671427105E55AD544AEE245517A4783A9AE04264BBB5EBD3DA34884BA9FCE640B5E343D2527847199B55DDA266A5EBBF00A68E440399EA779D12C2F5EB31E
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Compl.tez votre protection en ligne - GRATUIT!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Quelle bonne d.cision!",.. OEM_TOAST_VARIANT_INFO: "Vous pourriez .tre beaucoup mieux s.curis. en ligne. Ajoutez la recherche s.curis.e pour compl.ter la protection Web McAfee et pour renforcer votre s.curit. en ligne.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Vous avez compl.t. la configuration de votre protection Web McAfee en activant la recherche s.curis.e.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: ".valuation gratuite de l.antivirus McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protection du navigateur en ligne",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protection du navigateur est votre premi.re ligne de d.fense contre les sites Web, lie

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4951
Entropy (8bit):	5.370840416068541
Encrypted:	false
SSDEEP:	96:H1dQtHATWE0/hUcGNyFmjjc8md8QPSsnRxKGF7juyNmYSff9j5rQgw2m:VKtrE0pIUL6sR727FBygVm
MD5:	F4E3435EF272E7C4DE3FFF427BFEE8C9
SHA1:	E438962D0DE9398F50C9273C34AB329445B89EAA
SHA-256:	53CE15AA15770BDCF583538338A4CB84978848C155A01079D109CBE920F4F29E
SHA-512:	0FD66D67C0D80265E0F9D13210A4C250FAB9C235DEFBE2D9B817A02DD99F856DE87AD46B9B50D839BEFB0F6ABCFDC21539468BD3A05817387E6A4C69BC861D8E
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Terminez la configuration de votre protection en ligne . GRATUITEMENT.!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Bravo.!",.. OEM_TOAST_VARIANT_INFO: "Vous pouvez .tre beaucoup mieux prot.g. en ligne. Ajoutez la protection des recherches pour compl.ter votre protection web McAfee et renforcer votre s.curit. en ligne.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Vous avez termin. la configuration de votre protection web McAfee en activant la protection des recherches.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: ".valuation de l'antivirus McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protection du navigateur en ligne",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protection du navigateur constitue votre premi.re ligne de d.fense contre les sites

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4651
Entropy (8bit):	5.4612289686312865
Encrypted:	false
SSDEEP:	96:HCsNsKVqer5TZNOZG9OBhwMsvA0+Ovho6rQYBi9ECH:zNsiqsZ4cM6A0+Ove60YM1
MD5:	4E70D4BE2D762E463BE5A3A3861586AF
SHA1:	A098501DB91EC5F4B5C8720501B748A46B90C6F7
SHA-256:	B20DF2F111439916FC2F45BCC41BB4BFC6205A9797BC53C442A9234CB68AE430
SHA-512:	C6A3121F62156D1A13537CCC65AB61364E2E923827745CC5CAFAAE597C690CA1B7688CA5088859C061FF2DA1464725B73B41D77626E91625D8AE32C4A1E92A79
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Dovr.ite svoju online za.titu . BESPLATNO!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Tako treba!",.. OEM_TOAST_VARIANT_INFO: "Na mre.i mo.ete biti puno sigurniji. Dodajte za.titu pri pretra.ivanju kako biste dovr.ili McAfee Web Protection i pobolj.ali svoju sigurnost na mre.i.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Dovr.ili ste postavljanje svoje McAfee Web Protection omogu.avanjem za.tite pri pretra.ivanju.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Probna verzija McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Za.tita preglednika na mre.i",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Za.tita preglednika va.a je prva linija obrane od nesigurnih web-mjesta, poveznica, preuzimanja, zlonamjernog softvera i jo. mnogo toga.",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4620
Entropy (8bit):	5.54480423719366
Encrypted:	false
SSDEEP:	96:HfqjRDpi/v3XWyYNDX5XcmPcnrW2S6CatskM0QlHDS:/q7gGFDX5dorWKskCFu
MD5:	1CA78A205192F52EA676515486C81AAC
SHA1:	A01170B5808372F575FF7455F68A586D2FB48D36
SHA-256:	CA594084A6D915EB7B5BD130FD8D16C64621EEE9D8D6A69E82523D0AE785A945
SHA-512:	3571524AC31B6793ADBFDBE00E789440406AECE578CDC4DF2D45C5E4004EAD74CA08C36A9C0F0533F9C9E15B050D8FD4F9DA167FC9658DF324349FA8DC1FB210
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Eg.sz.tse ki online v.delm.t . INGYEN!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Nagyszer.!",.. OEM_TOAST_VARIANT_INFO: "M.g nagyobb biztons.gban lehet online. Enged.lyezze a v.dett keres.st, hogy teljess. tegye a McAfee webes v.delmet, .s n.velje online biztons.g.t.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "A v.dett keres.s bekapcsol.s.val befejezte a McAfee webes v.delm.nek be.ll.t.s.t.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee v.rusirt. pr.baverzi.ja",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Online b.ng.sz.v.delem",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "B.ng.sz.je v.delme a frontvonal a nem biztons.gos weboldalak, hivatkoz.sok, let.lt.sek, k.rt.kony programok stb. elleni biztons.g ter.n.",.. O

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	5.244617136812891
Encrypted:	false
SSDEEP:	96:HQj/oecik1Rs8CwrTww7Jr6QdIBOG1XY4RO2YC+qQAj7j1Z:4/obl1VnUw7Jr6QdIh1XY4RO2YC+pC7P
MD5:	A1CFE943711D68E29FB0BAF515C3BE30
SHA1:	3DF269E7BBAA6F5661D6BF38736F6C9D93C3C6BD
SHA-256:	AD7191575F92C5208DD7589BF0A61AECB8E3DDDDF65A0274DA1F87DCD21C1C4D
SHA-512:	4E7A11C2F071A006D64766091FEF24B177194F2788D228B11BFF8992D8567BDBB0336800DE9D01F93B4DB7E355763C30ABBDAD481753485217301D976A3C0919
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Completa la tua protezione online - GRATIS",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Ottimo!",.. OEM_TOAST_VARIANT_INFO: "Puoi migliorare notevolmente la protezione online. Aggiungi la protezione delle ricerche per integrare McAfee Web Protection e migliorare la tua sicurezza online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Hai completato la configurazione di McAfee Web Protection attivando la protezione delle ricerche.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Prova di McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protezione online del browser",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protezione del browser . la prima linea di difesa da siti Web, collegamenti e download non protetti e dal malware.",.. OEM_TOAST_VARIANT_FEATURES_DISAB

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5215
Entropy (8bit):	5.863428248831096
Encrypted:	false
SSDEEP:	96:HaYG+SPT4mep9K9B95H1bccLyf/9f71bYwNKiVEVH9skXbrbQCQ6L2nKQKUGsS:q+SPT4mnh5d/KVYwNZiZ9RrOJ6sS
MD5:	CCE06280CB507190ADCE8BF0A6168DCA
SHA1:	218C69735C706098057A38D39B5832F61ED248A5
SHA-256:	C7033A7615EC1A3C25E5A150B3475408BDC0ABDBE2B2DE8D000ECB0DDE65C448
SHA-512:	FDC6D207F4361EF8E9EE4339C7508F88DF9073E1D276BA352544F7609AAB2C5C7AC6E0EBBBBEB737D5437E35C9F032C80BBE368F20D0EBF7ED5FADAC999D65C0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "................. - .....",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ".......",.. OEM_TOAST_VARIANT_INFO: "............................... McAfee Web Protection ..........................",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: ".............McAfee Web Protection ...............",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "..... .............",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: ".........",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "................

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	5.834254412199816
Encrypted:	false
SSDEEP:	96:HNby+JvldshnPhOVGUZoI+0MYAT2T1eHEzdaVQkwpSMXH:tGk3sNhxHI+0cUKu06kTMX
MD5:	1B44458C43DD2FA2C7142399F4FE9834
SHA1:	6851B11509CD2477E7E145A3A332AA616CFCC0E3
SHA-256:	8107755D51D54BA5E22FC4C25A2E6E0ED10E50A37D4D8A0CD6E83D8A7A69A480
SHA-512:	6C7E1BAEB538CD145B86BCE80CF53D33039ECBB213B6F15A2150AB19C6806EF4728D5430675AEC803D04BB792173753585D29C17AB4E1FA36A4880BAA6B1668B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "... ... ... ... ......",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "......!",.. OEM_TOAST_VARIANT_INFO: "... ... ... . ..... .. ... .... ... McAfee . ... ... ... ... ......",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: ".. ... ..... McAfee . .. ... .......",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee ...... ...",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "... .... ..",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: ".... ... .... .. . ..., .., ...., ... .. .. ... ... ......",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4467
Entropy (8bit):	5.389537176674528
Encrypted:	false
SSDEEP:	96:HqSH3f2pqCBDGeE36ZmcQf5xPCN1LeCYrWbVhYqeQGE/MS4e:KmW4eClJ/PCN1LXYr2LYqdGE/x4e
MD5:	A4C6807924B6BF966555B5DBD9EC1793
SHA1:	F5A8B3D64BF446D90445028D5E7BA44E049EA241
SHA-256:	2ED4452C9D2E821FD0972277502EA4C6D2C2B19BA95731FC5A9829B2D5A52E48
SHA-512:	F58EF195FD3D4E0861C7A0F2B4AE1F104CACBE777D2D85B112B7F8F9BB7F639A9F1C3311E1A53EAA3D800B926AA65F33DBEF96D3294AAB4C362DD9ED6FD3BBBB
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Gj.r nettbeskyttelsen din komplett . KOSTNADSFRITT!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Ikke verst!",.. OEM_TOAST_VARIANT_INFO: "Du kan bli mye tryggere p. nettet. Legg til s.kebeskyttelse for . gj.re McAfee nettbeskyttelse komplett og forbedre nettsikkerheten din.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Du fullf.rte konfigureringen av McAfee nettbeskyttelse ved . aktivere s.kebeskyttelse.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Pr.veversjon av McAfee antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Nettleserbeskyttelse",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Nettleserbeskyttelse er ditt fremste forsvar mot usikre webomr.der, koblinger, nedlastinger, skadelig programvare med mer.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME:

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4299
Entropy (8bit):	5.383943743957999
Encrypted:	false
SSDEEP:	96:H2AwS9S9NzRHuSpGikmkH4XRgPKvpR1E1B2azPDcF2g+FeksVMkgR1pfQ5V:WAweeN9hGikmkHDKpRS1EaTDw2g+Ffs9
MD5:	17EE9A390B4432C9B6B56E5D646D17ED
SHA1:	33FCBB02679F92B160DE38F9B7E94BA88101A392
SHA-256:	9A05EAE0A7A690674C34D88CD6774E8CE18747338511182716D32AF14A263EB9
SHA-512:	22D4ECF9B2C6CD1FAE91F9932ED94BFC2EF2A83092149829B243E97342199266BC6D29AA9E1DF1E3696D0EF93F9407386400B0E77E825466BB130A480E4A999A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Voltooi uw online bescherming . GRATIS!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Goed gedaan!",.. OEM_TOAST_VARIANT_INFO: "U kunt online veel veiliger zijn. Voeg zoekbescherming aan uw McAfee-webbescherming toe en verbeter uw online veiligheid.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "U hebt het instellen van uw McAfee-webbescherming voltooid door zoekbescherming in te schakelen.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Proefversie van McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Online browserbeveiliging",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Browserbeveiliging is uw eerste verdedigingslinie tegen onveilige websites, koppelingen, downloads, malware en meer.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "Zoekbescherming",.. OEM_T

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	5.574820600496478
Encrypted:	false
SSDEEP:	96:HeH6Ry8L5clQB1MuoIbuNO8Q2STtWQLpXsJi6jiTZ/80zthQX2wyOjj:+Ht8tclQB1AnO8Q2STtWQLpXsJrEZ/87
MD5:	A9AB933906D018444065E6AFF57AA269
SHA1:	E562CF39C58DA9099185F983FA0E5413E7657D95
SHA-256:	60D4D1098AC398CC82F0C16998CCB9195AC0B637C274BFC516BF667C3FCF7A69
SHA-512:	4A596D6308FBFAF12B2277A6F452766805AEF1CD512507F7F9F8745DD84AB70CBEC6B85885E19812DF7C137488A05E181FC73844021A364D444DEA0BF820EEE6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Wzmocnij swoj. ochron. w Internecie . BEZP.ATNIE!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Dobra robota!",.. OEM_TOAST_VARIANT_INFO: "Mo.esz mie. znacznie wi.ksz. ochron. w Internecie. Dodaj ochron. wyszukiwania, aby wzmocni. ochron. funkcji McAfee Web Protection i zwi.kszy. swoje bezpiecze.stwo w Internecie.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Uko.czono konfiguracj. funkcji McAfee Web Protection poprzez w..czenie ochrony wyszukiwania.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Wersja pr.bna programu McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Ochrona przegl.darki w Internecie",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Ochrona przegl.darki to pierwsza linia obrony przed niebezpiecznymi witrynami, ..czami, pob

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4556
Entropy (8bit):	5.385079849437009
Encrypted:	false
SSDEEP:	96:Hlahgzv62PaQaLuR89CrPnzGS77lq+XQs6s:FaqvFL7R89MPnzGS77U+Asz
MD5:	87290CB0A50077449336BE1E2A3DDDCE
SHA1:	5121E1F7916B651BEA3F91BB17BB2A797E75BF82
SHA-256:	3743A392AD98A9F5A89B07AB5FB4B403185317C18F31AA235A1BD5001A1C5391
SHA-512:	A098FAE2FAAF60242C5768C35D9DFE497988EE442D064C08461D6B3D7A890D2740ABF0005F4B9454533EBDDE7D0D02DE0498653CE43B8BE63320869D24B8E57B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Conclua a sua prote..o on-line GRATUITAMENTE!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ". isso a.!",.. OEM_TOAST_VARIANT_INFO: "Voc. pode ter muito mais seguran.a on-line. Adicione prote..o de pesquisa para completar o McAfee Web Protection e aumentar sua seguran.a on-line.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Voc. concluiu a configura..o do McAfee Web Protection ativando a prote..o de pesquisa.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Avalia..o gr.tis do antiv.rus da McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Prote..o do navegador on-line",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "A prote..o do navegador . sua primeira linha de defesa contra sites, links e downloads inseguros, malware e muito mais.",.. OEM_TOAST_VARIA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4478
Entropy (8bit):	5.369224961069465
Encrypted:	false
SSDEEP:	96:HI2q8anq+9cCh9FcTVvtObxsp0R1vsfYRq+XQwroKh:o38eq7CTWRvtO6pe1vsfYg+Aw/
MD5:	69D59C7DFB5269E2AB75A5C8E37A5E92
SHA1:	B5433B6A152ECA99D46DA9EFE6C8D16765E63735
SHA-256:	D2D6D2735601FA9F1383A98D9EC40D9478E695B669011AD965EE7F5CED8B0B31
SHA-512:	48D121A0122D9A72717286EA567A3057D2600B4180565A916DD403E30D88174AA1C4F5AA1310FFC5D4B850856853DDE6B2A0922953FF79C9A44A3AAD4135EFAE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Complete a sua prote..o online . GR.TIS!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Boa!",.. OEM_TOAST_VARIANT_INFO: "Pode estar muito mais seguro online. Adicione a prote..o de pesquisa para completar o seu McAfee Web Protection e aumentar a sua seguran.a online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Terminou de configurar o seu McAfee Web Protection ao ativar a prote..o de pesquisa.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Avalia..o do antiv.rus McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Prote..o de browser online",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "A prote..o de browser . a sua primeira linha de defesa contra Web sites inseguros, transfer.ncias, malware e muito mais.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "P

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6441
Entropy (8bit):	5.187043096010651
Encrypted:	false
SSDEEP:	96:H3P3dV2BQF3iK4ttHiUWB3E4L2bLrrDSiaA1oSUd0BSO+Vft1ZQpmvfRoLCF:v/2Bo3L4iPdMPnSvA1UQbGf6pMfRoL8
MD5:	4A0A8E10A499BF1F70DCF4BA51AE5175
SHA1:	D4AD51BCE9EA3E40D965E873F91D4D0C387E6D77
SHA-256:	7AAFE063CF64C6B1BB6CF1727E8C540FE3747A26388C946AA746142FACF93164
SHA-512:	85DB099271143BBCC3257D9D6C906E7F3C091F02AB9B2255E07D1250EDFDC0F0241F3401625578909ED430F7883496199CDC204B4A895A2EBECF32799920F8C4
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "......... .... ...... . ......... . .........!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "... .......!",.. OEM_TOAST_VARIANT_INFO: ".. ...... ........ .... ............ . .......... ........ ...... ......, ..... ......... McAfee Web Protection . ........ .... ............ . ..........",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: ".. ......... ......... McAfee Web Protection, ....... ...... .......",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "....... ...... McAfee AntiVirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "...... ........ . .........",.. OEM_TOAST_VARIANT_FREE_LABE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	5.641615193218826
Encrypted:	false
SSDEEP:	96:Hu/cMHiS0zIB64Vb8JmdTv6zInPVO+mMQ9s/:2c+iE64xTdTvPVng9s/
MD5:	17B5E926E53D416E6C7395B987BD52A2
SHA1:	549F957E65575B218B9164A3BF6971864F7372D7
SHA-256:	F15C7E907A4CC72C439493387D645BCBB5D646D39BE1EE56E5D82A680BAEFA71
SHA-512:	1EBF984B89D6E0E6808A5B8C6A87C871EE56F8954C4FACC98818B6E6B12E6C90BBECAF78A4B19B423E82984ECF8DA7570E5328BE9BC33DDEE174DE5E31CDEC7F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Dokon.ite nastavenie online ochrany ZADARMO.",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Chr..te sa.",.. OEM_TOAST_VARIANT_INFO: "Aj online m..ete by. v.bezpe... Pridajte ochranu vyh.ad.vania do produktu McAfee Web Protection a.zv..te svoju bezpe.nos. online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Zapnut.m ochrany vyh.ad.vania ste dokon.ili nastavenie McAfee Web Protection.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Sk..obn. verzia antiv.rusu od McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Ochrana online prehliada.a",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Ochrana prehliada.a tvor. prv. .rove. ochrany pred nebezpe.n.mi webov.mi lokalitami, odkazmi, stiahnut.mi s.bormi, malv.rom a .al..mi hrozbami.",.. OEM_TOA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4628
Entropy (8bit):	5.435037641966001
Encrypted:	false
SSDEEP:	96:H7718TA7STZFOZGOA9wSdASMoNNPDgYK0hQOLYBB/:b7glDu8ASMAtjK0mOEBx
MD5:	4FF05AF3D37C4012A38429AE926782FA
SHA1:	E46BDF4664FD2D15F2149C383314C672E41E5024
SHA-256:	2313221E408F8DA8253D7BE37B2258E7F0E1C5164467CA3FD8FDA80A8526BFD6
SHA-512:	ACF0561CF71B932AECDF3FF96846BB93E820CD71520CDFCFFE234352B59C598590D737DD5710423ACEC819DABF8BE55D77E40352208B7B6CA694AC380DD7DF61
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Upotpunite za.titu na internetu . BESPLATNO!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Prava stvar!",.. OEM_TOAST_VARIANT_INFO: "Mo.ete biti mnogo bezbedniji na internetu. Dodajte za.titu pregledanja kako biste upotpunili McAfee Web Protection i pobolj.ali bezbednost na internetu.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Upotpunili ste postavku McAfee Web Protection omogu.uju.i za.titu pregledanja.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Probna verzija McAfee antivirusnog programa",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Za.tita pregleda.a na internetu",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Za.tita pregleda.a je va.a prva linija odbrane od nebezbednih veb lokacija, veza, preuzimanja, malvera i jo. toga.",.. OEM_TOAST_VARIANT_FEATU

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4220
Entropy (8bit):	5.441827768317273
Encrypted:	false
SSDEEP:	96:HkTQd3F1N1KuBfzHv7afFmZMfSseE08bwzGt9S0NpQIrCF+AQmGIuBm:KWVBbz5vsec0zK9p1LL/IN
MD5:	6AC7167B48887B8D895EB9C18B5BC4CC
SHA1:	CDD06D618920399CF9DD35D57B947E6275B6057B
SHA-256:	D81F7D4E27502BC091269685E6F0C01F44E2974B6C81B47A65AFABF3AB98E9F5
SHA-512:	846D7DE66FADB9717F43837DDD978C4852FD6C5505C9724BCCAA33DB161EB86BD4BDF9D03D6918D866D84824744040BDB69272096CA01518DBA71E2547E2FED5
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Fullborda ditt skydd online - KOSTNADSFRITT!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "S.d.r ja!",.. OEM_TOAST_VARIANT_INFO: "Du kan surfa mycket s.krare. L.gg till s.kskydd f.r att komplettera McAfee Web Protection och f.rb.ttra din s.kerhet online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Du har fullbordat inst.llningen av McAfee Web Protection genom att aktivera s.kskydd.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Provversion av McAfees virusskydd",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Webbl.sarskydd online",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Webbl.sarskyddet .r ditt f.rsta f.rsvar mot os.kra webbsidor, l.nkar, h.mtningar, malware och mer.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "S.kskydd",.. OEM_TOAST_VARIANT_FEA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4525
Entropy (8bit):	5.527304959583617
Encrypted:	false
SSDEEP:	96:HsafCWrSckFzm3EzHFSCvXV4lsQtFT76w:MaKWrSzm3EzHFSCP43Pmw
MD5:	6F533DB4BBA76B4DA5C26495E054A633
SHA1:	E5D21FC51C2B7E5C24B4BC0AB6AEC75DC6B0C6BC
SHA-256:	A62F652BEA97725BEF4AADDF987040CCE0A98541E582EA2F6985BA6AD2944701
SHA-512:	7F0ED02AEFE8FF7222090BBB5BE89F8D60F4BAE1A3C8CEB475E39B20BC01296927727590BCE086C1E5E40DD3C378DDB9D23CD08023DD19D56657AA59AC154E38
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: ".evrimi.i koruman.z. tamamlay.n - .CRETS.Z!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Tebrikler!",.. OEM_TOAST_VARIANT_INFO: ".evrim i.i .ok daha g.vende olabilirsiniz. McAfee Web Protection'. tamamlamak ve .evrim i.i g.venli.inizi art.rmak i.in arama korumas.n. ekleyin.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Arama korumas.n. etkinle.tirerek McAfee Web Protection'. .evrim i.i kurmay. tamamlad.n.z.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee Antivirus Denemesi",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: ".evrim i.i taray.c. korumas.",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Taray.c. korumas.; g.venli olmayan web siteleri, ba.lant.lar, indirmeler, zararl. yaz.l.m vb.'ine kar.. ilk savunma hatt.n.zd.r.",

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4033
Entropy (8bit):	6.10730871533129
Encrypted:	false
SSDEEP:	96:H69N08pRNQ/OJJNZsjB90G3Qm/aCQVHmkum6Q:a9+qN7JJ7mBKUQCaBNduA
MD5:	B644D5BA4787DDEE3DED56D60963AB57
SHA1:	E39137D5D68610A1F288B8E2F387E50832A8FF27
SHA-256:	094A9B8854353572BC1835CC97C0B75DD2654804AD524911D1432D0C5D53F356
SHA-512:	79567528F7659444943EE32827F95B2BD0AEC5EA2D466851CB4E7F7561055B00001C579345338073C9F7EC2679E6C49AC26A89D48DF872B1ABB83B0B9E59BC45
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "........ . ..!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ".....!",.. OEM_TOAST_VARIANT_INFO: ".......................................",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: ".......................",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "...........",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: ".......",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: ".................................",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "....",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_DESC: "......

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4288
Entropy (8bit):	6.169799601205913
Encrypted:	false
SSDEEP:	96:HummxlGEjsinJjE8X7IujB0LbIF5fFrQTyK6w:OmmOvkEU7IuN0+5fF0v6w
MD5:	5858CF78FE8413A686CF0458B7F06938
SHA1:	39C3E27397B99F01B9103214EBBC968EFCBD41F4
SHA-256:	4634E77F8ABF2E2C545B7DF9D485706C0652AECC343B4CDF29F357DD6973C9A9
SHA-512:	D8E59383665B8286FD141FAA40AC7D6C8626ECB301E517DC76AEE76DD0325D059BF98490C4101F63C3C6E7B4FE67A9DB3BEB6B4FEA02B55436127E1A5FC98822
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: ".......... . .....",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "......",.. OEM_TOAST_VARIANT_INFO: "................ McAfee Web ...................",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "............. McAfee Web ......",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee Antivirus ..",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: ".......",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: ".....................................",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "....",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_DESC:

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3415
Entropy (8bit):	5.667545190162343
Encrypted:	false
SSDEEP:	96:calbcPcTkV6hxvM/L4PgzN/6hxO232sN4agGum9t:GUwdkec2sN4agGum9t
MD5:	D0CAE9E568091C64A2774F4835937CF1
SHA1:	FE471F087C875DCC96F8C899BE1E3B7EC18AD3FA
SHA-256:	BBFF6BB3FE60B5664D67D2EEE9AF3D5DC888113D303E2DEA7CD21CBC8930AD19
SHA-512:	D308DE0690577DD8B1D8C442A3857D76DE55F639C322E2268AF20E16B8E389967DFDE9C08B38ED49F95C85C8CD68414BE58BD7830E2649DAB47B354A9A525716
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "N.pov.da",.. HELP_FAQ_TITLE: "Nej.ast.j.. dotazy",.. HELP_SUPPORT_TITLE: "Podpora",.. HELP_EMAIL_US: "Za.lete n.m e-mail na adresu",.. ABOUT: "O aplikaci",.. ABOUT_DESCRIPTION: "D.ky aplikaci {0} se m..ete na internetu l.pe rozhodovat.",.. CREATE_SAFER_PASSWORDS: "Vytv..en. bezpe.n.j..ch hesel",.. DOWNLOAD_CONFIDENTLY: "Stahov.n. bez obav",.. SETTINGS_SS_OPTION_ALL: "Informovat o bezpe.nosti v.sledk. hled.n. ve v.ech vyhled.va..ch",.. SETTINGS_SS_OPTION_NONE: "Neinformovat o v.sledc.ch hled.n.",.. SETTINGS_SS_OPTION_SS: "Informovat o bezpe.nosti v.sledk. hled.n. pouze ve slu.b. Bezpe.n. hled.n.",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Vlo.te nebo zadejte adresu URL.",.. TRUST_SITE: "D.v..ovat str.nce",.. DONT_TRUST: "Ned.v..ovat",.. HELP_FAQ_SECTION_ONE_HEADER: "K .emu slou.. aplikace {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "D.ky aplikaci {0} se m..ete na in

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3222
Entropy (8bit):	5.395400252005755
Encrypted:	false
SSDEEP:	96:cIWPf2VFTTGDGMZO4WVFwT/s9vyNnma/DvOvEiFk83qS8sDQTjmHBgpK+:9FMZAOgFiizJMjmWA+
MD5:	024CF90E2338E85A4DD9BE80B3BE1F74
SHA1:	40498CEE4A4F878D8B4EEE21688B6E0D7759DCFC
SHA-256:	173E39943AE937D9D927589BBB9FA733810C5F41D8CDA7F827B5F93FF99D6E49
SHA-512:	06D98804E904B94DECB76CF89E8C0E7DB83BDA72C07BFD6667DE234ADDB33D369BB0DE5FDA522E3DC0CEFC13C4EEA2C17A29EDABEB5930D8854D32C2DA5F38B7
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Hj.lp",.. HELP_FAQ_TITLE: "Ofte stillede sp.rgsm.l",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Send en mail til os p.",.. ABOUT: "Om",.. ABOUT_DESCRIPTION: "{0} hj.lper dig med at tr.ffe de rigtige beslutninger, n.r du er p. nettet.",.. CREATE_SAFER_PASSWORDS: "Opret sikrere adgangskoder",.. DOWNLOAD_CONFIDENTLY: "Sikre overf.rsler",.. SETTINGS_SS_OPTION_ALL: "Fort.l mig, om et s.geresultat er sikkert i alle s.gemaskiner",.. SETTINGS_SS_OPTION_NONE: "Fort.l mig ikke om s.geresultater",.. SETTINGS_SS_OPTION_SS: "Fort.l mig, om et s.geresultat kun er sikkert i Sikker s.gning",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Inds.t eller skriv URL-adressen",.. TRUST_SITE: "Har tillid til websted",.. DONT_TRUST: "Har ikke tillid",.. HELP_FAQ_SECTION_ONE_HEADER: "Hvad er {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} hj.lper dig med at tr.ffe de rigtige beslutninger, n.r du er p. nettet.",.. HELP_F

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3302
Entropy (8bit):	5.381142569836547
Encrypted:	false
SSDEEP:	96:c5vPqTKqMocuMD9nd/9j25ktHec9VYwpu4sD2oitoWD:BNMVLac+uYwp9sD2ptH
MD5:	E66FC7059526AE7B9BA1EBDFFC1F77D2
SHA1:	8A8E8554C9D9D62AAC14D7BE66FD538F48954C0A
SHA-256:	1C56CC1C5C3E0AEC60D67DE136C6660C83C2F1AA179605D995ED6F0A1B664D08
SHA-512:	97F65793A7CAC1887CD35808D549131BDBE332B55A599B34A00C108BD1B4A656A68AC491F05B99CD5EF76326048ED39DE7EB4CA8698027AEA6CB1560CC4BD16E
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Hilfe",.. HELP_FAQ_TITLE: "H.ufig gestellte Fragen (FAQs)",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Senden Sie uns eine E-Mail:",.. ABOUT: "Info",.. ABOUT_DESCRIPTION: "Dank {0} k.nnen Sie besser entscheiden, welche Websites Sie unbesorgt besuchen k.nnen.",.. CREATE_SAFER_PASSWORDS: "Sicherere Kennw.rter erstellen",.. DOWNLOAD_CONFIDENTLY: "Sichere Dateien herunterladen",.. SETTINGS_SS_OPTION_ALL: "In jeder Suchmaschine Bewertung von Suchergebnissen anzeigen",.. SETTINGS_SS_OPTION_NONE: "Keine Bewertung von Suchergebnissen anzeigen",.. SETTINGS_SS_OPTION_SS: "Nur bei der sicheren Suche Bewertung von Suchergebnissen anzeigen",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL einf.gen oder eingeben",.. TRUST_SITE: "Site als vertrauensw.rdig einstufen",.. DONT_TRUST: "Nicht als vertrauensw.rdig einstufen",.. HELP_FAQ_SECTION_ONE_HEADER: "Was ist {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "Dank {0} k.nnen Sie

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5323
Entropy (8bit):	5.032069401968367
Encrypted:	false
SSDEEP:	96:czSqYMiAFSTIbO48c2aO490VuVMGzqRcAF+gx/ijYz2HC8Tt7iVJnIjz1NCPcWF2:DMO8w3BVGt22jz1QPltZIHx
MD5:	BE98E64A61F6063DB453D8E3B14498F9
SHA1:	B156FD2DB25166A750B997794DD829A6F4349369
SHA-256:	8B42619BB2293B4C6D65659A8233E4CE78C73AE42F778179F44A95E97F39CD99
SHA-512:	CF2D582B9B90C8B86B20056E1DF75A176E04BDA07A0D66231A1148A915891DAF7559C4C659978EC96F9A4A97025D41A40B55DFC4D1722276ED055763B8A53D3F
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: ".......",.. HELP_FAQ_TITLE: "...... .........",.. HELP_SUPPORT_TITLE: "..........",.. HELP_EMAIL_US: "....... ... ...... ............ ............ ... .........",.. ABOUT: "...........",.. ABOUT_DESCRIPTION: ".. {0} ... ..... .. ......... .......... ......... ....... .. ... ......... ... ... Internet.",.. CREATE_SAFER_PASSWORDS: "............ ............. ........ .........",.. DOWNLOAD_CONFIDENTLY: "......... ...... .. ........",.. SETTINGS_SS_OPTION_ALL: ".. ............ .. ... .......... .......... ..... ....... .. ........... ......... ..........",.. SETTINGS_SS_OPTION_NONE: ".. ... ............ ..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2970
Entropy (8bit):	5.3552337380317
Encrypted:	false
SSDEEP:	48:cwr9pTTyT7Few0MxjU99E/E0v7StLuJHTuiGextXq/JXTGpUx86NQ4QeQr4+8LkK:cwr9pPyTEMxI99E/fTStLOz7xtulGOxZ
MD5:	6EF2CE5B8B5BB90A461735562BCF31E0
SHA1:	7DBE5D2A39B5C94C4DFD6128AF3B930B1E3FFB11
SHA-256:	AC8416144F7F4A34F299D7636BB7CABB411AFD3C770DE0E101442FEA4927532A
SHA-512:	492E95E4C9002F19C076DBC8032CB141687B61A523D47F020B01BA875C1810055124557ED0A97B4323760E5EB6D964F34FEAA45F90CB6C185DAC837179D57F7A
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Help",.. HELP_FAQ_TITLE: "Frequently Asked Questions (FAQs)",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Email us at",.. ABOUT: "About",.. ABOUT_DESCRIPTION: "{0} helps you make better decisions about what you do online.",.. CREATE_SAFER_PASSWORDS: "Create safer passwords",.. DOWNLOAD_CONFIDENTLY: "Download confidently",.. SETTINGS_SS_OPTION_ALL: "Tell me if a search result is safe in any search engine",.. SETTINGS_SS_OPTION_NONE: "Don't tell me about search results",.. SETTINGS_SS_OPTION_SS: "Tell me if a search result is safe only in Secure Search",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Paste or type your URL",.. TRUST_SITE: "Trust site",.. DONT_TRUST: "Don't trust",.. HELP_FAQ_SECTION_ONE_HEADER: "What is {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} helps you make better decisions about what you do online.",.. HELP_FAQ_SECTION_TWO_HEADER: "How do I share {0} with others?",.. HELP_FAQ_SECTION_TWO_CO

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3318
Entropy (8bit):	5.389092677966564
Encrypted:	false
SSDEEP:	96:cDEMyiTKKM+hOeBgn/qfBJq3/GQjD7mQujWoIcsp1lX:vieH+g1D7mfIcsJX
MD5:	D3B0B728BAEBD877C17C71E64FDC9FA9
SHA1:	E8FECA73463725DDDB6F74FE3BFC4C02EC78B15D
SHA-256:	FE0643FE7A711D26E1788044C83B0441FC73A2B0B6F6108E25BC7D6978DABA01
SHA-512:	AF5A0C6AEA94229B45A2E99976501B3BA971882C6FDE6545805ACBCACC4EB42EFE33B87827AA0EA0D08A1AFF86E1D99CB12298242CCA8F296989C62A4EC0152A
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Ayuda",.. HELP_FAQ_TITLE: "Preguntas frecuentes",.. HELP_SUPPORT_TITLE: "Soporte",.. HELP_EMAIL_US: "Env.enos un correo electr.nico a",.. ABOUT: "Acerca de",.. ABOUT_DESCRIPTION: "{0} le ayuda a tomar decisiones m.s fundamentadas acerca del uso que hace de Internet.",.. CREATE_SAFER_PASSWORDS: "Cree contrase.as m.s seguras",.. DOWNLOAD_CONFIDENTLY: "Descargue con seguridad",.. SETTINGS_SS_OPTION_ALL: "Informarme si un resultado de b.squeda es seguro en otro motor de b.squeda",.. SETTINGS_SS_OPTION_NONE: "No informarme de resultados de b.squeda",.. SETTINGS_SS_OPTION_SS: "Informarme si un resultado de b.squeda es seguro solo en B.squeda segura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Pegue o escriba la direcci.n URL",.. TRUST_SITE: "Confiar en el sitio web",.. DONT_TRUST: "No confiar",.. HELP_FAQ_SECTION_ONE_HEADER: ".Qu. es {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} le ayuda a tomar decisiones m.s fu

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3269
Entropy (8bit):	5.398972901259208
Encrypted:	false
SSDEEP:	96:cDEMRrT9tM+hOeBJDfE/ZABFWeLT91e5kkmpouToIc2eoxkHkO:SRO+gEDUkkmAIc6wL
MD5:	CF051BBF410DA11C4306F862D05EA2C4
SHA1:	1BD9711B079001803CC23C88A42BAAB91721F076
SHA-256:	D0D3F4DEDEB9F09E7647CBB740B6B8CE59B055A685FE75496A4DF786B710F917
SHA-512:	C27595E5B4B03997CA28F7B632E0A517706F3E29640DAE30083756B6C1077080911E239791BC1BFF1A380B4E074F2B8D42D2377EF377518D1474E99A5B3EF9D5
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Ayuda",.. HELP_FAQ_TITLE: "Preguntas frecuentes",.. HELP_SUPPORT_TITLE: "Soporte",.. HELP_EMAIL_US: "Env.enos un correo electr.nico",.. ABOUT: "Acerca de",.. ABOUT_DESCRIPTION: "{0} lo ayuda a tomar mejores decisiones acerca de lo que hace en l.nea.",.. CREATE_SAFER_PASSWORDS: "Cree contrase.as m.s seguras",.. DOWNLOAD_CONFIDENTLY: "Descargue con confianza",.. SETTINGS_SS_OPTION_ALL: "Comunicarme si un resultado de b.squeda es seguro en cualquier motor de b.squeda",.. SETTINGS_SS_OPTION_NONE: "No comunicarme sobre los resultados de b.squedas",.. SETTINGS_SS_OPTION_SS: "Comunicarme si un resultado de b.squeda es seguro solo en b.squeda segura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Pegue o escriba la direcci.n URL",.. TRUST_SITE: "Sitio de confianza",.. DONT_TRUST: "No confiar",.. HELP_FAQ_SECTION_ONE_HEADER: ".Qu. es {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} lo ayuda a tomar mejores decisiones acerc

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3156
Entropy (8bit):	5.343809524094855
Encrypted:	false
SSDEEP:	96:cFjnmzGSTEMQHo+X/lFYpHNVbA5yZq0Ui45u:dzGSxDlNFR8i48
MD5:	45A30EFBCDF6CD89C36B373F755342EB
SHA1:	59F75D6715E90BFFBB138244352271F8E60E26DF
SHA-256:	365D34F5BFE5082FB0E450C88D0275D9EA0C59130E5E6D7DFFBC9AF8AD76B3C5
SHA-512:	6564A0E58E07E67CAFCECABAF0CACAC041C950E48608BBB4B2D7B222AC19A8C2430D8362CB57760322FDF31B97C3B690C5CA9FFC4D3B1B819356C18A04BAA452
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Ohje",.. HELP_FAQ_TITLE: "Usein kysytyt kysymykset (UKK)",.. HELP_SUPPORT_TITLE: "Tuki",.. HELP_EMAIL_US: "L.het. meille s.hk.postia osoitteeseen",.. ABOUT: "Tietoja",.. ABOUT_DESCRIPTION: "{0} auttaa sinua toimimaan verkossa turvallisesti.",.. CREATE_SAFER_PASSWORDS: "Entist. turvallisempien salasanojen luominen",.. DOWNLOAD_CONFIDENTLY: "Luotettava lataaminen",.. SETTINGS_SS_OPTION_ALL: "Ilmoita, onko hakutulos turvallinen, miss. tahansa hakukoneessa",.. SETTINGS_SS_OPTION_NONE: ".l. n.yt. ilmoituksia hakutulosten turvallisuudesta",.. SETTINGS_SS_OPTION_SS: "Ilmoita, onko hakutulos turvallinen, kun k.yt.n Suojattua hakua",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Liit. tai kirjoita URL-osoite",.. TRUST_SITE: "Luota sivustoon",.. DONT_TRUST: ".l. luota",.. HELP_FAQ_SECTION_ONE_HEADER: "Mik. on {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} auttaa sinua toimimaan verkossa turvallisesti.",.. HELP_FAQ_S

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3475
Entropy (8bit):	5.383263860190444
Encrypted:	false
SSDEEP:	96:cyXk9LMTrBXOkXco29M5t6QUxT//fM5NzyKt6yQjhejXe:zZR+ksoX4xgbyK1Qjhere
MD5:	5953D9D74D83EB95B8ADDA87FD3B448C
SHA1:	8E2F7EA82DFE259178F8E2D8673874CF82F2009E
SHA-256:	FFCFE25E78E4834BA0E7F4BE8BC94DDC8969E75B5D7822B53907D529C47F6911
SHA-512:	F3465940646170AA4F897405834F05EB0F77D7EE8233A1FAE302714E3C64C31480A66EAECAD65EC31A9719FE5C96482401DD4C965325B354EE21385B6E705C9D
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Aide",.. HELP_FAQ_TITLE: "Foire aux questions (FAQ)",.. HELP_SUPPORT_TITLE: "Soutien",.. HELP_EMAIL_US: "Envoyez-nous un courriel au",.. ABOUT: ". propos",.. ABOUT_DESCRIPTION: "{0} vous aide . prendre de meilleures d.cisions sur vos activit.s en ligne.",.. CREATE_SAFER_PASSWORDS: "Cr.er des mots de passe plus s.rs",.. DOWNLOAD_CONFIDENTLY: "T.l.charger de fa.on confidentielle",.. SETTINGS_SS_OPTION_ALL: "Me dire si un r.sultat de recherche est s.r dans tous les moteurs de recherche",.. SETTINGS_SS_OPTION_NONE: "Ne pas me parler des r.sultats de recherche",.. SETTINGS_SS_OPTION_SS: "Me dire si un r.sultat de recherche est s.r seulement dans la recherche s.curis.e",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Coller ou saisir votre URL",.. TRUST_SITE: "Faire confiance au site",.. DONT_TRUST: "Ne pas faire confiance",.. HELP_FAQ_SECTION_ONE_HEADER: "Qu'est-ce que {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0}

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3557
Entropy (8bit):	5.404581861931083
Encrypted:	false
SSDEEP:	96:cyXkPWgMTpX56126MJk7OQTxN//i46XeNWtd0lDqKStVGC4jRgosKT:zrN1XU1G2xKnINCieosg
MD5:	11C6828B2F40BE0618C5D069D43DD379
SHA1:	329CEEB6CEE7A0AC76D8430213B3A0D432C292D1
SHA-256:	F2EDCCA3D6BA41FAFFD11174E4B6FABBDE66B85FBE4F05DC9797B8254EB08F85
SHA-512:	0428084E4F0C20D3C86CAF0E5A7F8D1E43AD1CD60EA893A82C2D481EC8A4D6F5B05B0FD3B17D3D8802A80615F94650FDF36111DD5C95212E975953F3596B259C
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Aide",.. HELP_FAQ_TITLE: "Foire aux questions (FAQ)",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Contactez-nous par e-mail . cette adresse",.. ABOUT: "A propos",.. ABOUT_DESCRIPTION: "{0} vous aide . prendre les bonnes d.cisions en ce qui concerne vos activit.s en ligne.",.. CREATE_SAFER_PASSWORDS: "Cr.ez des mots de passe plus fiables",.. DOWNLOAD_CONFIDENTLY: "T.l.chargez en toute confiance",.. SETTINGS_SS_OPTION_ALL: "Me dire si le r.sultat de la recherche est prot.g. dans tous les moteurs de recherche",.. SETTINGS_SS_OPTION_NONE: "Ne rien me dire sur les r.sultats de la recherche",.. SETTINGS_SS_OPTION_SS: "Me dire si le r.sultat de la recherche est prot.g. dans la recherche s.curis.e uniquement",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Collez ou saisissez l'URL",.. TRUST_SITE: "Approuver",.. DONT_TRUST: "Ne pas approuver",.. HELP_FAQ_SECTION_ONE_HEADER: "Qu'est-ce que {0}.?",.. HELP_FAQ

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3286
Entropy (8bit):	5.4526391390715085
Encrypted:	false
SSDEEP:	96:cv359TfWlMbZ5ur/cOKc+vOOES9Wxt9yzoIEZUDrBdj7T:iLW2yYlVES9+96UuDrBdj7T
MD5:	54576C02A4EDB6FB80DE5A4874E042FA
SHA1:	013B9279EDF53248FB7F06BBBA8CF4C2BF5251B5
SHA-256:	23129E0D7391D4AEA2F5D06FF7DB29F8111102A09FF84D99A0F0A0D56011E5EC
SHA-512:	6EB88689A2BDEBE3110DFBFD681D2395BBB01820D491BF8B5CD16E309CFBBF0541746425E366AAB52C26491EDAB8361F69A024631E8D2FCB3FC9A5347EA06370
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Pomo.",.. HELP_FAQ_TITLE: ".esto postavljana pitanja (.PP)",.. HELP_SUPPORT_TITLE: "Podr.ka",.. HELP_EMAIL_US: "Obratite nam se na adresi e-po.te",.. ABOUT: "O aplikaciji",.. ABOUT_DESCRIPTION: "{0} poma.e vam u dono.enju boljih odluka o tome .to .inite na mre.i.",.. CREATE_SAFER_PASSWORDS: "Stvorite sigurnije lozinke",.. DOWNLOAD_CONFIDENTLY: "Pouzdano preuzimajte",.. SETTINGS_SS_OPTION_ALL: "Obavijesti me ako je rezultat pretra.ivanja siguran u bilo kojoj tra.ilici",.. SETTINGS_SS_OPTION_NONE: "Nemoj me obavijestiti o rezultatima pretra.ivanja",.. SETTINGS_SS_OPTION_SS: "Obavijesti me ako je rezultat pretra.ivanja siguran samo u Sigurnom pretra.ivanju",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Zalijepite ili unesite svoj URL",.. TRUST_SITE: "Mjesto smatraj pouzdanim",.. DONT_TRUST: "Ne smatraj pouzdanim",.. HELP_FAQ_SECTION_ONE_HEADER: ".to je {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} poma.e vam

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3670
Entropy (8bit):	5.56678554502903
Encrypted:	false
SSDEEP:	96:c491zbQ9T9aMhF7fQdq/SvRonzXfFNtvf1B1BER7yU8Q:tbQ9hfQfRonzb/3iRGU8Q
MD5:	F46ED1CD4F8975B7B21EF2B69088B95F
SHA1:	80925875018C4F8502C7EADE81351D2687DAB262
SHA-256:	6BFADE8B2E1EAF6F976A19FA4AE02C8FF6889FD5A640A61D5E5ADA6CDCDCECEE
SHA-512:	CBBEF5C7EDAE45DC45E4A9D4BED4A1DAC93160B824AB13B969EE63173A4A524E421145A2593D01AFB036E78D669D55E690A2C70DB6C99733B4D3E419B353435F
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "S.g.",.. HELP_FAQ_TITLE: "Gyakran ism.telt k.rd.sek (GYIK)",.. HELP_SUPPORT_TITLE: "T.mogat.s",.. HELP_EMAIL_US: "K.ldj.n nek.nk e-mailt az al.bbi c.mre:",.. ABOUT: "N.vjegy",.. ABOUT_DESCRIPTION: "A(z) {0} seg.ts.get ny.jt ahhoz, hogy jobb d.nt.seket hozhasson az online vil.gban.",.. CREATE_SAFER_PASSWORDS: "Biztons.gosabb jelszavak l.trehoz.sa",.. DOWNLOAD_CONFIDENTLY: "Biztons.gos let.lt.s",.. SETTINGS_SS_OPTION_ALL: "T.j.koztasson a keres.s eredm.ny.nek biztons.goss.g.r.l b.rmely keres.motorra vonatkoz.an",.. SETTINGS_SS_OPTION_NONE: "Ne t.j.koztasson a keres.si eredm.nyekkel kapcsolatban",.. SETTINGS_SS_OPTION_SS: "A keres.s eredm.ny.nek biztons.goss.g.r.l csak a Biztons.gos keres.sben t.j.koztasson",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL beilleszt.se vagy be.r.sa",.. TRUST_SITE: "Megb.zhat. webhely",.. DONT_TRUST: "Nem megb.zhat.",.. HELP_FAQ_SECTIO

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3280
Entropy (8bit):	5.323424979090058
Encrypted:	false
SSDEEP:	96:cF+xiITUmLgSM+xy07Zg/ikrQs9N46fkjorok0jQxsxj:QIIag/+fENbsErI0xsN
MD5:	6745D840D9E4B0098098B1197662A26F
SHA1:	4FBFBC104243E1789DAC7475614DBB70B10C3809
SHA-256:	25804D3A20129062A9E4119F3410954279F0E60C517D6722A47078E3AF24431F
SHA-512:	51D007A90380A93029AC51471C43EC52C0BD9AE046AAAEAE443431331CC4844354E0638BBDC9D316ED1E9BD658CFC0443DEA91C7CF1BD125F318D502334F401D
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Guida",.. HELP_FAQ_TITLE: "Domande frequenti",.. HELP_SUPPORT_TITLE: "Assistenza",.. HELP_EMAIL_US: "Contattaci via email all'indirizzo",.. ABOUT: "Informazioni su",.. ABOUT_DESCRIPTION: "{0} ti aiuta a prendere decisioni pi. consapevoli sulle attivit. online.",.. CREATE_SAFER_PASSWORDS: "Crea password pi. sicure",.. DOWNLOAD_CONFIDENTLY: "Scarica con la massima sicurezza",.. SETTINGS_SS_OPTION_ALL: "Comunicami se un risultato di ricerca . sicuro in un motore di ricerca",.. SETTINGS_SS_OPTION_NONE: "Non comunicare nulla riguardo ai risultati di ricerca",.. SETTINGS_SS_OPTION_SS: "Comunicami se un risultato di ricerca . sicuro solo in ricerca sicura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Incolla o digita l'URL",.. TRUST_SITE: "Considera affidabile il sito",.. DONT_TRUST: "Non considerare affidabile",.. HELP_FAQ_SECTION_ONE_HEADER: "Che cos'. {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} ti aiuta a prendere dec

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3760
Entropy (8bit):	5.75270028130737
Encrypted:	false
SSDEEP:	96:cFuvhOT6tGCuqZu0KMV1V6Gq//0bNbJkKjixAwRm4wegixVU09T:1YGtGCuyu0HfDFBPiKem4/gi/9T
MD5:	C64DC3B4046B207FC4B51F7C8A5AC13F
SHA1:	94D55C841A88B1625899AF31D322CDF019331D57
SHA-256:	F21F7A0ABB5CC7107EB213CA30375F2EB4F9B19369EF4165D72067AA93CC7751
SHA-512:	4FA9F9F8670E0B923ADEE298DEF0EF3C979DF1FDA715B024C7FCD56C5AB199221347C111B7D2835DB00971B0E7BD83FA71E6A21BD44878AE787C5683B86F0977
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "...",.. HELP_FAQ_TITLE: "...... (FAQ)",.. HELP_SUPPORT_TITLE: "....",.. HELP_EMAIL_US: "........",.. ABOUT: ".......",.. ABOUT_DESCRIPTION: "{0} ...................",.. CREATE_SAFER_PASSWORDS: "...............",.. DOWNLOAD_CONFIDENTLY: "...........",.. SETTINGS_SS_OPTION_ALL: "..........................",.. SETTINGS_SS_OPTION_NONE: "..............",.. SETTINGS_SS_OPTION_SS: ".... .....................",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL ................",.. TRUST_SITE: "........",.. DONT_TRUST: ".....",.. HELP_FAQ_SECTION_ONE_HEADER: "{0} .......",.. HELP_FAQ_SECTI

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3451
Entropy (8bit):	5.828760629956441
Encrypted:	false
SSDEEP:	96:c0hbqh5TgP81LM2z7i6B/+XP6HUdYXx/gAw8otAJ2y8BwMrN:JWQ8S76X6Avot3hDh
MD5:	0CA54218CF33566B86262F674A780C28
SHA1:	3CE9452FCBAAB39D8939130C9B5BD917D22AECE5
SHA-256:	2FC9CCBB7235D2B8E2A870DE4851F64F40C9D927D4AF731F1E6D411CDED55450
SHA-512:	2F90A0D45275F4412D93CBA0D0998FC69F92BA2395EFD890662C5A8F13BAA820CDECBF3559BE6EFDDD54D7ACD4E94A0797BA83AFF44701DCCC7470364325AAEC
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "...",.. HELP_FAQ_TITLE: "... ..(FAQ)",.. HELP_SUPPORT_TITLE: "..",.. HELP_EMAIL_US: "... ..",.. ABOUT: "..",.. ABOUT_DESCRIPTION: "{0}. .... ... .. . ... ... .. . ... ......",.. CREATE_SAFER_PASSWORDS: ".. ... .. ...",.. DOWNLOAD_CONFIDENTLY: "... ....",.. SETTINGS_SS_OPTION_ALL: ".. .. .... .. ... .... ..",.. SETTINGS_SS_OPTION_NONE: ".. ... .. ... ..",.. SETTINGS_SS_OPTION_SS: ".. ..... .. ... .... ..",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL. .. ... ......",.. TRUST_SITE: "... ..",.. DONT_TRUST: ".... ..",.. HELP_FAQ_SECTION_ONE_HEADER: "{0}. .....?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0}. .... ... .. . ... .

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.348525118195868
Encrypted:	false
SSDEEP:	96:cA9ffAT6MuE50WT/CGoDAUtGZpn2g3BBIxY:ejVoxtepD3B6xY
MD5:	7641FDF95399F1C6651B98DB1A9FFEE2
SHA1:	E2C8A08BA45495226EBB58B184C7C5B119B92D77
SHA-256:	55586E96C76FBBDBFE4A988DCF9F79ABB5A480C4F8D55207215ABD597855EBF0
SHA-512:	4833C74E156BF150266AFC28F2FE656F1F56AE117FC159B94129D411CDD81977DFDC77C5362BE8A4505349C4A6D9AA6417FBE92E91D40F73F85369CEDD98037E
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Hjelp",.. HELP_FAQ_TITLE: "Vanlige sp.rsm.l",.. HELP_SUPPORT_TITLE: "St.tte",.. HELP_EMAIL_US: "Send oss en e-postmelding til",.. ABOUT: "Om",.. ABOUT_DESCRIPTION: "{0} gj.r det enklere . ta bedre avgj.relser om hva du gj.r p. Internett.",.. CREATE_SAFER_PASSWORDS: "Opprett sikrere passord",.. DOWNLOAD_CONFIDENTLY: "Last ned uten bekymringer",.. SETTINGS_SS_OPTION_ALL: "Fortell om et s.keresultat er trygt, i enhver s.kemotor",.. SETTINGS_SS_OPTION_NONE: "Ikke fortell meg om s.keresultatene",.. SETTINGS_SS_OPTION_SS: "Fortell om et s.keresultat er sikkert, men bare i Sikkert s.k",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Lim eller skriv inn URL-adressen din",.. TRUST_SITE: "Klarer omr.de",.. DONT_TRUST: "Ikke klarer",.. HELP_FAQ_SECTION_ONE_HEADER: "Hva er {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} gj.r det enklere . ta bedre avgj.relser om hva du gj.r p. Internett.",.. HELP_FAQ_SECTION_TWO_HEAD

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3196
Entropy (8bit):	5.336277046109412
Encrypted:	false
SSDEEP:	96:cwMUf5ztTk0aUPDMavouzNv/lzz0TldANPQ3tBvlvS4:rhtaUQWiMctBvBP
MD5:	85B883CD451BC374F81809129A590763
SHA1:	6375FF032AE11DD4C29FFF03CFD784DE12336746
SHA-256:	F02D164EDB34EB0E6B625C84AD25ACEDC870DC99A1E55A0B8D2C5260D7DF0FC0
SHA-512:	DE883DB1DD2D0CC651530D58583ABA5BB84678F72D69E9AF59BBA2613478BE8396181B83DED43D1E07CBC107BFB0788F966A41D7E3A38DF4F02F8B6EB398C487
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Help",.. HELP_FAQ_TITLE: "Veelgestelde vragen",.. HELP_SUPPORT_TITLE: "Ondersteuning",.. HELP_EMAIL_US: "E-mail ons op",.. ABOUT: "Info",.. ABOUT_DESCRIPTION: "{0} helpt u betere beslissingen over uw online activiteiten te nemen.",.. CREATE_SAFER_PASSWORDS: "Maak veiligere wachtwoorden",.. DOWNLOAD_CONFIDENTLY: "Download probleemloos",.. SETTINGS_SS_OPTION_ALL: "Laat mij in elke zoekmachine weten of een zoekresultaat veilig is",.. SETTINGS_SS_OPTION_NONE: "Niets zeggen over zoekresultaten",.. SETTINGS_SS_OPTION_SS: "Laat mij alleen in Beveiligd zoeken weten of een zoekresultaat veilig is",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Plak of typ uw URL",.. TRUST_SITE: "Site vertrouwen",.. DONT_TRUST: "Niet vertrouwen",.. HELP_FAQ_SECTION_ONE_HEADER: "Wat is {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} helpt u betere beslissingen over uw online activiteiten te nemen.",.. HELP_FAQ_SECTION_TWO_HEADER: "Hoe kan ik {0} met

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3433
Entropy (8bit):	5.622176979721996
Encrypted:	false
SSDEEP:	96:cnWv3LDTIKXe8FDXdIzMn5VRe/8gAR+3jRsFAEEGs6L49l0v2dUPJJby:ZPUKpFDOIiRc7EA+lXUPJJby
MD5:	91E06E8152D4CAF64489BB3180D95811
SHA1:	0E2AE5052049A2DF1D125C311A54219F55CC0E72
SHA-256:	057F28198CDF4A30C32C867C840A2C27DA3905CAD400410C868ED8AEA353759D
SHA-512:	4E6AB64E73436CB76419FF28AF9EB912C61A91566778A360DA8612210B080AA88CEF71DB500002A5FA1728B1C3841983FAF047D4E7B1FA7CDCB46D57B105FA48
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Pomoc",.. HELP_FAQ_TITLE: "Cz.sto zadawane pytania",.. HELP_SUPPORT_TITLE: "Pomoc techniczna",.. HELP_EMAIL_US: "Wy.lij wiadomo.. e-mail na adres",.. ABOUT: "Informacje",.. ABOUT_DESCRIPTION: "Program {0} pomaga podejmowa. rozs.dne decyzje podczas przegl.dania Internetu.",.. CREATE_SAFER_PASSWORDS: "Tw.rz silniejsze has.a",.. DOWNLOAD_CONFIDENTLY: "Pobieraj bez obaw",.. SETTINGS_SS_OPTION_ALL: "Pokazuj oceny bezpiecze.stwa wynik.w wyszukiwania w ka.dej wyszukiwarce",.. SETTINGS_SS_OPTION_NONE: "Nie pokazuj ocen wynik.w wyszukiwania",.. SETTINGS_SS_OPTION_SS: "Pokazuj oceny bezpiecze.stwa wynik.w wyszukiwania tylko w wyszukiwarce Bezpieczne wyszukiwanie",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Wklej lub wpisz adres URL",.. TRUST_SITE: "Zaufaj witrynie",.. DONT_TRUST: "Nie ufaj",.. HELP_FAQ_SECTION_ONE_HEADER: "Co to jest {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "Program {0} pomaga podejmowa. rozs.dne

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3252
Entropy (8bit):	5.390656972550379
Encrypted:	false
SSDEEP:	96:cc0m2Tpgz2z24eMgUWy0/IULhYRukp+ATR8tXVfNTe:wloYdMIuQ8FVfhe
MD5:	B3137F167E12E8FB6F4139D9CE0F1FB0
SHA1:	61FBFFE96E15180C90502D18FE804F0BF23D8904
SHA-256:	CF56A842A4E893C16CC2468996EC2EF39193ACC98CDB2C8D65DAB9418E8BF3E1
SHA-512:	16C206F76023BDFEF16549AD613FF1DA29F36E87CB26D620633568629978AD4401902BB59768EB179C6AD995A124C23FBE646BB248932AA6A6B56330414E2766
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Ajuda",.. HELP_FAQ_TITLE: "Perguntas frequentes",.. HELP_SUPPORT_TITLE: "Suporte",.. HELP_EMAIL_US: "Envie um e-mail para",.. ABOUT: "Sobre",.. ABOUT_DESCRIPTION: "{0} ajuda voc. a tomar melhores decis.es durante suas atividades online.",.. CREATE_SAFER_PASSWORDS: "Crie senhas mais seguras",.. DOWNLOAD_CONFIDENTLY: "Fa.a downloads com confian.a",.. SETTINGS_SS_OPTION_ALL: "Avise-me quando um resultado de pesquisa for seguro em qualquer mecanismo de pesquisa",.. SETTINGS_SS_OPTION_NONE: "N.o me avise a respeito dos resultados de pesquisa",.. SETTINGS_SS_OPTION_SS: "Avise-me quando um resultado de pesquisa for seguro apenas com a Pesquisa segura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Copie ou cole seu URL",.. TRUST_SITE: "Confiar no site",.. DONT_TRUST: "N.o confiar",.. HELP_FAQ_SECTION_ONE_HEADER: "O que . {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} ajuda voc. a tomar melhores decis.es durante suas ativid

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	5.387347023229262
Encrypted:	false
SSDEEP:	96:ccGmQ7XTlHUszMAqjI/O/rgZaFWCG3Ix5amxnDVl:I7hHUlmwamxnr
MD5:	38506448EEEA4C34B7260FE73D62A263
SHA1:	F4838BDD4E4112AD26DEA12B63CC8F38332F41C1
SHA-256:	D377F2ED3B9043363F402140DC33FCCDE8AD7DB87C0C8307AEC8FE28AFB22B82
SHA-512:	88BFCAC7ED99D172AE1DF723191E1CD2AD293EDB1F980E1011ACA1BBAF5084190DA597253D7ACA3E6099FAD629C940065C2A919BF5C3B509833FCD33BD9DE6A5
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Ajuda",.. HELP_FAQ_TITLE: "Perguntas Mais Frequentes (FAQs)",.. HELP_SUPPORT_TITLE: "Suporte",.. HELP_EMAIL_US: "Envie-nos uma mensagem de correio eletr.nico para",.. ABOUT: "Acerca de",.. ABOUT_DESCRIPTION: "O {0} ajuda-o a tomar melhores decis.es acerca das suas atividades online.",.. CREATE_SAFER_PASSWORDS: "Crie palavras-passe mais seguras",.. DOWNLOAD_CONFIDENTLY: "Transfira com confian.a",.. SETTINGS_SS_OPTION_ALL: "Indicar se um resultado de pesquisa . seguro em todos os motores de pesquisa",.. SETTINGS_SS_OPTION_NONE: "N.o me informar sobre os resultados de pesquisa",.. SETTINGS_SS_OPTION_SS: "Indicar se um resultado . seguro apenas na Pesquisa Segura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Cole ou escreva o URL",.. TRUST_SITE: "Considerar site fidedigno",.. DONT_TRUST: "N.o considerar fidedigno",.. HELP_FAQ_SECTION_ONE_HEADER: "O que . o {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "O {0} ajuda-o a toma

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4697
Entropy (8bit):	5.057383556240693
Encrypted:	false
SSDEEP:	96:cgyp6VTFkLeMF+TXVjM/2m9VzTUmw9+WTnoXTAqsWH:LVRkHARMH4TnoDAqsWH
MD5:	151405351E296400AFEE1A4CA6ACDB74
SHA1:	6262FB5988FC56F64716F6C4D693B32A1751A729
SHA-256:	EB4909E3CDB71D23A929CFD30AFDB3638334F854C682468648ECCB564722E5E1
SHA-512:	CCAAEF428F00ACC5D2178A9B404B5A764656156C1A79DF19BDC08CD7A88AC8FB97E9E3F70FA25EE175005951AF80658D5889937C0ADE741AE65FE1DA43133B04
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: ".......",.. HELP_FAQ_TITLE: "..... .......... .......",.. HELP_SUPPORT_TITLE: ".........",.. HELP_EMAIL_US: "..... ........... .....:",.. ABOUT: ". .........",.. ABOUT_DESCRIPTION: "{0} . ... .........., ........... ..... ......... ........... . ..........",.. CREATE_SAFER_PASSWORDS: "........ ........ .......",.. DOWNLOAD_CONFIDENTLY: "........ ... ........",.. SETTINGS_SS_OPTION_ALL: "........ . ............ ........... ...... .. .... ......... ........",.. SETTINGS_SS_OPTION_NONE: ".. ........ . ............ ........... ......",.. SETTINGS_SS_OPTION_SS: "........ . ............ ........... ...... ...... . ..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3534
Entropy (8bit):	5.646985735241136
Encrypted:	false
SSDEEP:	48:cwP+i9HTsGeKlMMUjY3n8BEM/f0vlJuOquLlXElBfoWagWpWrdimER7r+05+Zv4A:cwPb9HTcKaMUy8aM/sX0ajnecmSr+iAx
MD5:	0E11AC2841DF8F85ECF176CB1930D094
SHA1:	1D0BBC898745A4D8438447F1BD577E6BB547A999
SHA-256:	442B0E0F347D54F19DD08106DEE3EEB84E467F1C9BE3D259F82A5D44C7392EDC
SHA-512:	BB43DB3FEC25B914FCD38BA941D3759E223757AF0D33F437ABF962322CC63492799601B0A6AA0097213DD9323FD65892EEB3AEB356034D2EF5D15CC1CAFC9B01
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Pomocn.k",.. HELP_FAQ_TITLE: "Naj.astej.ie ot.zky",.. HELP_SUPPORT_TITLE: "Podpora",.. HELP_EMAIL_US: "Po.lite n.m e-mail na adresu",.. ABOUT: "Inform.cie",.. ABOUT_DESCRIPTION: "Aplik.cia {0} v.m pom..e robi. lep.ie rozhodnutia o va.om .ivote online.",.. CREATE_SAFER_PASSWORDS: "Vytv.rajte bezpe.nej.ie hesl.",.. DOWNLOAD_CONFIDENTLY: "S.ahujte d.veryhodn. s.bory",.. SETTINGS_SS_OPTION_ALL: "Informova. o bezpe.nosti v.sledku vyh.ad.vania v ka.dom vyh.ad.vacom n.stroji",.. SETTINGS_SS_OPTION_NONE: "Neinformova. o v.sledkoch vyh.ad.vania",.. SETTINGS_SS_OPTION_SS: "O.bezpe.nosti v.sledku vyh.ad.vania ma informujte len v.zabezpe.enom vyh.ad.van.",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Prilepte alebo zadajte adresu URL",.. TRUST_SITE: "D.verova. lokalite",.. DONT_TRUST: "Ned.verova.",.. HELP_FAQ_SECTION_ONE_HEADER: ".o je {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "Aplik.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	5.448332276099897
Encrypted:	false
SSDEEP:	96:cvh5lgT19NMMgHg8/9WQqRZt8JZZmVau8KP8jvv/FUD8VSDLVyO:BhlmJXPdSD8VSoO
MD5:	12457027079FCC7D897DAF08E1257702
SHA1:	AA81AB4ACE7438E385B5B36F188E5A43D995C1E3
SHA-256:	E435502D1D2627686DA1F3C70CDBF9F450D34C8F56D1872AF5C59D6A81151CE9
SHA-512:	C9143A959EB70209F260B23C0379BBDE9A164DC4ED2CCF62B6F22FCE3D404C73E412BD37C14A78F80613E0D3B9CB6731B046A1B2BA44A9B9694B94A3BAF9DEEE
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Pomo.",.. HELP_FAQ_TITLE: "Naj.e..a pitanja",.. HELP_SUPPORT_TITLE: "Podr.ka",.. HELP_EMAIL_US: "Po.aljite nam e-poruku na adresu",.. ABOUT: "Osnovni podaci",.. ABOUT_DESCRIPTION: "{0} vam poma.e da donosite bolje odluke o svojim aktivnostima na mre.i.",.. CREATE_SAFER_PASSWORDS: "Kreirajte bezbednije lozinke",.. DOWNLOAD_CONFIDENTLY: "Preuzimajte bezbri.no",.. SETTINGS_SS_OPTION_ALL: "Obavesti me u svakom pretra.iva.u da li je rezultat pretrage bezbedan",.. SETTINGS_SS_OPTION_NONE: "Ne obave.tavaj me o rezultatima pretrage",.. SETTINGS_SS_OPTION_SS: "Obavesti me samo u bezbednoj pretrazi da li je rezultat pretrage bezbedan",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Nalepite ili unesite URL adresu",.. TRUST_SITE: "Veruj lokaciji",.. DONT_TRUST: "Ne veruj",.. HELP_FAQ_SECTION_ONE_HEADER: ".ta je {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} vam poma.e da donosite bolje odluke o svojim aktivnostima na mre.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3145
Entropy (8bit):	5.462516087386713
Encrypted:	false
SSDEEP:	96:cayPkTXsNMjOlH/PROv5eFqNzXl9Rjz8BU5Uv:3Dsu/TNl9Fz3Uv
MD5:	B0201777E47A3822D0C9F6DC7A519B40
SHA1:	DF5B162E7171E4736AC9CC3CC89FF6245ADD489C
SHA-256:	ACF5AC77D83EC100B4D5B4FD476F37FD6C2569B21C9109637E7EB905B5814239
SHA-512:	57692A8EAAAADF129E0562F4191A1C5028B8EC5968F02C155D04967727982360026CB9A33BBB40F206C810A0A207E15C8F3908716951539B89BF21C10C7D38E6
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Hj.lp",.. HELP_FAQ_TITLE: "Vanliga fr.gor (FAQ)",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Kontakta oss via e-post p.",.. ABOUT: "Om",.. ABOUT_DESCRIPTION: "{0} hj.lper dig att ta b.ttre beslut g.llande vad du g.r online.",.. CREATE_SAFER_PASSWORDS: "Skapa s.krare l.senord",.. DOWNLOAD_CONFIDENTLY: "S.kra h.mtningar",.. SETTINGS_SS_OPTION_ALL: "Informera mig om s.kra s.kresultat i samtliga s.kmotorer",.. SETTINGS_SS_OPTION_NONE: "Informera mig inte om s.kresultat",.. SETTINGS_SS_OPTION_SS: "Informera mig om s.kra s.kresultat, men endast vid s.ker s.kning",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Klistra in eller ange webbadress (URL)",.. TRUST_SITE: "Ange som betrodd webbplats",.. DONT_TRUST: "Ange inte som betrodd webbplats",.. HELP_FAQ_SECTION_ONE_HEADER: "Vad .r {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} hj.lper dig att ta b.ttre beslut g.llande vad du g.r online.",.. HELP_FA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3451
Entropy (8bit):	5.513302802356553
Encrypted:	false
SSDEEP:	96:cUCFiIkATzMz/k1/DJMWeTc3a/B6eCVt/zes6t3K8SLcwl39cNyX:gngIDKQ/ei/Bik39cNQ
MD5:	A6F7892A4A11EB839391EA6BC79D2D08
SHA1:	1A1A098DCD347B09A5B0E55D97D6459215C97329
SHA-256:	000FED23BD41E57505991CE7FC983488922BB2496C0CE12502E56D21A555C8F3
SHA-512:	27D38B371900F851B36FE74FA79E134C9B802880561EE5CB22C07C8155783D88234DF8B19EFE0E2BCE382AC56A2554AFF1CE6DC982BD31D5BFCC21828B958C93
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "Yard.m",.. HELP_FAQ_TITLE: "S.k Sorulan Sorular (SSS'ler)",.. HELP_SUPPORT_TITLE: "Destek",.. HELP_EMAIL_US: ".u adresten bize e-posta g.nderin:",.. ABOUT: "Hakk.nda",.. ABOUT_DESCRIPTION: "{0} .evrimi.iyken ne yapaca..n.z konusunda daha iyi kararlar alman.za yard.mc. olur.",.. CREATE_SAFER_PASSWORDS: "Daha g.venli parolalar olu.turun",.. DOWNLOAD_CONFIDENTLY: "G.venle indirin",.. SETTINGS_SS_OPTION_ALL: "Herhangi bir arama motorunda bir arama sonucunun g.venli olup olmad...n. benimle payla.",.. SETTINGS_SS_OPTION_NONE: "Arama sonu.lar.n. benimle payla.ma",.. SETTINGS_SS_OPTION_SS: "Yaln.zca G.venli Arama'da bir arama sonucunun g.venli olup olmad...n. benimle payla.",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL'nizi yap..t.r.n veya yaz.n",.. TRUST_SITE: "Bu siteye g.ven",.. DONT_TRUST: "G.venme",.. HELP_FAQ_SECTION_ONE_HEADER: "{0} nedir?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2969
Entropy (8bit):	6.150609371498994
Encrypted:	false
SSDEEP:	48:cii4bo8iTBSeLHzMP0jnlOe/50vovlun8uTAlHWx3sMvZpSIOeN5SfKj0gPBFlpA:cii4boXTNHzMP07we/OQvl08GN8oZkI+
MD5:	E94DD21CE106A10C8C5D7B8526CC046C
SHA1:	25EFF3F43F1925F5FB2E7291D08590C60F89FA0D
SHA-256:	8B4C9CF5547317F0BFAAA90002BED826E4BE978C90DF9818CAD24C1DC017FD3D
SHA-512:	C82A452F0117AF287FD6320C1888ABB0A4CD5A8CFC30FE044E250DF5E4D77B869DAA7B287FCCDF4256CE57A6A629B80734E097678BD2483F3626578181EDCB53
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "..",.. HELP_FAQ_TITLE: "...... (FAQ)",.. HELP_SUPPORT_TITLE: "..",.. HELP_EMAIL_US: ".........",.. ABOUT: "..",.. ABOUT_DESCRIPTION: "{0}.................",.. CREATE_SAFER_PASSWORDS: "........",.. DOWNLOAD_CONFIDENTLY: "......",.. SETTINGS_SS_OPTION_ALL: ".....................",.. SETTINGS_SS_OPTION_NONE: ".........",.. SETTINGS_SS_OPTION_SS: "...................",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "..... URL",.. TRUST_SITE: "....",.. DONT_TRUST: "...",.. HELP_FAQ_SECTION_ONE_HEADER: "... {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0}.................",.. HELP_FAQ_SECTION_TWO_HEADER: ".......{0}?",.. HELP_FAQ_SECTION_TWO_CONTENT: ".

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3046
Entropy (8bit):	6.144914801057749
Encrypted:	false
SSDEEP:	48:cjEUAb0CTgSztJYMreb0j9ruR/o0v5uJufDeQO1LDohNp+i6Zj5dCQU8+N/SoVL2:cjpAbxT2Mru0p6R/TBmWDVMz7fU/N/Sf
MD5:	6DF2BA0F96F889FA95566DF7B57FBE90
SHA1:	2B5C07E1150FFD7B1D31B44647B03ACD6C1E3B5C
SHA-256:	091D29BA14960F92C2BF45A954A221273FCF8109D463ED3216C308CC0EEEBCE1
SHA-512:	CF3A9C0ECAE1D0FCA5E024876F878AFD112D1768A8ED4652CCAC6D7CB8E016BDD07873001301A1DBEFF08F26700C91AAD4CA0D628FE9D0592E256E2DE56B4F13
Malicious:	false
Reputation:	unknown
Preview:	var _lrOptions_ = {.. HELP: "..",.. HELP_FAQ_TITLE: "..... (FAQ)",.. HELP_SUPPORT_TITLE: "..",.. HELP_EMAIL_US: "...........",.. ABOUT: "..",.. ABOUT_DESCRIPTION: "{0} ..................",.. CREATE_SAFER_PASSWORDS: "........",.. DOWNLOAD_CONFIDENTLY: ".....",.. SETTINGS_SS_OPTION_ALL: "....................",.. SETTINGS_SS_OPTION_NONE: "..............",.. SETTINGS_SS_OPTION_SS: "...................",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "....... URL",.. TRUST_SITE: "....",.. DONT_TRUST: "....",.. HELP_FAQ_SECTION_ONE_HEADER: ".. {0}.",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} ..................",.. HELP_FAQ_SECTION_TWO_HEADER: "......... {0}.",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3708
Entropy (8bit):	5.70787396766121
Encrypted:	false
SSDEEP:	96:Kar2MPa6uw0VE2HYP9ouKQaMF2B8KVj5YVj8ftB:K8zb0VE24FfKQXF2B8aftB
MD5:	39DF19E23483926EBE6ADA612E306C8C
SHA1:	7C8311F64BCAFB848ECF78A16B9E62565706422D
SHA-256:	71AB139E20FB54CD4B952C30F845362A486F16CE2481E55980DB16C1EE59E05C
SHA-512:	77D948A3A8650C5A4AB013A920EEF1BF67CC08DB68B8ACB440530C9A7B0B8A46F89C32D7F5C05C6876FDF7F5AB19D52367D2B83567D1BC1A69DD81D4B0D54CCC
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknut.m na mo.nost {0} dokon..te nastaven. programu WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Povolit roz...en.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Nejste si jisti v..e uvedenou zpr.vou? Bu.te bez obav . va.e soukrom. je v.dy na.. hlavn. prioritou.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Pokra.ujte kliknut.m na mo.nost {0}. U. to skoro je!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Povolit roz...en.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "P.i p...t.m vyhled.v.n. budete po..d.ni o proveden. akce {0}, abyste dokon.ili nastaven. funkce Bezpe.n. hled.n..",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Ponechat zm.ny",.... SETTINGS_OVERLAY_CONTENT: "Klikn.te na zpr.vu {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Bylo p.id.no roz...en. McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Otev.ete nab.dku prohl..e.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3577
Entropy (8bit):	5.442938588315211
Encrypted:	false
SSDEEP:	48:AqjTIrwTeQCMF0yt0nWmumEbX0B57Oye2wos/ctmwufpsdb4jHpsd9rijTCLqn:JIsdCMYnWmnEc7FxtmwipsGpnmqn
MD5:	EF543C1C3D6C4601778C132DAFB8E81B
SHA1:	49BA7075CCF441EB697B11730E358E95F3E9CBA7
SHA-256:	5FC92EC393B7AF964B0F649DCA07B44A17B6F9668E3EDAA10DF39BB013893D64
SHA-512:	DD6D98499509CF8B41043EA2B2F5AF80DC6A986B71145B3FEB5FF7D64835B6C4021E96CDB94A4C5E99D85AC67AE6D7F8752274DD8E2E12AB1E29A2EB0977FFAD
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klik p. {0} for at fuldf.re konfigurationen af WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Aktiv.r udvidelse",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Er du i tvivl om, hvordan du skal forholde dig til ovenst.ende meddelelse? Bare rolig . dit privatliv er altid vores h.jeste prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klik p. {0} for at forts.tte. Du er n.sten f.rdig.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Aktiv.r udvidelse",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "N.ste gang du s.ger, bliver du bedt om f.lgende for at fuldf.re konfigurationen af sikker s.gning: {0}",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Behold .ndringer",.... SETTINGS_OVERLAY_CONTENT: "Klik p. meddelelsen {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-udvidelsen er blevet tilf.jet",.... INTRO_OVERLAY_CONTENT_1: ".bn menuen i Edge for at konfigurere Web

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3813
Entropy (8bit):	5.411886577143403
Encrypted:	false
SSDEEP:	96:KClwI7loU8z+JpKGZVp978ACtA6YI2l46D6sITl2klcYp:KUToUfZVp978AmA6Rw46D6sIp2+t
MD5:	07B62454E79AF6E6ED7B5CFB656B77B6
SHA1:	B14752A7F3BD882F895BC155FE16638F3E6133F6
SHA-256:	A6EB900CA329F99D51666D541F51B41253D2E73290A7A48726C86870D76C4DDB
SHA-512:	679928C4AEC3F2F971F794497657BFB8B68AFD54CFED0A1D6DE4F5ADBE8D04954AEE62853FE8692D444CF5F734EE07E79DF212375EDA8E42519D2CBD1160A56A
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klicken Sie auf {0}, um die Einrichtung von WebAdvisor abzuschlie.en.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Erweiterung aktivieren",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Sie sind sich unsicher wegen der oben angezeigten Meldung? Keine Sorge . der Schutz Ihrer Daten hat bei uns h.chste Priorit.t.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klicken Sie auf \"{0}\", um fortzufahren. Fast fertig!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Erweiterung aktivieren",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Bei Ihrer n.chsten Suche werden Sie aufgefordert, auf \"{0}\" zu klicken, um die Einrichtung von \"Sichere Suche\" abzuschlie.en.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: ".nderungen beibehalten",.... SETTINGS_OVERLAY_CONTENT: "Klicken Sie auf die Meldung \"{0}\".",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-Erweiterung wurde hinzugef.gt",.... INTRO_OVERLAY_CON

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5373
Entropy (8bit):	5.066746898030147
Encrypted:	false
SSDEEP:	96:PKUYel5agUIM392dF9xVV/vT2Kc9xKUOl:aePhFLC4
MD5:	37BCB3C2871EF5DF7B14F8A237FE1631
SHA1:	021187CC052683748BDE08F0599CCFAA87250EF4
SHA-256:	97D8D29617338DEDED5C88AFFC49DFFBC1CB24CB4558937582073808B5833368
SHA-512:	39251A30AAAD214B69914FEE5CFD7B73F687D5D421BEE30FDCC70C2A6A983F79B6EA12653630938480172F785BD69A2D3FEDF6188A786B1CA3865983282FF022
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "..... .... ... {0} ... .. ............ .. ....... ... WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "............ .........",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "... ..... ........ ... .. ........ ......; ... .......... . .. ........ ... ..... ..... . ...... ... ..............",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "..... .... ... {0} ... .. ........... ...... ..........!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "............ .........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "... ....... .... ... .. ...... ........., .. ... ....... .. {0} ... .. ............ .. ....... ... .......

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	5.436213343008664
Encrypted:	false
SSDEEP:	48:hX+nTmLZpNvS6qfKmtBBiNgsbjBLNZoIJon512xyQyBB0k:FpfqfKwegw7jen2MT
MD5:	34E62E6ED0CAD489103EA4192295FE28
SHA1:	985BD829AC9CF52BF911721B67BEEB06002E3001
SHA-256:	16574D8EFC4BB9528A1B8DA448EE06A9FCBEF241A2FB8C439A80F4DB33659B26
SHA-512:	FC581CC7AF342676C7B04AB58857E251BD5B825304702B130BCCDC2F7AE8EB8247E8DC871D101B69529B940A1BFE0308494DAF19169FEA52236DCF58A56B0AA2
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Click {0} to finish setting up WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Enable Extension",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Unsure of the message above? Don't worry — your privacy is always our top priority.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Click {0} to continue. You're almost done!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Enable Extension",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "The next time you search, you'll be asked to {0} to finish setting up Secure Search.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Keep changes",.... SETTINGS_OVERLAY_CONTENT: "Click the {0} message.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor extension has been added",.... INTRO_OVERLAY_CONTENT_1: "Open the Edge menu to start setting up the WebAdvisor extension.",.. INTRO_OVERLAY_CONTENT_2: "Avoid risky sites while you browse, shop, and stream with free web

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3561
Entropy (8bit):	5.43403680872909
Encrypted:	false
SSDEEP:	96:795vs3WVLAOOxYqGEsU9b5TaBl/t6/Pv5ec:7LvKVk3U9tTa/E/PBec
MD5:	2AE5065576656D3760E5E9D40EF9E348
SHA1:	0EB617A0C2543BC0FC24B7ADECA5E5BB5A68EAC0
SHA-256:	3D79DCDD04B65D41DC3080624DABEFA5CC7E274195E10534E62525DD2D92DA11
SHA-512:	F84A189817E2973D3B39EEBC38F77B5E18189A7A43EA68966071C5BD56B8425F42F19F97A76BA520216202E22F3FF3E0F180CEA92F1BB07B5B1F9F49AD69D305
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Haz clic en {0} para terminar de configurar WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Habilitar extensi.n",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: ".No est.s seguro del mensaje de arriba? No te preocupes; tu privacidad siempre es nuestra m.xima prioridad.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Haz clic en {0} para continuar. Ya casi has acabado.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Habilitar extensi.n",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La pr.xima vez que realices una b.squeda, se te pedir. que {0} para terminar de configurar la b.squeda segura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Conservar cambios",.... SETTINGS_OVERLAY_CONTENT: "Haz clic en el mensaje {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Se ha a.adido la extensi.n McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Abre el men. de Edge para empezar a configurar la extensi.n WebA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3447
Entropy (8bit):	5.410954085805761
Encrypted:	false
SSDEEP:	96:7qs4c3WBLAOuAd6j9bTNbOEQyNxe6x1es:7qsZxa6j9FbyExtx1X
MD5:	EF450A23DBAFD6549C2596D11ADFAC05
SHA1:	003F95D19924308919841679A7E26491E5DAF2FB
SHA-256:	3FF066BBF4836081F43A9F9E290FAA05F0984DE2DC0B3696A2DE6D209297BADC
SHA-512:	04956B42EEF20C9C5120F24304ABFF6C3E8D17BEC00A4909B6D5355B3BD0E768C498F64501EF3C26B7A50BDE866D39FD72B93A21F778B02447826957074AB8F3
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Haz clic en {0} para completar la configuraci.n de WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Activar extensi.n",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: ".Tienes dudas sobre el mensaje anterior? No te preocupes. Tu privacidad es nuestra prioridad.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Haz clic en {0} para continuar. .Ya casi terminas!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Activar extensi.n",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La pr.xima vez que realices una b.squeda, se te pedir. que {0} para que termines de configurar la b.squeda segura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Conservar cambios",.... SETTINGS_OVERLAY_CONTENT: "Haz clic en el mensaje {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Se agreg. la extensi.n de McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Abre el men. de Edge para comenzar a configurar la extensi.n WebAdvisor."

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3511
Entropy (8bit):	5.43678132205377
Encrypted:	false
SSDEEP:	48:PNyeWArmSSL0jMwX/Bz7N208N2Kv7qw0qhah7ddaXETuMgPl+5UAeWO/m:PMYGwvBz7Np8N7wj1ddaUi145UAm/m
MD5:	883F08F42AC1B02D0ADBEF1440781453
SHA1:	74ACA32C3FF86A7ED76D3DD78A7025E63EBF668D
SHA-256:	2B0CA9FC75DE7173C4826C8DC238EB80AF242272CFAA5A6FCC4F9D3CBC2A11F9
SHA-512:	4A79E081BE7BC03A225FBBC7427472B411AC18471170DB3769A0B987D2FEAC0FBF2B906F816934E011B7AF826732DDF34D6056F441E18F9B8341C304F3FCCA4B
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Napsauta {0}, jotta voit viimeistell. WebAdvisorin k.ytt..noton.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Ota laajennus k.ytt..n",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Etk. ole varma yll. n.ytetyst. viestist.? Ei h.t... Tietosuojasi on meille aina t.rkeint..",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Jatka napsauttamalla {0}. Melkein valmista!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Ota laajennus k.ytt..n",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Seuraavalla hakukerralla n.et pyynn.n {0} Suojatun haun k.ytt..noton viimeistelemiseksi.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "S.ilyt. muutokset",.... SETTINGS_OVERLAY_CONTENT: "Napsauta viesti. {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor -laajennus on lis.tty",.... INTRO_OVERLAY_CONTENT_1: "Avaa Edge-valikko aloittaaksesi WebAdvisor-laajennuksen m..rityksen.",.. INTRO_OVERLAY_CO

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3808
Entropy (8bit):	5.387151544240124
Encrypted:	false
SSDEEP:	48:RvCshWLo4LeWU3EWP8/41QYd2WwawjOk51nBXwQw81NimwIu4W8u4kVusExXX:hVt3EWPmWFwawSkpgQNYmwIHbHMUn
MD5:	940F2DA3642AD546289FB20351FCF338
SHA1:	131A002B67D5100459E3668FDA121AED2ED36E0D
SHA-256:	13DC5E988D870F1BFD40FF479FA86E596ED3F79C86D6B3DCD3D47FDAFBABA176
SHA-512:	DBBACBE47681CF4055AE9335C7988AF31C112B71D2F9DE44F9BC02902CC5E14528D47A3B1DB4BEE33C73C0B81AD302F3D2AA07223A16CD55D66BAC8603B706E9
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Cliquez sur {0} pour terminer la configuration de WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Activer l'extension",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Vous avez des doutes sur le message ci-dessus? Ne vous inqui.tez pas. votre confidentialit. est toujours notre priorit..",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Cliquez sur {0} pour continuer. Vous avez presque termin.!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Activer l'extension",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La prochaine fois que vous effectuez une recherche, l'action suivante vous sera demand.e pour terminer la configuration de la recherche s.curis.e.: {0}.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Maintenir les changements",.... SETTINGS_OVERLAY_CONTENT: "Cliquez sur le message {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "L'extension McAfee. WebAdvisor a .t. ajout.e",.... INTRO_OVERLAY_CO

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3820
Entropy (8bit):	5.3997981408701525
Encrypted:	false
SSDEEP:	96:q4Hj53EWP1ww63K2z1gUYmwEF2HfuVHfuf4B:q4HywPUYZ0C2N2f4B
MD5:	763DCD30D87C61B79548AD3CA514CC47
SHA1:	25EC772F9DEEA156916358D19819DD4F9DEA4247
SHA-256:	17E5544DC1E669F3B4925E4EC86CF3C5B43919AE85453019049E49BE8087C299
SHA-512:	EFCAA3F8E5384F1DA6759847982725EE094F6151B9833CE3575C67111E68D4240AB2C5F777B09268E7B2D9C109DE031EF2277ED7714EBAF77908FD15FB7ED10B
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Cliquez sur {0} pour terminer la configuration de WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Activer l'extension",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Vous n'.tes pas s.r du message ci-dessus.? Ne vous inqui.tez pas, votre confidentialit. est toujours notre priorit..",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Cliquez sur {0} pour continuer. Vous avez presque termin..",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Activer l'extension",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La prochaine fois que vous effectuerez une recherche, il vous sera demand. de {0} pour terminer la configuration de la recherche s.curis.e.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Conserver les modifications",.... SETTINGS_OVERLAY_CONTENT: "Cliquez sur le message {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "L'extension McAfee. WebAdvisor a .t. ajout.e",.... INTRO_OVERLAY_CONTENT_1: "Ouvre

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3559
Entropy (8bit):	5.5044930817966655
Encrypted:	false
SSDEEP:	96:iKtsjv9hNkY6z3qRQRMmCxgFXNNXxXlU201Ii8nm:iKev9I3oQRMmCxgFXNNXxXlv0ii8nm
MD5:	8CA4A0BFBD420EC5DBF0855FEAE88213
SHA1:	2AD8F0A786441ED2FA135FDE321DC365DED57559
SHA-256:	5A3E3EDE8F7186129FE6F39392AED1C6AEA1F9A4F6636E4AEF63B06ABC200C76
SHA-512:	D62629EDC204A98C7F303ACD4E0D87C06C78BD7CB34191B3AA5BF96EED58E649579C741D67F807197F949A8D4BE98DAE968899DDF87B759E56FA34442932C199
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknite {0} kako biste dovr.ili postavljanje WebAdvisora.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Omogu.i pro.irenje",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Niste sigurni p.to zna.i gornja poruka? Ne brinite . va.a privatnost je uvijek na. glavni prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kliknite {0} za nastavak. Skoro ste gotovi!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Omogu.i pro.irenje",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Sljede.i put kada budete pretra.ivali, od vas .e se tra.iti da {0} da zavr.ite postavljanje sigurnog pretra.ivanja.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Spremi promjene",.... SETTINGS_OVERLAY_CONTENT: "Kliknite poruku {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Dodano je pro.irenje McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Otvorite rubni izbornik za po.etak postavljanja pro.irenja WebAdvisor.",.. INTRO_

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3871
Entropy (8bit):	5.602204570416175
Encrypted:	false
SSDEEP:	48:BjeL2klA7qs9fOpTbYFBbyN6t6rksl9EJky2twp+2mTpTW25:x7qwmJLrksTE74lR
MD5:	8B177D472E81B01CB1637DEC446F28F9
SHA1:	0592908F8700AB6D7E67FECA93E87CAE074B0D16
SHA-256:	D0F653F4A9FDBD2CE53FE0AB8F6AA655C2769FDD80FE3D658BB7E399FB713F4B
SHA-512:	A2210B2FC32BCAB7CC3E9C348F6711168A1A90A61255505D37DCA8E2E87862BE8D29D49F8DA115471383D1044E8E3353203DB2EDE88AE58728415379F61D425A
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kattintson a(z) {0} lehet.s.gre a WebAdvisor konfigur.l.s.nak befejez.s.hez.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "B.v.tm.ny enged.lyez.se",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Nem biztos a fenti .zenetet illet.en? Ne agg.djon. Szem.lyes adatainak biztons.ga a legfontosabb sz.munkra.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kattintson a(z) {0} elemre a folytat.shoz. Majdnem k.sz.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "B.v.tm.ny enged.lyez.se",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "A k.vetkez. keres.sn.l megk.rj.k, hogy fejezze be a Biztons.gos keres.s be.ll.t.s.t ({0}).",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: ".rizze meg a m.dos.t.sokat",.... SETTINGS_OVERLAY_CONTENT: "Kattintson a(z) {0} .zenetre.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Hozz.adta a McAfee. WebAdvisor b.v.tm.nyt",.... INTRO_OVERLAY_CONTENT_1: "Nyissa meg

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3451
Entropy (8bit):	5.346116627167779
Encrypted:	false
SSDEEP:	96:9w0wJWteojRUyUw5Jaw5+/3Aw+ydJPw1he:9VA0jB9aK+vA+Pyhe
MD5:	3FF00E0250B550132CB0D18019491D83
SHA1:	168B8AB54CA052E99E8EC513D28D97669E99C415
SHA-256:	FD45F10B9A1EE05AD44F4C68D1D1F01D0F2434D3EC4464D9CFBF70A496259FF1
SHA-512:	30832540A430CFEABAA411AA39B7497B8564D31204BB389AC82B86298781DC6DEE3BBB4F09F7D923EB5FA1D206519332A23333B348D6F5F514ED3C7D6EBB745A
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Fai clic su {0} per completare la configurazione di WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Attiva l'estensione",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Hai dubbi sul messaggio mostrato sopra? Non ti preoccupare: la tua privacy . sempre la nostra priorit. assoluta.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Fai clic su {0} per continuare. Ci sei quasi.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Attiva l'estensione",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La prossima volta che effettuerai una ricerca ti verr. chiesto di {0} per completare la configurazione di Ricerca sicura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Mantieni i cambiamenti",.... SETTINGS_OVERLAY_CONTENT: "Fai clic sul messaggio {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "L'estensione McAfee. WebAdvisor . stata aggiunta",.... INTRO_OVERLAY_CONTENT_1: "Apri il menu di Edge per iniziare a configurare

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4710
Entropy (8bit):	5.64199460658645
Encrypted:	false
SSDEEP:	96:5mF9hGIitPqUUJnILJn90N3l3QLzb3Nl3CprHEwPbbDiabGdtiDR9hGrv:5mF9hC91nQmLzTNoprH1b3JbctiDR9he
MD5:	21A93521B3AA24B619C4F4EC52F31B21
SHA1:	FABD6D48E9C792EA83084699C9A8254ED6859596
SHA-256:	258D3FAEDB47A7186EE67EA4EE651762DBC3745BDBB2A5B2EFA75E27757D99D9
SHA-512:	429517196A66EAA58A4A6157817C67BD1D7467A5C90E038638850D43340343CAD509FA09B832B2D47E79E0946DF1CC933EAC8A1FF66EE1D2785DC03EE1DFB2AF
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "[{0}] ..............................",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "..........",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "..............................................................",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "[{0}] ..................",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "..........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: ".........[{0}] ........... ........................",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: ".......",.... SETTINGS_OVERLAY_CONTENT: "......{0}.......

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3733
Entropy (8bit):	5.886458213537712
Encrypted:	false
SSDEEP:	48:QYCvdMrjNB9ZGI4BGSS1FdMUB2dgSG36cBJsg57AB2vCC1vyqtYIvdli:36ynuBGpFyUBkYBJsmcB2ZGQe
MD5:	57A23B2DEBF453CF273AE6F0F240E3B7
SHA1:	C4DECCD19DCDF2E1F8660300B1A9D2794C07C301
SHA-256:	8D929181D0E1B8167CF95AD725F7AB0DE543E2F97E5F9120CFEE75BC122FA414
SHA-512:	B2A2B5A1AC6B44BD4C512DA8FDED6219BA75047820F3A23861C6E13B74DF8AB77EF26DE13CA3FDBF835106F9FF8CF0A9C9EE12B3A5516AAFBEAD3FB456C5B659
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "{0}.(.) .... ...... ... .......",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: ".. ..",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: ".. .... .... ......? .... ..... ... .. ... .. ... ... ......",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "..... {0}.(.) ....... .. ........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: ".. ..",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "... ... . {0}.(.) .... .. .. ... ..... .... ......",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: ".. .. ..",.... SETTINGS_OVERLAY_CONTENT: "{0} .... .......",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. ...... ... .......",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	5.454339158545961
Encrypted:	false
SSDEEP:	48:Kx63r03o9AwnQ5deXavDKYw7unkf56lQepfbVdqwqkMpHCxdnlpZ9R0lpZ9OCZ+8:JQjwncYXavDKvukfwlPpu1pHSTpJMpGi
MD5:	EE219966B84BF8D2F1C262A9D6558947
SHA1:	8A9C926AC624B90AF18FC8D75B346D3DA5B35DC7
SHA-256:	5CA84380ABE0D90BE92A944E0862CC34A69C093D8B6D58B124FF1C4917277F0D
SHA-512:	9DF641C7C0C0F438DAD081B6BF686225F5DB43F9379E8F50E31BF817C964094D9FA26279ED682FCF96251B8B43F439C0CBF5F85180FD31B5DA1C379823A048B5
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klikk {0} for . avslutte oppsettet av WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Aktiver utvidelse",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Usikker p. meldingen over? Ta det helt med ro; ditt personvern er alltid v.r topp prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klikk {0} for . fortsette. Du er ferdig om et .yeblikk!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Aktiver utvidelse",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Neste gang du s.ker, vil du bli spurt om . {0} for . gj.re ferdig oppsettet av Sikkert s.k.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Behold endringer",.... SETTINGS_OVERLAY_CONTENT: "Klikk p. meldingen {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-utvidelsen er lagt til",.... INTRO_OVERLAY_CONTENT_1: ".pne Edge-menyen for . starte oppsettet av WebAdvisor-utvidelsen.",.. INTRO_OVERLAY_CONTENT_2: "Unng. risikofylt

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	5.383260260230869
Encrypted:	false
SSDEEP:	48:hYNSUmrH9+LhVyH81/nxxM3P7zLFSOXYNXwBxrcB5w7qTF951eUq5j6YUNGUUY:qWoM81/3czLFLYNa4BO7qTB38/6
MD5:	AD8AF3012ECB1D0AB08EB45F93AE0444
SHA1:	E6967BD4B4B6C8021CE62487DC4EE70E2BACF5CC
SHA-256:	D99282D5366399128611A24A55050FDAB779E58AFB865DFA6D2167CD9F7DDE13
SHA-512:	63C10AE56743A8A11C02E4E76569AFA933A51A13509B70C4D7A3BEE389C97C35FBD563398DE8B8D5EC56596D80B90A1CEB391B9E5A77AC976F99E4FC3FEB4DEC
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klik op {0} om het instellen van WebAdvisor af te ronden.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Extensie inschakelen",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Twijfelt u over bovenstaand bericht? Geen zorgen: uw privacy is altijd onze topprioriteit.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klik op {0} om door te gaan. U bent bijna klaar!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Extensie inschakelen",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "De volgende keer dat u zoekt, wordt u gevraagd om {0} om het instellen van Beveiligd zoeken te voltooien.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Wijzigingen behouden",.... SETTINGS_OVERLAY_CONTENT: "Klik op het bericht {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-extensie is toegevoegd",.... INTRO_OVERLAY_CONTENT_1: "Open het Edge-menu om de WebAdvisor-extensie in te stellen.",.. INTRO_OVERLAY_CONTENT_2: "Vermijd risi

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3592
Entropy (8bit):	5.649106032090047
Encrypted:	false
SSDEEP:	96:UMCvtaaOZWKfNNz9KqIbQUZW9TRNcWRlP+im+oS+oGIUwI0qU4o:UMC1aaOIxbQUI9TRpR95mhShnUB0qU1
MD5:	726F68AD88CBAE5DDE8F9F71EB78AA15
SHA1:	7D1E3A6E0547401B19BD96C154851F1C8C5792C4
SHA-256:	5F39AC918E7C98A8B1A073ECBEFD10EB8C90F103CC9820AF13DED319D0A9CF91
SHA-512:	A2FB4D89826ACE62C332EBB54229784355031E7CA01E152062385B1048E1C40033C7BF040811242E01ED01A6EEB84B11E4748C5A297872CE426FCD28CEAAD4D9
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknij przycisk {0} aby zako.czy. konfiguracj. funkcji WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "W..cz rozszerzenie",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Nie masz pewno.ci co do powy.szego komunikatu? Nie martw si. . Twoja prywatno.. to dla nas zawsze priorytet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kliknij przycisk {0}, aby kontynuowa.. Ju. prawie gotowe!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "W..cz rozszerzenie",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Przy nast.pnym wyszukiwaniu pojawi si. monit o u.ycie opcji {0}, aby doko.czy. konfiguracj. Bezpiecznego wyszukiwania.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Zachowaj zmiany",.... SETTINGS_OVERLAY_CONTENT: "Kliknij komunikat {0}",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Dodano rozszerzenie McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Otw.rz menu przegl.darki Edge, aby zacz..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3368
Entropy (8bit):	5.417047473922712
Encrypted:	false
SSDEEP:	96:tBRKXbIv/U8cc0dGvgObgbIc1JS+RUkwo:tg8ccqsXcPSsUkwo
MD5:	BB9F407FCAD1DA167A53D52B0F4E1619
SHA1:	4A42EE1485DE39ED517481D2A3EAA795DEF3DA8A
SHA-256:	F1FFB00352F061D648F9A1B8E1E905B9628AC8D578A63C34DACC1050DBEBF901
SHA-512:	A44FD183263382EADCC743A44B31779D7C4441EF928AF6253918D4911E25E9EAAEFB0733D151672648C40C6C3115D8B77B2E9F8E3B6D59A876E32F027EC1B3CE
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Clique em {0} para terminar de configurar o WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Ativar extens.o",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "N.o entendeu a mensagem acima? N.o se preocupe . sua privacidade . sempre nossa prioridade.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Clique em {0} para continuar. Est. quase terminando!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Ativar extens.o",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Na pr.xima vez em que pesquisar, ser. pedido que voc. {0} para terminar de configurar a pesquisa segura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Manter altera..es",.... SETTINGS_OVERLAY_CONTENT: "Clique na mensagem {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "A extens.o McAfee. WebAdvisor foi adicionada",.... INTRO_OVERLAY_CONTENT_1: "Abra o menu do Edge para come.ar a configurar a extens.o do WebAdvisor.",.. INTRO_OVERLAY_CONTE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.406293897230586
Encrypted:	false
SSDEEP:	96:tcgHxIKIF/UyvFz7d+J0b5H3JgJSgnDlF:tfHzC/V15gggnDlF
MD5:	E12C90DF248A480202C06D2D51898966
SHA1:	8B68612EBDD0409363459EE9B4E76D11652F9DF0
SHA-256:	2B64E5733EE1468548BA2ABC382895A80A0B71A28FE8C06A7A8C5FDFD6712D6C
SHA-512:	FAD59A438A5A2AD407306D75E4119DEC584FF856BB3892E0E9E230BBFF6F2AD98B4E53AA810FAF6B569A5E0E128DEDF59FF16059E96575403C3CD9D594A79019
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Clique em {0} para terminar de configurar o WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Ativar extens.o",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "N.o tem a certeza sobre a mensagem abaixo? N.o se preocupe: a sua privacidade . a nossa m.xima prioridade.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Clique em {0} para continuar. Est. quase!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Ativar extens.o",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Na pr.xima vez que pesquisar, ser. pedido {0} para terminar a configura..o da pesquisa segura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Manter altera..es",.... SETTINGS_OVERLAY_CONTENT: "Clique na mensagem de {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "A extens.o do McAfee. WebAdvisor foi adicionada",.... INTRO_OVERLAY_CONTENT_1: "Abra o menu do Edge para come.ar a configurar a extens.o do WebAdvisor.",.. INTRO_OVERLAY_CONTE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	5.138776833826638
Encrypted:	false
SSDEEP:	48:km1cmOcoujLEUXirQfZVaSy/lcv8xv0pv6eyH5Z6LX6L0YA5ANvPuYV1kwgkebOH:bSP52Z7Iqv8IvzSt/vPuYV9gkbEYZAa
MD5:	9FA7AB4D2815FCC3958672CD78AD6814
SHA1:	3BB86B53E36CAE395DF4054B4C77D3F020A58784
SHA-256:	63950AA1F92D341E56EFC52F7AF07CEAA09239F8EF088422CAF57569EC17B46D
SHA-512:	AF1B5BBE892FFC57C8C6E8A280B95D3D776EF90CC6ED11993DE2414004DEFAF8E38E1BF50172A9CA3A256CD7FC9B186E9E90ADA7D90DB271A698CA62E87A7F2B
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "....... {0}, ..... ......... ......... WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "........ ..........",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "............ . ......... ....? .. ............, .... .................. ... ... ....... ......",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "....... {0}, ..... ........... ..... ......!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "........ ..........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: ".. ..... .......... ...... ... ..... .......... {0}, ..... ......... ......... ........... .......",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "......... .........",.... SETTINGS_

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3645
Entropy (8bit):	5.659564746812874
Encrypted:	false
SSDEEP:	96:Za1q+c5nLPgGcp7rGEaqHNGXaGWSnEBCxu:Za1CcGcpPGEaoNGXaGWSnEBCxu
MD5:	66BE792D42304C3BDC3BD554436CA100
SHA1:	0FA1D4CDBFB80CDBC3EEF06998331D2AE47A28F7
SHA-256:	549A722F6482FEFCEC51349C4E5526967632B1F261D8ACCA9AC6A097569CBD80
SHA-512:	A095710FC12FBA841F49DE94CDCDD62CD4EC955FE12819AF5C3CF9BE5AE4B7D58DCA8B8B5F0F19513EBDD1208E4CB104BB8F23EE04505B7EA71568F7B9ADDF2B
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknite na mo.nos. {0} a.dokon.ite nastavenie slu.by WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Zapn.. roz..renie",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Neviete, .o znamen. uveden. spr.va? Nemus.te sa b.., va.e s.kromie je na.ou prioritou.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kliknite na mo.nos. {0} a pokra.ujte. U. to skoro m.te.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Zapn.. roz..renie",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Pri .al.om vyh.ad.van. sa zobraz. v.zva {0}, aby ste dokon.ili nastavenie funkcie Zabezpe.en. vyh.ad.vanie.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Ponecha. zmeny",.... SETTINGS_OVERLAY_CONTENT: "Kliknite na spr.vu {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Roz..renie McAfee. WebAdvisor bolo pridan.",.... INTRO_OVERLAY_CONTENT_1: "Otvorte ponuku Edge a spustite nastavenie roz..renia We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3448
Entropy (8bit):	5.52345775049827
Encrypted:	false
SSDEEP:	96:CKwa7ruIwBho7Pjxm+FhiJcrERrEztNou:CK1kK7Plm+Fhi2rYrqt1
MD5:	38F4238742D878971219DA6633F4BBB4
SHA1:	311296E41397550642D1C83A9D31FCDACA10D44D
SHA-256:	789704DBC72C097172B5E1FF035403F1CBC9AB41679D557A0EBDFD0E901A926D
SHA-512:	7B227D31D848261FC236B898E81624FD2DAE4AC7BB33117B2D09995251287D3AAC5216DD9A36EB197DDCE667867FC34B840F6BFBC3EF11A623875CF3A3534929
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknite na {0} da biste zavr.ili pode.avanje WebAdvisor-a.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Omogu.i ekstenziju",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Niste sigurni u gornju poruku? Ne brinite . va.a privatnost je uvek na. glavni prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kliknite na {0} da biste nastavili. Skoro ste gotovi!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Omogu.i ekstenziju",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Slede.i put kada budete pretra.ivali, od vas c.e biti zatra.eno da {0} da zavr.ite pode.avanje bezbedne pretrage.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Zadr.i promene",.... SETTINGS_OVERLAY_CONTENT: "Kliknite na poruku {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Dodata je ekstenzija McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Otvorite rubni meni da biste zapo.eli pode.avanje ekstenzije WebAdvisor.",.. INTRO_O

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3419
Entropy (8bit):	5.533271832723571
Encrypted:	false
SSDEEP:	48:XLtr87bPTBKfvmX6L9AvAMbEFGt9M+WRRZJ1aq3CTCc2IEqr:btkPdKfvLLGS3NDI9
MD5:	6404D773DA16F832FD5AF2FA301DAA1C
SHA1:	93C8F95587D554B7CB03095876CA155EE62F3A92
SHA-256:	13DF10ECC89C09F9DDCC3D979BDB045E67B92E217F21BEFCA0744C64DBAEE234
SHA-512:	DFEC2D4D96FEAB5994152DDEC6F2B5AA05DC1FB07241FA102717FEBF0B2A04A04C7250D495B5EC31FB634025F46E9B36DD63413405E4ABE3C505D76CDF54F76F
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klicka p. {0} f.r att slutf.ra konfigurationen av WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Aktivera till.gg",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Os.ker p. ovanst.ende meddelande? Oroa dig inte . din integritet .r alltid v.r h.gsta prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klicka p. {0} f.r att forts.tta. Det .r n.stan klart!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Aktivera till.gg",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Du blir tillfr.gad att {0} f.r att slutf.ra konfigurationen av s.ker s.kning n.sta g.ng du s.ker.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Beh.ll .ndringar",.... SETTINGS_OVERLAY_CONTENT: "Klicka p. meddelandet {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-till.gget har lagts till",.... INTRO_OVERLAY_CONTENT_1: ".ppna Edge-menyn f.r att b.rja konfigurera WebAdvisor-till.gget.",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	5.554179967722551
Encrypted:	false
SSDEEP:	48:8gTrSRlazqTSoc8T4mq+pxP3yfK2XsCzjW3A/O20q5HBjgr:LMTSzUtCBwOBjgr
MD5:	1C1B8A9EEB71DA4B74B5B3235CF4D111
SHA1:	A61B33886405DE9589A4825ADD9EE2AFA62E70BD
SHA-256:	558E5DC9C25728F1F49747AF9A227D9E00C98F9341C96269922471E7A46D8923
SHA-512:	62DD74DF9D888DE75CE955C831ED8086B1FE135CEDE6C79012B2B06A4D9B806BAE8CA1B285656CBD561D1B4047ACD2EA4FBBA957D9C596C1F7ABBD280F1731C3
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Web Advisor kurulumunu tamamlamak i.in {0} ..esine t.klay.n.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Eklentiyi etkinle.tir",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Yukar.daki mesajdan emin de.il misiniz? Merak etmeyin . gizlili.iniz her zaman birinci .nceli.imizdir.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Devam etmek i.in {0} ..esine t.klay.n. Neredeyse bitti!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Eklentiyi etkinle.tir",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Bir daha arama yapt...n.zda, G.venli Arama kurulumunu tamamlamak i.in {0} i.lemi istenecek.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "De.i.iklikleri koru",.... SETTINGS_OVERLAY_CONTENT: "{0} mesaj.na t.klay.n.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor eklentisi eklendi",.... INTRO_OVERLAY_CONTENT_1: "WebAdvisor eklentisinin kurulumuna ba.lamak i.in Edge men.s.n. a.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	6.217812122783
Encrypted:	false
SSDEEP:	48:6UrfcU6lnW9tyEQeLJrcwfrZaq0KSVnUUJfQpriFJ:6UrkF0t2excYzSVnUU9KriFJ
MD5:	C3ACC492D138FE86B0A1917314544DBB
SHA1:	EDE0EC946AA0421052A640A432510A07C19F0C73
SHA-256:	51B1351E5BFFEE659C60B7D26B04FED5EF2D96BA6B8178E1BF8A6595BB4C2944
SHA-512:	201AC39006B1A1484CADF600FD486909706B09366F2416B10198E656E7096C1CC62EE5F2ACF980648971164BA4F351EEEC075CD109CA68A4FEC43ED4F87B8A27
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: ".. {0} ..........",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "......",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "...............................",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: ".. {0} .........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "......",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "............. {0} ..........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "....",.... SETTINGS_OVERLAY_CONTENT: ".. {0} ...",.. SETTINGS_OVERLAY_CONTENT_BOLDED: ".... ...........",.... INTRO_OVERLAY_CONTENT_1: ".. Edge ................",.. INTRO_OVERLAY_CONTENT_2: "..........................

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	6.287479166634276
Encrypted:	false
SSDEEP:	48:Fnm6KjBr0E5eC+WKA4DKoYwWAV85brkeUwmxm3VBpRBpG2m6a3:JbM5dtKPDVfeZrkRwGm1pDb6
MD5:	5BCBB44A2769F617655839A50782A8B4
SHA1:	3C4E08E7A76EA624FEB1966B15E003981DB19046
SHA-256:	B30F7E4AF3275943E6A6C246676A633FA4203E43EE4AF578B2C82D0BB05A0FDD
SHA-512:	BB451632C4EE68094447D7C44132292904D6DA40FCC93C0AF85A0D793C5A4E54DB528C2D347ABCED86C297A989F6A7197C656B0C8345D616F200064F8A0CA713
Malicious:	false
Reputation:	unknown
Preview:	var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "... [{0}] ... WebAdvisor ...",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "......",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "...............................",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "... [{0}] .........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "......",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "............... [{0}] ..........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "....",.... SETTINGS_OVERLAY_CONTENT: "... [{0}] ...",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "... McAfee. WebAdvisor ....",.... INTRO_OVERLAY_CONTENT_1: ".. Edge ........ WebAdvisor .....",.. INTRO_OVERLAY_CONTENT_2: "...............McAfee .

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.4758106681040415
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHmBjCQenDHMM:CRsyeBmWfV8ZSXSH6enQM
MD5:	FE207EFC1D1F63A4D549083FEAA01FC5
SHA1:	30A5ED12A58902138ABB290B0CDF710E4A07D218
SHA-256:	4CA46325F70B8F53BB46EED7A33F3F5188436441E434E8E41DD928B75D074869
SHA-512:	F9C85EF03BB237479CAA60AD04CA997AD4FB5EF1C2C29CBB9C40BDBEA31DFA927CB8CCF24CFAB3BDB92ED6BB14F1ACE09A39301D88D2D64E5B4EEA12B0103AE0
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//9B7C7E8EBBBC447B5537C8A97AB5E1B199370B388A1B1C80D191D7391D235851E91065AA52952C7BA745BBDF2D248266D6C3279723A9ADFC126A1D93A063B67F++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.481832957925144
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHXW9eAV7Di+gWSb:CRsyeBmWfV8ZSXSHG9s+gWK
MD5:	ED6C4DF9FF122601857DAA470E979881
SHA1:	AADDD247269D05C789534DACCC8B4DDC2DB753F9
SHA-256:	0B5A1D4193F0EFB40AAC5F1350957A5798E70CCAB6FB0F015629CD6EFC523EBE
SHA-512:	8A3C6342C1EB379B50B3D55ACE2AB293C18A00686C43B856732C2278822A3584826AE777491FFC5F0D471A067E319C9AE3FDBD0BD8992A6932AD01F9246662D7
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//1812DFFC4360496CE2E6004D4E5F722C7724845CCC68A360204D449171F6DDA825D1FE1B72118DC4FCAD453E194F3219A6F95796639A0F7E5D80B8CFC5EE4B7C++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.495091095046002
Encrypted:	false
SSDEEP:	6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRSLZ94qesLa4r:pCPR+2cyeBmNEfSU8ZpoXSHx3te4/1a8
MD5:	C09144B45710EFDDD7A48083C1863478
SHA1:	293DE1F5110D77FF4789185BE982FC53D4167736
SHA-256:	A3A78267541D736410C668E0BDD44FF4EB8457E9B2D167AA25C0AD804BB253A8
SHA-512:	B55334160178BAC01D99EDEA7450CF94234EFF7531103CC578092E8895E23E3BC864D62340D353FACB6BCED85A58CAB267168AB33A8205816D783CE8946A07FD
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//B70C62FD017C6D5FC50432B9F240DA710CCF7869A23B66B18D15CB67AF2D863A35101D2145CD9E8DE283994B90F9C07581D12036962DFD00C5A67F8FBA51D957++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.471831051494513
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHGHRY04QWUku13:CRsyeBmWfV8ZSXSHGxf4QWUkuR
MD5:	4B52DF3831532268C073A22DDD76EB08
SHA1:	F0C9446406F08D7ED69B2BB127521D667621DD99
SHA-256:	BC9B2AB8EDE4C07F8FC46D29DD1EEA1B37805B37C7EADC0971ADD7C01F439582
SHA-512:	76FECA263ED43FA600795AA7CC8E5CCF85287AF64BEC188E5709F6C4AA10951F0389B8E5E8E0857D85BA772D4C77E5E068937475139C81C3D36DF85D8F6C2A33
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//A8C901B5AE19074C3BA0948E85341671C46B35A741FA1627DF1ABC8991DC90B80F3323A4EC25CFE5A9435DFCE4CB2AEE64B08AFBD2D5BCFAF2516B32AAC2AF20++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.47040040499985
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHS3ORpymh6duoy:CRsyeBmWfV8ZSXSHS3OHymhKy
MD5:	DBF540A3561B3B3F17F2D494045FE660
SHA1:	1FAF035DE82EFC9BE99B63046DB46D78C075F129
SHA-256:	143CC14CE4E4B0226369BFE707F2DD5FAAC5664C4343F11811FC8F9F0F957A46
SHA-512:	59B6EA41993EB11740E0FE02D4E5726C9A37559C7900BA588C34910C806D88BD296BA8B115EED76FB8FB7DFE44868ECD539B6C9469A5CD3D0124F8B4BAF42695
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//B5440D399E1EB1FB924A26E1D2228FB7BB4E8034A0BE0FACDA4BDF04626A8FE7D86630F5B71F6BFD1638EBC26C9184787D38EADBEB08A14E716C68639A8C8658++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.4307378142966165
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHjPNKp7XIsRc:CRsyeBmWfV8ZSXSHjsIec
MD5:	49D76CF2617639E1D949091D75B9A35A
SHA1:	556C990E0243A385F30F7124BCCFFC174A31892A
SHA-256:	4237377B85143E1CC3C11C0BB1CC95005F11594B577CAFC8FD157B36006C323E
SHA-512:	89D855D0E61CA1CDC29BF5C72EF02291DDACED7C1EA9AD0C350D70E12DBE05446F5E68DF1FEA36D04658EACFE69D73BBDFE0AEA2F429F3213AD95FB4F39E0FF0
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//CEB5CD70E0DB458F5B4CD30C6CBEB97FCC49E84893F4E0BE8C3C76F1B99BC68FB36CD19411CAC0BFC9B3C7DB57C265A546184D74D3AAB2EADC900AA1E7C10BCA++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.47435822751087
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHHwF7ORhn2FOnu:CRsyeBmWfV8ZSXSHHyCIOu
MD5:	E119B6F3E45E92E092CCE6DF906DEF20
SHA1:	3A323CE6A1F80191841DA26FCAB0277475BC59F7
SHA-256:	FA8CF6BC1FFB61D9FE98FC8685B6FB8E8B29B9AA6680FD54B11D2690C8574E72
SHA-512:	1C60A6A304FC2073B74FDED7F960AE734AF2D19A0A112C40632BF486E04DA5F57977ADFF8D3B131768EE5F99BDA63E1F955CBD8FABC4BF6DDE4224F46B17DAF9
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//B1D0B04C2AC3C816AE041A99A0A444C5C57A4B715C0AD7EABDE0C2C33D3B491A48768F813DC38966C2501D36C555F39512969838CEFA4637CCF634379D1C82B0++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.479123914275465
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHZa5nJdGoYcV:CRsyeBmWfV8ZSXSHZMHGotV
MD5:	45700F425D5E40AC2DD84233976773D3
SHA1:	78B3C8D1CBAE263306DAB46978494F06086F5BAE
SHA-256:	A130771AE3A9C400F6D1F5B9CB52A571209C26A752156B97842E44D53C90F18E
SHA-512:	1BB697F3ED203F91F5EF49D316048AD4D7F4FFC8E896E3DADA4B902F0C5D3976A949C5351D921F7795FDF42B971FFD00D126365AD82E539A927E227244273EA1
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//D54C1F8A4CD47DD94F8374AFAAB95D3EC9CFAF8E9893977F864E86D424A52955E81625E650E110E3777232F689A9F9849285ED9F8217751DD5BA14431E021889++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.462731863639466
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHv9kSnlRGkRFVm9M:CRsyeBmWfV8ZSXSHvG6GIFk9M
MD5:	90C63FBEF9319D87F172047942E53C94
SHA1:	9495CE1FFCB132734BD7D6D8448FD9787E033FE7
SHA-256:	FE0E89053829AEDC19CE90FD34B2376169C9C7EF3AA61E92FD119108489352E0
SHA-512:	35D39F07D1BF8564B5AD26FFAF5D08B9EF935C1567678230FFF251EEDAD4B1A709C6BDC6A2BA19EA456DD4E1F61EE783A6B9A1E7A7D9940F86A5189A76FCC2DD
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//FF5995D85DA229F7EBA74F9746AFF56F7001B3BAE16D758EC641E7ED1EB6697EB1C76BEFEC2162895B0DDA6575358667A9E8DFEEA69BF5A0E922148B0C1246A6++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.443578744550161
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSH5OtXhnZrYY1yrO:CRsyeBmWfV8ZSXSH5enqgyrO
MD5:	465548A4CEDEDFC0A3E5752E375F4873
SHA1:	3C4432435867C420EF3AD6351788C26D2504A455
SHA-256:	D4933E59325CB1697DC4C7C0A10D2709899C6073DB55E3C034CC8ED0DC98B59C
SHA-512:	6626397EA94E89AA696A64011ACFCEF65AE345E5C2ED89359340CE96FC2FADB64621BE5090A22063F565FF99609585AC102FB5593348C7F464E6C46E7332F2C8
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//EF9AA7C3B59E831BFC3E5629A3C70BEB963D81CF66AA9D5FC6186E56FC3A7D30A6EC6F777CADB1768BEB8B3B8561200D2BD1AE94DFE930B0AEE301D26BA0F60D++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.475960282259572
Encrypted:	false
SSDEEP:	6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRM4qTbE0AS/Ji:pCPR+2cyeBmNEfSU8ZpoXSHh/E0bJeD
MD5:	9B8FA9B7ACFB4311432168C153170741
SHA1:	18F8FFDB9EB3A5E839F5A6D5C04033C1F21E4F19
SHA-256:	8E9B8DDED930A115BFAE560EB16861A53EDE5522396AADD340E76E056D39C686
SHA-512:	B559A1E4D773A38ACCB5F970BB5F2D2BCF31B258809487FA15C55B86F8D91FD6590953BC09B95E8844665C8830F700F4832F748C95E5F6F3BB907F41C162DB1A
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//6456AB811C53668A6B2E515F3AF2FDE6639FB3A580D0D09427DB47F4BC4746C66A157100CDCEDA14C9AFB01B3DA037A88B3077808A86CCEC070CF3ADF0F8144B++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.483353476014259
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHadhXn7CGVg:CRsyeBmWfV8ZSXSHadhrdg
MD5:	890D321493F4127CE4D926DD0C05266B
SHA1:	0AB7E230C7417C6965DED3F82339447A0FAD3FD4
SHA-256:	8759C3CF0E235DBAD9134B35D1A2A9300E24157B804BCB08B2FE41B6ACA3E84B
SHA-512:	D0113CEEAFC33D90EEEA86FD9A02F0EDB29B22926C4C6B08CE6F44C1B799485CCEA7AFC913E1854FF04C8E04F96A7ABAE24B8F61C22494BED19D6FE723D58AB3
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//BDB5A0A665C57F5C51D8383DB4D1BBF8E3E61B686AC9DC649BE7938E72210C062D1B77BB158636291473994AF223D48E22823A1435E87DD23D80CE3106B26D5F++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.448184357719359
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHknIKF68zcdm2JRRTh:CRsyeBmWfV8ZSXSHpAj2JRj
MD5:	AB8614D5308C49BA531C930B37FA92F4
SHA1:	8230295D1E30DE23BE56F5D65797E224C243D354
SHA-256:	528E052026984F89ADFE9489D9658A91C8B14C455791544D29E9E70CA99C7C79
SHA-512:	F5B2EB27AB0CF9E69A6C496DF9685B6DDAF80A632A4BE24D3F486349E825D13A00EFA3B82F4A59681314CCB89279977926B160BF3E389A2C8ABA2228266F7118
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//8DCADF21EBE41A72AF4F28870726C03694FCA878887CF2E7B838852004B6BFF58820F81C578E6628A84DECF85671963FCD32682ACB2AE815C0CEE0FB4464AC82++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.478085141923155
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHelTEUXFWa2/3rQ:CRsyeBmWfV8ZSXSHepEUXIl/8
MD5:	004810B643348F82B0B92DAC6FC43859
SHA1:	9C410CD3AA1402A756B5AAF376EEA432271D6659
SHA-256:	E41B3B2F4BD327CCC1813C949C081FCF52A4547AC6734CB8A214C142C95CECAD
SHA-512:	220F5E6E3E2670E6B2A12B4B58434D16D4166A1F27B2E381882B0C6736CD00378959C48889671807C08C2BCB5E2944AA3DD1B1DF5031133AC2E88C541EE94F8A
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//A77CB812FBDBB3E757CAC50899849B7E3BD083FBDD4F874AF42EB2466A658C7E28B1D386A2A4943C63A71C0944E5A263B7683E003E9B4563358EBFA5068DAF5C++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.491038109455585
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHddp3g2ezYc:CRsyeBmWfV8ZSXSHdZecc
MD5:	139478E90AAF608C4ABC9FB040DC45D5
SHA1:	B3BBBD1755CCC7C07F5BEE8E9209409CDD2F8881
SHA-256:	81685015E6C7DA4C68D0C6B31200643F6549B28B4ADE6F07BD55AFE74D9822AB
SHA-512:	163C140C7D1C06170D547DC0209B06724DA4D7D4B1C89F1A2CFD442406AA79C9B2F93578EA9B6B8854AA91CAB4B0F2D855441892872618A898BE9F1BBB5D9D6E
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//D41493B50028FA8C2DE76CCE94593C98E881B9F37F2E9FF5A1F23F06AE82D1A56D1009893C4F7CB126C03279B7466208799BE1059CEFDEF41409F16341C4113A++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.454642148955664
Encrypted:	false
SSDEEP:	6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRTJ2t058/hvLU:pCPR+2cyeBmNEfSU8ZpoXSHkOxle
MD5:	DF15DAB74FA4DBCE9E8878573E9179B2
SHA1:	8AF092312427ADC0D97B35940FFC3417EF7ACEEE
SHA-256:	96E8883A9EE15C9916130AAF963846A479058328560CFFD1068C8FABF1193D07
SHA-512:	0D6C4D4F8FED98A67C3798E5C5681A638C800C4265CDF2874DE13B1FC95C90B495018F9091AD7F3C58DB9A4B53B444B9367265F074374EDB9FED08F32FE5B69D
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//4F9A158A393A4E42B52F4367C94C00D15E424EFE1E9AB00D9DF96A2C0C96E0898D3BABB8835BFC4E6B08E7D79230F8CD6AD532E8093EBE33E5CAB49457E2C8EE++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.4435879544367785
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHd5hnXWeS5U:CRsyeBmWfV8ZSXSHvhX3SK
MD5:	C6626B62DFED6725A5A4DDE03E46FE44
SHA1:	5B36273D30BDA060C86DFCC46EF239BE88A1D0A5
SHA-256:	F0F5DF76A2D313BAF60751B54B8D0AE7EF4C422F8BEDA3C6054B4AFFC4F08C9F
SHA-512:	21827B132AD910AE5A27C09FA1611BDE7A66892C1EA06CEDF255B07CA167C4BE7903E71839181408F5EE4C1D481D8EBCE6A92FADD1D7D4EB84A3C1D898B74E34
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//AE6A27BDE408F65B5701FEB493A22AB286C3BB54CDDBE20482A76442E2ACD9EFFA6612AE4A5E8EBE09CBA9C363FDC680D0EA44227D33FED2D4BC606D51BD651E++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.463513217681237
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHVjmiQukwPRH:CRsyeBmWfV8ZSXSHJawPx
MD5:	2C9D7937F982E7DA29751EB2BC031FD8
SHA1:	C68C00B221F70204F9022AB380AD35FC9F2802E9
SHA-256:	45C1CE3A57C70679EF573DF52D0A375CA76D6DB03D4BD6F9AF7F1B28CB55D808
SHA-512:	D01A21D2FB2969D22BF4EEA084B6C87AF7C292EA9DF638ECC574C52C876885742309903FE61DE4FBE531C79E3ED3DBF851287C6C1F60D69878A8A08D10FCA0B6
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//6D68A495BDF8FC574B7565B4B075D715D0D7B7EC3288B2FA3E85D1CCC7E4B9E139086AEE4D6342959D4C6865285B5AA88468D46EB75136D29B83982683EC6D41++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.474688718068832
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHP1b2nRhRjsp:CRsyeBmWfV8ZSXSHhI0
MD5:	DB60705077F2F8F52FBF71FB808710FA
SHA1:	CA4239AA9549C18C63C26D548D4CBD12F1E14918
SHA-256:	568244A252618BBD192F529CF00F8F34FBDA8AF7DADB4AF11604DE361DCE5208
SHA-512:	4183BED126777F13125826D096F4E68A373015D93957A22CE975D2F8925C9F1CC4FC245B0C3A35C2040FFD903F7B0A5495ED769E7922649ECF7F5EE65ADF22C7
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//71D074919F166A2866A2BB7E4DA639CB92A391665B4555E7E62A45607B4DCB475C1EFBEDC21A9A155FD23DB57F50037F7730EEBAD960A920479C169A233D60D9++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.458074089048836
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHoxXTdQ1ggvdhn:CRsyeBmWfV8ZSXSHkjdQZVh
MD5:	D7030879A1CD886767C2956A05F3E80A
SHA1:	AF22439F94DFFA48CFE827B1877A793388238D06
SHA-256:	D20CD9BD0543BB7A860D23095DC22406641C6DEF448449A143F7E818E784B9E9
SHA-512:	041E50BA2F8D2E66E29DBE46895B27C3FBDBC58707984C88939D1E774E23D63284FE57F9E63D7913BA8C9AA54721A20411E8644026086FF2BCF5042CC26FEC20
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//A9600F19215FBE491226EBD40A0D9D963AA4D25230F42A0DD9541CE9912D7C4944241112B34C5687256BCB8E6ACA9CA4E4AE2EF85B87EDAFB16AED073CE26EE0++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.481344686655015
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHSA69cHbPcjVdzER:CRsyeBmWfV8ZSXSHSAacH4jV5K
MD5:	2534ECE97EB182B4A51D5588713736F3
SHA1:	A9D1FCBC8DF9D250E2E94BE2886A79E39238DCFC
SHA-256:	3C390FCE3F4FDF1BF6C0127F910E006CD52230145B9815CCC7D5D064F0862C27
SHA-512:	3EF22C8AF9213FE1ADF589A9E51B30110C1BC70FD0E682D86CD4EBE031590ACB1B38A00148DAD04AA763E0415301CAF7349F917D5E33FA86A7D4DDE967EAC2B0
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//3A6507E6FE48B47BC4C1F02114E35D4D52F1C5E08A222F8FFE72AF52D9FDB7E857859AFFD5DDD3B566F577B52579DB31A35ECACFB2A098A039A3470579C0B027++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.466027731100819
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHPdU5OccXo1+R:CRsyeBmWfV8ZSXSHdccX5R
MD5:	37F1B93F4C785E8D779FE5D6681DA998
SHA1:	792AD3E763666DB2493E43CC6AFF6EC6FB0C314D
SHA-256:	C699A6A19F2E9B09330E97EF633DBE8D79D3BDBECC5AEDD12704BCA31F2E5308
SHA-512:	B77468B2B238B92E79B5060E19358C54496F0FA9E55AE3E5A192D45BE30550EB4DAEB1A141A97E15D865CA52AEF01C2A484233BD6F7A13E04A962F6BD2F778CC
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//11510DCE0F7C5918C3B25CC120E2A204AF5B051DC0009BD7DE82A2D7BCDDA171977FEB6D5DE89D5A4EE81EF01A5549857E562A8F4B21FD737D9B96630F31AA01++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.4787556586911155
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSH84Itih9oziqh:CRsyeBmWfV8ZSXSHqih9oR
MD5:	4E97243E498B29E9C3D039745CB97FB9
SHA1:	5A318BC4F0A38EDD0EE32DC648E46CF1C212F3A0
SHA-256:	266E2BCE743B4FB4B8374F2B9F744764019BE49063F2D6319E210544A2906927
SHA-512:	82A084162FE56D4DAC1E6014366FC05E457E396E0C7AC0DE5F2620226DB18B68EB156B9E0C2376FA73C5F06E845A0018C711CF8D129A025743FD1C6A8811135C
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//0EFA169094261DD536B0FA26C237BE24F84C4AA0FC5A74F53645EE5D44F8CAB2AB9DF1D316020B841C1E2BCA84FDAC357774C3C90566FDC6ADD1A85FA9CD9734++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.488813032392837
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHGhSZzNY2TyDwO:CRsyeBmWfV8ZSXSH22y2TW7
MD5:	FB0AEE157672520C1625E58842658DAF
SHA1:	EF3F8617466E91B9E39754A9A61536DAED1D3054
SHA-256:	55387D9551216BB11D61DF0433105175CBFF2099BA56FB96D498C301FCDE52DE
SHA-512:	3B36F798A6C176100A4F492354282C62E97DECD4F0A78EBA4546DA149A6C45C6C0ABA9E7574DFBB4ACF91BE70A82B24F912D4EDA296696AAD41565B4D31510AB
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//5CB74A920FE99EEF01CD66BDA2414BD45DBE2BE13A2BD2FA3364122721A2693D3C949ECD5013B31D5694B88EA58693B7081A15E5B353A3F89F9298A74C804072++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.463311687549381
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHhb5F2seVJmqO:CRsyeBmWfV8ZSXSHhb5wUqO
MD5:	BE294E9582CE78D78C6E0C4673D0B563
SHA1:	EF2B0253721E02B8B6D2DE02B4170611E5034541
SHA-256:	2A512268E8B675F9DAE07C594E6A9C4602184A72AE891B997F8F748AD5B07057
SHA-512:	966F6FC8BBA48F61A5AAF8700DE4D346DCF1CB1545B51B73A905C8B7DF5B3067E7C644500732DE6D9822DB558E013FAD7B39D67B037B1B0FBBADDD7459B9D9FA
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//B9AABF9FC26A9244FBE2CA074FB3CF8AC3DDA8BC9A7192EA19C4472FEDD29A82EB200BA67C2297D69654F6A925270B5353718D80DB277BF5330A2CECFA7D0D42++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.477610503111263
Encrypted:	false
SSDEEP:	12:pCPR+2cyeBmNEfSU8ZpoXSHIdISjg4eq2iCh:CRsyeBmWfV8ZSXSHI+St7Ch
MD5:	397A8AA01D128C07BC7C55A949DD3DA5
SHA1:	7012001F4A68B9EAD9765E4BE78FE5CF1C6A60FC
SHA-256:	DE2740ED7BE8A7337586BBEE83D8646235D3F1AE427904979E865AC8FA59B8D3
SHA-512:	438DD113DFB5BD98787CEDC02482CECFDFDA4C10F102B82CEAB31DCA32BDA9B4A1DB70164B9D199EEC67DB8D7A7511B8287B620F902E0B8B39FDC6D3520006E3
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//9E4C8ED710BC5567A1DE50AEB93249DDEB710D3A16CE785BD2F6B288CE84F5FF1F81EDBC2DFE6F655875A8D3AA19F34846100A6D1B95C541B398193485F0D8F5++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.481021717019209
Encrypted:	false
SSDEEP:	6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRm/r4UYwh4nbE:pCPR+2cyeBmNEfSU8ZpoXSHjnVvfqRGX
MD5:	C407E5A5955B7542D99192CDAFC66F14
SHA1:	D630B5BC6E9EF91BF63C28F89D69AA3FE2D4E543
SHA-256:	500CD57CEBC52D51606C1DF525CF267646ECE554603612CDDC22F9AC06A466C1
SHA-512:	F3496B6C5C013BF4FB61A4BE0BB2DEBB5B44FDB8705692195206EF8B321BA3BA6772C4051440B17CBC8D3ACDF59C120FC0D9D4A1489057D52B2406D8EF6D496A
Malicious:	false
Reputation:	unknown
Preview:	var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//C7B68584711F77A5823D538B36D64E804C35C2BABE7FC6F8B0F09AA2B01BA005762AE1CB28CCBA736B910DBC5036F5C205DF0A39D3893E0803FF86164B25FBEE++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	716
Entropy (8bit):	5.603466386701819
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfx6v9LuO4biqra6fMocbkLwT5zxjAHo8+9wuRTos4SxQrKOCj:7e9SlNLiaf4v9KO4zG6fMocWIOHo8+9t
MD5:	8794C890BD2E81943C82C292F66F3667
SHA1:	3B4C2828FD3DAB4F81A8C31B1D4317970A19712F
SHA-256:	074AC361DD559BAD3396B7D2BBAB1DD617F0D703F1F9EDD187A01A70E5469C4F
SHA-512:	A092DDCA133709C3E07A59FF231F97ED03FAAE2DF99D819E92B0D49CDB0A832CB8C913405C438A7A9322466BC41D5BDD9D392EB8FA0100A8D15910239EE86082
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verze",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Prohl..en. o ochran. osobn.ch .daj.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//A33A9CEAAE4D249C0FFCF86B46DD3CFE7CFED92C807371FAAD24F10184439BD12196A90CAD70144F27B4D1487BF8C1647F83CB050B21FF0689425EE4A0E9E96D++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	728
Entropy (8bit):	5.561213207315339
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bikzbkLwT5zxjAHo8wN9wuRToIDlUMJMlE9:7e9SlNLiafLYFv9KO4dWIOHo8wN9ZR0g
MD5:	A051DAA9B5606E594E4CD75E82068988
SHA1:	7AFC13E52ADC302A9E3835FC418A8ABB501957D9
SHA-256:	0F18C38792BB96A8CD3F11E91E8F8C05C463D7755945D5D0630C459A6EE90995
SHA-512:	341F223CDF8F49FB8CC8126B610026949E9171F85B24970E797F5EB75D3CAE9EC6C066B94DA62283972C57737D80C77241DE02B238D0B078FC012AFFC961B027
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Meddelelse om beskyttelse af personlige oplysninger",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "F.rdig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//775927AF51C58C15181597C0E40C51FFB2B46720C140702E55EDD759C98B1BBB9BB1BB67EBC5319E66CEC6C06F4E63D92929522DEBA419907802E4311F4B6AB1++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	695
Entropy (8bit):	5.546960598972389
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bi+p3ibkLwT5zxjAHo8+N9wuRToh88JwGdOO:7e9SlNLiafLYFv9KO4pSWIOHo8+N9ZRw
MD5:	4CA73911A8549309C48D4E2DBCCD384A
SHA1:	D5E3B5C8D2C4353315B93EF16DA69F8E6F7445F6
SHA-256:	145DB2CDB5B8FD781A5F84E84A57CDA055A47551DC291D3335ED695E459AEDED
SHA-512:	8E9DBAD8225952584310480BF67DE048C2FD27D6EC7776F30F5EFB3C5821AB60513618B7E98BCEC0BAB954BC5197154CE03A6965E64D506C190E0A8EC2EE6AA4
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Datenschutzhinweise",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Fertig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//37B600152353029B4EE0D51C5F5DC779FA4154C41F9E987CBBF78A388CF7EAD941C181F0D37CD82E6A42E1523AF2D045963BF87889701AF7027EEA10566B41D7++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	750
Entropy (8bit):	5.75038358315992
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kft6v9LuO4bi7XKfRWkGmbkLwT5zxjAHo8JP9wuRTo2ma+apHkGKb:7e9SlNLiafEv9KO4mXCWkHWIOHo8JP9Q
MD5:	6FE7F9625E2B43D3DFA72219A32CD797
SHA1:	AAA18255C4C9228FAAC221451CC599881DFE99F0
SHA-256:	99DB09DCA477A43E3C1230DED9DB306527A648BC9CDD1FE4D11396EECBC4E8A3
SHA-512:	F60D3F083BB557ADA563E07568ADBA9E81BA9FEA3A385F9C57BE02B313DFF4AAB51A2B3EA42CC3B23BEFD3385A67C43BBA39098D711819B04226E397FF618E8D
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "...... ............ .... .........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: ".....",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//5D3C085C46ADBA2C87236F283C7F7A6F9F8528F5D95484748AD517E395A273333B09FFE5C5AD7832E2A2AECCDA0A44E491DE1E4FCE209B0AF2F79D34A9089B03++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	688
Entropy (8bit):	5.5148376008517355
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4biqkCbkLwT5zxjmT9wuRTouGQN:7e9SlNLiafLYFv9KO4zkCWIoT9ZRxT
MD5:	96F06BCE2F8241D3FAA99D215D5165E9
SHA1:	6CC4465149BA689E6509BA85C199C357DA5E76B9
SHA-256:	E6806211EC82E58650186D6CA0E2586158031052AFB622AF8D669B6DF8B10586
SHA-512:	294C816E99BFEB230C629FC90CA4DEC3E969731B25D0DC252A833C914AAED54E686005F875284488EC6432555EBA23C63DA0C27E05A0EF0B23CFFEE85603D2F0
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacy Notice",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Done",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//B470C7AAF5FDD24BBF32F7476686D802B0DDD7A2E27E19E227FC11A318F1F178EE4A187DD27F062D9068D7C9D3AF476F7739316C707BFE1246DBE8BCCB582598++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.53027365887532
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToFVoEmUo/GbXn:7e9SlNLiafrFv9KO40gnWIqgV9ZR2Vo+
MD5:	6B40E984877643345441286818FD3E70
SHA1:	72C8EBFC44446664E55F7789FCEA06CA1B18DF44
SHA-256:	B49C9D62E2060E3BBFAF24ECC36016322B8E11A11CDFEAF1BCD5AC34605AE51F
SHA-512:	0542309BAB98597D6DE4608B2F14DECD65322D8517F9D9D95D7169EF5E9A1DAEECD9ED0894D8621B0AAFE9AAE58BB5DF95D8E49EDAC8404FDD527F961CD466B9
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BFC1DB273BDD11606013A9CE4642C9329CA41AD21F8C5F38531ECDD48BE2385679A485CD0BCFACF2455A2D5D9F53158546E6970F6E6C56ACBC14DB30A9FB7FB0++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.524664431479274
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToJcdLRDonXqU0Xn:7e9SlNLiafrFv9KO40gnWIqgV9ZRHdVd
MD5:	06DD08181921F52A83115283267E31C2
SHA1:	34E1A98CAC15200DACF84A5C4EAAE3C48769F48A
SHA-256:	36C38D7E0367F32F8A4390424B826F337E3717AF61610D3B6DE7355735252DE2
SHA-512:	804FD02DC4B162A9D25A8F395E904100CD87073DE18AAB1941E56571BAB2EDC4904FCEA4FE3AA9DE27DA85EC723CFDAE0AFC6FE981E07EFA3992A4E90E56EEFD
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//754B3DBDEB13314364EEB697D5B6FCC9D319892836CC4544C9D93068886BD51329DF441F3502D2BEA4DD61E90BF9BABABFDF8DBDC811D9B264B26A0CD94D3A62++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	692
Entropy (8bit):	5.516986272783081
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfft6v9LuO4biu6gbkLwT5zxjAHo88WN9wuRTo8pcqxFaSRa:7e9SlNLiafsv9KO4RWIOHo8Z9ZR1cIav
MD5:	3C20435CCED9E2BECB29CAB56E69538B
SHA1:	406AEED3490CAAE193A4944197A3C682DEE6A427
SHA-256:	E0691F6FFCC80E2D932F5E32A9825BD7C4ABFC929C2DA9F74BC432F50AB8142A
SHA-512:	B472AD0D1AC7196F070CEB9E7D23ED70EBE5F6B2065C53FA98F0B1E10E9C9986CA8612DB622DBBAA938BBAB8AE0E5DD7D62CB03B864CFCC8FEBE840EA5102A0C
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versio",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Tietosuojaseloste",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Valmis",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0645A2C63F8874B2644CB688496CC128F3D37ADF4FC5C554ACED68A88DA43DABEF8D1954B6DD7DF54AD1137215CE6B6683F5A9571F7336393F5858DE05A9DAC2++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	710
Entropy (8bit):	5.554042069584347
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRTounXHUyEe:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRv7
MD5:	779EA85FBBF62C1510D3E05AB20C26EC
SHA1:	A57E416890AD142307798E99AAFF5E2F3BE4EEC0
SHA-256:	DBB25AEB94E9C422846AC42C27EEC7E640F1319EDD2AFFC2FD5567CC6B4A6B40
SHA-512:	A068B003B7F34147F770415F2934F03E4693197542897CC9BAB4E11C7155630B8A4F1AC2E50EF07C59FA5551E86C0D94872E55303F39212AE582310DB6777C14
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//9E70D09B967A834FE69317BA4B5B2CDCA5AC0F8BA4BCE75D9F9BDA71C2AFC01B14569FD2CB1D7E039B498BB092871C7EE39C6108057E2C26BF900E4805FC2775++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	710
Entropy (8bit):	5.541459694602625
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRTo7NoqnUXLpKn:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRaD
MD5:	638D9816DE2A345FA16AE761F050A6AE
SHA1:	532A74ACD0DDF25BE6045AAD208641E89709CE68
SHA-256:	08098B71086F96092F73853EF83B8A022A91C47E63898F30B844A9E743C972D9
SHA-512:	0AE92E9CA59CF34623952AC68E61ACD46F09EE74BBD0CAF2CACA87D93DF7503C953229FDDF39E497FC1A0295F5A54EEB658E49690A95D0AB79FE4C4FA4C89627
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//6F7E8BC63672E5124455E40C6A50391F50FF34D1A21C9CC76B56B5DDC555534CC35BD263EF7C7A12E42D75356E165C5A39E0AA148F5F8A7BDE6016BA541E147F++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	703
Entropy (8bit):	5.556912313975577
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfv66v9LuO4biaBzcbkLwT5zxjHT9wuRToUePBNIm2Xg:7e9SlNLiaflv9KO43BoWIVT9ZRzdQ
MD5:	0354889B640A12B309CC946C5354C21B
SHA1:	022A64BFDF5B8F2D679A6E156C152507498E16AA
SHA-256:	E1541C5B527D9D1E3A8811D5A6A7C507A8603416043B053CA97C288209BB8A4F
SHA-512:	72EA0BE258BA654EDDC88CB869FD0942ED95BAB5CB406E6B7F51B85446C2907E318C794D19B45D5D4FCD22A8A17459E903D95AB61FDDF2A02D90B272A0886295
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obavijest o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BD9F914B7A0128058D12F3AC184833E8A377909F9AA32B164D1780B4F12C26513CB70BE7383900D24E79F5DFC4F0B91CD6E9656E92B21310D6C6A3CDCCEB2021++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.595019305091011
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfQdU6v9LuO4bihIHmdcbkLwT5zxjAHo8Kwv9wuRTozXbVNVXc/yP:7e9SlNLiafQd7v9KO4k6ocWIOHo8Kwv4
MD5:	2CDA0C30A354370C38A338217D211433
SHA1:	E9847A549D61A27ABC0ED964FD5274CE0445A353
SHA-256:	2386382712EE52F5FBECA3B47504F3D4B5A4721A7D04A1E778F2E26E87F8C19D
SHA-512:	3619B598B49B9988EC39E1E3D6157F20657F89D01CC28D429DB0D7437190BFBAAF4059B5474140D28D4DD955DF16F019686B47D58E515CAA2AE81A93C55073B6
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzi.",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Adatv.delmi k.zlem.ny",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "K.sz",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//B646A3402844D34E1A3BA92A3ECDCFB4D75F7956083C08493BAC3027813F5D2321C77A171338350B777AE9128F7DF21D1E437C0236713F2161F293A88ACF137C++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.5303189627766365
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfy6v9LuO4biNkbkLwT5zxjm79wuRToHMqjKVYVPT/idrr1n:7e9SlNLiafVv9KO4akWIo79ZRlqjKG/8
MD5:	7EB6790A46F59D57836EB565C8660794
SHA1:	DD58C46B3B5F26B17928EDE27D1A8E906B545634
SHA-256:	69B6D743C89B74E2C9E84D16C528D200CC2DA5CB664B0A42EDB63EDAAFB2C31C
SHA-512:	F6ED66EAC521E498E00C489C851D33B923160B13AD843393634F90D62737D2F41F676A19384C8574962766619B3E32A6EAFEB176C78E81E5E5163B4EBB7735F9
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versione",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Notifica sulla privacy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fine",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//E9BE2387F2CDBC3D449C22604AD71B570D5065387929BCD0066BA637E8BA9FE83771F4F1EA6F7C81CD037BAD09A8DCDE212A3E4D7A5EAA079206B856D67B6B39++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	808
Entropy (8bit):	5.724439798276386
Encrypted:	false
SSDEEP:	24:7e9fLdo5ijdfA6Dlv9o4A2AWIOHo8UHv9ZRDZNZU34F:K9fLdICdfA49XLAWIOfUHFz3ZJ
MD5:	07FDBD0D28F682026EEBC7916F698498
SHA1:	CDD412C22D0D717EA237AEBB8290191FE06CB248
SHA-256:	BF7E520F826F1B040E673EB83D63F59335E19555B8D30E13DB5D292BE76E65FE
SHA-512:	15BB86ADE7D71AD2FBD33735D6FF39C0B2E22E87D82FB4B3658BF777D0138AFD8F7A1C584441787782EEEAD50F30C0B170FE4E9033A4AE6AA374BC1F9A361324
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "..... .........",.. PRODUCT_NAME_LIVE: "..... ......... ...",.. PRODUCT_NAME_TRADEMARKED: "...... .........",.. VERSION: ".....",.. WEBADVISOR: ".........",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//7783325CA0B03097EBECF6759CE913AB93310E7D91DC918C9BA143A6ADA9FE7E0F2EF884278D3A99A8FC3097885BEB1D9FF0CF7E6AE5F0A3979CD545BE514079++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	742
Entropy (8bit):	5.824735575206991
Encrypted:	false
SSDEEP:	12:7ekSd6ds63i7R6ikfV/i6v9kc4biyGbkLwT5zxjsGiFW9wuRTopvNWL2zXkK7h:7e9Ed13isnfVtv9kc4sWIViQ9ZRmz9h
MD5:	E8C5D1545F9A393D61EFD20253BF601B
SHA1:	B0BB63E52182556570FE309FE544C58833AA3246
SHA-256:	3A7D35147BE6D99B49508736EB75272896262B026B84DCAA2B549F3B4DFDB4CE
SHA-512:	B753B23CA68DC1D4A3ADEAD1B85B74A0A5C2EEC4E7A441AAB2C206C474FC2892F156B02B9046807BF962824940C044E05F875DFAE1F4BF492F75F3B036391114
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee ......",.. PRODUCT_NAME_LIVE: "McAfee ...... ...",.. PRODUCT_NAME_TRADEMARKED: "McAfee. ......",.. VERSION: "..",.. WEBADVISOR: "......",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".. .. ....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//D23508851469B0EA5EED19A4C0E5034E8AA911B017BE0301EAC8EC7767872C403759927A82BAD01581A53086B63B596E8A716496FDDEECFBF302529D7FCE4548++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	696
Entropy (8bit):	5.556600355543895
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kf3Hi6v9LuO4biqyNLMBHbkLwT5zxjmf9wuRTo3scybWLO:7e9SlNLiaf3Fv9KO4zyNsHWIof9ZR1cG
MD5:	03F5F916ED430732D2218BB14B0B42DC
SHA1:	4D0EF8E67F16E6552DA5A74F45A1AFA8D56300A8
SHA-256:	5400F723BC1A0E3F88990BDEB6271BB676FAA6EA6517EB6FC89609357CB7438C
SHA-512:	2F457D2C3059DD51F948379AAC6E7A60E0AAA4DF17C3353963787A72DCA7B6D6DFDC000C5EB12F545B80231AF8703C69A8BD4FBE0D52C8EB81395B6E858D0E48
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versjon",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Personvernmerknad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fullf.rt",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//98255434BED62EA15F51E86E3B8DE2FA4C5ED375452638A40C358F773F990D4A535C2EF1B49A47703266BCFF789DC96D2BC830BE3EB996D903CA66C70EE2BA29++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	746
Entropy (8bit):	5.612753891806925
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfP6v9LuO4biqLEnbkLAWB2CT5zxjAHo8CW9AWB2CuRToHWRsVWsO:7e9SlNLiafyv9KO4zLEnWtB26OHo8CWk
MD5:	775D563614C64FD3F82E7DAE40FA502E
SHA1:	FF27DAF15836E916D1E45F7EC26A92CF4BD9B64F
SHA-256:	A7344FC245049318767A5397C3B9E36A975201559F2B829D9B1B7B0F4370EA6C
SHA-512:	8FB67852EA2A891379F7EC062D3013FA6065E6A015984795D01BC26953DD2B4C15A1FDA59AAEB080CE4CFF233EF376AFC26C51B0A6243794602804795D60CB37
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versie",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacyverklaring",.. PRIVACY_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Gereed",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//727E9C732B0CD944FB705156A8CE66E8FD455712F1D580E15CE2F39E0B8C824793BC1475EC46937EE451EFE3565A81D88B2B1679C803A536DDC6FCDBDCD984C7++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	709
Entropy (8bit):	5.54596132666323
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kf6v66v9LuO4bipidGGnbkLwT5zxjmO9wuRTo/aSb8+viScjC3GxL:7e9SlNLiaf6vtv9KO4oMGGnWIoO9ZRGW
MD5:	F16C62EC1EBC7863FCAAD41304A250FE
SHA1:	4A15712ACE684882C40E47DC8827A12768A56FA7
SHA-256:	8A4D1AC4E1A0272C147173CFF86711028FB8D0CD944D98DAD8CC013C462C8EBF
SHA-512:	9B50630AED63B9A7F274626AAA6169293E80B5BD2675F3C573307DFE3B2F4ED44CF26FC940D8E887F0DD5704186434A567590E6137D210988778D6322063C7DE
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Wersja",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Informacje o ochronie prywatno.ci",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Gotowe",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0D7B3AB56D641A87696C4D7861802CB559C2F1BE08BFF6F2E435DEFBE8F7ECFC73135DDD88EAAE9F2CB34E783D1FAD68739D4EC473D6CB2CF389DA4B49EC967F++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.5527621729689685
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfqX6v9LuO4bicmHbkLwT5zxjAHo8kf9wuRToVoHGqQhWngT:7e9SlNLiafBv9KO40HWIOHo8K9ZRpmqE
MD5:	28785D55CAEB93DC4DAB0E948BB295B8
SHA1:	B05E40516159DE35EE28E69E9027C7EEB217F53D
SHA-256:	299E921BF57E002F61B4831B666DDC3B67A4BDC53ED42EA28DD3F6221D44DEE9
SHA-512:	BE3E4BA37FEE694D8F1F535822E557A325891B0FEF100F37C907D9CE09C6E53C3959BCEF5EE7A31266DB4EFD92B910888C93F44B47A978E1F69F96434F8314B4
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//6384AD8AD4D850A59D39F3DF8D3E6FFC05FBFC8FFB3AFE45226E4F6BE153C05D14FD4108A00C5732762890D6B5A991E32590D693E6BE198229630DC131620C87++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.561157492608534
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfqX6v9LuO4bicmuybkLwT5zxjmkf9wuRToSQwCeO:7e9SlNLiafBv9KO40nWIoK9ZR7O
MD5:	6E9EBAC171792EF5C6F675889922D4E3
SHA1:	7EC4E4E9A6C05FEAD73A3CF0C0B30D599AC7DF94
SHA-256:	6C5A8D69D2FD38010862BE52AE391308663CE074F6B0E044F67C60A873F02812
SHA-512:	5341A9DC69DB49FEA4E7B82C02D57DBF51C549DC02B23E0FCEC7AF077552534249F8502044776D9BB0987EF12E1321A3A22EC0BC2A171FCFAAEF5380A188623A
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de Privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//58A82BDC7983BE1E70FE02354721ED75ADD01428ED2050CA7791180C6104C112BB5DB8E540169E5C91C0073A6773072B0F6BC2A1396F9FB25F73547F67070B8A++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.737759761884001
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kf96v9LuO4biq0epiXbkLwT5zxjhKgE9wuRTo3xP0XPUXR1wvE7nn:7e9SlNLiafUv9KO4zrWWISt9ZR6xP0KD
MD5:	E5366F92DC09135D4640ABB48E3D98D5
SHA1:	9924C9AA3F6A5B53E0682F2C9047D9DCD3825D12
SHA-256:	2D800754132F08AC208F3295F5EB6A3ECA08732CAB0DF5C146FFBC4B3864CC28
SHA-512:	094A4A7A669CC338B33867470A0D0ACC3A79959DEDAB1054557F2CC262287A5844481D0154DCAAE713D82F3C3F2CB999474AF848A53A54CDE2F9FEF51130CEA3
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........... . ..................",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "......",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//DBACDB75FBA39FBC15B351D433142ED25DB2AC0B412CECD79AF5708967C1C7BCA3374D5C31A7810DE779A2376DF88FC613485DE7403C105FEFCAAE13F10E164D++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	719
Entropy (8bit):	5.625409797709229
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfa6v9LuO4biIAbkLwT5zxjAHo8+9wuRToFyChIAZqXh:7e9SlNLiafNv9KO4uWIOHo8+9ZRCyhAC
MD5:	4230B155E5353C646812C4B20A90A814
SHA1:	9C2A64A9AD57DAE5FC6D236E1A68FDB84F98F1BD
SHA-256:	068D918BE3BF86CB7DF6DF57E46437AC3444D8EA517F9198F80D454A5FB16D5C
SHA-512:	A63B3886C005C976A2FEB66103D1B5B0747D378E03F3591D98FB0458C50825B971D8CE4932AA0088EB28374AB9646B3F791BDF997C9B835EF81807D01D28EB64
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzia",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Vyhl.senie o pou..van. osobn.ch .dajov",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//1698D976D7AC87F831659B59C60859AD6FBC935CCC12576FB6028F661C7F8E9DDCEE146AF5511923D30C7B2C5D2C545F1D4EDBE57ED8FF9EB69DF309F3F67480++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.560681855604894
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfv66v9LuO4biagkcbkLwT5zxjHT9wuRToeS+5biFKh:7e9SlNLiaflv9KO4cjWIVT9ZR8+51h
MD5:	379010E8E69CD46B7ED701D46C0274E8
SHA1:	26385C67C579AABA0126B71F0DE2CF7A4CE42139
SHA-256:	C73D7384F7D7468922ADE76DF21C28BD82AAC84E3183A5ADD983A635B5B0599B
SHA-512:	32686912626F89BBAB1739B18DA936DA20F70245D7524346C10C1F80E8C6463D291F2C0D04C9FBE79A37FE7158A8C673A51E142215C7BC9C23E3777ABF9D3459
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obave.tenje o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//81BC8CD8174ABC72C657AA1ACCD80081D790AABC38287E28008535C781AE076513523744D7D80A922489EC406F62A5F8430F7B5DBD6D02646433F82C562FA6F2++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	690
Entropy (8bit):	5.551835977982428
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfLYi6v9LuO4bieGbkLwT5zxjmf9wuRToCBdA1urQhJI+wJ:7e9SlNLiafLYFv9KO4JGWIof9ZRpKG/
MD5:	3BBBA0177E49E07313D7AFA2D56FEB5B
SHA1:	B8A9ABA78CF68595606290E647D63EA61266DD1F
SHA-256:	FA7E940E883699DDA4C7F68408C33824574039570B0F238BEC73ADF54DF7A8F0
SHA-512:	4B6F2AD8C339877CB6CA20A3178007752E4AF7DBFABE58D00A234FDAB6A9888A310A93159A06576CA8D323FE37C650C5C7B77D4B7C6877628DFB1DEB2ADDDAE2
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Sekretesspolicy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Klart",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0B8440823AF6C68D538110EDF9B1057AB7F8C1344531F24CBC5959C7227B25E29BA23672DABAAF461F65B9F65E0E1368C143B4C026F21027AC9EE578336A7147++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	696
Entropy (8bit):	5.55794047416744
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfT6v9LuO4bij2VbkLwT5zxjAWoN9wuRTo8n0YPgWMkBhADQPh:7e9SlNLiafGv9KO48QWIuv9ZRvn0RK28
MD5:	824BCE38448D0B743D4476B8370F2C3E
SHA1:	E838BEBD1F9DC325B9E45627049D12C482095D0B
SHA-256:	5055352E2F168228580BB4A56319D9B6598FE1C100D324E10F7648376ADFD126
SHA-512:	B0D3C64B42845A0F0AF4FBFA3E48652236B1E2B971B4F92C11A998854BF3D7EDF619FAD422CFB8A9B1A9129151895580E6D6B5D15A4936C32BD4F2DC0A7E9AE6
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "S.r.m",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Gizlilik Bildirimi",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Tamam",.. DONE: "Bitti",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BA08A3B8359F502901E7D31E0480037E54351C96475E3E93E59079DA9A82A2DC78686CBD1579E3ACE9B26C82C069D2AFBBF896D32619BF9378E06BFCDBD2C09B++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	713
Entropy (8bit):	5.910535895650701
Encrypted:	false
SSDEEP:	12:7ekSuKxi7s6kfF6v9bgbiE4ebkLwT5zxjtDYv9wuRTo+sCfxRVc:7e9uui7s/fsv9bg/HWIv49ZRxZfxQ
MD5:	88A78221CC6E88E6DB37C449A1D1AEB5
SHA1:	9017C3F33738B08F6A99D567D57BE297E2E02F7C
SHA-256:	501566824AAC07EE52296D3410F9CBEF3834CE71624510E51228C25C6D26E084
SHA-512:	F77DB85E5F805EB1EC5BF4019F13091551B52794CFEAB3C878781E0142F6DCA951DD091BA013D19F03DED6A86CDDDBD5223D33143029919980D10A8DB63A571C
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: ".......",.. PRODUCT_NAME_LIVE: "..........",.. PRODUCT_NAME_TRADEMARKED: ".... ....",.. VERSION: "..",.. WEBADVISOR: "....",.. COMPANY_NAME: "...",.. PRIVACY_NOTICE: "....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//3FD962EDECC3B234D81E83329F4821B544341288A1BCDFBBFD54E680F6B982CC48E6C1257714B94C9335E839FF08DD1CE27166E81DDCE3CC0F2B71563A6EF948++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	694
Entropy (8bit):	5.710761896835509
Encrypted:	false
SSDEEP:	12:7ekSSlN95i5kfF6v9LuO4biP3emebkLwT5zxjgDYv9wuRToflpU1PM0Rhn:7e9SlNLiafsv9KO4d1WIG49ZR9n
MD5:	2657FD5592A96D8AECB301F21F28887D
SHA1:	4D890B88E4C6FEEE10A2DA20C8616E4E35C8BCB2
SHA-256:	E43BEE2A6045B1703EBA1101350E3205FE3E7F734E7EF69B37303F72684CA9FB
SHA-512:	1218C8EE669D316DD247830058B4DE225870377AA5362E3DDE8A52E756210BE19C428F8A22875DC5D66A6C7E3C5ED9F12FD237CBC4DE42EBA2881A2424BD2F6D
Malicious:	false
Reputation:	unknown
Preview:	var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "..",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//779C74F28EF2D51F12A816128E5A3064780E7FA615050C896D51C037DB0E19D7BA8AC249CF54879EF4983799B68C53F507E053D3B9FF1911A15D49784F8475F4++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3828
Entropy (8bit):	5.647077032874223
Encrypted:	false
SSDEEP:	96:ElmtVPut9muF9guJVDWtfDUEWP4gU4zTA46AOif7:ELt9mG9gMVDMfD7VgUeb6ZC
MD5:	40CBABC4984A2C48E4A301EBB435C4D0
SHA1:	FB862BFA6BB713658FCFC491003FD045ED4F1262
SHA-256:	A41D469879E99FFB4E054C555A01070E4C4536601E2D872D6DB53D9297DE8A1B
SHA-512:	BD007492945C57AAF4228EEB33D6579E0FB3DA16F4C67741BB6EE698561231DDC33FA9F3467A7782F48CF727797D89A72F5A265772E29F54FE21BE49F3387728
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "M.te z.jem o je.t. lep.. zabezpe.en. vyhled.v.n.?",.. TOAST_VARIANT_CHECKLIST: "Ano, chci po restartov.n. zapnout slu.bu Bezpe.n. hled.n..",.. TOAST_VARIANT_BUTTON: "Hotovo",.. TOAST_VARIANT_BUTTON_FREE: "Hledat se zabezpe.en.m . ZDARMA",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Hledat bez ochrany",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Nechci bezplatnou ochranu",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Va.e webov. ochrana nen. zcela nastavena . aktivujte ji zdarma",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Dokon.ete nastaven. bezplatn.ho proch.zen. internetu McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Chra.te sv. osobn. .daje",.. TOAST_VARIANT_1_INFO: "Proch.zejte web a vyhled.vejte s v.dom.m, .e va.e osobn. .daje jsou chr.n.ny. .ekneme v.m, kter. str.nky jsou bezpe.n. . a kter. mohou b.t nebezpe.n..",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3597
Entropy (8bit):	5.386810788526084
Encrypted:	false
SSDEEP:	96:w/A9Lqnt+lLcLvjcU7s1KWfENcDh22BqOQiirtt:etCLovj5AIWfENkBqB5t
MD5:	7638AB2DEC58D2047CEED0EFAD6FC894
SHA1:	0045D989131FFA22A3DF515E7D193F9337151F30
SHA-256:	7813126937421407099F92585CBEB929DE6685BC16496EE54AF9163E4420F6E5
SHA-512:	EA33F00DDB18F2EB477BB1033B53105242782A1DC5243C40D1BC266174C4B8CF9F9D45679C8135FCF7CDD311BE83DAC212352AE00BBF5C30AB8B878CF7175305
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Vil du tilf.je ekstra s.gebeskyttelse?",.. TOAST_VARIANT_CHECKLIST: "Ja, aktiv.r sikker s.gning, n.r jeg har genstartet browseren.",.. TOAST_VARIANT_BUTTON: "F.rdig",.. TOAST_VARIANT_BUTTON_FREE: "S.g p. sikker vis . GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "S.g uden sikkerhed",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Jeg vil ikke have gratis beskyttelse",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Din webbeskyttelse er ikke fuldt konfigureret . aktiver den gratis",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "G.r konfigurationen af din gratis McAfee-webbeskyttelse f.rdig",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Beskyt dine personlige oplysninger",.. TOAST_VARIANT_1_INFO: "Gennemse og s.g, vel vidende at dine personlige oplysninger er beskyttet. Vi fort.ller dig, hvilke websteder der er sikre og hvilke der kan v.re farlige.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Fjern bekymringen fra

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3722
Entropy (8bit):	5.357301392436372
Encrypted:	false
SSDEEP:	96:MO3e8qGlKtiKL/7vdAmPegpo1fkJFfVQz4bLECx8OoMUxy:xdqGYtj/7vdAjgpSfkJBVQ8bI6BoY
MD5:	E9ED399FF8A144F71D5A65BD8BF631CF
SHA1:	C5D8030B627FDE7505710A937D70BAE42C97B642
SHA-256:	5410BFE496327E0FD88D554AECAA131A8922DB5E318DC5957170BE83E5116D64
SHA-512:	2FE6B451F1C3FE0E79C487950E9BDCCD17004EAFBCC9103BC817D04477A17393EAE36FF91D1E66D13DDACAD49AC00B24450FFB127C605A7D5CD5B7EE76E56E20
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "M.chten Sie zus.tzlichen Schutz bei Online-Suchen?",.. TOAST_VARIANT_CHECKLIST: "Ja, die sichere Suche nach dem Neustart meines Browsers aktivieren.",.. TOAST_VARIANT_BUTTON: "Fertig",.. TOAST_VARIANT_BUTTON_FREE: "Sicher suchen . KOSTENLOS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Ungesch.tzt suchen",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Ich m.chte keinen kostenlosen Schutz",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Ihr Web-Schutz ist nicht vollst.ndig eingerichtet . jetzt kostenlos aktivieren",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Schlie.en Sie die Einrichtung des kostenlosen McAfee-Web-Schutzes ab",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Sch.tzen Sie Ihre pers.nlichen Daten",.. TOAST_VARIANT_1_INFO: "Surfen und suchen Sie mit der beruhigenden Gewissheit, dass Ihre Daten sicher sind. Wir zeigen Ihnen, welche Websites sicher sind . und welche nicht.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_T

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6107
Entropy (8bit):	5.028541869977441
Encrypted:	false
SSDEEP:	96:3/3ftrYEERsgXRx/+P5BLE27ww5X4e0TSS8bW0u21Uq88:33trhEfXT+P5lrMSS8bEIF
MD5:	006345BA10D9E3B45A7F720FA9148FD7
SHA1:	801A716960714D69021205833845F3C4DE0CB556
SHA-256:	3507BB03C08F0E326AB7EF7645F5662E6F4A3D86934C4CFF4A462F69D9040E2C
SHA-512:	6E63D200A31CD5D1A2BC22F8E0CB8B24A184ECB7E46220B6B2608F174C4F847D8496219A3341C65CD9ABCD94940BE5A22126F71477FE57E54BB4A1492988EFEE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "...... .. .......... ........ ......... ..........;",.. TOAST_VARIANT_CHECKLIST: "..., .. ............. . ....... ......... .... ... ............ ... ............ ...........",.. TOAST_VARIANT_BUTTON: ".....",.. TOAST_VARIANT_BUTTON_FREE: "....... ......... . ......",.. TOAST_VARIANT_BUTTON_UNPROTECTED: ".. ....... .........",.. TOAST_VARIANT_BUTTON_NOT_WANT: "... .... ...... .........",.. TOAST_VARIANT_TITLE_NOT_SETUP: ". ........... ... ......... ... ..... ...... ........................ ... .......",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "........... .. ....... ... ...... .......... Web ... .. McAfee",.. // Toast varia

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3367
Entropy (8bit):	5.337347888881663
Encrypted:	false
SSDEEP:	48:KDGTsDGspn5vrfL5mwfPUpGRtBRTyCM0RL+K8KfEKxKxUT4TyALYrkyL0LEtTC6j:XIisJlwrmtBJZM4d9AY4GbJpMlDQ
MD5:	522592EC49F38054136F90B337388E45
SHA1:	5BC6C83EB12F699CB02AC68BEAD737A1ECE03F40
SHA-256:	267D5189D91B918B4E154BD538643B6254E291D43D0D053F3CF1028984538652
SHA-512:	8DC15C93856C08F754084FB30D7A7BCC5AE0BB95CE9B0AE031EDCCE8A396FF4C665BED2B724C9BA7F806E6D73E03E70CC0124C644BA76E2984D58AA1F7654364
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Would you like to add extra search protection?",.. TOAST_VARIANT_CHECKLIST: "Yes, turn on Secure Search after I restart my browser.",.. TOAST_VARIANT_BUTTON: "Done",.. TOAST_VARIANT_BUTTON_FREE: "Search securely . FREE",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Search unprotected",.. TOAST_VARIANT_BUTTON_NOT_WANT: "I don.t want free protection",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Your web protection isn.t fully setup.enable it for free",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Finish setting up your free McAfee web protection",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Safeguard your personal info",.. TOAST_VARIANT_1_INFO: "Browse and search with confidence knowing your personal info is protected. We.ll tell you which sites are safe — and which could be dangerous.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Take the worry out of the web",.. TOAST_VARIANT_2_INFO: "Browse worry-free k

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3632
Entropy (8bit):	5.365263001922846
Encrypted:	false
SSDEEP:	48:Ks358rLYfTJnrXJm8Up0RtjRoZgeCYSL+VKDKNuKA5K7oUlYZxBOGsdUXc+Kno3t:vRg0tjy4BONb9GEjiGWPc+BIS
MD5:	BA3FA5E5B4E129856321EEE5AFEA7C2A
SHA1:	CC869883C897B85C9E74248FE56E84AFE514FF09
SHA-256:	04A8B7DAD811A670C26175E8D77FDD3AEBB6E445D69D488D4B9DF5E8178C9C9E
SHA-512:	F4D1F7BB85A9DD3F8ED9637A692AFE1D67F144D729B7C3C9F2B54EA4EEE8FB05286A2BB3702F7C5C22913A39C4F12AF837A3309FB26BDF2B98177E53D882DD39
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".Quieres a.adir protecci.n extra en tus b.squedas?",.. TOAST_VARIANT_CHECKLIST: "S., activar la b.squeda segura despu.s de reiniciar mi navegador.",.. TOAST_VARIANT_BUTTON: "Listo",.. TOAST_VARIANT_BUTTON_FREE: "Buscar de forma segura GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Buscar sin protecci.n",.. TOAST_VARIANT_BUTTON_NOT_WANT: "No quiero protecci.n gratis",.. TOAST_VARIANT_TITLE_NOT_SETUP: "A.n no has terminado de configurar tu protecci.n web: es gratis",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Termina de configurar tu protecci.n web de McAfee gratis",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Protege tu informaci.n personal",.. TOAST_VARIANT_1_INFO: "Navega y busca con confianza sabiendo que tu informaci.n personal est. protegida. Te indicaremos qu. sitios web son seguros y cu.les podr.an ser peligrosos.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Olv.date de los pe

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3652
Entropy (8bit):	5.36862951096208
Encrypted:	false
SSDEEP:	48:KHJS5wrLYl0ImbIrXJmfUp0RtjvZgPChBxZSLWKJKDuKlZKIUldZxecemv+G0pPl:QskmV0tjvHhHs4Db+XVpIWYcXBM/j/
MD5:	AAB72366E7BD9D0CCCED2D36E36E778C
SHA1:	A9B9CE1100DB77F9D5A83B1E2A767EB687C50EC7
SHA-256:	9E4D9110A241A1FB04FEC6A3AF120C77F5FE05F0C21E73F5B554D90E1CCBD05E
SHA-512:	182615DF5C80CE66D88E36F7D8F14377D565D3AFD26A21BEA3FA0860B2EFC743A123AA0A04AF44DDFE302FF96B7E8CDD2BBA778CE6A42747B665F997BB0F7C43
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".Te gustar.a agregar protecci.n de b.squeda adicional?",.. TOAST_VARIANT_CHECKLIST: "S., activar B.squeda segura despu.s de reiniciar mi navegador.",.. TOAST_VARIANT_BUTTON: "Listo",.. TOAST_VARIANT_BUTTON_FREE: "Busca de forma segura, GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Buscar sin protecci.n",.. TOAST_VARIANT_BUTTON_NOT_WANT: "No quiero protecci.n gratuita",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Tu protecci.n web no est. completamente configurada: habil.tala gratis",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Termina de configurar tu protecci.n web gratuita de McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Protege tu informaci.n personal",.. TOAST_VARIANT_1_INFO: "Navega y busca con confianza sabiendo que tu informaci.n personal est. protegida. Te diremos qu. sitios son seguros y cu.les podr.an ser peligrosos.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Navega por la

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3556
Entropy (8bit):	5.347283549492298
Encrypted:	false
SSDEEP:	96:dWem9nFXHGetHHST0of6hMJHL5Y+jMp1t3NQh8lp:shXmetHyYof6hMJHLm+jEt3NSGp
MD5:	731D0EA3BAB93E021C951A9ACAB6E223
SHA1:	3DE61E0896A0553E7D0AF835DE667F1453D93A72
SHA-256:	9389D68EACF47C85E5ABBBDB78695F6BD9012212F9C21EC634275C970C9790EC
SHA-512:	5C7CEBAB822020ADC472AEB6785D57A3AE917D3F4617C46D9C51BC06B4CC6876F0F4EDED69FA565B56E5151F69A26F3A2C3F27D14788F67F3BA3003A981FEFA3
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Haluatko lis.suojausta hauille?",.. TOAST_VARIANT_CHECKLIST: "Kyll.. Ota suojattu haku k.ytt..n, kun k.ynnist.n selaimen uudelleen.",.. TOAST_VARIANT_BUTTON: "Valmis",.. TOAST_VARIANT_BUTTON_FREE: "Hae suojatusti . MAKSUTTA",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Hae ilman suojausta",.. TOAST_VARIANT_BUTTON_NOT_WANT: "En halua ilmaista suojausta",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Verkkosuojausta ei ole otettu t.ysin k.ytt..n . ota se k.ytt..n maksutta",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Viimeistele McAfeen maksuttoman verkkosuojauksen k.ytt..notto",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Turvaa henkil.kohtaiset tiedot",.. TOAST_VARIANT_1_INFO: "Selaa ja hae huoletta . henkil.kohtaiset tietosi suojataan. Kerromme, mitk. sivustot ovat turvallisia ja miss. voi piill. vaaroja.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Ei huolen h.iv.. verkossa",.. TOAST_VA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3937
Entropy (8bit):	5.325857152978712
Encrypted:	false
SSDEEP:	96:a/ScFsBmXt/CuFCNSCAQ9BYYmWJmn9AvwuHAnp/SsQWgXcm:aKOEAt/tFqSpQ9BhrmKYEApKsQym
MD5:	4AE521A2ADBF616AC09649A6136099BF
SHA1:	A9EDA7D3F9C14A73C6D23E670FD37BEA1F525FC8
SHA-256:	A3AEBA9909E01C09FE4EA4EBCE8E4D5A297A5802C0D931FD11BC5781D9EB2F28
SHA-512:	FE7AD12887BCCAD25F8D42F6DFB73378EF17C07BA17C32C9485124BEF5E286193C7D660FFA2F775D2859D4823E20D7B04355C8C0A099B7FF662E9BA24F36E355
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Aimeriez-vous ajouter une protection suppl.mentaire . vos recherches?",.. TOAST_VARIANT_CHECKLIST: "Oui, activez la recherche s.curis.e au red.marrage de mon navigateur.",.. TOAST_VARIANT_BUTTON: "Termin.",.. TOAST_VARIANT_BUTTON_FREE: "Recherche s.curis.e - GRATUIT",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Recherche non prot.g.e",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Je ne veux pas de protection gratuite",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Votre protection Web n'est pas enti.rement configur.e. Activez-la gratuitement.",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Compl.tez la configuration de votre protection Web McAfee gratuite",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Prot.gez vos donn.es personnelles",.. TOAST_VARIANT_1_INFO: "Naviguez et recherchez avec confiance en sachant que vos donn.es personnelles sont . l'abri. Nous vous indiquerons quels sites sont s.rs et ceux qui pr.sentent un danger."

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4024
Entropy (8bit):	5.32197544571694
Encrypted:	false
SSDEEP:	96:b34FUJtSNXfN0SPAuWXhC00ZmnfQR9SujAnV3JyMAh:bQMtkWS4umSmoCgAVgh
MD5:	C04956B6946712B30F6DF0FBBF9F7C40
SHA1:	EF3E5E3A2D9A8FCB474733614E7D1DD1E8549B15
SHA-256:	7BACC85701838E0302A8FAFD95789E48F2DE00F7371FE53DD222B7D15AC40AFF
SHA-512:	878A74B7D551EA27AA13492FF33E518A66D05EEB0759E41CCE19D0B29DB1AFCC787B82463E70F3068CAAC7AC8E1F99F89EC830F43B33F3F158DA3AE2B9642901
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Souhaitez-vous ajouter une protection de recherche suppl.mentaire.?",.. TOAST_VARIANT_CHECKLIST: "Oui, activer la recherche s.curis.e apr.s le red.marrage du navigateur",.. TOAST_VARIANT_BUTTON: "Termin.",.. TOAST_VARIANT_BUTTON_FREE: "Rechercher de fa.on s.curis.e . GRATUITEMENT",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Rechercher sans protection",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Je ne souhaite pas de protection gratuite",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Votre protection Web n'est pas totalement configur.e. Activez-la gratuitement",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Terminez la configuration de votre protection Web gratuite McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Prot.gez vos informations personnelles",.. TOAST_VARIANT_1_INFO: "Naviguez et recherchez en toute confiance en sachant que vos informations personnelles sont prot.g.es. Nous vous indiquerons quels sont les sites s.c

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3635
Entropy (8bit):	5.44810511568993
Encrypted:	false
SSDEEP:	96:ajcHGot9qU8FSKd49nVVtx5B9Psk+20fmlq:zBt9z8Fjd493txz/L0fmlq
MD5:	6EA35A6A7E77D8D9E87A631FA8F3DC37
SHA1:	CADD782257293C5DC46A9A4AD4D3BDAD08696D5B
SHA-256:	8C24E8B65269E1D1048D1DBDA6A2913C391C31F20871B59E490EF4E7298E654D
SHA-512:	65B831F291A5DF8246B7056C3FA0372D2A85DF580A931F831F33ED355967380768B7B158454CBCAB14D296508A669DFD5E8555C31CD70133091734B5E4FE6477
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".elite li dodati dodatnu za.titu pri pretra.ivanju?",.. TOAST_VARIANT_CHECKLIST: "Da, uklju.ite Safe Search nakon .to ponovno pokrenem preglednik.",.. TOAST_VARIANT_BUTTON: "Gotovo",.. TOAST_VARIANT_BUTTON_FREE: "Tra.ite sigurno - BESPLATNO",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Pretra.ivanje neza.ti.eno",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Ne .elim besplatnu za.titu",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Va.a web za.tita nije u potpunosti postavljena - omogu.ite je besplatno",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Zavr.ite postavljanje besplatne McAfee web za.tite",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Za.titite osobne podatke",.. TOAST_VARIANT_1_INFO: "Pregledajte i pretra.ujte s povjerenjem znaju.i da su va.i osobni podaci za.ti.eni. Re.i .emo vam koje su web lokacije sigurne & mdash; a koje bi mogle biti opasne.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Uklonite

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3828
Entropy (8bit):	5.517745405979984
Encrypted:	false
SSDEEP:	48:KQpmKkwbL+sDfLlUpxKRtIC0vCGNAgc+LP+K5LK3TRKwJKV54QUQQ99P1s+l2cSP:6QtdTBPqw3Tg/UgbCx+lN4xM
MD5:	5CEAB1D74EC64DAE0215EECD06BE91A4
SHA1:	1C1B360F1A35EDEFC5213C3F5CA9FD930F8F3C6C
SHA-256:	C476BAAF44D7F1FE03235B9E19EBD5D23D4C1B900E2FE0689E78B2EFEA59A603
SHA-512:	30176163D5AA03FE28D2C5C32E6CEC504217B9F4BB6FA313ADC12DCD24816197805FFB748FDB6AB31A6A934B6DDAC77DCE2B00286EFD4C12F30025C0470F532E
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Extra keres.si v.delemre is sz.ks.ge van?",.. TOAST_VARIANT_CHECKLIST: "Igen, legyen bekapcsolva a biztons.gos keres.s funkci., miut.n .jraind.tom a b.ng.sz.t.",.. TOAST_VARIANT_BUTTON: "K.sz",.. TOAST_VARIANT_BUTTON_FREE: "Keressen biztons.gosan . INGYEN",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Nem v.dett keres.s",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Nem szeretn.k ingyenes v.delmet",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Webes v.delme nincs teljesen be.ll.tva . kapcsolja be ingyenesen",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Befejezte az ingyenes McAfee webes v.delem be.ll.t.s.t",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Szem.lyes adatok v.delme",.. TOAST_VARIANT_1_INFO: "Magabiztosan b.ng.szhet, hiszen szem.lyes adatai biztons.gban vannak. Megmondjuk, hogy mely oldalak biztons.gosak, .s melyek lehetnek vesz.lyesek.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3548
Entropy (8bit):	5.233302989528303
Encrypted:	false
SSDEEP:	96:9xj3zLp7tpe0ddA4Pxt9Qmcnq1qYENfDI/0DES:T17tpe0sQxt9QZ+qHY05
MD5:	832D1E4B0B47693401F27F2CA25B16CF
SHA1:	C1BD7541EF4B46EBB7F39713B82782B508ABD7FD
SHA-256:	B18E0E30CC569F8F8530FBE3E0E8A7B9CD183C14F5C385F2AD2C3FF8CDD6F90A
SHA-512:	C6592C552ADB467FDE1D4CB16AE96AF96F9873B364806230EFCF1C7C4EE02314AD1999BCD7E79A022E431F6317B6851589F5E0B308E3378C38C36E7A87148ED7
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Vuoi aumentare la protezione delle ricerche?",.. TOAST_VARIANT_CHECKLIST: "S., attiva la ricerca sicura dopo il riavvio del browser.",.. TOAST_VARIANT_BUTTON: "Fine",.. TOAST_VARIANT_BUTTON_FREE: "Ricerca sicura . GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Ricerca senza protezione",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Non desidero la protezione gratuita",.. TOAST_VARIANT_TITLE_NOT_SETUP: "La protezione Web non . configurata completamente. Attivala gratis.",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Completa la configurazione di McAfee Web Protection",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Tutela le tue informazioni personali",.. TOAST_VARIANT_1_INFO: "Naviga e cerca senza timore sapendo che le tue informazioni personali sono protette. Ti segnaleremo i siti sicuri e quelli che potrebbero essere pericolosi.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Naviga sul Web in tutta tranquillit.",

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3960
Entropy (8bit):	6.014091106818228
Encrypted:	false
SSDEEP:	96:6hHMKEaeQVt4/aWso3rOx4mc2JYtwhnoIZH7Ssx:YB5ztO57Ox4mJ8Eogmsx
MD5:	91284D12C2F6BE7F3265B34FECF57462
SHA1:	34F08B1CB6F70EF9BEB4A772E862755DE6FAA3E8
SHA-256:	10066143A6D4183D07C1EE20DC6B72A6493CA83042FA63B18EB82E8557D356CE
SHA-512:	F6A4E507E4A5DD82B7EF3171CAF7C755DAD8532DF0DD3828D26F11441968FDA2F5E3B566FFA34581DC68A787FFA31E3C21DAE77B79B276C512E1FD3C1A37ED27
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "..............",.. TOAST_VARIANT_CHECKLIST: ".................. ...........",.. TOAST_VARIANT_BUTTON: "..",.. TOAST_VARIANT_BUTTON_FREE: "..... - ..",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "..........",.. TOAST_VARIANT_BUTTON_NOT_WANT: ".........",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Web ...................................",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "........ Web ...................",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "............",.. TOAST_VARIANT_1_INFO: "..................................................",.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3783
Entropy (8bit):	5.930936945865895
Encrypted:	false
SSDEEP:	48:KwNX9/6gkTR6wtUp7RtlvCI/Lg7KoR/+KNM2KHK4Uq0RxIZr1ZNpiL8s/cCM7R+e:P26Ft8+W/rNIqxmQlbe6qFlj7n
MD5:	6D2FC5D5309788421889E48C6E541E9C
SHA1:	59A6E9AB53F84E0D274C3FD22D0428AF7EBB36B0
SHA-256:	23D6454C0A9493574C2FF5AC70F99D398424C02B0146574F0249C88DFDA8CCCC
SHA-512:	1742303F0542B2A4A8F2CDB086DA03D809F4E6EBFA6959CDBC850CA4FC71886B3C33524A580CEBBBEF6AEFA76ED81CBE518BBC005AAA8B8B7125BAF302D5DAB6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".. .. ... ........?",.. TOAST_VARIANT_CHECKLIST: "., . ..... .. ... . .. ... .......",.. TOAST_VARIANT_BUTTON: "..",.. TOAST_VARIANT_BUTTON_FREE: "... .. - ..",.. TOAST_VARIANT_BUTTON_UNPROTECTED: ".. .. ..",.. TOAST_VARIANT_BUTTON_NOT_WANT: ".. ... .... ....",.. TOAST_VARIANT_TITLE_NOT_SETUP: ". .. ... .... ...... ... ........",.. TOAST_VARIANT_TITLE_FINISH_SETUP: ".. McAfee . .. ... ......",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: ".. ... ......",.. TOAST_VARIANT_1_INFO: ".. ... .... .... .... ....... ... .... ... . .. .... .......",.. // Toast variant 2 specific.. TOAST_VARIANT_2_T

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3599
Entropy (8bit):	5.361970253589453
Encrypted:	false
SSDEEP:	96:wMQx7teYFyZ8K3XdIcJK10kNeso2bMUaMZiBdOG:8teYFyZ8K3N9E10kNtoYMUaMc
MD5:	63C3662BD8AC02782A14854B5349F15B
SHA1:	8BD0A29EDA4EB3E84F7113B02DCBF47BC36A7537
SHA-256:	03C55E7C83D578FBA0D7778111F5212F1CFBBFBDEFD2C15A67A646ED68C5B8FD
SHA-512:	79CEB7FAF83C3225AB0DD0318D45255579911A0F939A3B019ADAF60855C985C0DB9EA897A05108097FD4F727FE0A0170162DB8E60CD0431017ACF05492419F9A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Vil du ha ekstra s.kebeskyttelse?",.. TOAST_VARIANT_CHECKLIST: "Ja, sl. p. Sikkert s.k n.r jeg starter nettleseren p. nytt.",.. TOAST_VARIANT_BUTTON: "Ferdig",.. TOAST_VARIANT_BUTTON_FREE: "S.k sikkert . KOSTNADSFRITT",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "S.k uten beskyttelse",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Jeg vil ikke ha kostnadsfri beskyttelse",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Nettbeskyttelsen din er ikke ferdig konfigurert . aktiver den kostnadsfritt",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Konfigurer resten av nettbeskyttelsen din fra McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Beskytt personopplysningene dine",.. TOAST_VARIANT_1_INFO: "Du kan surfe og s.ke uten bekymringer i visshet om at personopplysningene dine er beskyttet. Vi forteller deg hvilke omr.der som er sikre og hvilke som kan v.re farlige.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Slipp . beky

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3539
Entropy (8bit):	5.328628433196016
Encrypted:	false
SSDEEP:	96:WupCvikhC0tR356VrLrVHgKFteK5/AhK/pxFoD4QkHdJJ:WupCvikbt9AVrLrVHhuk/AhK/pxOD4Q8
MD5:	046B6A4DF006AB11B72614C073B8B8C5
SHA1:	5CE3EEFBCE9306BFEB751944056AD37506E3062C
SHA-256:	91BC3869286327CF7AA4048AF48A7EA878A7E8C94F38489E8788BA234A5431E1
SHA-512:	C3A5D5C9B053DBCCC820508B02FF9BC0D961CFD93FA6C6582685200C886E3B871D60932B066DF8B1D50C41003048B5B035834AD018F56F929FFFEC62E1BF0B3D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Wilt u aanvullende zoekbescherming toevoegen?",.. TOAST_VARIANT_CHECKLIST: "Ja, schakel Beveiligd zoeken in nadat ik mijn browser opnieuw heb gestart.",.. TOAST_VARIANT_BUTTON: "Gereed",.. TOAST_VARIANT_BUTTON_FREE: "Veilig zoeken . GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Onbeschermd zoeken",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Ik wil geen gratis bescherming",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Uw webbescherming is nog niet volledig geconfigureerd. Schakel uw bescherming gratis in.",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Uw gratis McAfee-webbescherming instellen",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Bescherm uw persoonlijke gegevens",.. TOAST_VARIANT_1_INFO: "Browse en zoek vol vertrouwen in de wetenschap dat uw persoonlijke gegevens worden beschermd. We laten u weten welke websites veilig zijn, en welke mogelijk niet.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Zorgeloos browsen",

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3618
Entropy (8bit):	5.593265357282572
Encrypted:	false
SSDEEP:	96:QrIqKLAst649Gs63IcBPevJwh8i8iiQlacMrIMXkIL:QcHtn9/pcBPevJwh8i8iiQlacMcMVL
MD5:	5A61B80845AB4A488387780EF70AD8FC
SHA1:	95B54859477D0025D46C66E0C9B9D16DFDFA2781
SHA-256:	E4E96D7650B556E76D40F05691CC00B5F8F95422DCACF4C0EE3D1B0AE0ACA5DB
SHA-512:	73A1C59265CE0F1328AC887469FC023F2E4B6E477E8008A4204E0B9F87816475F68DB0D989F8B8724EFF1B869A7232F77118856505112170EB7A4817096439C1
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Chcesz zwi.kszy. bezpiecze.stwo wyszukiwania?",.. TOAST_VARIANT_CHECKLIST: "Tak, w..cz Bezpieczne wyszukiwanie po ponownym uruchomieniu przegl.darki.",.. TOAST_VARIANT_BUTTON: "Gotowe",.. TOAST_VARIANT_BUTTON_FREE: "Wyszukuj bezpiecznie . BEZP.ATNIE",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Wyszukuj bez ochrony",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Nie chc. bezp.atnej ochrony",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Twoja ochrona w sieci Web nie jest do ko.ca skonfigurowana . w..cz j. bezp.atnie",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Uko.cz konfiguracj. bezp.atnej ochrony sieciowej McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Chro. swoje dane osobowe",.. TOAST_VARIANT_1_INFO: "Spokojnie wyszukuj i przegl.daj, wiedz.c, .e Twoje dane osobowe s. chronione. Powiemy Ci, kt.re witryny s. bezpieczne, a kt.re nie.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Spokojnie korzyst

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3738
Entropy (8bit):	5.344905240542473
Encrypted:	false
SSDEEP:	48:KpaRlEpnKqfJuUuRwyUptRtbVaKjJOhCf+L7UKkKwKfK6TU0kPVdq54420uUFLto:w3HtvJxfqFZC/tdHLwjLWz
MD5:	B484DBCD0BC5BDEAFC95B4E320570B41
SHA1:	92C6D2846A941DCC37E6A8FB06BAE8E5B3459625
SHA-256:	F8BB150E1D66F7B317481EEA0301F36D41753F633504EBC4BE070E698B10655D
SHA-512:	7D3FBE9299A336FF3FD08B757A6C135928FCC280E1E5826A6A13E119AB0198029DB758945983D3B0A45B172EA82DCD1589D64BD51B58A9E89FD553F751D9B3F3
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Voc. gostaria de adicionar prote..o de pesquisa extra?",.. TOAST_VARIANT_CHECKLIST: "Sim, ative a pesquisa segura depois que o navegador for reiniciado.",.. TOAST_VARIANT_BUTTON: "Conclu.do",.. TOAST_VARIANT_BUTTON_FREE: "Pesquise com seguran.a GRATUITAMENTE",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Pesquisa n.o protegida",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Eu n.o quero prote..o gr.tis",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Sua prote..o na Web n.o est. totalmente configurada. Ative-a gratuitamente",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Conclua a configura..o da prote..o gratuita da Web da McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Proteja suas informa..es pessoais",.. TOAST_VARIANT_1_INFO: "Navegue e pesquise com confian.a, sabendo que suas informa..es pessoais est.o protegidas. Informaremos quais sites s.o seguros . e quais podem ser perigosos.",.. // Toast variant 2 specific.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	5.338046016472384
Encrypted:	false
SSDEEP:	48:KVFTplRl0d61FB0yUpDRtbVaK6HOd0TZeC5p30BL7UKkKHKMKFTUBk30aB5qyQOA:GE3ttmud03zEPFqtvEezHWNdLb
MD5:	24BCE503317956051C2DAF5A2FEE1D82
SHA1:	59B497AE2A5968198F9A7A70978C61569ED1E6C3
SHA-256:	3D6FDC58D15C7F43DF1DF2C30DEC345A67FA77523E90220C1516E7206A32A60D
SHA-512:	872CD509215408AD9B73CF6EBD7BF234BA1753608E1CF1621E86C52F0B7045CDDEA46FB1241B0E37C4409CE306D10C6B415234FD5EFDD11799AAA11FE5D53974
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Pretende adicionar prote..o de pesquisa suplementar?",.. TOAST_VARIANT_CHECKLIST: "Sim, ativar a pesquisa segura ap.s reiniciar o meu browser.",.. TOAST_VARIANT_BUTTON: "Conclu.do",.. TOAST_VARIANT_BUTTON_FREE: "Pesquisar em seguran.a . GR.TIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Pesquisar sem prote..o",.. TOAST_VARIANT_BUTTON_NOT_WANT: "N.o quero prote..o gratuita",.. TOAST_VARIANT_TITLE_NOT_SETUP: "A sua prote..o Web n.o est. conclu.da: ative-a gratuitamente",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Termine a configura..o da sua prote..o Web da McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Proteja as suas informa..es pessoais",.. TOAST_VARIANT_1_INFO: "Navegue e pesquise com a confian.a de que as suas informa..es pessoais est.o protegidas. Vamos indicar-lhe que sites s.o seguros e os que podem ser perigosos.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Deixe

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5374
Entropy (8bit):	5.130785974433442
Encrypted:	false
SSDEEP:	96:/Li+T0t5WKRmY8vzQedwpNv473IdQ/NtRgn:f0t5Dl8vzQex7DNPgn
MD5:	DC2D53618078BF5EE98AD3789D55AA6C
SHA1:	A89E591AEDF6C12F06BF867554A75D1091EFFD65
SHA-256:	EC5AAEF069F36C78A4485A1C3745A482320F18D5A15B43A28F640A0DC5D7A0D0
SHA-512:	155EAA09EAF03822BB294F5BFABD132B192A1591C9F37541D219C65A53BECB0054F39F4F47F96DE15C69A23F0FA9D6C47CD6C4557C0C9A64B7A0FE3562519ACF
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "...... ........ .............. ...... ......?",.. TOAST_VARIANT_CHECKLIST: ".., ........ .......... ..... ..... ........... .........",.. TOAST_VARIANT_BUTTON: "......",.. TOAST_VARIANT_BUTTON_FREE: ".......... ..... . .........",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "..... .. .......",.. TOAST_VARIANT_BUTTON_NOT_WANT: "... .. ..... .......... ......",.. TOAST_VARIANT_TITLE_NOT_SETUP: ".... ...-...... ......... .. ......... . ........ .. .........",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "......... ......... .......... ...-...... McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "........ .... ...... ..........",.. TOAST_VARIANT_1_INFO:

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3752
Entropy (8bit):	5.647213774791545
Encrypted:	false
SSDEEP:	96:G/v3lJ6qJt9g29MgiL+tBjYE7+R8LB0HDDx+U16j:G3l4At9g29MnL+tpYE7o8LB0Xx+v
MD5:	84A2B59A200F1C9AED6C165233379784
SHA1:	19E69C82C91F0DA54FB9F53E3DB1FE27DF0D5B7B
SHA-256:	72F3649A7BF4E3A238BC4B5F3B0BD8A06EC5DE9A55D2783C32F87A1E5738FCD2
SHA-512:	41FD22971F99909656B03BD6B3EBC13FDB5802AAAC0BBE8E097B0029933A16266B7EB0A4F6D86ED854238FFAA77BB0593947E4B7DD5F2D424AA20DAA198852F8
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Chcete zv..i. zabezpe.enie vyh.ad.vania na internete?",.. TOAST_VARIANT_CHECKLIST: ".no, zapn.. zabezpe.en. vyh.ad.vanie po re.tarte prehliada.a.",.. TOAST_VARIANT_BUTTON: "Hotovo",.. TOAST_VARIANT_BUTTON_FREE: "Vyh.ad.va. so zabezpe.en.m . ZADARMO",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Vyh.ad.vanie nie je chr.nen.",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Nechcem ochranu zadarmo",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Webov. ochrana nie je .plne nastaven. . aktivujte ju zadarmo",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Dokon.ite nastavenie webovej ochrany od McAfee zadarmo",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Chr..te svoje osobn. .daje",.. TOAST_VARIANT_1_INFO: "Preh.ad.vajte web a.vyh.ad.vajte inform.cie bez ob.v v.aka ochrane osobn.ch .dajov. Uk..eme v.m, ktor. lokality s. bezpe.n. a.na ktor.ch hroz. nebezpe.enstvo.",.. // Toast variant 2 specific.. TO

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.447837939845179
Encrypted:	false
SSDEEP:	96:5541sqXt9UFE+s49f8cQq5gAWFLrf9UQba:5Yt9UFq49LQqyfFvOQba
MD5:	75848ADF876428BCAF9B46E099D510A7
SHA1:	234A763C89226315A521C75F274891DAC8C731A2
SHA-256:	748C2D6BAD10907674CF129F23618DAD646BB105FC1275036A238FD3D56C7E35
SHA-512:	0EF16538CFBD4093FB4565A6D1ED1993DE4240F333C716F76BF908568B9C60688411031FB17A30FA6DC1DF911A85AE385DB1945653DE79E50E53A69A2E539937
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".elite li dodatnu za.titu pretrage?",.. TOAST_VARIANT_CHECKLIST: "Da, uklju.i Secure Search nakon .to ponovo pokrenem pregleda..",.. TOAST_VARIANT_BUTTON: "Gotovo",.. TOAST_VARIANT_BUTTON_FREE: "Pretra.ujte bezbedno . BESPLATNO",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Pretraga nije za.ti.ena",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Ne .elim besplatnu za.titu",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Va.a za.tita na internetu nije u potpunosti postavljena.omogu.ite je besplatno",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Zavr.ite postavku va.e McAfee za.tite na internetu",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: ".titite li.ne informacije",.. TOAST_VARIANT_1_INFO: "Pregledajte i pretra.ujte bez brige znaju.i da su vam li.ne informacije za.ti.ene. Re.i .emo vam koje lokacije su bezbedne . a koje mogu biti opasne.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Uklonite brigu sa veba"

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3492
Entropy (8bit):	5.43263730809154
Encrypted:	false
SSDEEP:	48:KaGqWQzrHqWU7B10Up8LRtXbY8ACXGiLuKcUCLK6LKVKo9U31Ta920FLlpx/TV5y:B6CtsQ2klVdM5+9npxU2oBZvOF8Ke/
MD5:	A7CA64B3B9C74251F5C38A623ECDB1C3
SHA1:	296D1BE93423158A2011325C2A7D69CB70F21DE2
SHA-256:	A0F9813680A31316475FC5C3D63A2C67B609BDEAC15A1798FC204C9A3C3BA3FB
SHA-512:	4D41579633C8BD81C3ED0D76743904C95FA94B653AA9C159A683715CF630B5D900E8E2892FA051A23A7263A6A64509F21E15580921D30619B0C7329976220286
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Vill du l.gga till extra s.kskydd?",.. TOAST_VARIANT_CHECKLIST: "Ja, aktivera s.ker s.kning n.r jag har startat om webbl.saren.",.. TOAST_VARIANT_BUTTON: "Klart",.. TOAST_VARIANT_BUTTON_FREE: "S.k s.kert - KOSTNADSFRITT",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Oskyddad s.kning",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Jag vill inte ha kostnadsfritt skydd",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Inst.llningen av ditt webbskydd .r inte fullbordat - aktivera det kostnadsfritt",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Fullborda inst.llningen av ditt McAfee-webbskydd",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Skydda din personliga information",.. TOAST_VARIANT_1_INFO: "Surfa och s.k tryggt i vetskap om att din personliga information .r skyddad. Vi ber.ttar vilka webbplatser som .r s.kra . och vilka som kan vara farliga.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Surfa p. n.tet utan oro",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3702
Entropy (8bit):	5.514258187564101
Encrypted:	false
SSDEEP:	96:CCIbtSgyGyouKx+bG/dDeFfQ3t16h87oCe:8t1yGydKx+SlN916hqG
MD5:	5068C75E130E256EEDF9E56583BB29E8
SHA1:	7D819A8F60DB44C5877C25DF19AB855B79C46778
SHA-256:	A2AE2F6609582487247DA41940DA876E0AAA89DF1E70AB46E2513F557CD30EA1
SHA-512:	31489C0665EF9A8311D70566DA0315F4E908891A988090E9619DDD1E3538A562B864DBD1AA78352A279BD5C01542A1A428FC5D3D4BEED0FAA8FE6B08BF5A934C
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Ekstra arama korumas. eklemek ister misiniz?",.. TOAST_VARIANT_CHECKLIST: "Evet, taray.c.m. yeniden ba.latt.ktan sonra G.venli Arama'y. a..",.. TOAST_VARIANT_BUTTON: "Bitti",.. TOAST_VARIANT_BUTTON_FREE: "G.venli arama yap.n - .CRETS.Z",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Korunmadan arama yap.n",.. TOAST_VARIANT_BUTTON_NOT_WANT: ".cretsiz koruma istemiyorum",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Web koruman.z tam kurulmam.., .cretsiz etkinle.tirin",.. TOAST_VARIANT_TITLE_FINISH_SETUP: ".cretsiz McAfee web koruma kurulumunuzu tamamlay.n",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Ki.isel bilgilerinizi koruyun",.. TOAST_VARIANT_1_INFO: "Ki.isel bilgilerinizin korundu.unu bilerek g.venle gezinin ve arama yap.n. Hangi sitelerin g.venli, hangilerinin tehlikeli olabilece.ini size s.yleyece.iz.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Endi.eleri webten uzak tutun",

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3220
Entropy (8bit):	6.321706518970158
Encrypted:	false
SSDEEP:	48:KpV0YrIr3BkaxUpYNRtt5K2dCaLQzKeKGBKHlKCQUDlFJ5g68a1MzflHS/+xKAYO:aS9KotKvaLJ8CJFPl8aSwXNtl43b
MD5:	A7860BA1FB405475626241C20FBB529B
SHA1:	4FE3C20BF37E7CF1509572EC21999EBF435E02AE
SHA-256:	D31DD76FDAEEC40547850219A82631E7DBA9CE5BE425478E1E2C541B7860BDDF
SHA-512:	8DAFD236BFFDDAEA3CDA5859FBDE3470C9FCE956C86640D4838297E3B82400913498B8FE0C84B5F2DA6B2B7471BD3044FB8A603018F901F8CE544D153C2D18EE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "...........",.. TOAST_VARIANT_CHECKLIST: "................",.. TOAST_VARIANT_BUTTON: "..",.. TOAST_VARIANT_BUTTON_FREE: ".... . ..",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "......",.. TOAST_VARIANT_BUTTON_NOT_WANT: "........",.. TOAST_VARIANT_TITLE_NOT_SETUP: "...................",.. TOAST_VARIANT_TITLE_FINISH_SETUP: ".............",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "........",.. TOAST_VARIANT_1_INFO: ".................................................",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "......",.. TOAST_VARIANT_2_INFO: ".........................

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3309
Entropy (8bit):	6.332643698930827
Encrypted:	false
SSDEEP:	96:LjGwO6t6wKA44s2xr92kwcK8jtUuhSSmcV:tt6wc4s2xrskwc3U6SSBV
MD5:	6C3CC72C225E42092B15CA63DF5F5EA3
SHA1:	2C71ED5D8CE7F11B285475647F6C046AFAC0087D
SHA-256:	01A0C3041939871A8DE9046216E39BF752A79EEC312B6F83F2612DA0BAF34A30
SHA-512:	07091EF3065684F6764BB6961F362FBA8898C0C0EC3EB6F879D2D03C2C3B18FF8F144C6E32901DD133C44DB409576AB9ADE2919FBE660446636CEB07C59CB8DE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "..............",.. TOAST_VARIANT_CHECKLIST: "...................",.. TOAST_VARIANT_BUTTON: "..",.. TOAST_VARIANT_BUTTON_FREE: ".... . ....",.. TOAST_VARIANT_BUTTON_UNPROTECTED: ".............",.. TOAST_VARIANT_BUTTON_NOT_WANT: "........",.. TOAST_VARIANT_TITLE_NOT_SETUP: "..... Web ...........",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "..... McAfee Web .....",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "........",.. TOAST_VARIANT_1_INFO: "................................................",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: ".......",.. TOAST_VARIANT_2_INFO: "..........

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2317
Entropy (8bit):	5.715868911757881
Encrypted:	false
SSDEEP:	48:CvSUqYRSK+R28Y2zgJsQqpq/83qkj6B9nw4RJtlzysE:C6UnSKOY2zegB6Dnw
MD5:	B04C05E4A04B010DA5A2FB6F06F0EA1B
SHA1:	4C507189448B3CAEDC7426FC00FBB8AB9FBC237E
SHA-256:	12B6F9AEA00E4BCA3744DB290AF5B0A3CC0BD5388100CDC58128587FB72E9AF6
SHA-512:	72A54C1D3EDF4C81E156518F4375324EB2647F9F7DC7E077C07F184B8F6F0935F5926D75E13A33AEEEBCA77755D39ED66885AAD6AA11F89FDFF78D6D46D0DB43
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "M.te k dispozici dal.. mo.nosti ochrany",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Vy... ochrana je p.ipravena",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Vy... ochrana je vypnuta",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Tyto funkce vy... ochrany v.m zajist. v.t.. bezpe.. online. Zapn.te je.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "V.e je nastaveno! Kdy. p...t. znovu spust.te prohl..e., budete moci s jistotou vyhled.vat pomoc. funkce Bezpe.n. hled.n. McAfee, kter. v.m uk..e, kter. str.nky lze bezpe.n. nav.t.vit.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Je vypnut., proto.e bylo zak.z.no nebo odebr.no roz...en. pro hled.n., kter. je sou..st. vy... ochrany. Z.skejte tyto funkce zp.t.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Funkce Bezpe.n. hled.n. McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1:

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2319
Entropy (8bit):	5.420745904460456
Encrypted:	false
SSDEEP:	24:7HOvdgRfy2uhvydFxcosFBzr628e3kC8osd8vbCsUcJheOqmv0p/c7THyFfG/IKH:CvJjkjVsFprf0Ksd4Ajfm0p4TS4Zudaf
MD5:	A4ACA5BF37470F7431FF19EFF2C41649
SHA1:	B453CBCB66E62A4D10427EC87E72EAA397802059
SHA-256:	ED6288BD2FA49E2351DB7CABF4CC74854B857395D722FE78BA968100A7F159F0
SHA-512:	21B131978CD5B7984C94DA0BA95F5F5F9EADB8F2724E6DA7F74A2C8D62CA451464EEE8B255CC41350B4F864558695D70A31D71B72B59369632B01F8EF8CC0955
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Du har flere beskyttelsesmuligheder",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Ekstra beskyttelse er aktiveret",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Ekstra beskyttelse er deaktiveret",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Disse ekstra beskyttelsesfunktioner forbedrer din onlinesikkerhed. Sl. dem til.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Alt er parat. N.ste gang, du starter browseren, kan du surfe p. internettet i sikkerhed, fordi McAfee sikker s.gning viser dig, hvilke websteder det er sikkert at bes.ge.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Funktionen er deaktiveret, fordi s.geudvidelsen, der er en del af den ekstra sikkerhedspakke, er sl.et fra eller er blevet fjernet. F. disse funktioner tilbage nu.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee sikker s.gning", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} viser dig, hvilke websteder d

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2382
Entropy (8bit):	5.446052546996521
Encrypted:	false
SSDEEP:	48:CvzhxfTyDKyA7h3CFycAOFsxEclSgH084:C1xfeDS3CT2I/N
MD5:	D9A68CF5FA53A9BF503FDF88374E6AA8
SHA1:	11CA637ECBDB7BB5DCBC3DA877925EBAC9D957BA
SHA-256:	819CC710C8A193D9A1ED5F11B77B19800C383DA6B3B8BF537E1270A7EDBDBD5C
SHA-512:	D07EB93ACDFABC09A70923F5BE4BE91E51F77E000FD56CE7DBC00B39CF03DA40EAF613CE63C55DC4E495D241F2FFD9C3AB3B9D9D516583FA0E67F5DDA569A6F4
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Es sind weitere Schutzfunktionen verf.gbar",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Zus.tzlicher Schutz wartet auf Sie",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Zus.tzlicher Schutz ist deaktiviert",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Mit diesen Funktionen des zus.tzlichen Schutzes sind Sie online besser gesch.tzt. Aktivieren Sie sie.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Alle eingerichtet! Wenn Sie das n.chste Mal Ihren Browser .ffnen, sollten Sie die sichere Suche von McAfee nutzen, um in Ihren Suchergebnissen zu sehen, welche Websites sicher sind.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Sie ist derzeit nicht verf.gbar, da die Sucherweiterung, die eine Komponente des zus.tzlichen Schutzes ist, deaktiviert oder entfernt wurde. Aktivieren Sie diese Funktionen jetzt wieder.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Sichere Suche", .. SEARC

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3630
Entropy (8bit):	5.082348269919875
Encrypted:	false
SSDEEP:	96:CNwyIyaSMAwsC38BDAeuDFKed0uHpUKtf:CNuzDAAmtuJlDpUKtf
MD5:	2E0533650D501C20272F529FE1CC2E3F
SHA1:	B3BC796035476A42CA318DA376DB386E7EFCB1B3
SHA-256:	9B5275A63E7259170D741430CAD8C44BF8114630C810F06A7047B88282FBCE53
SHA-512:	8455DECCC874DECA5A6F2E3F5AA89BFC9BAB6257BAA041F12A2D7435686446D1F9A3BAED372E723774769854E148166DC7A864A4ACC2B4ECB12213D85B0C8776
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "..... ........... ......... .........",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: ". ........ ......... ..... ......",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ". ........ ......... ..... ................",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "..... .. ........... ......... .......... ... ....... ... ........ online. ............. ... ............",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "..... .......! ... ....... .... ... .. .............. .. ......... .......... ..., ......... ........... .. ..... .. ... ...... ......... McAfee ... ... ....... ..... .....

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	5.453076477780133
Encrypted:	false
SSDEEP:	48:Cv45dlzloc0Zvdr05DJMtWXS7bJ3sLEISkz68:CKHzloLZ25DJMtiUW4Nkt
MD5:	93C630D9AD8363E260AE92AB7044CF48
SHA1:	973E7377DB457D7FD624F55FE5B8BB9C97C7399B
SHA-256:	64A7FFB454A0FD3254532879EBEF4DEBD133EF394FF33EC661C13FBB77278F05
SHA-512:	4683FB5263D05A0DACB307D54CA52EDE4F53864A979A1D033020375437075B84EF0E0EB9154AB5DDFA124974C9411712926F895B649E6FC8C0B338A01E49257B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "You have more protection available",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Added Protection is ready",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Added Protection is off",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "These Added Protection features keep you safer online. Turn them on.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "All set! The next time you restart your browser, search confidently with McAfee Secure Search showing you which sites are safe to visit.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "It's off because the search extension that's part of Added Protection was disabled or removed. Get these features back now.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Secure Search", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} shows you which sites are safe before you visit them.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2: "Ad Blocker", .. SEARCH_TOAST_ADBLOCK_BULLE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2325
Entropy (8bit):	5.439646708329903
Encrypted:	false
SSDEEP:	24:7HOvdgk9mBAPBQdBFXyUzwXFoI1mfCzZA8hmUA1ov8KJMfePnEW4dpaPVFk4/3Ph:Cv7MkYFXTzGFoIEWPyovzQArVZGLIwMD
MD5:	C91ADF3E2C643F7F73B9201D70A5CFE3
SHA1:	4E479E5231A79422A2EFAF57444AB5664C6D1AB9
SHA-256:	287DD80EB4B35AD8CE30E35A565A1D893E261377FAD153CAB57B0ABD5D1C2DDD
SHA-512:	2F5B0C71A6EBE23BAFB72FA69900DB41D17040F4A27945CFDB232AC554F57B9773A26E94C145292076C2E585DA4A8967AFF8319445F6BFCF3D722D53043229D7
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Puede disfrutar de m.s protecci.n",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "La Protecci.n a.adida est. activada",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "La Protecci.n a.adida est. desactivada",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Estas funciones de Protecci.n a.adida le mantienen a salvo en Internet. Act.velas.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Ya est. todo configurado. La pr.xima vez que reinicie su navegador, tendr. la tranquilidad de saber qu. sitios web son seguros gracias a la B.squeda segura de McAfee.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Est. desactivado porque la extensi.n de b.squeda incluida en la Protecci.n activa est. desactivada o se ha eliminado. Vuelva a activar estas funciones ahora.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "B.squeda segura de McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} le muestra q

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.453264218703966
Encrypted:	false
SSDEEP:	24:7HOvdgWQIvN6tKQtqWmwUV5mOZzZCB4vhmUwRKJhZfeT5gAdFqdVtBcwKHvcJi9/:CvlQIjWZKTZ8Kp6c0jqrtqvEIJ/OC
MD5:	D1D9F8BFAF1235DF5A5327519004A64D
SHA1:	5A290136DC97273D4246FF04299C65D77591007C
SHA-256:	84FA07E9B67A0A7315D602E4915E13294CC9683561E8080514B5072F3009A3C6
SHA-512:	D818DC0643DDDAAC972C71E5F81B4D58BF0E2E6F6D70126604F1D417776679555488BF7CE2DAD4ACB37F954D1F0CB477B87FCEBEA49BE84DBB47FA8572D8E9B0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Tiene m.s protecci.n disponible",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Protecci.n adicional est. listo",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Protecci.n adicional est. desactivado",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Estas caracter.sticas de Protecci.n adicional lo mantienen seguro en l.nea Act.velas",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: ".Todo listo! La pr.xima vez que reinicie su navegador busque con confianza ya que B.squeda segura de McAfee le mostrar. cu.les sitios son seguros para visitar.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Est. desactivado porque la extensi.n de b.squeda que es parte de Protecci.n adicional fue inhabilitada o eliminada. Recupere esas funciones ya mismo",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "B.squeda segura de McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} muestra qu. sitios son seguros ant

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2246
Entropy (8bit):	5.423207109718243
Encrypted:	false
SSDEEP:	24:7HOvdgGvLPUQPmMdzpP5x4bICHA4fEOGVGd1Pwsx7LmNhI+a6soNxawi9dySBx7z:CvXlmMd9m6mdFwWrZ6kxuFrCQeLR
MD5:	8D689C3A3BDE4BBFC8D185D80C80A329
SHA1:	78127A7D66F55A2AD030FD5DB9B58D0EAF650A10
SHA-256:	EBDCDAE74ACA7451181C70F80AD7E429D5751799149374F101BF5D44A89DB17B
SHA-512:	6BDF2E91661D1549F1D8D0FAD27C3D277110AD4216816BABE07CACAEB22FCDB8E9C16B05D81FA5C41283DE9A8B7B5FE5A9082132A85BC5C9ADC4852A99EB04C7
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Lis.. suojausta saatavana",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Lis.suojaus on valmis",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Lis.suojaus on poissa k.yt.st.",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "N.ill. lis.suojausominaisuuksilla pysyt paremmin turvassa verkossa. Ota ne k.ytt..n.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Kaikki on valmista. Kun ensi kerralla k.ynnist.t selaimen uudelleen, voit tehd. hakuja turvallisin mielin McAfeen suojatulla haulla, joka n.ytt.. vaarattomat sivustot.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Se on poissa k.yt.st. siksi, ett. lis.suojaukseen kuuluva hakulaajennus oli poissa k.yt.st. tai se poistettiin. Hanki ominaisuudet heti takaisin.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfeen suojattu haku", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} n.ytt.., mitk. sivustot ovat vaarattomia ennen

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2413
Entropy (8bit):	5.4423051651797465
Encrypted:	false
SSDEEP:	48:CvmQM4M92AhLMdlzu5ZHl0l1nD2qqhs4ecME:C+W42AhLmlzu5BkJyqK
MD5:	3BA64CA1293B95CF0582F69BCFE37D74
SHA1:	E70081892925A683C40809B85707180D4AB0A82B
SHA-256:	8F520190C4139B7DB330723376C66AD5C5EAA16EE4037920E1BADF7B75A26323
SHA-512:	40A8712784AC266AC0D0D3C3D94855D4541D4E711E320C9478CBC37AD3DC5ADBC4CA359DFB4F1339C04417FFEA5A3B6F4663F77A4481BED3EB2617B9E5B2D6CC
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Plus de protection disponible pour vous",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "La protection accrue est pr.te",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "La protection accrue est d.sactiv.e",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ces fonctions de protection accrue vous apportent plus de s.curit. en ligne. Les activer.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Pr.t! La prochaine fois que vous lancez votre navigateur, parcourez le Web en toute qui.tude pendant que la fonction de recherche s.curis.e McAfee vous indique les sites dignes de confiance.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Cette fonction n'est pas activ.e car l'extension de recherche qui fait partie de la protection accrue a .t. d.sactiv.e ou supprim.e. R.tablir ces fonctions maintenant.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Recherche s.curis.e McAfee", .. SEARCH_TOAST_ADBLOC

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	5.444487240093578
Encrypted:	false
SSDEEP:	48:CvqwGuHF9o9/EuB8u5J5AxHaaydCPjPXB0+1n:CSwGeY/EuB8u5olydCPr6+1n
MD5:	01B8313727CF5509A75D74342F1A733C
SHA1:	1CA2C1B526D976B557DE5ED96B4D87BDC40B6EBB
SHA-256:	E17459EBFF5C73EB8085CDC9603FDA8EC86460BCBA70E6408FAE5EDE79802325
SHA-512:	0599D8B235DCC24CA0694F47EB9A09E7029524B27578A480C3ECE830F603379B7E05099C4A0FA42C6B6C7E94B5002C6725ADE458AD7E64A8F07D2B7117D6E226
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Vous avez d'autres protections disponibles",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "La Protection renforc.e est pr.te",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "La Protection renforc.e est d.sactiv.e",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ces fonctionnalit.s de Protection avanc.e assurent votre s.curit. en ligne. Activez-les.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Vous .tes pr.t.! La prochaine fois que vous red.marrez votre navigateur, vous pourrez effectuer des recherches en toute confiance . l'aide de la Recherche s.curis.e McAfee, qui indique les sites que vous pouvez consulter en toute s.curit..",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Elle est d.sactiv.e car l'extension de recherche qui fait partie de la Protection renforc.e a .t. d.sactiv.e ou supprim.e. R.cup.rez ces fonctionnalit.s maintenant.",.. SEARCH_TOAST_ADBLOCK_BULLE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2273
Entropy (8bit):	5.521198892269799
Encrypted:	false
SSDEEP:	48:CvIoaSjp60i4X476LRiouHFshwFZcBmYt:CAejbVA8RcHFsh0ymYt
MD5:	21EA284E74CA6DD9DB183F074AF1D454
SHA1:	3175298788025034AC3D55D738B2294B4675DF04
SHA-256:	448136F169159EC3A9288E4EF8E48A81461F4D2D9490155083090D9D0985D532
SHA-512:	E34C405BA9CAD0CAC63B94A751D999A7D49030C6A2828D3B64C23202E294209709E6B7DCED396C2C23CB690EC21281BE60A82A3DE48A99754E4A4341927B1979
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Dostupna vam je ve.a za.tita",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Dodatna za.tita je spremna",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Dodatna za.tita je isklju.ena",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ove funkcionalnosti dodatne za.tite .ine vas sigurnijim online. Uklju.ite ih.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Sve je spremno! Sljede.i put kada ponovo pokrenete svoj preglednik, samouvjereno pretra.ujte uz McAfee Secure Search koji .e vam pokazati koje je stranice sigurno posjetiti.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Isklju.eno je jer je pro.irenje pretra.ivanja koje je dio Dodane za.tite onemogu.eno ili uklonjeno. Vratite ove zna.ajke sada.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee sigurno pretra.ivanje", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} vam pokazuje koje stranice su sigurne prije nego ih posjetite.",.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	5.62799581098861
Encrypted:	false
SSDEEP:	48:CvtCmH9aqAIDT5WSSWp7IpKwYnZmT+FLepwiV3lm4Cp7:CFCmHMVIqtYY+BWO
MD5:	480CF567C496E21DD5F104FF56F32E72
SHA1:	6D49C0661843C311CB8B52808724D70C410116FF
SHA-256:	2B99135BB6548A2749258CF28BB0DA786C50D1E7EBB969847C4761A3024F267D
SHA-512:	7438A6D6607BB3C1B72F4D3F19757559AB98D1118A8B0C512C6B0D60C869DE6A57D7C29BFFED015DE38DD9FA8DA47059BCCEDE94D235A388014FBE67B2B8F7D1
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "M.g hat.konyabb v.delem .rhet. el",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "A tov.bbi v.delem k.szen .ll",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "A tov.bbi v.delem ki van kapcsolva",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "A tov.bbi v.delmi funkci.k m.g nagyobb biztons.got ny.jtanak online. Kapcsolja be .ket.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Minden k.szen .ll. A b.ng.sz. k.vetkez. elind.t.sakor magabiztosan kereshet a biztons.gos keres.s funkci. r.v.n, amely megmutatja, hogy mely webhelyeket keresheti fel biztons.gosan.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Ki van kapcsolva, mert a tov.bbi v.delem r.sz.t k.pez. keres.s b.v.tm.ny le lett tiltva vagy el lett t.vol.tva. Vegye ig.nybe .jb.l ezeket a funkci.kat.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee biztons.gos keres.s", .. SEARCH_TOAST_ADBLOCK_

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2180
Entropy (8bit):	5.433305293693542
Encrypted:	false
SSDEEP:	48:CvlUzrFEVioJofWr5HsJcxnyhXpwfJwTRraFQ:CpVioJoerVsJWylSm4G
MD5:	CDA97511FEDE6BC971D99F2C5237635B
SHA1:	DD9A361A0CC70A919B0F5C7A745392E71EE5B7EB
SHA-256:	54C57FAA6C4F22F9BBA3732A520A2CA45D28881F902920614BFDFFAAE3F0F073
SHA-512:	29C243A17A6F834AA8E544150D6931FDC0C1A75A3A5C9B472ECDF17749614AF5F3D57E145B5CD62F8AB996A91D8D1EAE0A2C2C358574326CF1CC29E6863C66C8
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Puoi aumentare la protezione",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "La protezione aggiuntiva . pronta",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "La protezione aggiuntiva . disattivata",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Queste funzionalit. di protezione aggiuntiva aumentano la tua sicurezza online. Attivale.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Tutto pronto. La prossima volta che avvierai il browser, la ricerca sicura McAfee ti mostrer. i siti sicuri da visitare.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: ". disattivata perch. l'estensione per la ricerca che fa parte della sicurezza aggiuntiva . disattivata o . stata rimossa. Riattiva subito queste funzionalit..",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Ricerca sicura McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} ti mostra i siti sicuri prima di visitarli.",.. SEARCH_TOAST_ADBLOCK_BULL

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	5.7891485894746575
Encrypted:	false
SSDEEP:	48:CDihdOhGELq02HhMyCYaYPuMLmeStoN5PcvhvD8veRz:CDihdsjz2BMRNkmTgg5wWRz
MD5:	2528A5B5506080917860D1FEDFD0CA57
SHA1:	62E52ED437876AF8BEB66490393C0EB7FD42A33D
SHA-256:	5EEFB7009916BE225B099F027BE2801C14DD5B8063DFDA80E950315C2DCD5098
SHA-512:	F84BD96CDAB51A1642E2EAE7C6613782F2EF7DF3965F06467F6A2AB1E640032D08C2748AA2422AB9FD7BF2CC2DFE92B5CCA9ECD9F173C36D0ECB1A51DCD1F190
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: ".........",.. SEARCH_TOAST_ADBLOCK_HEADING: "..............",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "............",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "...............",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "............................... .............",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: ".......... ....................... .... ....................................",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: ".............................................. ...........

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2396
Entropy (8bit):	5.8990881351370295
Encrypted:	false
SSDEEP:	24:7HOVLgXlf/klv04CjUXktjHaQLKOudpQVg/xFSQXmYQgpyyqK4wQNqDhOnwIjuNE:C8FJUXy6XlbSvYi3wiQ/6
MD5:	B15F6015FB5EE5EA083BE3D516A1B2AF
SHA1:	DC17A791D7BDD1B1E2ED1006F450FB2C27542111
SHA-256:	435AF7FBE0B43529AB3256B499EAB445BB4582413F5F4D93D941C2134DA3A7B9
SHA-512:	C624D8AEB134466D47BF168CF176AC0BB165042304FE2EACCE764D800CFEC5BB945AAE6CC1BEAFBEF06DCE2E4B60625A177EA0DDC4942F5C564B2736A78DD116
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "......",.. SEARCH_TOAST_ADBLOCK_HEADING: "... ... . ....",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: ".. ... ... . ....",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ".. ... .. ....",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "... .. .. .... ... ... ... ..... ... ....",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: ".. ........ ... ..... .. .... McAfee .. ... .... ... .... ..... .... ... . .....",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: ".. ... ... .. ... .... .. .... .. ... ... . ..... ... ... .. ......",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee .. ..", .. SEARCH_TOAST

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2170
Entropy (8bit):	5.445951597755009
Encrypted:	false
SSDEEP:	48:CvJIksPYZC/uu6YZJN5QsKYmOArOhR/QExYG2h:ChI1Y0/u3YYsGKrYS0
MD5:	165FD91071155739FC589AF893CC035A
SHA1:	B9EFC1C40898E1130C67E5CB04DA2CAC10C1322B
SHA-256:	4141526C0A9B18C695DDAF63D9A63D2CE5537FE2CFE10F6C59E9F0D9D4473AA8
SHA-512:	BDA05192209B0214486F1B40504F053BACF980A242D0E7DC18E8D349E574B6D4BDC178553147C0AA3C08B25D28991F928ED963DB3295DB0E48787259CD9CCFC1
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Flere beskyttelsesfunksjoner tilgjengelig",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Ekstra beskyttelse er klart",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Ekstra beskyttelse er av",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Disse funksjonene i Ekstra beskyttelse holder deg sikrere p. nettet. Sl. dem p..",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Alt klart! Neste gang du starter nettleseren, kan du trygt s.ke med McAfee Sikkert s.k. Funksjonen viser deg hvilke omr.der som er sikre.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Den er av fordi s.keutvidelsen som er en del av Ekstra beskyttelse, er deaktivert eller fjernet. F. tilbake disse funksjonene n..",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Sikkert s.k", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} viser deg hvilke omr.der som er sikre, f.r du bes.ker dem.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2:

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2216
Entropy (8bit):	5.44182410906775
Encrypted:	false
SSDEEP:	48:CvKJpceq6RTcyrCBuH1ibZ/Pp93MK64kFUq5EpvnS41MA:CQSN6Roy8uHwZHpi34Tqmpqo
MD5:	EE5E188838F859C7741567EBD7292F64
SHA1:	57012928729B1BC5343C3413843A45BFA767DC77
SHA-256:	2A3EEFB558D8C12DEB53D92D309921136F211714B38035EB451B4F9407306FFB
SHA-512:	038C356DE36A85AD899618E6BED9955E8D6D2B51D31488BC5170556DA672FD6D2ADB12E8238599715336DD26BA2AD26F7F484EE02A6A79F2BFDF19F785B33012
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "U kunt over meer bescherming beschikken",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Extra bescherming is gereed",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Extra bescherming is uitgeschakeld",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "De functies voor Extra bescherming verbeteren uw online veiligheid. Schakel ze in.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Klaar! Wanneer u uw browser opnieuw start, kunt u zorgeloos zoeken met Beveiligd zoeken van McAfee dat u precies laat zien welke sites u veilig kunt openen.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Het is uitgeschakeld omdat de zoekextensie die deel uitmaakt van Extra bescherming, is uitgeschakeld of verwijderd. Schakel deze functies nu opnieuw in.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Beveiligd zoeken van McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} laat u zien welke sites veilig zijn voordat u ze bezo

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2289
Entropy (8bit):	5.687357670351731
Encrypted:	false
SSDEEP:	48:Cv4058MjlxcXI9qWiXgwsIvE8QK0tKWhEZ0JILHVI16sSIIRXp/:CQ01jCI9qXXLsIvE8Q5K+EOgVIEsSFXh
MD5:	58387DF1A6CABE9D1398527678141740
SHA1:	F4DE01049C95CAB9BD3BA4E65EA2337BE5055ACE
SHA-256:	A14AD32D01B47D8767ADF429C993A1316BBB54109BCEA8063FEB00C9D9FF52D7
SHA-512:	CC04B280E2969B5C9F20CE97184B2E05A4A8D19A20F05B8F0665A2F53C2F87546E5BD8D4F128653B349F094B7F01FD8C418527E6E478FC9A721582537BA004ED
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Dost.pne jest wi.cej ochrony",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Dodatkowa ochrona jest gotowa",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Dodatkowa ochrona jest wy..czona",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Funkcje Dodatkowej ochrony pomagaj. chroni. Ci. w Internecie. W..cz je.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Konfiguracja zako.czona! Po nast.pnym ponownym uruchomieniu przegl.darki, Bezpieczne wyszukiwanie McAfee pomo.e spokojnie wyszukiwa., informuj.c o bezpiecznych witrynach.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Jest wy..czone, poniewa. rozszerzenie wyszukiwania b.d.ce cz..ci. Dodatkowej ochrony zosta.o wy..czone lub usuni.te. Odzyskaj teraz te funkcje.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Bezpieczne wyszukiwanie McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} pokazuje, kt.re witryny s. bezpieczne,

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	5.47387320968386
Encrypted:	false
SSDEEP:	48:CvVVlKrZ/ez2L3dpZszSJEufUo7G+D3GDgkg:CNq62LizsUoCK+Hg
MD5:	90B914040F94107BA41FCB1772D09FA0
SHA1:	5ED45788C1396823D9C438156DF3A03A11178660
SHA-256:	7EAB510320494F6F4A7B2DA2946543FCEC2241A2B60D9D7086DD7D582BEADCDA
SHA-512:	3AC5135B3FD0B2C10F1634C25B2B8419FD0648BE4C5B2FA92A9351807B5019F67E8FF4047A43AD4AA08E6595B45496BA06A434F0B0109DFEB88F85C68D75D37C
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Voc. tem mais prote..o dispon.vel",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Prote..o adicional est. pronta",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Prote..o adicional est. desativada",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Esses recursos de Prote..o adicional o mant.m em seguran.a online. Ative-os.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Tudo pronto! Na pr.xima vez que reiniciar seu navegador, pesquise com a Pesquisa segura da McAfee que exibe os sites seguros de visitar.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Desativado porque a extens.o de pesquisa que . parte da Prote..o adicional foi desativada ou removida. Traga esses recursos de volta imediatamente.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Pesquisa segura da McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} mostra quais sites s.o seguros antes de voc. visit.-los.",.. SEARC

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2324
Entropy (8bit):	5.466189875954599
Encrypted:	false
SSDEEP:	48:CvOb9fKjnZdVrzzHUUFZeEi351TgV4/QbG9Okr7KJ:CWJmZTLUUFZgLQiLmJ
MD5:	EC48908B5800098F0DCA2673714EC557
SHA1:	82C398FCDD8D9C6F456BFF588214A2035B300E3C
SHA-256:	9F3A67D4AE54F253B91DDA8FCC8E70E3B90E4F9E4E0AA97DA86C5F5A46A490CA
SHA-512:	8DC3AE313E68937DB4DA497299A2830A7BAD06317AAD563B5E7405516F05150E8A1FC6CDF33F8082A875A18149F352D054B5CCC3E1BCDCE7467AF31FBB8BAF51
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Tem mais prote..o dispon.vel",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "A prote..o adicional est. pronta",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "A prote..o adicional est. desativada",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Estas funcionalidades de prote..o adicionais mant.m-no seguro online. Ative-as.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Est. pronto! A pr.xima vez que reiniciar o seu browser, pesquise com confian.a com a Pesquisa segura da McAfee a mostrar-lhe que sites pode visitar em seguran.a.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Est. desativada porque a extens.o de pesquisa que faz parte da prote..o adicional foi desativada ou removida. Obter estas funcionalidades novamente agora.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Pesquisa segura da McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} mostra-lhe os sites que s.o seguro

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3288
Entropy (8bit):	5.129607467704588
Encrypted:	false
SSDEEP:	96:COrsBqgVZBkBuYVCdpLVREi4c1rTZPNiNbdK:CCsBqgVZiuYV8pLV16hK
MD5:	0D9400D81449A3F73B73150518D20C62
SHA1:	666ED7A2857AA21FCDA0348FD5445FD2DF1DEE9A
SHA-256:	E24967E0C1434CA28E0907FF6976156364A6B002E34BDCDB48C975D174FF5633
SHA-512:	1D3D38482B23BB6D02F325494E64BD7BD0463449B3415C87919E9DD7322033FC0CD7839C5C27CDD251AF9CE2433A25397FEF57C11819EF462962F87257F9869F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: ". ... .... ...... ............ ... ......",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: ".............. ...... ......",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ".............. ...... .........",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "... .............. ....... ...... ............ ............ . .......... ........ ...",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "... ......! . ......... ... ..... ............ ........ ......... ..... . ....... ....... ........... ...... McAfee, ....... ........., ..... ...-..... ......... ... ..........",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADIN

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2276
Entropy (8bit):	5.766692122839274
Encrypted:	false
SSDEEP:	24:7HOvdg0FQ8YIcT3JOzrgffdIxL8EHbgnDHKXldVV/aVcFUC7wQi0o0ekfSanwINw:CvW8zM6pE2VDVGc377SI/tNOkhlSv
MD5:	7EBE57F97A47B89066289AF9E6D8B262
SHA1:	F01BC5CD1804745D99FEB4FD99A264220BD825CE
SHA-256:	B0859CAAA849FCE1C0F0BB3E9BAAAD33DAF28441F94F0A8640F883B6E292FBAE
SHA-512:	F0753DA42E2D3A2014CA3E66739BB71FD756D31617C3C365DB22EF02865EF370F18941D3B0915594C5CC169E3708361D42D26A9C92AE7457E5F9E1D9657FB9E1
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Pon.kame v.m viac funkci. na ochranu",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Zv..en. ochrana je k.dispoz.cii",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Zv..en. ochrana je vypnut.",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Uveden. funkcie zv..enej ochrany v.s ochra.uj. online. Zapnite ich.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "V.etko je nastaven.. Po re.tartovan. prehliada.a v.s zabezpe.en. vyh.ad.vanie McAfee ochr.ni pri prehliadan. a.zobraz. str.nky, ktor. je bezpe.n. nav.t.vi..",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Funkcia je vypnut., lebo roz..renie vyh.ad.vania, ktor. je s..as.ou zv..enej ochrany, bolo vypnut. alebo odstr.nen.. Z.skajte tieto funkcie sp...",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Zabezpe.en. vyh.ad.vanie McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} v.m porad., ktor

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	5.545261700793753
Encrypted:	false
SSDEEP:	48:CvzaSNcoHl5A0Pt0opbUbFpGbQg55EfVLQ:C5NH5AatiFpNMck
MD5:	983B892D97B0E2661F3C624E1CA8ECEA
SHA1:	85AAC7EAE11D798D3F3C1F487047F25A0A35BAA6
SHA-256:	E3FDA9BE3F8B02D5A0102BBBF7F5426037D560C3E62471F71954DDAC441A246F
SHA-512:	041170122EA8F1A5C0291D29D0917BD5ED305615AF8066A6594CB19694C21C5EB1C32B65435E32CDB2953563605A990904E84620E70C0616AB9B366485729739
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Imate na raspolaganju vi.e za.tite",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Dodatna za.tita je spremna",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Dodatna za.tita je isklju.ena",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ove funkcije Dodatne za.tite .ine vas bezbednijim na mre.i. Uklju.ite ih.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Sve je spremno! Slede.i put kad budete ponovo pokrenuli svoj pregleda., pretra.ujte sa samopouzdanjem uz McAfee Bezbednom pretragom koja vam pokazuje koje lokacije su bezbedne za pose.ivanje.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Isklju.ena je jer je ekstenzija pretrage koja je deo Dodatne za.tite onemogu.ena ili uklonjena. Vratite odmah ove funkcije.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Bezbedna pretraga", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} pokazuje vam koje lokacije su bezbedne pre nego .to i

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	5.5422752457528475
Encrypted:	false
SSDEEP:	24:7HOvdggWQRZC50gO/GNxNteo7XH8QU/OC8Q5zuVJAlbGF5ON1y8mJbc3NU7nfv1B:Cvg5Lf7jC1iVJkbJ1YJbYChTRfDkHW
MD5:	BEA3761455779A151F64A8177E9D5FE3
SHA1:	F042A8EE4B47B33AAA7588FA5C45EFCF0F9ABDB1
SHA-256:	9F69F705A5A821F0903CED1C294E2A23AE2CB15639A41C2FF96DB15C07132FB4
SHA-512:	197C1737C2DE634FF14C0397E428F20F620400AED751412CE07E2001C3F0E8344FF0E7C517DB41A1496BAA6928C66DE54E4DFA798408D1A3339D7CCDAB655B98
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Du har mer skydd tillg.ngligt",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Ut.kat skydd .r redo",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Ut.kat skydd .r av",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ut.kat skydd-funktionerna h.ller dig s.krare online. Aktivera dem.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Klart! N.sta g.ng du startar om webbl.saren kan du s.ka tryggt d. McAfee s.ker s.kning visar dig vilka webbsidor som .r s.kra att bes.ka.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Det .r av eftersom s.ktill.gget som .r del av Ut.kat skydd inaktiverades eller togs bort. F. tillbaka funktionerna nu.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee s.ker s.kning", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} visar dig vilka webbsidor som .r s.kra innan du bes.ker dem.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2: "Annonsblockering", .. SEARC

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2206
Entropy (8bit):	5.583104208287412
Encrypted:	false
SSDEEP:	24:7HOvdg/UOH95vCfoXiRvLa/sGcdDSqi+2O1ebxZQ25BMblR/B2sK3SZ/Z9vKlmCV:CvSG/GoSqi+Z7bQspvKG68ddlifn
MD5:	49D4D264D3AE80CA4D83492E2429D0DD
SHA1:	FC97262DA75DE2A23EAEA17F022932561D9BD5D3
SHA-256:	B30E605CCB94693EACAB3DAFCE0A29F8D6E583173423C8264F8D394B618C03D2
SHA-512:	3AA58DDCC7D47CA338EE94B6F6112DF7EF66D84BBB15A9A56ADA59C2C19020DB8988F209891D3C5D8CDD49E7F7F34ABB7624DC812DB9D180E4941FA9406E2A31
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Daha fazla koruma se.ene.ine sahipsiniz",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Ek Koruma haz.r",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Ek Koruma kapal.",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ek Koruma .zellikleri sizi .evrimi.i korur. Hepsini a..n.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Her .ey haz.r! Taray.c.n.z. bir sonraki ba.lat...n.zda, hangi sitelerin ziyaret edilebilece.ini g.steren McAfee Secure Search ile g.venle arama yap.n.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Ek Koruma'n.n bir par.as. olan arama uzant.s. devre d... b.rak.ld... veya kald.r.ld... i.in kapal.. Bu .zellikleri hemen geri al.n.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Secure Search", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} ziyaret etmeden .nce hangi sitelerin g.venli oldu.unu g.sterir.",.. SEARCH_TOAST_ADBLOCK_BU

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	6.265368522179317
Encrypted:	false
SSDEEP:	24:7HOZgVstn8dWjt8EWNjtM7LLyllJtjEcjt/dcz58qNAMdstxjl7BnwIj8gEdOeo:CjBt/wppKWMGzRl9VPj
MD5:	15BF07EE452C164270EA78F45B63FB8A
SHA1:	B0B31E64863E08F316516985CCBBB86D062FC742
SHA-256:	A4E99C27606352C85F305218DE0DF1A4C44D6BEF90712E0489E4876FB35E881D
SHA-512:	223E909509C34D3139B85C7B346F236D63F93CC148E31E21AD74D26C81FB0C381890E723C08CB95B492A8481BF03F543AC19A8AE46A82C541EAA657BF15EC5DC
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "....",.. SEARCH_TOAST_ADBLOCK_HEADING: "..........",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "..........",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ".........",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "...................... .....",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "..... .................................",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "........................ ...........",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: ".......", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: ".......{0} ..........",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2: "......", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_2

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2123
Entropy (8bit):	6.285210627854244
Encrypted:	false
SSDEEP:	24:7HOvdgQyNha9y+lmmhIlHCbMKEW2+Z8d/9t6Hj4mQjKKgcjSlMXmIyuiSlGlSBYy:CvaX+Mm6t8MZoD+KKtSr5FlITWiyOP
MD5:	73520C7B5D0FB138F2766E7ADBDEA185
SHA1:	9D95DEFF362252658B07AA9E3B4CB98A527BE375
SHA-256:	ECA080FB01441134D686040E8B317059DF6EFC464EC72173DE548E3E0B1E1EC3
SHA-512:	DAEC81A5937B37E8735551E33A07EE7CCCEDFBE554176CE4EAF313EFE81CFA688A244F1B5582ECE57529C53D304FD3D2B857D4229F4C3E2A13FDBBB08C1D0FD8
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: ".........",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: ".........",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ".......",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "............................",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "................McAfee ..............................",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: ".............................................",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee ....", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0}.......................",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2:

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	908
Entropy (8bit):	5.699090953568685
Encrypted:	false
SSDEEP:	12:7HUDAS6FXOqZG1g4zBFU+K6IPHf7q4qtox+Lmjz8kSUve:7HbzFOKGy16IPTq4W4zxSge
MD5:	8BF1E103445939CF0C1A2FB4A41CEF24
SHA1:	00FAC03EB66F78F7D9202E3E05943E317F4022B4
SHA-256:	22BB4D8693C1073228601E8EB2AAD9B0EE23B74E0B31553B540C2629366C3198
SHA-512:	DC80D8AB753AF2A663201049063ED9B2B0E19ACAEAE429BF5B784F60586913F45E47844925B6BA064EC784DBBAF47515B49BC47B8DEC27B6F269F10848F63C5F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nem.te slu.bu Bezpe.n. hled.n. . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING: "Slu.ba Bezpe.n. hled.n. v.s ve v.sledc.ch hled.n. prov.d.n.ho pomoc. vyhled.va.e Bing upozorn. na rizikov. str.nky.",.. SEARCH_TOAST_BODY_TEXT: "Chcete vyhled.va. Bing doplnit o slu.bu Bezpe.n. hled.n. a b.t v.dy o krok nap.ed p.ed podvodn.ky?",.. SEARCH_TOAST_SUB_FOOTER: "Po restartov.n. prohl..e.e zapneme slu.bu Bezpe.n. hled.n. a nastav.me vyhled.va. Bing jako v.choz..",.. SEARCH_TOAST_YES: "Ano",.. SEARCH_TOAST_NO: "Ne, d.kuji",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Zapneme slu.bu Bezpe.n. hled.n. a nastav.me vyhled.va. Bing jako v.choz.."..}..//80C94CB54204974D7742D8B3DCDDBDE8F044A0C62F376BAA92452B15AD24711F169D5DD4AA691B37E3718A101593818F5247F555875E8CC0D18D44EC75B293C7++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.452980451718285
Encrypted:	false
SSDEEP:	12:7H4FhR8kq0Qs8pyzAJi7nF+yUd8R2Vd7S8ehQhF2FAqtEFJy8ehxrSmQdgt:7HaufsEtijFTUd42Vd+PQhF2FAZePx1
MD5:	8A151EE801198C872536DA815E7BA059
SHA1:	A483445DFF95D0C93B956A236EBE6D59296C0F4E
SHA-256:	E26D13CB2EEF0B29CE5A5E44F01B87D25B580D2C81A9D2B8D14B95723BC4DA44
SHA-512:	E5D8A6D5E5D316F9DA630AA44A54282866511A8E4F649FBB79C6DD681037D58D48C2CE557F14D0EF108F1532CBAE23464E1BC9FEDB68DAE1CF0E8CC702428712
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Du har ikke sl.et Sikker s.gning til . s. v.r forsigtig!",.. SEARCH_TOAST_SUB_HEADING: "Sikker s.gning leder dig v.k fra risikofyldte websteder i Bing-s.geresultaterne.",.. SEARCH_TOAST_BODY_TEXT: "Vil du f.je Sikker s.gning til Bing, s. du undg.r at komme ind p. grimme steder?",.. SEARCH_TOAST_SUB_FOOTER: "Vi sl.r Sikker s.gning til og .ndrer standards.gemaskinen til Bing, n.r du genstarter browseren.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nej tak",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Vi sl.r sikker s.gning til og .ndrer standards.gemaskinen til Bing."..}..//E7E208D06E2126E6B7EFD7D6770EECD7533E6B86EC6E146748224C1AFFECE85C3236DDCFCDE2FBCF85008ABDE631977A1245707D4BFEE2A099B87AC24DB74F66++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	863
Entropy (8bit):	5.354248886089501
Encrypted:	false
SSDEEP:	24:7HGgFJZ+X0qvX66Q+3F2wlPQ+CL7lYaPRg:SAJZcVQ+VjVQ+m1g
MD5:	B7CBC2A085FBDDA3948E23E1063A543D
SHA1:	09C1ADCB429D646DC1B2A4348E88CD45D0832097
SHA-256:	23133D3EA99DD308FE1DE07EAED088A5882CF928438D01A8423835CE8633E249
SHA-512:	D84A20E95543A34CE65A00E3FD9F25E8F2619AAC1830B45FA4DBD5591874EEF8D28D7224F0D77252D70759D46144144C0D25EBD54ED1C48E06E76DF840C5F01C
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Die sichere Suche ist nicht aktiviert . seien Sie vorsichtig",.. SEARCH_TOAST_SUB_HEADING: "Mit der sicheren Suche werden Sie vor risikoreichen Websites in Ihren Bing-Suchergebnissen bewahrt.",.. SEARCH_TOAST_BODY_TEXT: "M.chten Sie die sichere Suche zu Bing hinzuf.gen, um Kriminellen immer einen Schritt voraus zu sein?",.. SEARCH_TOAST_SUB_FOOTER: "Wir aktivieren die sichere Suche und .ndern Ihre Standardsuchmaschine zu Bing, wenn Sie den Browser neu starten.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nein danke",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Wir aktivieren die sichere Suche und .ndern Ihre Standardsuchmaschine zu Bing."..}..//A058C32FF779D627F3406F29927475248BB1C0B5C48330271679DAB4780793A338C1722AFA5B55B0D749E3DB9500C7E1076564F5A64102E7699290195EAB0EA8++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1522
Entropy (8bit):	4.9601298443225925
Encrypted:	false
SSDEEP:	24:7HB3IsMXLr2bnATla3ybWG2hbiLy+wgjxUbiP7zC6:W2UTlaLvbiVGbiT9
MD5:	6415E2886A25A0B3CC1232E8B6BE539A
SHA1:	13E38D7D747261A08D3C011C67B13566623621D0
SHA-256:	D0674E1C7B157AB9254EFA3136F05B699EB4A8B859B8BF649F19837924951571
SHA-512:	C18891D32AA513C16BBB3D6746284563C2BB1AAC255EA885E85C4A04C6866467AD707481A8B753D31103C4CAD8E857EBF11741941D20CDC613DF40E53EDCD36F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "... ......... ... ...... ........., .. ..... ...........",.. SEARCH_TOAST_SUB_HEADING: ". ....... ......... ... ........... ... ........... .......... ... ............ .......... ... ... ........... ... ......... .. .. ......... Bing.",.. SEARCH_TOAST_BODY_TEXT: "...... .. .......... ... ...... ......... ... ......... Bing ........... .. ..... ..... ... .... ....... ... .... ............. ...........;",.. SEARCH_TOAST_SUB_FOOTER: ".. ............... ... ...... ......... ... .. ........ .. Bing .. ............. ......... .......... .... ... .....

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	780
Entropy (8bit):	5.357219060385291
Encrypted:	false
SSDEEP:	12:7HdW9H3npSuVNTzLo4uiJH7IyOtS9eDqt1IyOKoAzuL:7H8XpSuVNTzxcCeD7HhAzw
MD5:	A7F4F1E8189F960D94D6264B823FEAC1
SHA1:	FFB5F9E4A7AB6D406885D006E89D1C94BDEA6969
SHA-256:	6874C7763A403D7F127E89CFE95DD85B78A8EF2676C1AC10D654852760CF0EF5
SHA-512:	1B3399B5D3313CEE2C781FBA374C8BA2965DF4AC3C6B06E9C74129A0F621B2B54242C46FC7A8339B57B44F4B59D069860E9BF88039FF10BDF0A4D24A92ADB1F6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "You don't have Secure Search . be careful",.. SEARCH_TOAST_SUB_HEADING: "Secure Search steers you away from risky sites in your Bing search results.",.. SEARCH_TOAST_BODY_TEXT: "Would you like to add Secure Search to Bing and stay ahead of the bad guys?",.. SEARCH_TOAST_SUB_FOOTER: "We'll turn Secure Search on and change your default search engine to Bing after you restart your browser.",.. SEARCH_TOAST_YES: "Yes",.. SEARCH_TOAST_NO: "No thanks",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "We'll turn Secure Search on and change your default search engine to Bing."..}..//3AD1409A0AF6FFE6FB8B7652D60575037BA20E0348678C371531D32B1DF06E1C9F6553E743E11A5871E166E28B8A1B869CD26B858E956A6126977C54BF765A43++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	834
Entropy (8bit):	5.402478049767432
Encrypted:	false
SSDEEP:	12:7HTOW06YIJHM8MEIoyLLQZSUJHHrSXXY0Vqt15ZSUJm2iCWhsnQ+rO:7HqpQJHM8MnoyEpmHYGm5QhMO
MD5:	C4C6DE50051F2EC5DAD7F6434134831E
SHA1:	A98E22883DEEBE2A9764A8B75008AE5A6AB2666A
SHA-256:	13E30481F131F633CA32147B65F2FAAE2E4CD58276A0F6A08B0C72582E3F3BA4
SHA-512:	C02C821FDABCA127CC866F8E3A5061678F280F0388D4E480920F1336BEF6B0DFAB67B9A82DCB55D0B8AE6697A174A79A0355C65662D76E0DA4E3C85363140D7A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "No dispone de B.squeda segura, tenga cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura elimina los sitios web peligrosos de los resultados de sus b.squedas en Bing.",.. SEARCH_TOAST_BODY_TEXT: ".Le gustar.a a.adir B.squeda segura a Bing y olvidarse de los malos?",.. SEARCH_TOAST_SUB_FOOTER: "Activaremos B.squeda segura y cambiaremos su motor de b.squeda predeterminado a Bing despu.s de que reinicie su navegador.",.. SEARCH_TOAST_YES: "S.",.. SEARCH_TOAST_NO: "No, gracias",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Activaremos B.squeda segura y cambiaremos su motor de b.squeda predeterminado a Bing."..}..//DA3C42FE1CCB3AC324C7522FF7510B3C8E7A2212FFD7F9EBED9206CB6F4BC2D45643F5549EFD033ED52375AC57F4B6311849E92A96DD823E9A54B47810718287++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	848
Entropy (8bit):	5.369526343417038
Encrypted:	false
SSDEEP:	12:7HT9+6YzsinKM8MEIe4LyO3KVoqZSUJHHrSXXY0Vqt1BbSUJRTsJ8V7VAbRROn:7HCsiKM8Mne4X3QpmHYGmbw8eo
MD5:	76E2E5BDB1D16CF872CFAFE9B58E17A8
SHA1:	F01CB6F8157E664008AE9C3D2B865647C4B52334
SHA-256:	EE4AB2BA7FEE85AECB9A5DE96D8F01913A5FC9F2F8C183D4FDC5B74DA41F6A0C
SHA-512:	BBD18598FB658A895C464849CED8067AF1BBC9ABC5347DC132945821BD5111D843EC1155DA1C3584373448ED41A8FEB93E504F515781ACE79DFF99B593A312EB
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "No tiene b.squeda segura: tenga cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura lo aleja de los sitios peligrosos de los resultados de sus b.squedas en Bing.",.. SEARCH_TOAST_BODY_TEXT: ".Le gustar.a agregar B.squeda segura a Bing y mantenerse por delante de los malos?",.. SEARCH_TOAST_SUB_FOOTER: "Activaremos la B.squeda segura y cambiaremos su motor de b.squeda predeterminado a Bing despu.s de que reinicie su navegador.",.. SEARCH_TOAST_YES: "S.",.. SEARCH_TOAST_NO: "No, gracias",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Activaremos la B.squeda segura y cambiaremos tu motor de b.squeda predeterminado a Bing."..}..//4D050A01E720C5D71156A0972A6DA09C3DC046CB7A1DD0E4B42CB7DFBF28AC51C15195C4A4B0684FDBA1A907A28B199C953B26E7CD0F5EC1C4C97B8772233784++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	837
Entropy (8bit):	5.402473787369444
Encrypted:	false
SSDEEP:	12:7HMljiYYtHMjpJNnR9k9flAgPMfoRGpWfUfqt7foRMrRRjOLCj2z:7HQ2htHsNn+dWfoRVfeEfoRMrRRjehz
MD5:	70E961BFC8A981458D837A748B13F089
SHA1:	8A9AA2BC86866D0131337209EB049DBE5BAFDE55
SHA-256:	EBC4FC7CF1E29AD5DC1F777B0B1543679096B3020FC64DADB063BF8CEC8AFFC7
SHA-512:	9F8F1706C8A9251F26095082966DD8283D4DDECFC6AD67970A3FFB95448A6495E223B84C6EC9F7DB7DD7508ACCD84CB6B0D924EDE185C8B51AF3A01EF86370B6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Sinulla ei ole suojattua hakua . ole varovainen",.. SEARCH_TOAST_SUB_HEADING: "Suojattu haku suojaa sinua vaarallisilta verkkosivustoilta, kun suoritat Bing-hakuja.",.. SEARCH_TOAST_BODY_TEXT: "Haluatko lis.t. suojatun haun Bing-hakukoneeseen, jotta pysyt jatkuvasti muutaman askeleen rikollisten edell.?",.. SEARCH_TOAST_SUB_FOOTER: "Suojattu haku otetaan k.ytt..n ja oletushakukoneeksi muutetaan Bing, kun k.ynnist.t selaimen uudelleen.",.. SEARCH_TOAST_YES: "Kyll.",.. SEARCH_TOAST_NO: "Ei kiitos",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Suojattu haku otetaan k.ytt..n ja oletushakukoneeksi muutetaan Bing."..}..//96CE9AF3FC4B64C8CD5357880CEF5B82795B767A1AF6264665BC347BE351C97E2122F18E190D3F270F1F1EFA75D7D6C7ABEC19279137FD1D189D32C1EB35FA77++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.362182215848356
Encrypted:	false
SSDEEP:	24:7HW5WFTGeg5rqskm8wwbY6xQam8wwbYnf/iTu+:uWFTGeg5Wwv6Bwvno
MD5:	9F1C0BCFF5CAB6BEC40C78AB6CF5ED74
SHA1:	D9F3619950DB03AAFD687425D1EBBBD2BDB581E6
SHA-256:	36424576D4154C23CDB10645C792C2FDB7208BE69CBF25BEEA5A86924B80F8F2
SHA-512:	B862878E1C172472360E2CD3BE9F17EEFBF92E7C8F5ECD9DAE349FC02626A6D84BA253D7C545B798C83773506C79A87E52C4E72DBDAA60D685C695C145636651
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Attention! Recherche s.curis.e n'est pas install.e dans votre navigateur.",.. SEARCH_TOAST_SUB_HEADING: "Recherche s.curis.e vous met . l'abri des sites Web dangereux figurant dans vos r.sultats de recherche.",.. SEARCH_TOAST_BODY_TEXT: "Souhaitez-vous ajouter Recherche s.curis.e au moteur de recherche Bing et d.jouer les escrocs?",.. SEARCH_TOAST_SUB_FOOTER: "Nous activerons Recherche s.curis.e et configurerons Bing comme moteur de recherche par d.faut apr.s le red.marrage de votre navigateur.",.. SEARCH_TOAST_YES: "Oui",.. SEARCH_TOAST_NO: "Non merci",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Nous activerons Recherche s.curis.e et configurerons Bing comme moteur de recherche par d.faut."..}..//2FF5364948D6B31D78A453FB28416684FE6C5022DC09D0D6CD94ABD16BB36DF80A3D7247E48C42DA7DC809861DBFB3C75A6F24EB7654C2BB4E83C164E0A2D664++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	940
Entropy (8bit):	5.358631799720568
Encrypted:	false
SSDEEP:	24:7HNL7EemtP5RTOpwemfw8uWY6xxAamfw8uWYCw3j:R7EemtPaiwX6CwXCwj
MD5:	51C0C0DC12DB3E0779959C9B823211E7
SHA1:	0B7CB3478884C74F6F278836EEFB8F75A314A10E
SHA-256:	99979B3C9A91666E9EDA5F8CACA562E094E0E17717347B6B5DF336B69A8ADABD
SHA-512:	BDBD0A33025F9E548907A258D360AE2DC8138C99BF7B268857ECCE4D072E992DACDDDBE00C989521639455FBFB3C9B888127F5B0966264DBFCDFF380B74D31BE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Soyez prudent, vous ne disposez pas de la recherche s.curis.e",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e .carte les sites dangereux dans vos r.sultats de recherche Bing.",.. SEARCH_TOAST_BODY_TEXT: "Voulez-vous ajouter la recherche s.curis.e . Bing et garder une longueur d'avance sur les personnes mal intentionn.es.?",.. SEARCH_TOAST_SUB_FOOTER: "Nous activerons la recherche s.curis.e et d.finirons Bing comme votre moteur de recherche par d.faut apr.s le red.marrage de votre navigateur.",.. SEARCH_TOAST_YES: "Oui",.. SEARCH_TOAST_NO: "Non, merci",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Nous activerons la recherche s.curis.e et d.finirons Bing comme votre moteur de recherche par d.faut."..}..//B0189751C1D6DBA9C74502709511CB1E1ADA6C69F07D6E483B11F90EA3E55F32635A52151A96195329996B918C66304635EDFBDD7ED7AA565641865EC2ADFC4C++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	798
Entropy (8bit):	5.437037048426234
Encrypted:	false
SSDEEP:	12:7HM+9DuIg9sCZwzJl//L9hd9MuGvPJHCqtL9MuGRCMpScrymb892O:7HMogol25vxHCD5RfYUymw9p
MD5:	AACB0CDB77141F470E5F5BC7D51DFA8F
SHA1:	46C53F71D44C8682F168B3BABAF302BBEA2C7418
SHA-256:	CAEE9A5850A1787F26DC209F6A145278DAF84C9CF5C0829B5F8938FC53EB2250
SHA-512:	DDDC71A0FEEC88DB1EC080A4C3015BD3F4A962AA47D992B6655E83BBF44B45D0FECB54532AE5FF091FF00015812258A15CA6F48E2508B15F54355ED1CBD2BF63
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nemate sigurno pretra.ivanje - budite oprezni",.. SEARCH_TOAST_SUB_HEADING: "Sigurno pretra.ivanje dr.at .e opasne stranice podalje od va.ih rezultata Bing pretra.ivanja.",.. SEARCH_TOAST_BODY_TEXT: ".elite li dodati sigurno pretra.ivanje na Bing i ostati ispred?",.. SEARCH_TOAST_SUB_FOOTER: "Okrenite sigurno pretra.ivanje i promijenite zadanu tra.ilicu za Bing nakon ponovnog pokretanja preglednika.",.. SEARCH_TOAST_YES: "Da",.. SEARCH_TOAST_NO: "Ne, hvala",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Okrenite sigurno pretra.ivanje i promijenite zadanu tra.ilicu za Bing."..}..//6F1BF4F6020DB998AD3906E103BAA97804A053E6BF030E04D66C681E693A0707879C56A86B7CF757FB2FF3B54843642FEECF35F6EB81D1313F75EDD7C69BCD00++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	922
Entropy (8bit):	5.586709359581212
Encrypted:	false
SSDEEP:	24:7HL8d6oBd5US6Xdd7qQpuYeBdyEpFnY45EgpuYeBddpFtJNAoQg:q6ojijX/+QpuJjTYH+uJjj7
MD5:	FE8D6CC30C9932B007640A2BE160A528
SHA1:	323A412365564671FABEDF561B954001DFCA72D5
SHA-256:	0CFAEA02338563D5F02B3D08459B198F4E6D781004D6C7296F9E2D7479E0DE75
SHA-512:	971EA9E93206330B7EAC0C526BA165CA9057CA95CE8D029CBAA0ED40DDFA540A04D9A89E293E6444DE8F5497E56EF949479C65342CD42076C113B9944B35CE79
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nincs biztons.gos keres.s funkci.ja . legyen .vatos",.. SEARCH_TOAST_SUB_HEADING: "A biztons.gos keres.s funkci.val elker.lheti a Bing keres.si eredm.nyei k.z.tt tal.lhat. vesz.lyes webhelyeket.",.. SEARCH_TOAST_BODY_TEXT: "Szeretn. hozz.adni a biztons.gos keres.st a Binghez, hogy n.h.ny l.p.ssel mindig megel.zze a rosszfi.kat?",.. SEARCH_TOAST_SUB_FOOTER: "Bekapcsoljuk a biztons.gos keres.st, .s a b.ng.sz. .jraind.t.sa ut.n az alap.rtelmezett keres.motor a Bing lesz.",.. SEARCH_TOAST_YES: "Igen",.. SEARCH_TOAST_NO: "K.sz.n.m, nem",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Bekapcsoljuk a biztons.gos keres.st, .s az alap.rtelmezett keres.motor a Bing lesz."..}..//66CAC5931CFCEE505C00391080F15EA1560D6022B980DC63CE66DF68894E0ABCCAE2B4E2676A079DC1B523E3D168838CB5B0044C537EFAE14410DA714124E21B++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	819
Entropy (8bit):	5.271202876132089
Encrypted:	false
SSDEEP:	12:7H1J1Z2psz/XEKapHoCv815HFl+pqtKHoCv8195iZISeTy:7HB8OXEhpICvoFlIhICvizkISWy
MD5:	0FC5AB330CFDB73BBF675494F2B6C22A
SHA1:	5FB6D66F0560490B74A6907C0EBF03C381B8056F
SHA-256:	FA0A2AF9A597F30E75C5C3C937000D2855CA98E4390F836E7F8832D52E683A9B
SHA-512:	AAD3AA3A5179EA5E841043496F79A6B5FC0B73437D8D41BD89B0933A39BE87B7B9C5ABDB7E742897731FC7879CD53E4D74402A2F45478F965D6A2FB5E6FBC479
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Attento, non stai usando la ricerca sicura",.. SEARCH_TOAST_SUB_HEADING: "La ricerca sicura consente di escludere i siti rischiosi dai risultati delle ricerche con Bing.",.. SEARCH_TOAST_BODY_TEXT: "Vuoi aggiungere la ricerca sicura a Bing e tenere alla larga i malintenzionati?",.. SEARCH_TOAST_SUB_FOOTER: "Attiveremo la ricerca sicura e imposteremo Bing come motore di ricerca predefinito dopo il riavvio del browser.",.. SEARCH_TOAST_YES: "S.",.. SEARCH_TOAST_NO: "No, grazie",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Attiveremo la ricerca sicura e imposteremo Bing come motore di ricerca predefinito."..}..//09BC74CC30388A2A8BB1F6D6B85AAD4A59BF83B5031D315A1766A6A687109B5A8C52994645602632AA1F7A4E7B7688F8220069C18AB72F08C074CFF6082F475B++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.724388216204465
Encrypted:	false
SSDEEP:	24:7H8PQbHaQ4gy2XLCreYv6RlqkYv2mKMS+X+bIh:4PQzanP2XLInvKc1v7S2+i
MD5:	660E1D578C97A248E538815C640FE04D
SHA1:	0677A773BC2D46199C6C30AF2F333C556AF46D4F
SHA-256:	2C2C938D4279857A003B5F1534B4514B8A5A289A773D4ECE75A35853655A7017
SHA-512:	6EFE699E12BF2D1CC73F1AD3CCD0B25DD18BFDE8982FEF0D29EB91291D3D95EAB6E3EA7B3D41DE958DEF4B1A7E2675215BED202CEB621582CD61251FEF80BFE1
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".... ..........................",.. SEARCH_TOAST_SUB_HEADING: ".... .....Bing ....................",.. SEARCH_TOAST_BODY_TEXT: ".................. .... Bing ........",.. SEARCH_TOAST_SUB_FOOTER: "................ ...................... Bing .......",.. SEARCH_TOAST_YES: "..",.. SEARCH_TOAST_NO: "...",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: ".... ....................... Bing ......."..}..//92B355078ADDA8897AE68B6B6618188656A5B6F22F697542AE618F8DA77F58C00580A12C2E828C0E29F6CE8F8D2791A8B7BDE6E1F1D4BEC660A66FAE195D72B1++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	823
Entropy (8bit):	5.911256675781558
Encrypted:	false
SSDEEP:	12:7HN1I68EVZFj2F/40kOv8k16xQl07Cqtk16xQlrv5N9VT0tG8x:7Hx9E7ka8kg7CtPv79T8x
MD5:	33529508417C14C943E60A151812942F
SHA1:	A422F3A863A37CDBC8D677029A8B5AC53E1B078A
SHA-256:	CEF0A9BCCE4D7D7CC3D2E55AC3D66EB95403F99192B8EA12E2A23DA6D7A9C0C7
SHA-512:	C41C142345D4C0D4B5A025BDD8630256851EAB5395695347BB3370C2CF26C65BF3A0A77E3F3AC920DB5591B379879EE74B8D682F5BF7929A6AB7ACE283804AE3
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".. .. ... .. - ......",.. SEARCH_TOAST_SUB_HEADING: ".. ... Bing .. .. . ... .... ......",.. SEARCH_TOAST_BODY_TEXT: "Bing. .. ... .... ... .. ........?",.. SEARCH_TOAST_SUB_FOOTER: "..... .. ... . .. ... ..... .. .. ... Bing.. ......",.. SEARCH_TOAST_YES: ".",.. SEARCH_TOAST_NO: "...",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: ".. ... ..... .. .. ... Bing.. ......"..}..//C85E7AD449B7A6A3FD1FDA68A7D1F01406FD48ADFD78C3258ADBA4A5D452CA3BFCF862C679053C8842FB76F9E9D948232D0E43192905470FA53241C4B342F3DD++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	759
Entropy (8bit):	5.428769083942061
Encrypted:	false
SSDEEP:	12:7H4jM/QjBU4dkyU/6FkbS7CWJCYfUfGKF2cFqtEFJCWJCYfUqu4Mj3HcZhI:7H0MojXdUCFHtrfyGKF2yZtrfbu4Mj3P
MD5:	F12FFF036663E45B075537C2CCA423AA
SHA1:	BA9171FB748597F463532D81A3AE53DF123A31EE
SHA-256:	562269AF94C7A90B422673FC78F21CDD809503BAAF945EC4A9DB947CA410B921
SHA-512:	2BC8CC36C9FCB22AF55A6E5D4D3D718AEFD8BE4FE1EE2127C1DB8CC5EDF6A785548B2CE95E007AEFB80690AD74990D1ADDA20017CE7AB5631700C4E8DFE270F0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Du har ikke Sikkert s.k - v.r forsiktig",.. SEARCH_TOAST_SUB_HEADING: "Sikkert s.k holder deg unna skadelige omr.der i Bing-s.keresultatene.",.. SEARCH_TOAST_BODY_TEXT: "Vil du legge til Sikkert s.k i Bing for . ha et forsprang p. skurkene?",.. SEARCH_TOAST_SUB_FOOTER: "Vi sl.r p. Sikkert s.k og endrer standard s.kemotor til Bing n.r du starter nettleseren p. nytt.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nei takk",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Vi sl.r p. Sikkert s.k og endrer standard s.kemotor til Bing."..}..//179565C3BA0190D7E109A1FC723C84B592BF3530E1254C1E715FD889944F5B04FBF5593F5475B0378FAA6E884717995934AE628E8E7E976F0DAC38C0A93512BD++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.394699392796352
Encrypted:	false
SSDEEP:	24:7HrtakxOEfqPZq7oYde5XPCF2sbde5XX2lTVdVS:vkk8jPtYwRoDwGTFS
MD5:	83CFF7CF5EE5F5A77EE97F721BCB502E
SHA1:	9AF8BA73E5B68A0394A909F8B758D880218984F6
SHA-256:	F2939175D59E1A2E23AA287A4208EB760FC2EAB5EE6D098CF75FDC63F1114ED5
SHA-512:	8764B8E31A2FE3C8C6DFCCDCD6233119DC1D81A9039B06019E6261AAB8EEF14D9B840EC9CA4FFC7D9CEFFF9DAA016DEDE3CA77B76F0464DCC4ECBBAC051A90AD
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "U hebt Beveiligd zoeken niet: wees voorzichtig",.. SEARCH_TOAST_SUB_HEADING: "Met Beveiligd zoeken kunt u de riskante sites in uw zoekresultaten op Bing vermijden.",.. SEARCH_TOAST_BODY_TEXT: "Wilt u Beveiligd zoeken aan Bing toevoegen om criminelen een stap voor te blijven?",.. SEARCH_TOAST_SUB_FOOTER: "Wij schakelen Beveiligd zoeken in en maken Bing uw standaardzoekmachine nadat u uw browser opnieuw hebt gestart.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nee, bedankt",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Wij schakelen Beveiligd zoeken in en maken Bing uw standaardzoekmachine."..}..//F7B14C511761424258FCA1253AD2F968CB08E6BF631BC9894D665C2363FD8883D602664F671747C6073E9211E6486D2BDDF5EC8648F6857E98129AF6BFB07BEF++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	840
Entropy (8bit):	5.576160192007848
Encrypted:	false
SSDEEP:	24:7HOnXZoB12oBsflpBcPMfaBpgXJveZsBpgXJlS8jMvn:qXZI12IAdcMGaX7aXiMUn
MD5:	C3606BFCDE8444674ED95F6A9222313A
SHA1:	70EBD480A0302F572FA951EE79B718F0D02EE849
SHA-256:	66806B9DBA4747E33116BA38EFB4F7182C3E07951FB7AC60A694690087122915
SHA-512:	2B7B499FEDB524B34BB53FE4D821DD6BB3F7863F153A6E69925A4D4D9F8D8E921A17285CFDE77F7DE2A66E624068DC3E29808B8524CF5B0D0B12196015C65DFF
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Uwa.aj, nie masz wyszukiwarki Bezpieczne wyszukiwanie",.. SEARCH_TOAST_SUB_HEADING: "Bezpieczne wyszukiwanie eliminuje niebezpieczne witryny sieci Web z wynik.w wyszukiwania.",.. SEARCH_TOAST_BODY_TEXT: "Chcesz doda. bezpieczne wyszukiwanie do przegl.darki Bing i uprzedzi. zagro.enia?",.. SEARCH_TOAST_SUB_FOOTER: "Po ponownym uruchomieniu przegl.darki w..czymy bezpieczne wyszukiwanie i zmienimy domy.ln. wyszukiwark. na Bing.",.. SEARCH_TOAST_YES: "Tak",.. SEARCH_TOAST_NO: "Nie, dzi.kuj.",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "W..czymy bezpieczne wyszukiwanie i zmienimy domy.ln. wyszukiwark. na Bing."..}..//889AB70E5A8AF245C51F39470B54E831E8B079596D53FD8CFD6F0B3F3E7AFF8CBC03C132E4FF66640397E2F43271FD2ADE9BB0A2EF0500C82B604890803C7ADB++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	836
Entropy (8bit):	5.285923408550998
Encrypted:	false
SSDEEP:	12:7HEJVEPlVLVGGWF/7Qy7XTLYG7MJgZ6GuISWM8jgqtNpG7MJgZ6GuJzPiBgBgWw3:7HouiF/rDTLdtZy6MTZtZyliqBTSh
MD5:	0522A580B9D231BCAE249B715BB2F26E
SHA1:	F81183AFD4324459D7364E80CA686C5F0B40BE27
SHA-256:	CE75B70514339CDBCBC6CF7CEFCFA9931B4D3589F07E5022414CD29DB33926B9
SHA-512:	5014BE0B9E1F0C60D0F640CE56F167E28D5AD92A097BF476EB8490191B0C5619BBD96DD31A039E24F5B498A524C9C6FB80992F07F197E0AB4712A672BFFCA52E
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "A Pesquisa segura n.o est. ativada - tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A Pesquisa segura evita os sites perigosos nos resultados da pesquisa do Bing.",.. SEARCH_TOAST_BODY_TEXT: "Gostaria de adicionar a Pesquisa segura ao Bing e se antecipar aos criminosos?",.. SEARCH_TOAST_SUB_FOOTER: "Ativaremos a Pesquisa segura e alteraremos seu mecanismo de pesquisa padr.o para o Bing depois de o navegador ser reiniciado.",.. SEARCH_TOAST_YES: "Sim",.. SEARCH_TOAST_NO: "N.o, obrigado",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Ativaremos a Pesquisa segura e alteraremos seu mecanismo de pesquisa padr.o para o Bing."..}..//9537AF5255608485ABF128E1A089E604B94550A09F39BE39BD91045A3C082F823F69E0BCBB9BB8DD31DF737A56F946BE07E646346E581E594FF74B880DA0843B++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	823
Entropy (8bit):	5.3279147767815145
Encrypted:	false
SSDEEP:	12:7HR7EVLOEcQWFnQgj7366Jb7yg4HjSa8jgqtMJb7yg4HjmuuWNEsBrEGpXO:7HRrnFjjhJbOg4uaTRJbOg4tuGEsFE8e
MD5:	04B24D196BB3BDBF754C602F814B860B
SHA1:	535B495FE4C5778A04CBEFB89A67AA642EDCF4D7
SHA-256:	5DE1B3637CC3747351A4AC82E7AD55F8AA27563F5A53675165C2DA1B3F16C582
SHA-512:	30F1EC22B48C4F849298C1223F14F5933BDF8043F2B5BF33C114E09D12AA9FB4128D2630BD186EF290ED7F78F18359705EB2F0994E89048F3E0F71968C81CEAB
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "N.o tem a Pesquisa Segura, tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A Pesquisa Segura ajuda-o a evitar os sites perigosos nos resultados de pesquisa do Bing.",.. SEARCH_TOAST_BODY_TEXT: "Pretende adicionar a Pesquisa Segura ao Bing e antecipar-se aos malfeitores?",.. SEARCH_TOAST_SUB_FOOTER: "Vamos ativar a Pesquisa Segura e definir o Bing como o seu motor de pesquisa predefinido ap.s reiniciar o browser.",.. SEARCH_TOAST_YES: "Sim",.. SEARCH_TOAST_NO: "N.o, obrigado",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Vamos ativar a Pesquisa Segura e definir o Bing como o seu motor de pesquisa predefinido."..}..//259BDC1FA9ADE95FF9745921D545D1CB5B53CA9DA48A3DA835ECC5F598D38A50033E1EA034D73E665626943E361F9EDFF8D2B15388BD94AD982195F83F6A9BF1++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	5.12745413764515
Encrypted:	false
SSDEEP:	24:7H0i5Cke6gyt20qJNs2OSVptfnZMtXye4qfjFsX58cMtXye4qf86KqW:IMCke6gyJqjbOSfNnS9yHiT9yH0tW
MD5:	4E7D54D0675DFE8289701D81B8A75E2B
SHA1:	462FAD7DB0110BF8F427CE850DBB5706E873BEBE
SHA-256:	4D905E8F5E1DF15CD7C8CB57A76DA5530E98F0CA063F84BAD0D8B387C69E4D93
SHA-512:	74B5C5B3C21FFAD25FA0E3C11EB46C1D1DC80B862C71C0DE32FCF6F01CA800722EA6B49F2AFF5A7B2083637287B8B91F808926B1D5E26BAC81F17439503543B0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "...... ........., .. ... .. ........... .......... .....",.. SEARCH_TOAST_SUB_HEADING: ".......... ..... .. ........ ... ........ .............. ....., .............. . ........... ...... Bing.",.. SEARCH_TOAST_BODY_TEXT: "........ .......... ..... . Bing ... ...... .. ...............?",.. SEARCH_TOAST_SUB_FOOTER: ".. ....... .......... ..... . ....... .... ......... ....... .. ......... .. Bing ..... ........... ...... .........",.. SEARCH_TOAST_YES: "..",.. SEARCH_TOAST_NO: "..., .......",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: ".. ....... .......... ..... . ....... .... .........

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	959
Entropy (8bit):	5.692928595284706
Encrypted:	false
SSDEEP:	12:7HUMukzWX/lJxvkgn45U1bORyg+yqto3bZcidg+wh:7HmVXDxTbOsg+yU6gRh
MD5:	AA71AD61D0E3E7136783127620033A36
SHA1:	C559F3D4FC96524BBD4071015AAAB57962A1F90A
SHA-256:	8DA91614CC9B889306D2B06E508CF8DFD589AD9A332DB34BC7F396521473AF05
SHA-512:	A5BE4544681E2D074562D861E6667748C1C653F21FF7A9721470206A53EC920A286502AA5BAF839A1803D02590BEC66D70F7F06431274791F4B729F4FA2F446D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nem.te zabezpe.en. vyh.ad.vanie . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING: "Zabezpe.en. vyh.ad.vanie v.s vo vyh.ad.vacom n.stroji Bing chr.ni pred nebezpe.n.mi lokalitami vo v.sledkoch vyh.ad.vania.",.. SEARCH_TOAST_BODY_TEXT: "Chcete prida. zabezpe.en. vyh.ad.vanie do vyh.ad.vacieho n.stroja Bing a.zachova. si ochranu pred mo.n.mi .to.n.kmi?",.. SEARCH_TOAST_SUB_FOOTER: "Po re.tartovan. prehliada.a, povol.me zabezpe.en. vyh.ad.vanie a.zmen.me predvolen. vyh.ad.vac. n.stroj na Bing.",.. SEARCH_TOAST_YES: ".no",.. SEARCH_TOAST_NO: "Nie, .akujem",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Zapneme zabezpe.en. vyh.ad.vanie a.nastav.me vyh.ad.vac. n.stroj Bing ako predvolen.."..}..//682C232E2ACFE160DE2A1D89DFAB65197DE5AA4E5482CD3D8C6CE66BF018A934430A0CD580BA2197634CF9C867D322C79A9D118FAE2BDF05A677996D3AF24BF9++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	791
Entropy (8bit):	5.493568545352214
Encrypted:	false
SSDEEP:	12:7HM3Rzi2T//nHkpIUaSB1kd1BgqDHCqtMB1kd1BgqbDoPUl91:7HM3B0T3kd/DDHC53kd/DbDoU91
MD5:	9E4A59C6E8814C21B9ABC03B46E92C13
SHA1:	A91F5483A7F0F0D200850A0E4F0843E967FE2777
SHA-256:	7D94D0436926A1CF555592B6C19C5A8A5E32550888E848EC3AD5C6F964FFAE98
SHA-512:	0EBC8D5A3093C41836D4D2F96D964B611FA5A0C35A3174BD5D69C33C6A5B9232814C8AB4A4C84A3C8FF216E6251C7153C0E4848090AFCBA74FA113EDAC8F203D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nemate bezbedna pretraga - budite oprezni",.. SEARCH_TOAST_SUB_HEADING: "Bezbedna pretraga vas .titi od rizi.nih lokacija u Bing rezultatima pretrage.",.. SEARCH_TOAST_BODY_TEXT: ".elite li dodati bezbedna pretraga u Bing i ostanite napred?",.. SEARCH_TOAST_SUB_FOOTER: "Uklju.ic.emo bezbedna pretraga i promeniti podrazumevani pretra.iva. na Bing nakon ponovnog pokretanja pretra.iva.a.",.. SEARCH_TOAST_YES: "Da",.. SEARCH_TOAST_NO: "Ne, hvala",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Uklju.ic.emo bezbedna pretraga i promeniti podrazumevani pretra.iva. na Bing."..}..//58DCE3ECF6D720CD26EFDC80C330239AD7594D92714C97488258A8E552FBE77839D583D27526F8F137CBEBA610B065BEBC0771B0C32C639AAB67013B6A3E3A7B++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.479322790254831
Encrypted:	false
SSDEEP:	24:7HBZa8gL2eN/Ttn2gW6DTXMoOF2FTnZ2gW6DTa2SkmDpTO:CuY/ZrT70GZrTa2eTO
MD5:	D7C5862AE6600309433FF282531D5B55
SHA1:	5DB3E230B3FBFDFDAB2BDCACBBCBCB6C8D42A284
SHA-256:	ED45A60D81A96BC182752A96A7E50092633355DAA8993689BEB7D7D3064939EB
SHA-512:	96AA5A735D42E24DA463673A3B95F8F3A5ADE23A50F1606FD1857AF24BC7F5707F71CEDDD822EE696BE9B4C54F5D769895E7CB24AC24653C8A0D4882F571322F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Du har inte s.ker s.kning . var f.rsiktig",.. SEARCH_TOAST_SUB_HEADING: "S.ker s.kning h.ller dig borta fr.n riskabla webbplatser i Bing-s.kresultaten.",.. SEARCH_TOAST_BODY_TEXT: "Vill du l.gga till s.ker s.kning till Bing f.r att h.lla dig steget f.re skurkarna?",.. SEARCH_TOAST_SUB_FOOTER: "Vi s.tter p. s.ker s.kning och .ndrar standardalternativet f.r din s.kmotor till Bing efter att du startar om webbl.saren.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nej tack",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Vi s.tter p. s.ker s.kning och .ndrar standardalternativet f.r din s.kmotor till Bing."..}..//C1576214923D1F7138F31E042A618F7A4ADDCF526C7242E52C04C068F85CE9C73F9EE2A484C1CF9F6BECAF7C8C2DEB8F6CF6EC074583560693911A7561E6539E++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	857
Entropy (8bit):	5.536686502677647
Encrypted:	false
SSDEEP:	12:7HMhMT4PwAf00hBLUF8Tt7zYE3MKUR59HQmeonSqt9UxQme7oefddBBj/iX:7H8O44Yh88x/YE8PJfTnStf0VdBoX
MD5:	A2BD6BCEBF5F57D9ED68DFF588BA8122
SHA1:	54519CD20B50FB60E6F40FE283A39A1FA22DA467
SHA-256:	A97D130976105416C510DE2F15364D391173026C2D2EFA807A55F186D4924CF3
SHA-512:	EDC737BA59FC22975DEA48A99E286F56DC06A811A57CD0A92DA2E7FB423675669090F27B7F40511FCF27819E893A6D6A8E024AC7B5306B1AD071F03CC12135CF
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "G.venli Arama'ya sahip de.ilsiniz, dikkatli olun",.. SEARCH_TOAST_SUB_HEADING: "G.venli Arama, sizi Bing arama sonu.lar.n.zdaki riskli sitelerden uzak tutar.",.. SEARCH_TOAST_BODY_TEXT: "G.venli Arama'y. Bing'e eklemek ve k.t. ama.l. ki.ilerden uzak durmak ister misiniz?",.. SEARCH_TOAST_SUB_FOOTER: "G.venli Arama'y. a.ar ve taray.c.n.z. yeniden ba.latt.ktan sonra varsay.lan arama motorunuzu Bing olarak de.i.tiririz.",.. SEARCH_TOAST_YES: "Evet",.. SEARCH_TOAST_NO: "Hay.r, te.ekk.rler",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "G.venli Arama'y. a.ar ve varsay.lan arama motorunuzu Bing olarak de.i.tiririz."..}..//D684C2353E737B7ED09C8E6F136C2D343A3B98484E4CBFD2C345CE33B21105DB29239EF98FFC4C18F4CEFFE7848BB86ACCFF2470ADB3FC4133B8E27CA5952D64++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	777
Entropy (8bit):	6.210660451495342
Encrypted:	false
SSDEEP:	12:7HZeVjrLdwETCJeYNVLkfD9nktuLMSleNyunyHS8K+9qtBuKeNyunyHc4CCgSFRB:7HujCHVLkr96S4fnyHd99zfnyHjCo
MD5:	2CDB562215413FF625A3E356CA217FD2
SHA1:	0E820278AEB0C2CD715A82ABB686C117DCEE4657
SHA-256:	53DFADCA0E93CA6D896309B0E62FC927EB500AEE8AFC38CF3F4AF884BF12C667
SHA-512:	99FF01A6D7FD5385F970FAEC77F753E15F683B5B9B6C5FD6D72D08D38DEA89E4886EE93C849A5A7FE067B72DAE35A27A7918E78CE063C63193CE4F1BA0019102
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "......... . .....",.. SEARCH_TOAST_SUB_HEADING: "......... Bing ............",.. SEARCH_TOAST_BODY_TEXT: "......................... Bing?",.. SEARCH_TOAST_SUB_FOOTER: ".............................. Bing.",.. SEARCH_TOAST_YES: ".",.. SEARCH_TOAST_NO: "....",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "..................... Bing."..}..//CBC01CF39F5C771ACA721004F9514B5A5A1B48B5E249B312D98B3519F13DC1A7A249A4A16B245B917338090DAE48916ABFFBF5F96E838291831FB2FAACA6B7DA++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	6.174517491073846
Encrypted:	false
SSDEEP:	12:7HdRjeD31S5BdlevclAZKdKX0S19HS8KFy9qtNSNv7l2HcVymD7T6hlfe/S:7H76D31Sy8AZKIz19Hd79qU7l2H6v7yJ
MD5:	A35F8ED7C78439B4D397041DADA1C6F5
SHA1:	C3886E73F57189CD432EFC6A2914B9DB9DC6D377
SHA-256:	732EFC7EC82F832D385B9F38BE264A20F5545525CBB2FF3D48755BB126E262E8
SHA-512:	68BB1AF4EC3DE60D4D65EEF654990A16C91E2E64D19C76B5329648C441940D7E73802BAF658DF80C890C4BAB900A348BDA598AB315E0CAD0E823A4A85129604A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "...........",.. SEARCH_TOAST_SUB_HEADING: "......... Bing ............",.. SEARCH_TOAST_BODY_TEXT: "......... Bing...........",.. SEARCH_TOAST_SUB_FOOTER: "............................. Bing.",.. SEARCH_TOAST_YES: ".",.. SEARCH_TOAST_NO: "....",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "...................... Bing."..}..//19D99A1E6BCC22AA59513DF80F32C1CD231CF93F896F0D5E5AC9ECEDFF8F067F2714A86FF98B492B950F47BF3ACC079A52C1CBF33F35161B67C0A88A9FAEDA0F++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7420
Entropy (8bit):	5.698357857658691
Encrypted:	false
SSDEEP:	96:CXLFSeinF0GY2zegRdgmgV+2bt9kuB9Ouy9kuv9FoEGopoMgLmVvuumqY:CXLF5WF0SHMt9kg9O39kIOEGQZVdq
MD5:	BBAC48551D0F25C5D11E1820503EDA1A
SHA1:	7C2F780DE0B2EAC168D26BFACD6FF27FA8888365
SHA-256:	D830A121D06FE973A5BE0D2E1DB3A4A86EEB0DBCF6BD141D7BBB5A9D17555F90
SHA-512:	EE35BEC08352B47BCF0DCBF21F5AC11108C65A8C2510617FFE791DCCA6CDAE9AC135DDC6193A697317F710B72071665F33EB699D392222931B74F4498BB750A4
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Slu.ba Bezpe.n. hled.n. je vypnut. . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING: "Slu.ba Bezpe.n. hled.n. v.s ve v.sledc.ch hled.n. upozorn. na rizikov. str.nky.",.. SEARCH_TOAST_BODY_TEXT: "Chcete zapnout roz...enou ochranu p.i hled.n., abyste byli v.dy o krok nap.ed p.ed podvodn.ky?",.. SEARCH_TOAST_OPTION: "Ano, chci po restartov.n. prohl..e.e zapnout slu.bu Bezpe.n. hled.n..",.. SEARCH_TOAST_DONE: "Hotovo",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nem.te slu.bu Bezpe.n. hled.n. . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Slu.ba Bezpe.n. hled.n. v.s ve v.sledc.ch hled.n. upozorn. na rizikov. str.nky.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Chcete p.idat slu.bu Bezpe.n. hled.n. a b.t v.dy o krok nap.ed p.ed podvodn.ky?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ano, p.idejte slu.bu Bezpe.n. hled.n.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6899
Entropy (8bit):	5.420190232642894
Encrypted:	false
SSDEEP:	96:CjNwgL2CS6ddGw2jKK3A/BZ6mQNeTNlspRmbM1BM0t+lWcoLa8XcZ+lWch9FF/34:CWToK3A/Bj32ttCWy8XgCWSj/o03Wwy
MD5:	73C7531F74DC0C5905AAAFD45E62BE3B
SHA1:	90AFC73ED69E8F43512224E4EFD8D31FA53C66BC
SHA-256:	994772D22B0FBB17DA88E686A5028D59C4DF8E1C5E661A7F76229349DEAC8854
SHA-512:	B869BCB087A8411FF0082E9FB22230B4F1DA125A7E2A91A6D128E2CAA653FCFD607658FFBE41FA494972EB19AC0D1457F3DF1459C3B8A28EAE08D5B1BEF9C82C
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Sikker s.gning er sl.et fra . v.r forsigtig",.. SEARCH_TOAST_SUB_HEADING: "Sikker s.gning leder dig v.k fra risikofyldte websteder i s.geresultaterne.",.. SEARCH_TOAST_BODY_TEXT: "Vil du v.re et skridt foran forbryderne og have ekstra sikkerhed, n.r du s.ger p. nettet?",.. SEARCH_TOAST_OPTION: "Ja, sl. Sikker s.gning til, n.r jeg genstarter browseren.",.. SEARCH_TOAST_DONE: "F.rdig",.. SEARCH_TOAST_HEADING_COMPLIANT: "Du har ikke sl.et Sikker s.gning til . s. v.r forsigtig!",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Sikker s.gning leder dig v.k fra risikofyldte websteder i s.geresultaterne.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Vil du tilf.je Sikker s.gning, s. du undg.r at komme ind p. grimme steder?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, tilf.j Sikker s.gning til min browser, og s.g som standard ved hj.lp af {0}.", // {0} SEARCH_TOAST_*.. SEAR

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7159
Entropy (8bit):	5.347712937175425
Encrypted:	false
SSDEEP:	192:C9EB5FeK92iZaU3vFJMGNMmXdtUGj/7vFyDGkHEXcFtDD:C+5/btltJ/7vFOEML
MD5:	7F74CC1B45891F462506A23BF36FFA0B
SHA1:	A856079FF3DBAEBB01065F37F4ED3517B4164E47
SHA-256:	86C08DF557680985A4AA74DD473E4B45B41062E2368E1E130C5C40863460C120
SHA-512:	A127B7B95BDEE6839085D5FA6ACA5AF991B6B9BBB5F22D9DEF01ACF90FAD3C51FB9E7C1B1BDF5236EFFDDDADC9EA22AA905E95B0D39141740AEEDD1DDABBE1EB
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Achtung: Sichere Suche ist deaktiviert",.. SEARCH_TOAST_SUB_HEADING: "Mit der sicheren Suche werden Sie vor risikoreichen Websites in Ihren Suchergebnissen bewahrt.",.. SEARCH_TOAST_BODY_TEXT: "Wollen Sie Internetkriminellen mit zus.tzlichem Suchschutz immer einen Schritt voraus sein?",.. SEARCH_TOAST_OPTION: "Ja, ich m.chte die sichere Suche nach dem Neustart meines Browsers aktivieren.",.. SEARCH_TOAST_DONE: "Fertig",.. SEARCH_TOAST_HEADING_COMPLIANT: "Die sichere Suche ist nicht aktiviert . seien Sie vorsichtig",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Mit der sicheren Suche werden Sie vor risikoreichen Websites in Ihren Suchergebnissen bewahrt.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "M.chten Sie die sichere Suche hinzuf.gen, um Kriminellen immer einen Schritt voraus zu sein?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, die sichere Suche in meinem Browser hinzuf.gen und Suchen

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	991
Entropy (8bit):	5.76521979020505
Encrypted:	false
SSDEEP:	12:7HOyOM3oeWURG11jdHDUUOSj6TrY3jdHjdVtiSTj6cUnjdMA8Y9pcObANRGXUkAt:7HOvMrWh1WTMBgF5RjbgsXCd/
MD5:	17945F04E84D4FB4CE698914258C9A76
SHA1:	DE37A08477338A9F02D09E26A89931506E491E7D
SHA-256:	8186488F7090F47A0A50D860021B51BFE508115A5407DB4F577FC9E7BD6566E6
SHA-512:	D7BD1E18F6520D3DD3ED115D000296AE2D817BC6418023C6CFBE043178AF63C98B12DB10E907A569B047D0DE88E2931294BE3A68BB4CFEA04A6B65CE752D1F76
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "D.l.te si starosti s t.m, .e budete sledov.ni online?",.. SEARCH_TOAST_SUB_HEADING: "Pou.ijte prohl..e. DuckDuckGo s ochranou McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Soukrom. hled.n. s prohl..e.em DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} zaji..uje, .e historie hled.n. z.stane v soukrom..", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Funkce Bezpe.n. hled.n. McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokuje .kodliv. odkazy ve v.sledc.ch hled.n..", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo bude pou.it jako v.. v.choz. vyhled.va..",.. SEARCH_TOAST_YES: "Vyzkou.et soukrom. a bezpe.n. hled.n.",.. SEARCH_TOAST_NO:"Ne, d.kuji"..}..//29A07B12017F7C45E1AE186DFE0C7E9C05E4A35FD33E48E0D41A85A60396D75981CE17A26E68181B7558E948CEFB17E1B40D0E90BE19D7CDF058F6217310B198++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	900
Entropy (8bit):	5.589383052671258
Encrypted:	false
SSDEEP:	12:7HOyODmFK9r7NWME1jdHvyjC8C9JYBjdHjda88SjNwojdbnEl48twdn0wwDVKMRK:7HOvCQ9NWMEcCrYFnwinQ4Kwxwvg
MD5:	ED262FA6590F02FCEF4B3A6DE4CB978A
SHA1:	7D8B2EF5C9A50D43BA416313BB5EDA9D539A0DAB
SHA-256:	14E847A0DC869E1403A6B8E49BE3C1889AC07639F666C4E66FBE94254877DC6B
SHA-512:	3489A1A95C1868E491E6BD164D9186489632F5E6D487D5D893A1A11C42F5EA9476810F01DE3F415CFF79123D7C964D09084937DA8C26882220831F6C054E57C4
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Er du bekymret for, at der bliver holdt .je med dig online?",.. SEARCH_TOAST_SUB_HEADING: "Brug DuckDuckGo sammen med McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Anonym s.gning med DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} s.rger for, at din s.gehistorik forbliver anonym.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Sikker s.gning", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokerer skadelige links i s.geresultater.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo bliver din standards.gemaskine.",.. SEARCH_TOAST_YES: "Pr.v anonym og sikker s.gning",.. SEARCH_TOAST_NO:"Nej tak"..}..//A4D875843194BE8F86F8DB5361398B4A7B9219DDA006D4B8CD9F2768D71E1EC3E43A43B13DEAE94378E89833287BF926401A1AA7357C111D5BACED105663F65F++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	936
Entropy (8bit):	5.57240291397162
Encrypted:	false
SSDEEP:	12:7HOyOIV8tfCIjdHkjPqqbjdHjdar9jICnqjkjdAhalRVnzQYjLWl+R8nYZmD+WXC:7HOvc8yqrLLBQbwRi+j
MD5:	BB9762D7607F15FCBA02304DDF94994D
SHA1:	69D8FDDC5F0EED15006D91F37B54F9137FB5E70D
SHA-256:	004BC3F34676FB666BB43244D2A7BE252F7BC916AF06DA40317E10AFE6DA4CE7
SHA-512:	4916BA50650CE019B850FE812E86AE897502EC61D1318F994E55BCFA782AB4EF6D2DCBC365325CFCD39C6D105A31ED6491CE79C7BEF7C77792591C98E520079B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Sie wollen keine Online-Tracker?",.. SEARCH_TOAST_SUB_HEADING: "Verwenden Sie die McAfee-Erweiterung in DuckDuckGo.",.. SEARCH_TOAST_BULLET_STRONG_1: "Privater Suchmodus in DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} . damit ist Ihr Suchverlauf f.r andere nicht sichtbar.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Sichere Suche", .. SEARCH_TOAST_BULLET_NORMAL_2: "Die Erweiterung \"{0}\" blockiert b.sartige Links in Suchergebnissen.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo wird als Ihre Standardsuchmaschine festgelegt.",.. SEARCH_TOAST_YES: "Private und sichere Suche testen",.. SEARCH_TOAST_NO:"Nein danke"..}..//D5733356DF6A1DB99842CD54D971C480217831DC3AC2E93D764692E966E06468555952F4D757BFBBE62DD2FD7C13E72EBC76FA94A43AF827CFA567FE1647A58A++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1278
Entropy (8bit):	5.509401045070423
Encrypted:	false
SSDEEP:	24:7HOvdVOfNkrI8gvMi3QonM4diUPg4HDTWFTm:CvdAVktgfQoMmiUDv7
MD5:	1F6235A605EF58A330D6ACFC6EB451C9
SHA1:	BB011382D5D40246E1175A2E3FB27C1AC215E17B
SHA-256:	8B261F3738CD0EDFDBF9785175A51EE3D98F721376C57FBF8118AE986B49F818
SHA-512:	419DA940A737871B2CDFF9D3684CAED4F1928AE0C091B2250B7A3DE21703FB139BCAE05201883E5471790F7FD151DF4599A89EE67A2A3FD805E0F56067FFD8C0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "... ........ .. ........... . ............. ... online;",.. SEARCH_TOAST_SUB_HEADING: ".............. .. DuckDuckGo .. .. McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "........ ......... DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: ".. {0} ..... .. ........ ... ........... ... .........", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "....... ......... McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: ".. {0} ......... .... ........... .......... ...... ... ............. ...........", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: ".. DuckDuckGo .. ..... .. ............. ......... .......... ....",.. SEARCH_TO

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	851
Entropy (8bit):	5.524743584334964
Encrypted:	false
SSDEEP:	12:7HOyO8zqqNPR4t1jdHMLBjaPCuYh8jdHjdatBjPvkTzgjdA8xvsHxExFgOu9M3:7HOv8moyALKFYhl5kTzqsHx6p3
MD5:	B08E603CC1B91D69814CA7F2F1EE849F
SHA1:	8C4426D5CCA135B31367945D6F895AC8D57E447B
SHA-256:	D75B4EB9D2254824B9D95559AC156F13BB97F538A6B748BD8042DEB209A18D27
SHA-512:	717A17661568EB5E9D00C29E82C19FB7F52BA5BC9D6BBA6B02779682593B414A92178EE495A835BB51EEDAFA3D92DEF34125E6CFAFF451F5CA38B3FB82FF3DF0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Worried about being tracked online?",.. SEARCH_TOAST_SUB_HEADING: "Use DuckDuckGo with McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Private Search", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} keeps your search history private.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Secure Search", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blocks malicious links within search results.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo will become your default search engine.",.. SEARCH_TOAST_YES: "Try Private & Secure Search",.. SEARCH_TOAST_NO:"No thanks"..}..//A0D8F2C048B46A4FD7AC0D07FD283E6005DAD693F00EFBD1B05738E4656BA94A47373F62FC39ED59E81B6BB967FB030CE7672E9E3A6FDEE893FA9F6EFB39CD71++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	945
Entropy (8bit):	5.574679504461569
Encrypted:	false
SSDEEP:	12:7HOyO9ocZRs11jdHCajW7SuTQQQjdHjd0Fmzjq0KdQjdEiSZSUjETASKsPpD+0k:7HOvy71A7JPmS0gR54TYUDu
MD5:	0C85FFE70BEA4662722D7DDC7BAF6655
SHA1:	7C80B90675F6FF6142AEA534DFD834F10636C6CE
SHA-256:	21CC3A7B36DAFE6E2213BC2DEF1C613320F8134A7142582E7E9FED5E4C27E2D2
SHA-512:	FB1CB294908F664D55159F76472D2EB26115BD70EE861BC8B1143BBEFB64EF58E8BC744BA6475E1A78C8D95D5535BE8AE5D67D9A343C86C9EEAD037AA492552D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".Le preocupa que rastreen sus actividades en Internet?",.. SEARCH_TOAST_SUB_HEADING: "Use DuckDuckGo con McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "B.squeda privada de DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} garantiza la privacidad de su historial de b.squedas.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "B.squeda segura de McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloquea los v.nculos maliciosos en los resultados de sus b.squedas.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ser. su motor de b.squeda predeterminado.",.. SEARCH_TOAST_YES: "Pruebe las b.squedas seguras y privadas",.. SEARCH_TOAST_NO:"No, gracias"..}..//2F98FB8F703BDBAD5895565B1894F74BA272938EB135B9C739591F4802AA123DC8580F7BB8A27484F56C3C8BDA5C6C720AA48E5F5ED296DEAD84190C43E47B7E++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	925
Entropy (8bit):	5.583856013603583
Encrypted:	false
SSDEEP:	12:7HOyO9ZHhHmdks11jdHCajZyFK2jdHjd0Fmzjqrpo3FK2jdEDE/ZSUwIesaRM8cf:7HOvdHmdN1nnzmSiA74HcFRPc2Kr
MD5:	6F2C728DC1AD4951F425E3F5A6B6C103
SHA1:	598BF2464111B79468D1B89ABB3CC720D9D869FC
SHA-256:	BDF902D263DDA61181881DFECA440C5747A40FCF32D0EFAC8BD525A2EA9EEBB9
SHA-512:	A1FFFE93CB7B6D1E098F1AA3C11542EA4967B72D3D869C391705C4477A15A19E25D43F40BB1503DA6711206729891685B27EAC4DE998D8E9F78459FE3267A763
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".Le preocupa que lo rastreen en l.nea?",.. SEARCH_TOAST_SUB_HEADING: "Use DuckDuckGo con McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "B.squeda privada de DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} mantiene confidencial su historial de b.squeda", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "B.squeda segura de McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloquea v.nculos maliciosos dentro de los resultados de b.squeda", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo se convertir. en su motor de b.squeda predeterminado.",.. SEARCH_TOAST_YES: "Pruebe B.squeda segura y privada",.. SEARCH_TOAST_NO:"No, gracias"..}..//20CB364129A65D16B871889450A57ADE3AF3F7D4BB21A7B97A3AED459081FE634FF398C691A65D3B87DA5922B0E2307B63B3DC3584D8A1720F6DB68D1C911459++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	870
Entropy (8bit):	5.547827997187383
Encrypted:	false
SSDEEP:	12:7HOyOmciWozjdHJmavj+rUEpjdHjdXpvjm0QCojd6U9hSnl2dUQaI0Yn:7HOv7iWoCUEBJOhy2xZ0o
MD5:	A378EE0DE62DC81E33AC99782F01A16D
SHA1:	46CF150FB1E201D7D7672BF46391093DDF9AD881
SHA-256:	DDDE4176DA25CAE2B619848AA712B5D17249C7411335F0D36B90DDC7B960A66A
SHA-512:	AD824B9D5B72C5323D48EE5998C1F0C6154119D2D2870E1FDF75A97F4B3F8A4121F7D8C117E23E2995AED5E616791AC2525801336CB93B525679F877A0DC0B44
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Huolestuttaako seuranta verkossa?",.. SEARCH_TOAST_SUB_HEADING: "K.yt. DuckDuckGota yhdess. McAfeen kanssa.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGon yksityinen haku", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} takaa hakuhistoriasi yksityisyyden.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfeen suojattu haku", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} est.. haitalliset linkit hakutuloksista.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo valitaan oletushakukoneeksesi.",.. SEARCH_TOAST_YES: "Kokeile yksityist. ja suojattua hakua",.. SEARCH_TOAST_NO:"Ei kiitos"..}..//D7A6F318B4BB1E59F7FF4BCC5008B965458186FEEFD7F0B1140ACC2F5F4A3D8536C8CF155DF886C2A60A249B88EB3FDFC663825B02A48A87F86D467222D32182++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.532793462010508
Encrypted:	false
SSDEEP:	12:7HOyOZKM/Jvf1jdH+9kRjBjdHjd55wjq39M5vjdShWvw/jFe5/qnJHjq3LNO7A6O:7HOvBRMkbb7Wvw/jFe5iJoLN2O
MD5:	5758AA0E07AB191E9A0D369793BEAF7A
SHA1:	0CE9978D6C6C5FF0C6B7B7DBCE7851691966C9F5
SHA-256:	95ACE104142539D785528924A37CA353F4056910653616AFA4F2DE5A08B75A16
SHA-512:	04E39DAE9B5DBA58BC0135151C0F97BD25CC275428E4BD21131626AF661D9C9C68EE270195F2BC83FA21CCAED875475065BDAB961012F60F7CA839D20DB7F48A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Inquiet d'.tre surveill. en ligne?",.. SEARCH_TOAST_SUB_HEADING: "Utiliser DuckDuckGo avec McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Recherche confidentielle DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} pr.serve la confidentialit. de votre historique de recherche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Recherche s.curis.e McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloque les liens malveillants parmi les r.sultats de recherche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo deviendra votre moteur de recherche . d.faut.",.. SEARCH_TOAST_YES: "Essayer la recherche s.curis.e et confidentielle",.. SEARCH_TOAST_NO:"Non merci"..}..//AB673037DB157C0CF847E5A84C22BCCA1275C3B21541F73DD4FADF0E584E28E74BF08703EC67672EA1B01EEAD9128C47ADA0575E3FECFFB63AF9ECA050FD688D++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.55602244762339
Encrypted:	false
SSDEEP:	12:7HOyOR04/yohvf1jdHUzhCSjm+MjdHjd55wjDDJ3tp5vjdG4kWYXF9owhBbOVQmI:7HOvVyoRAzhNwKTkWYcwh5OVOW8
MD5:	65C49E7A9CAD8E965D2003857646FF93
SHA1:	4E4E6F87BE5A399F724131AE52A412E125FF0164
SHA-256:	33D7478269555FC9FECBB2A3D1A233310C7FDB9C432E9196F2CBE8EA7173D18D
SHA-512:	FAE7D20584BCA6B76BBEFA391F025B87DE317241F06696FBDE71B40A06C58556863E81021CF882602199CC1E863CB002DC42087AA6FB44B9CC2F10270DBC2EAD
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Vous avez peur d'.tre suivi en ligne.?",.. SEARCH_TOAST_SUB_HEADING: "Utilisez DuckDuckGo avec McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Recherche priv.e DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "La {0} assure la confidentialit. de votre historique de recherche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Recherche s.curis.e McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "La {0} bloque les liens malveillants dans les r.sultats de recherche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo va devenir votre moteur de recherche par d.faut.",.. SEARCH_TOAST_YES: "Essayer la recherche s.curis.e et priv.e",.. SEARCH_TOAST_NO:"Non, merci"..}..//DDF45239DC70A4A38C09DF3C1DDBEDE9B36F695BEAB9D0BCE84B2AA9D09749C88BC9573B78CCC04564C76381C4225FB24650FAB96D6CB2633A68023C0B6D8926++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	931
Entropy (8bit):	5.607629011471915
Encrypted:	false
SSDEEP:	12:7HOyOXmRUFqyW+1jdHOhjsgv2jdHjd6D39hjpfzJujdXoBcBw1S9IezucRIUyjqz:7HOv2iYT+0vBZflUZViez
MD5:	D366E8D473A0D339187A8FF6CF6C7C91
SHA1:	7DC57717C9650B402927F1AB09118DFC6FC0BB8F
SHA-256:	E6E3ED8B320C57AA685EA4D1C387F884B608AE594EAD166A5FAB23940029018F
SHA-512:	D251060B0F9665E3277ED6D7F71A13BE22924C36D8DB42C2E0F04EDBE7628E0E0181AD103B3A2B5A18DAB83078BFBC107B43DCAD3CC77C9E4CABA1997F653109
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Zabrinuti ste oko pra.enja na internetu",.. SEARCH_TOAST_SUB_HEADING: "Koristite DuckDuckGo s McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo privatno pretra.ivanje", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} dr.i va.u povijest pretra.ivanja privatnom.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee sigurno pretra.ivanje", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokira zlonamjerne poveznice unutar rezultata pretra.ivanja.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo .e postati va. zadani alat za pretra.ivanje.",.. SEARCH_TOAST_YES: "Isprobajte privatno i sigurno pretra.ivanje",.. SEARCH_TOAST_NO:"Ne, hvala"..}..//44D8F1855E9BF7AB2DCE460F5826B7F9FC46A329A2575E51EEBD06954C2897339414BFB6AFE18366A96B249D58D2DF9EA5E0F7C55F177EC431FB8A5F0022415A++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	989
Entropy (8bit):	5.704938741584662
Encrypted:	false
SSDEEP:	12:7HOyOaC24TjrjdHGSHBjXllzFrYjdHjd8dHBjzEfCsbV0kjdUcjaSC65dGE76Muz:7HOvaH6ESZzFddFE8dTadv6BKtv5W
MD5:	6AEFA0BF3ADC76CEE6414AF61FB23F79
SHA1:	AA3235BC0FA708AABFE14B9CC489654A59F368C8
SHA-256:	452B89D35B2F668A121A412402CB03F60B52821B0C9CC1632BA98614F749BF6C
SHA-512:	A3FB089A47139708EED3CB9A41E616949CE3CC5DAB9B2D04355FAAFCFDFE12DAE74FCE887C30A8502A06209DAD1A822BACB6BF195B3A7A72918671A21160D63C
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Agg.dik, hogy k.vetik online?",.. SEARCH_TOAST_SUB_HEADING: "Haszn.lja a DuckDuckGo szolg.ltat.st a McAfee-vel.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo priv.t keres.s", .. SEARCH_TOAST_BULLET_NORMAL_1: "A {0} gondoskodik arr.l, hogy keres.si el.zm.nyei szem.lyesek maradjanak.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee biztons.gos keres.s", .. SEARCH_TOAST_BULLET_NORMAL_2: "A {0} blokkolja a keres.si tal.latok k.zt a rosszindulat. hivatkoz.sokat.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "A DuckDuckGo lesz az .n alap.rtelmezett keres.motorja.",.. SEARCH_TOAST_YES: "A priv.t .s biztons.gos keres.s kipr.b.l.sa",.. SEARCH_TOAST_NO:"K.sz.n.m, nem"..}..//3A1A0FB600593CAC234826AD8FC593A9C49D4ABA6E0434674ACA541B0EC57E4815E5D8516E821B61FD3B0BE51347D99951E3651B441392D503F92AD76F068CF3++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	886
Entropy (8bit):	5.476573198162924
Encrypted:	false
SSDEEP:	12:7HOyOfOMUUAR11jdHbFLjichFDojdHjd1TzjX+BbtAfpPjdEira8KF6wGezGg+Ss:7HOvfa1fhFwTv+MfQiraewlGxugfeEe6
MD5:	79A46EC0D8FC403FAE34C3BED0EC248F
SHA1:	0FE7404A5995EFC5BB2C790E33F031E3579CC2D0
SHA-256:	FD2F9B03A68CC05B6A795C7B5F32C4291E9E9CE32228A79B5CF615787AAD8EED
SHA-512:	2C119C89431937E5FB7026E6E23D30A7E104CFFB17336B1F386C04002A17E6F62AEBEB55BFBDC01EFC5739BB30C0C0E365DF9C89CF7ED6A0622751EF22FDCA40
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Temi che le tue ricerche online vengano tracciate?",.. SEARCH_TOAST_SUB_HEADING: "Usa DuckDuckGo con McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Ricerca privata DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} mantiene private le tue ricerche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Ricerca sicura McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blocca i link pericolosi nei risultati delle ricerche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo sar. il tuo motore di ricerca predefinito.",.. SEARCH_TOAST_YES: "Prova la ricerca privata e sicura",.. SEARCH_TOAST_NO:"No, grazie"..}..//B72F8F379C9A80DD082F897AC2336C6A45F01B7909477E5AC51E6DF7A8548ABC03D39DCFFF9E126653C08D9168E339BC10427DA61FD764A954C1667FCCCD8E5E++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.913422907949394
Encrypted:	false
SSDEEP:	24:7HO+ok2PLDnWzuynP6aG3/jD9vEU0nWzAAH9riGwf:CZPQiaG3/v9v39iGO
MD5:	5DC8A6A5F2EB9EB6DDBECDC7B18488A4
SHA1:	F005D82BF5427447C09C42B66F895EA72FE70B69
SHA-256:	E7B207E03BEA57BD5FBF26F9F5C5E233F50337CA867098E97DA344FF3A275EDE
SHA-512:	3B021F1C15F3CC47B90BEE0E9B506C016E1DB81BFBC1CE9487942455A3235E9D2A3DBC3D404B616988EFEE40964219085C2141D473108222283A68CE8793EBFA
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: ".........",.. SEARCH_TOAST_HEADING: ".......................",.. SEARCH_TOAST_SUB_HEADING: "......... DuckDuckGo .........",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo ...............", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0}...............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "..... .... ...", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0}............................", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ...................",.. SEARCH_TOAST_YES: "....................",.. SEARCH_TOAST_NO:"..."..}..//46640E5CF05B1F8D2357ECE1164EE0CF936AC8D2B

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	961
Entropy (8bit):	5.983907782778655
Encrypted:	false
SSDEEP:	12:7HOVlzFX8YwOhLRjdH2Zvj0qSwjzjdHjdipvjZF3jlESzjdQecDhLpjVwOnTth:7HOVsYwO9mpSP3REz59pyOTf
MD5:	1E6DE95E346D0161A1554D603606EB05
SHA1:	3ED335A8C360865623F3237767213CD360EB65F0
SHA-256:	89D03B277A5E303C57334B80F58B28A9ACC4E1BC5591DB72F1D34F37A9CD5171
SHA-512:	07E309BB793743F5C552998ABB952C16DFB3AE066BE65B9E9851D32FA8CF6A8D6A269DA786991873BDC3CEC50AC97E1113C447B9ED153A9D005D1B6371AC5B85
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "......",.. SEARCH_TOAST_HEADING: "... ... ......?",.. SEARCH_TOAST_SUB_HEADING: "McAfee. .. DuckDuckGo. ... ....",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo .. .. .. ..", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0}.(.) .. ... .... ......", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee .. ..", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0}.(.) .. .... .. ... ......", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo. .. .. .... ......",.. SEARCH_TOAST_YES: ".... .... ... ...",.. SEARCH_TOAST_NO:"..."..}..//81AACFC0791430DE29237790AC2A954BE2FD6A6DC1D3258D1E751ED67CA9C24E54E4D1DB85E160B0412E6CA0088E64A3829BB1094DC94188B660625725AE572A++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	845
Entropy (8bit):	5.5275256652088745
Encrypted:	false
SSDEEP:	12:7HOyORW/G1jdHMLBj+WjdHjda+jns4jdHnfUMX4M1QWM8QCSZKXWtBy:7HOvmGAL4mnfoMTM5KyBy
MD5:	AF0120871BAF2161BB8A6E4CF8846D8F
SHA1:	A7D85EC6885F76A6100483F138721897D5FEA56F
SHA-256:	25F3BFD13C32744612CDF54EB0787F023AB7F646FD5B73854775EA88B25ABBA8
SHA-512:	F4C7504E964645AF4A11EB6A1FA3F3FC6BBC5C240CD7DAB33BF9C9A7382365ED02D04AA4A55165F54DF0D8B1D35CC3E3748CC2AABC229E1359B4B72DB0B7059C
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Er du redd for at du blir sporet p. nettet?",.. SEARCH_TOAST_SUB_HEADING: "Bruk DuckDuckGo med McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Private Search", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} holder s.keloggen din privat.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Sikkert s.k", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokkerer skadelige koblinger i s.keresultatene.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo blir standard s.kemotor.",.. SEARCH_TOAST_YES: "Pr.v Privat og sikkert s.k",.. SEARCH_TOAST_NO:"Nei takk"..}..//EC2E46B243B5824729E59FFB065A580C5EF86C2B344D8E88DF2A38CAB0FBE9C2CC8E59180EA4B820E15FECB7D3CA2BFCDCFF8AB4B35753E27FBDCAB1FF8CFFB1++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.594216202996838
Encrypted:	false
SSDEEP:	12:7HOyOEKAQ1jdHcxRVjWw5KAjdHjdJMyVXjjvc6jdAYy0IYywQsHBgxNNCj10dIdE:7HOvEPQCRsFCZ6dwQgBOKj1fdhih
MD5:	D54BC25240B6A38EFF15A56FA2181DF8
SHA1:	CC394321EFE2F42C76578331D82870CA57AA3A45
SHA-256:	9282375094704104EA66B5E201C1A2E37C571AA2D21DDD9501C71F38687B8796
SHA-512:	662FEDAEBB741F1C08D9F6EA9F701FF841BE8F4D008CA09D99698B6978106627E6E5D657B0432D16E35E0FBC84BEF338DE7B334403B48D3ED294753B8D05EA43
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Wilt u niet online worden gevolgd?",.. SEARCH_TOAST_SUB_HEADING: "Gebruik DuckDuckGo met McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Priv. zoeken met DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} houdt uw zoekgeschiedenis priv..", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Beveiligd zoeken van McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokkeert schadelijke links in zoekresultaten.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo wordt uw standaard zoekmachine.",.. SEARCH_TOAST_YES: "Probeer Priv. zoeken en Beveiligd zoeken",.. SEARCH_TOAST_NO:"Nee, bedankt"..}..//494316BE737C3411583AA4228A3996234BD4E59D0EF640886F8B3D1110FBA7496D87C8C050168BE1739AF601D9C646842512034B1812A75D130938F94CA2B814++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.752345232520265
Encrypted:	false
SSDEEP:	24:7HOv7riOxBHc8doB0k/fX2eB1WRuEAArJ:Cv7riOxB88dI0knXNLArJ
MD5:	8E40C0D1357D742FBACAF071DCC5E303
SHA1:	2526F9559FB07CC075E8E1378B56EA373D228815
SHA-256:	B9D99952A239002F9279EE7CD67521DB9DFEA77DFB1AD4080B96793A8E25BF36
SHA-512:	D5ECCB0A8A2BC523D28C8BF005160ABFAD99B7F50685C6BC50E4423B8C803284972EBC7D0AE4F4A926B3234E18E5111B83D4E55BDACBB0512CE3E163EFB2077A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Obawiasz si. .ledzenia online?",.. SEARCH_TOAST_SUB_HEADING: "U.yj przegl.darki DuckDuckGo z produktem McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Prywatne wyszukiwanie DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "Przegl.darka {0} zachowuje prywatno.. historii wyszukiwania.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Bezpieczne wyszukiwanie McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "Przegl.darka {0} blokuje z.o.liwe ..cza w wynikach wyszukiwania.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo stanie si. domy.ln. wyszukiwark..",.. SEARCH_TOAST_YES: "Wypr.buj prywatne i bezpieczne wyszukiwanie",.. SEARCH_TOAST_NO:"Nie, dzi.kuj."..}..//99C89E820433C195871F4A96C191820DA4BEDE93EF62CB8B4571A026D247E73D11949927CF39BADBC3F773469777C5B3A6082B88D3B0B9F8E6D237C484A806DB++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	905
Entropy (8bit):	5.573826123867286
Encrypted:	false
SSDEEP:	12:7HOyOamduRsK1jdHMLBjSHajdHjd2OtFcjq/C9yd+WFujdEiXGunNwDFPGtjtThl:7HOvam9KALhB60FDYnNsPG7QNksLA
MD5:	DEF9FEBCF706528D4A4D2A532B094F78
SHA1:	7CBF0AA14E90AA15481DBDACC2E8F7096FC0546F
SHA-256:	5D07FE3AD9B001DD366F42A252EF818006F874D409173E710A3D17D57DF7250A
SHA-512:	51D978666C9D96318559149D3A0086FB51A59F00B9A47471AC5AB41FB29A8298E2BC7A7BB2306F80ACCBA00FCCC80CABCA37C4049DEF82A1D035AC77D768DE35
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Preocupado com ser rastreado online?",.. SEARCH_TOAST_SUB_HEADING: "Use DuckDuckGo com McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Private Search", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} mant.m seu hist.rico de pesquisa em privacidade.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Pesquisa segura da McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloqueia links maliciosos nos resultados de pesquisa.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo se tornar. seu mecanismo de pesquisa padr.o.",.. SEARCH_TOAST_YES: "Experimente pesquisas privadas e seguras",.. SEARCH_TOAST_NO:"N.o, obrigado"..}..//5380834EB49FC74F2191E28F491F1BC2CDF6354848A5686D2C1D0E581C85CBB281CB850039F67FA9DDD421227F0DD935DA79FA1B02939D4A07CEA24219B273BA++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.579048356995121
Encrypted:	false
SSDEEP:	12:7HOyOwON2GFfK1jdHcwOFoSjPH5jdHjd2OtFcjq/CGMoujdvIjmg57IIePGtjJZD:7HOvwONFFfKEG+B6Ur5wPGN6v7oEM
MD5:	CDA6270CBD9FA8FC78E235C4CEE1DD0E
SHA1:	9DC44A4C862712E13A395D997A2EF5F572BDD13E
SHA-256:	1E0F67722A18060067EF298071FE0290FCCFC67E5FC99090F46C806B2AFC4F0F
SHA-512:	9179B680A93B4A4B136E940A3817DEBA4D90682D845A16291A88EBFD13AB18692EB7DE643F5B9AD2C87A05396ADA30E62CFD637399D1701BAD39C557E9830DAE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Est. preocupado com a possibilidade de ser monitorizado online?",.. SEARCH_TOAST_SUB_HEADING: "Utilize o DuckDuckGo com McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Pesquisa privada do DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} mant.m o seu hist.rico de pesquisa privado.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Pesquisa segura da McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloqueia liga..es maliciosas nos resultados de pesquisa.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "O DuckDuckGo vai tornar-se o seu motor de pesquisa predefinido.",.. SEARCH_TOAST_YES: "Experimente a Pesquisa segura e privada",.. SEARCH_TOAST_NO:"N.o, obrigado"..}..//2E4666D7F920C5B0C8E5A3BC27798AE7915D5ABD183AE3B471E93B04785795CDE6A84476874243B377FB1EE60B419A0651FA2F7CFD40DF64CB8F888CD04EAEC4++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	5.469519648385535
Encrypted:	false
SSDEEP:	24:7HOvEzOMHAIonuRIovfPFt5rNlvytaiSAF+RQX/XJfzl:CvEK6AuLfPFPfvyciSAFffJx
MD5:	C220E25B3C9A7677CDE272C61730079B
SHA1:	39093FB66572B8530AE293545D09000544D3C288
SHA-256:	32A7A9DF84A049853BAC0E559D5F58472870759EAC11EF6063F65EB6A47A0550
SHA-512:	B199592FA9D19719A01034C86B04DDAF3EC43E770648150505639672767F03A909814566C92E267DB34C598C61216ACB157077AF5C4163E55AE4D846A5C73FF0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "............ .. ...... ............ ...... . .........?",.. SEARCH_TOAST_SUB_HEADING: "........... DuckDuckGo ... ......... McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "................ ..... DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} ......... .................. ...... ..... ....... .......", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: ".......... ..... McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} ......... ........... ...... . ........... .......", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ...... ..... ......... ........ .. ..........",.. SEARCH_TOAST_YES: ".......... .

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	959
Entropy (8bit):	5.809433846677453
Encrypted:	false
SSDEEP:	12:7HOyOuKOG811jdHvXjy9RDujdHjdVlj6cKj/ujdDEmy9g72LSokwXPjk8Ab:7HOvuKp81rOOI7jRN9Y2vkb
MD5:	CB14E54FE4E4E4BFD9E6381387CDF22E
SHA1:	98CA287535F27DAA71102CC3D5EBF092D6A599E1
SHA-256:	6CAAC2C18DBC1E00F7026B620F6F2FC112C33754081421724A15F0A0CEF6A86B
SHA-512:	FBC294661C57BDA0A19E54D6F777A7C05A0DE5E95B575D8305C18F4DFD69077094F3F94903A6AEB26DE7FC0EFC2F7542D120C86C550C4906E5101C9B1ED0FB01
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Ob.vate sa, .e v.s niekto sleduje?",.. SEARCH_TOAST_SUB_HEADING: "Prehliadajte pomocou DuckDuckGo s.ochranou McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Anonymn. prehliadanie DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} zabezpe.uje va.u hist.riu vyh.ad.vania.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Zabezpe.en. vyh.ad.vanie McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokuje .kodliv. odkazy vo v.sledkoch vyh.ad.vania.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo bude predvolen.m vyh.ad.vac.m n.strojom.",.. SEARCH_TOAST_YES: "Vysk..ajte s.kromn. a.zabezpe.en. vyh.ad.vanie",.. SEARCH_TOAST_NO:"Nie, .akujem"..}..//71AA65F1DC5872056C55D5E55A90C3268B9852B528AE65DB30991543FAAFB352805C9FED427B4963040A01CF9CF963C767190595628114C128ACDA0FFB558C03++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	899
Entropy (8bit):	5.6038422969759765
Encrypted:	false
SSDEEP:	12:7HOyO5bp57xqyeE1jdHqj81jXjdHjdSjqQf7jdXoBSLgOYk/ryGTkcnTdfWb4Lh:7HOv5rcsh1jlQfddLj/r1TkWRDt
MD5:	278676BF91D770DC118F29BF18C1702B
SHA1:	7553E2E22654505FEA525BF7D0F9F3FEEECF39AB
SHA-256:	1A9B10CD6C7F0BA54DBB9D08A3112B76083D6E7C2BF1B1BA16ADB9EE1041662F
SHA-512:	0B3491D25CB2766C25F06E7F224358E73A76698F2B8CCC1453182B859D0A6EA1767D7FB9DFF75578E1520364A892C5BC6B3394C8B61CB5974BD28AAEF6FE5161
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Brinete da ste pra.eni na mre.i?",.. SEARCH_TOAST_SUB_HEADING: "Koristite DuckDuckGo uz McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo pretraga uz privatnost", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} .uva privatnost va.e istorije pretrage", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Bezbedna pretraga", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokira zlonamerne veze u rezultatima pretrage.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo .e postati va. podrazumevani pretra.iva..",.. SEARCH_TOAST_YES: "Isprobajte pretragu uz privatnost i bezbednost",.. SEARCH_TOAST_NO:"Ne, hvala"..}..//4EE3A431FAE39873DE972705A85402F1FAFF98FCB2417AFD1293FE6F9B68F0070435B93A8E7F7D9AD55B921B796D253A4BCAFD111D63F9D2C7DAE12E727592A4++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	855
Entropy (8bit):	5.609499495634988
Encrypted:	false
SSDEEP:	12:7HOyOP10P/1jdHgjNejdHjd6HjSEqNjdc+yJLzwd7VvxXbqH0:7HOvt0XKYEV+yJ/wTvxXbqU
MD5:	5DB7E685FE9867DFCA1163DB463E4F59
SHA1:	5757D5B7E56501118CCA9028A9A5B32021FCFC2B
SHA-256:	6A349142B06F01B2808B5155A16CCCD0060D33306F6421CE487A00449D34A13D
SHA-512:	F3F20F1CC7A95DCB12A7DF5554B000B3551F1CF605E5B78F3467C8A7AAF940AC6D7F4B5F1192B5E8E962E82CAF47FD248A94AD36165A46B4D83146F586BF6B35
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".r du orolig .ver att bli sp.rad online?",.. SEARCH_TOAST_SUB_HEADING: "Anv.nd DuckDuckGo med McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Privat s.kning", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} h.ller s.khistoriken privat.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee s.ker s.kning", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blockerar skadliga l.nkar i s.kresultaten.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo kommer bli standards.kmotorn.",.. SEARCH_TOAST_YES: "Testa privat och s.ker s.kning",.. SEARCH_TOAST_NO:"Nej tack"..}..//BB9AE0BA2930DA20E383A897C4A50696C9D6B768528D496EF1EA95F7C88058E61ECE06939667BE8D391FF1D3E50D94C9D2DDB9ACF5C40A2D5CCBC37226A3658B++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	907
Entropy (8bit):	5.684192341197801
Encrypted:	false
SSDEEP:	12:7HOyOb0kPX0jdHCZjHvLWjdHjdatBjQ8JI3chAjdKlaUAcYQHcIwCc43nd2+x:7HOvb023vLrubY/YQ9wC320
MD5:	9D00AE03C25DFB0B32774B3AA8BB90CE
SHA1:	EB05A3AD9A0BAE456640959AD12A242094F58B88
SHA-256:	C34D861A62DFCF95FBF2840D69DC238F69022DA53D9D81FDDDE257F0E1120E68
SHA-512:	B9133DF9B42EA6DB0284840E1AF1D135486AC0E25CDA005B956B581E7DDA0E9CD4A7C21D6DC5A53A1DD3AE329682C539911F2B2349D5F753F101EC2D3C62622D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".evrimi.iyken izlendi.inizi mi d...n.yorsunuz?",.. SEARCH_TOAST_SUB_HEADING: "McAfee ile DuckDuckGo kullan.n.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Gizli Arama", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} arama ge.mi.inizi gizli tutar.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Secure Search", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} arama sonu.lar.ndaki k.t. niyetli ba.lant.lar. engeller.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo varsay.lan arama motorunuz olacakt.r.",.. SEARCH_TOAST_YES: "Gizli ve G.venli Arama'y. Deneyin",.. SEARCH_TOAST_NO:"Hay.r, te.ekk.rler"..}..//C7047C8F67448C0CB8489F2FD439076397E8F3EBAA2DBDD3BCF2F885C3E7D90362DCAB25B4BBBA579678E2D824D9905749505C37B4776DC6ECBA144D4688E8A9++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	848
Entropy (8bit):	6.098392659863907
Encrypted:	false
SSDEEP:	12:7HO+9p0jdH4Ly0jJwCjdHjdOZLy0j2u1AjdKeNygHChLjSXHGEbyw10vvGh:7HO2Lyyw5LyHf8gHmSXIw103Gh
MD5:	BA39CB0C119068E2F630FC575379109B
SHA1:	9F902CE460E73F785045D0FD5E9A1F5B63F82A45
SHA-256:	E7C2BC598123882A01546D5EE0BBF1FAE5B309AED1B1CE1FA1DC4DB7FFE6A3A8
SHA-512:	5863D3BC084A7FA3876F7837B7C776C5F018A30ADFDAE773E9A43E5E274BB09BA363070BE53D67122DB880FEA3B50E29471548CDE3A23BD05D771E90CD9AF5E7
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "....",.. SEARCH_TOAST_HEADING: "........",.. SEARCH_TOAST_SUB_HEADING: "....... DuckDuckGo.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo ....", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} .............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: ".......", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} .............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ............",.. SEARCH_TOAST_YES: ".........",.. SEARCH_TOAST_NO:"...."..}..//866E027ADED7D5B7F0C36FBF565CC9CF78FBE11002A554DF4C0AD518FBD2468BF84ABDCB6F821A189B1342E17851AE931593A946E6B87387AA9D6C481E1CE110++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	863
Entropy (8bit):	6.114438032208445
Encrypted:	false
SSDEEP:	12:7HOyOOcMZGjdHMLBj8SC5jdHjdtjkYjd/eBAM+bCvZUIy5X0a9tXUK:7HOvupLyFeF0Yyl0a9tXUK
MD5:	419BCEDAC4FB2A6FF5709318C56BDF2E
SHA1:	3E6AB879AD3281ABFC7184E7BADC2B9434A80C49
SHA-256:	07C72589EA8CBC69771D2A3E480579C9354B473393998AC6DD377C763A51AE62
SHA-512:	704C0FA5C7D7B3AFC16936511C2E29A543C7F5087A588AE8AB71CF823B5E9F63D5CE9DDF06647BCE2B36A8B768E78BCFB16E7B0EFAE5116512A1A6E1570466B6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".........",.. SEARCH_TOAST_SUB_HEADING: ".... DuckDuckGo . McAfee ..",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Private Search", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} ...............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee ....", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0}..............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ............",.. SEARCH_TOAST_YES: ".........",.. SEARCH_TOAST_NO:"...."..}..//293E181DAC21161671A568D6590EE58002001828FC287C0D726FE50D118CDCA3ED663A081577996A8989B5CF11976C34568A68D0DC526A99F55643781F03A05C++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11879
Entropy (8bit):	5.005043787837462
Encrypted:	false
SSDEEP:	192:CBketuJEUrvtH9Ai5trhElBXXrhEN1QtfT6GpD:CBksuJEUrvNyi5tKBnkQVOGJ
MD5:	5F9B32DD56D8EA845C3B7DAE2404ACC3
SHA1:	1B5CDF356D0DA241DB4F6C1DAF80C97B25E1E5B6
SHA-256:	BDAE1BDA30D72C00D20A54325BCFB0A910423813E3EA83682306B3EF75A39A27
SHA-512:	8D86D291F4DC816ADCD1905E00EB6B45ACA762BE4080A5E7B1039656A106C5646FFC4B6D9AD60CA6CCA758B7DFAFB0386B2431680286FE9646ABC9404EAD22E3
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ". ....... ......... ..... ................, .. ..... ...........",.. SEARCH_TOAST_SUB_HEADING: ". ....... ......... ... ........... ... ........... .......... ... ............ ...........",.. SEARCH_TOAST_BODY_TEXT: "...... .. ......... ..... ... .... ....... ... .... ............. ........... .. ........ ......... ..........;",.. SEARCH_TOAST_OPTION: "..., .. ............. . ....... ......... .... ... ............ ... ............ ...........",.. SEARCH_TOAST_DONE: ".....",.. SEARCH_TOAST_HEADING_COMPLIANT: "... ......... ... ...... .........

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6293
Entropy (8bit):	5.371200704117131
Encrypted:	false
SSDEEP:	96:Ckl7LklkKuaz45DJMtR4fAgK0vQ8jwsClwJcv+ztBDABrBN9FC1WgjsRBva54ApN:CkWF+Uturjjj42tBABrFoUgOBixN
MD5:	6C306FAA1E445268C8982C9BD470E831
SHA1:	F8DD22113F54DB8445842393D621FDFE48DB7C26
SHA-256:	7385277B4E0F0E3D9A0D44750E7A04C7F62B6F82EF9F2FF22D0AD4FA00D8042D
SHA-512:	FA6BB3037F4B4492299ABE80E117390E0800F1267E1C247CC252E50BDA404BB87604E67A946D4694435C025B3EDA3CB23A098478EC4DB7266BBA65BBAF8E2ECE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Secure Search is off . be careful",.. SEARCH_TOAST_SUB_HEADING: "Secure Search steers you away from risky sites in your search results.",.. SEARCH_TOAST_BODY_TEXT: "Want to stay ahead of the bad guys with extra search protection?",.. SEARCH_TOAST_OPTION: "Yes, turn Secure Search on after I restart my browser.",.. SEARCH_TOAST_DONE: "Done",.. SEARCH_TOAST_HEADING_COMPLIANT: "You don't have Secure Search . be careful",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Secure Search steers you away from risky sites in your search results.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Would you like to add Secure Search and stay ahead of the bad guys?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Yes, add Secure Search to my browser and change my default search to {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",.. SEARCH_ENGINE_YAHOO: "Yahoo",.. SEARCH_ENGINE_YANDEX: "Yandex",.. SEARCH_ENGINE_

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7166
Entropy (8bit):	5.361271692904923
Encrypted:	false
SSDEEP:	96:CikaW+DI24sA0etjy/gsjyw9FsBR52/MGSrZcUyxITK3mwq:CNL+DI23ktjy4sjyGeR5jKnOKWV
MD5:	A27281454C30899678F3FBD223D64F47
SHA1:	BA2B07D7728CFAEA2DE69FCC1346CCBDECB7F822
SHA-256:	DEBC021B4105E12DDDBAAC449B0783A512AA82C4324F8CDF8F48A109F72219B6
SHA-512:	38BB9C0DCE14D0DD93B9C8C9B21198D345788448A1EF70871764FC26E186F70B43FD0F867A3E9FC17A9FA232252296E039E1D10DD3EC31C93114037F3E75D9B8
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "La b.squeda segura est. desactivada: ten cuidado",.. SEARCH_TOAST_SUB_HEADING: "La b.squeda segura elimina los sitios web peligrosos de los resultados de tus b.squedas.",.. SEARCH_TOAST_BODY_TEXT: ".Quieres ir un paso por delante de las amenazas con una protecci.n extra en tus b.squedas?",.. SEARCH_TOAST_OPTION: "S., activar la b.squeda segura despu.s de reiniciar mi navegador.",.. SEARCH_TOAST_DONE: "Listo",.. SEARCH_TOAST_HEADING_COMPLIANT: "No dispones de la b.squeda segura, ten cuidado",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "La b.squeda segura elimina los sitios web peligrosos de los resultados de tus b.squedas.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".Quieres a.adir la b.squeda segura e ir un paso por delante de las amenazas?",.. SEARCH_TOAST_OPTION_COMPLIANT: "S., a.adir la b.squeda segura a mi navegador y cambiar mi b.squeda predeterminada a {0}.", // {

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6972
Entropy (8bit):	5.376232051601562
Encrypted:	false
SSDEEP:	192:C7nHt6A2Av8eK1mD8OOtjvQxj4jJ5QXGfTB9gn:C7nN6dABK4wOOtjvQxj4lomTB9gn
MD5:	B1F44A6576E7EFAA2B274B4E7882E3C6
SHA1:	433ACF70FA32C49855EDF99311F15233A580E514
SHA-256:	00559D0234C57E5EC34C028A8569A13ACB477BD5135076DE0FD8EA43846771BA
SHA-512:	8F0A17E0C3039851E64CBF610AD3FE76059D02AABFE1963702DE1545BA299ECC9D73B5811D0F38E87A33026E17088FE73665EEA0D9B53B6B14F57D40768DC4EE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "B.squeda segura desactivada: ten cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura elimina los sitios peligrosos de los resultados de tus b.squedas.",.. SEARCH_TOAST_BODY_TEXT: ".Quieres ir un paso por delante de las amenazas con una protecci.n extra en tus b.squedas?",.. SEARCH_TOAST_OPTION: "S., activar B.squeda segura despu.s de reiniciar mi navegador.",.. SEARCH_TOAST_DONE: "Listo",.. SEARCH_TOAST_HEADING_COMPLIANT: "No tienes B.squeda segura: ten cuidado",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "B.squeda segura elimina los sitios peligrosos de los resultados de tus b.squedas.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".Te gustar.a agregar B.squeda segura y adelantarte a los malos?",.. SEARCH_TOAST_OPTION_COMPLIANT: "S., agregar B.squeda segura a mi navegador y cambiar mi b.squeda predeterminada a {0}", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6713
Entropy (8bit):	5.396839920360876
Encrypted:	false
SSDEEP:	192:Cf5VcSzQubYOrlY0XRMYSJd1VtHyYZN66mHyY4XubJMt:CfWJXecJtlf6vl8ubJQ
MD5:	22A4491D425049A6DB1854ACFF9B394D
SHA1:	2C686EECA2F0A4F845BAFB41FFE80B3EDEDADC5F
SHA-256:	7B7835DCC403359DE3966B8F970E904FF00BD44F15EC73BD6E1456A0E8E17494
SHA-512:	54F6FA1620C33C6DC3907B61B292A6801933C133DB91516775AAA6624D215EA5CCE46D344127AA2B9535D98228B5C2CD7D31B011238A6CF6B6CFB45818F49E77
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Varoitus: suojattu haku ei ole k.yt.ss.",.. SEARCH_TOAST_SUB_HEADING: "Suojattu haku suojaa sinua vaarallisilta verkkosivustoilta, kun suoritat hakuja.",.. SEARCH_TOAST_BODY_TEXT: "Haluatko lis.suojaa hakuihisi?",.. SEARCH_TOAST_OPTION: "Kyll.. Ota suojattu haku k.ytt..n, kun k.ynnist.n selaimen uudelleen.",.. SEARCH_TOAST_DONE: "Valmis",.. SEARCH_TOAST_HEADING_COMPLIANT: "Sinulla ei ole suojattua hakua . ole varovainen",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Suojattu haku suojaa sinua vaarallisilta verkkosivustoilta, kun suoritat hakuja.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Haluatko lis.t. suojatun haun, jotta pysyt jatkuvasti muutaman askeleen rikollisten edell.?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Kyll., haluan lis.t. suojatun haun selaimeeni ja muuttaa oletushakukoneeksi {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",.. SEARCH_ENGINE_YAHOO: "

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7707
Entropy (8bit):	5.340016424850186
Encrypted:	false
SSDEEP:	192:CNztZLR3dPCgbg0LUaJbQA1A/6yb2qz2KAnt/rF43U/HqBosOCA2FSij:CB/CqQaKA1i64z27t/rF43U/KBosOCAM
MD5:	7FE1C1D9114B26389A823CB43BC6A088
SHA1:	0C386C110C4D2C54D4014B0B201BE82A07C668CE
SHA-256:	F11AC143D9E22A6829DD126EC36AC9BC48ED28CC2A7C251F5F5F28149B7D598E
SHA-512:	82169468A2BFD73369A1411E74232B62B75FA81314859E6248805176CD7685E724207F36F9188096B73A34915AD488D0D5F83DCF958F87581629E6F4920BDA3D
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Attention! La recherche s.curis.e est d.sactiv.e",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e vous met . l'abri des sites Web dangereux figurant dans vos r.sultats de recherche.",.. SEARCH_TOAST_BODY_TEXT: "Voulez-vous d.jouer les escrocs en vous dotant d'un moyen de protection suppl.mentaire?",.. SEARCH_TOAST_OPTION: "Oui, activer la Recherche s.curis.e une fois que j'aurai red.marr. mon navigateur.",.. SEARCH_TOAST_DONE: "Termin.",.. SEARCH_TOAST_HEADING_COMPLIANT: "Attention! La recherche s.curis.e n'est pas install.e.",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "La recherche s.curis.e .carte de votre recherche les sites internet risqu.s.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Souhaitez-vous installer la recherche s.curis.e afin de garder une longueur d'avance sur les escrocs du Web?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Oui, ajouter la recherche s.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7690
Entropy (8bit):	5.333235855616893
Encrypted:	false
SSDEEP:	192:CsERzSimDtBPs31a2/DMEopt+3eOpPZA2XYGAy:CXFABPq1x8t+3HZA2IGAy
MD5:	73A28FCD9D09E6845C84568A67784C2A
SHA1:	B0B7D95416388610492E2B39B6E9CB1623FC28D1
SHA-256:	C040F7D2D08FBCE33F2CE076F4F9BF8C7EB5696229F8D3E60C53E3BFD5F99207
SHA-512:	85907760D42FC156BE41B4C294C7703823BFD2EEEF4F60AC9B0749B25543B3FCAAE48C74AC83FF6EAA68D90033E08F36FAFF8C800B2D40D8B989F898F3C73D19
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "La recherche s.curis.e est d.sactiv.e. Soyez prudent.",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e .carte les sites dangereux dans vos r.sultats de recherche.",.. SEARCH_TOAST_BODY_TEXT: "Vous souhaitez une protection de recherche .volu.e qui vous mette . l'abri des utilisateurs malveillants.?",.. SEARCH_TOAST_OPTION: "Oui, activer la recherche s.curis.e apr.s le red.marrage du navigateur.",.. SEARCH_TOAST_DONE: "Termin.",.. SEARCH_TOAST_HEADING_COMPLIANT: "Soyez prudent, vous ne disposez pas de la recherche s.curis.e",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "La recherche s.curis.e .carte les sites dangereux dans vos r.sultats de recherche.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Voulez-vous ajouter la recherche s.curis.e et garder une longueur d'avance sur les personnes mal intentionn.es.?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Oui, ajouter la rech

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7046
Entropy (8bit):	5.490921343909714
Encrypted:	false
SSDEEP:	96:C1/oREn0Rscvuy66DERG9MCt9qU8FCjN9JPh9qU8F/9FYeP5en2uRpPpQA9:CxnifBE6t9z8FAN9H9z8FFeQm5DPyA9
MD5:	5DA23CDDB7BC8A0395ED207520E211F8
SHA1:	81F38492CBF181D0B29516405674F475ECB71C59
SHA-256:	83B8AA811C323A5B0D8C3906B1B603E64F9786F4B704D50131F87B29F97C131B
SHA-512:	A31CB709F956C7D0AA5A696812BCE7FAD39FCA17C59274D1FC9934E3E8BB12A36C2A4AB545C095F151522A165AD12475B54AFC76E346DF4EE0D2F0F96F430C6A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Isklju.eno je Sigurno pretra.ivanje - budite pa.ljivi",.. SEARCH_TOAST_SUB_HEADING: "Sigurno pretra.ivanje dr.at .e opasne stranice podalje od va.ih rezultata pretra.ivanja.",.. SEARCH_TOAST_BODY_TEXT: ".elite ostati nekoliko koraka ispred negativaca s dodatnom za.titom pri pretra.ivanju?",.. SEARCH_TOAST_OPTION: "Da, uklju.i Sigurno pretra.ivanje nakon .to ponovno pokrenem preglednik.",.. SEARCH_TOAST_DONE: "Gotovo",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nemate sigurno pretra.ivanje - budite oprezni",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Sigurno pretra.ivanje dr.at .e opasne stranice podalje od va.ih rezultata pretra.ivanja.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".elite li dodati sigurno pretra.ivanje i ostati ispred?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Da, dodaj sigurno pretra.ivanje mojem pregledniku i promijeniti svoju zadanu pretragu na {0}.", // {0} SE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7496
Entropy (8bit):	5.557339709578155
Encrypted:	false
SSDEEP:	96:CyQ0mXVpV8YYxZXThD71WnkWYtezBPwe49Fnmsv31B94+CgB:CxFXV8YabLtaB4jXH4gB
MD5:	E3D9416AE1CAF895358C69FA3C4783FE
SHA1:	15D4C237FF6F261F0311B63C0DA6AD506793AE9B
SHA-256:	05B76F6B77C79AA7284E141A9EA86B9E07236AA8B22749DF5185B808BF999F0B
SHA-512:	CCE2AA0171D177F7B8B19B00A91B1FEDC5FFBDF3A5A412F608822D3AEA517C7B9ED122B27B0F4ACCC36EB3A5097F739DA2D1AF0FFD09AA2D0FCDD2B2702BA19A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "A biztons.gos keres.s ki van kapcsolva. Legyen .vatos!",.. SEARCH_TOAST_SUB_HEADING: "A biztons.gos keres.s funkci.val elker.lheti a keres.si eredm.nyek k.z.tt tal.lhat. vesz.lyes webhelyeket.",.. SEARCH_TOAST_BODY_TEXT: "Szeretne a rosszfi.k el.tt j.rni az extra keres.si v.delemnek k.sz.nhet.en?",.. SEARCH_TOAST_OPTION: "Igen, legyen bekapcsolva a biztons.gos keres.s funkci., miut.n .jraind.tottam a b.ng.sz.t.",.. SEARCH_TOAST_DONE: "K.sz",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nincs biztons.gos keres.s funkci.ja . legyen .vatos",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "A biztons.gos keres.s funkci.val elker.lheti a keres.si eredm.nyek k.z.tt tal.lhat. vesz.lyes webhelyeket.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Szeretn. hozz.adni a biztons.gos keres.st, hogy n.h.ny l.p.ssel mindig megel.zze a rosszfi.kat?",.. SEARCH_TOAST_

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6908
Entropy (8bit):	5.245498610099517
Encrypted:	false
SSDEEP:	192:CNcefx5VArSHAmTy+rr0l2BJ07tpelslpeWy++WVHJKG:CL5OpmOU0lCJ07tpiWp4st
MD5:	B35C9DF7CCF1DFAB39B8D150BDBAD0EC
SHA1:	87A1399F15722BF19093F9E0986D243E3FFF2F55
SHA-256:	830EB5467933E0C98FE12B4B0416C78D08588069115A8684E0F1470832BACD0A
SHA-512:	82755EA3703807A50320C88365BAE530E82F6257B8FFE765447BAFC12942447C69F47360E7D9CDE19E572FFCF20988608D0B0837CD0674D164E0EB2CF5974BB5
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Attenzione: la funzionalit. di ricerca sicura non . attiva",.. SEARCH_TOAST_SUB_HEADING: "La ricerca sicura consente di escludere i siti rischiosi dai risultati delle ricerche.",.. SEARCH_TOAST_BODY_TEXT: "Vuoi essere sempre un passo avanti rispetto ai malintenzionati, grazie a una maggiore protezione delle ricerche?",.. SEARCH_TOAST_OPTION: "S., attiva la ricerca sicura al riavvio del browser.",.. SEARCH_TOAST_DONE: "Fine",.. SEARCH_TOAST_HEADING_COMPLIANT: "Attento, non stai usando la ricerca sicura",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "La ricerca sicura consente di escludere i siti rischiosi dai risultati delle ricerche.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Vuoi aggiungere la ricerca sicura e tenere alla larga i malintenzionati?",.. SEARCH_TOAST_OPTION_COMPLIANT: "S., aggiungi la ricerca sicura al browser e imposta il motore di ricerca predefinito su {0}.", // {0} SEA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8147
Entropy (8bit):	5.851856695337375
Encrypted:	false
SSDEEP:	96:CPLfnSHyVfZ2H6EisoqNkij09yT4eKVX0fe66UqPJGNBcpIEdt4/L22XPJn4/799:CumbTi9Itk2s1EuSU8sJ7nJQ
MD5:	93F4B53055095A2822875E255EC9A1A7
SHA1:	880C7C6F38DE0969A51B2DA44ACE4DE08E587999
SHA-256:	73366047A17E6F52F3F95FFEE1344AB1D709F560884726275C82BA174A436FA5
SHA-512:	FF390DD8042ADF87F61448F30BE85C64A3D8882533448E48981A9B5D3E233552C386902172BCE253E92345348F38E8FC5DF605C0C6F03D33B8EAF921096575A8
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: ".........",.. SEARCH_TOAST_HEADING: ".... .................",.. SEARCH_TOAST_SUB_HEADING: ".... ........................",.. SEARCH_TOAST_BODY_TEXT: ".........................",.. SEARCH_TOAST_OPTION: ".................. ...........",.. SEARCH_TOAST_DONE: "..",.. SEARCH_TOAST_HEADING_COMPLIANT: ".... ..........................",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: ".... ........................",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".................. ...........",.. SEARCH_TOAST_OPTION_COMPLIANT: "........

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7384
Entropy (8bit):	5.939360540567115
Encrypted:	false
SSDEEP:	96:CIfSwAbRpdRzltRSN79FIt4khpJAk/Nzf88:CIawKtRSNp1k+YD88
MD5:	48709A430A962C8F9D9FCC45B7749629
SHA1:	8C16BEF24717A8988B4E57E0E58C4F779317B5F5
SHA-256:	0130AA731ED15D0499D3E08778F473D8F4B09D58E722F3C755D29E41A8EA03E9
SHA-512:	6A7A9B80D77C13ECF8361DC583572A8EA0319DC5A80A46C41B72E86C150F84BC48B51ECDF91B6BA34FA2C226FCEE56FCF6C0AF3A2D67E743400A42AF01CCF5AE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "......",.. SEARCH_TOAST_HEADING: ".. .. ..... - ......",.. SEARCH_TOAST_SUB_HEADING: ".. ... .. .. . ... .... ......",.. SEARCH_TOAST_BODY_TEXT: ".. .. ... .. .... ... ........?",.. SEARCH_TOAST_OPTION: ".. . ..... .. ... . .. ... .......",.. SEARCH_TOAST_DONE: "..",.. SEARCH_TOAST_HEADING_COMPLIANT: ".. .. ... .. - ......",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: ".. ... .. .. . ... .... ......",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".. ... .... ... .. ........?",.. SEARCH_TOAST_OPTION_COMPLIANT: "., .. ... . ..... .... .. ... {0}(.). ......", // {0} SEARCH_TOAST_*.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6835
Entropy (8bit):	5.392466327888846
Encrypted:	false
SSDEEP:	192:CKrYAXY8c4VteYFB8K3ueYFYRbyLXKFK4M/:CNGY8VVt7FB8K3u7F6yLXKFK7/
MD5:	88C1B238521E9CBEFEBCEC854F39084B
SHA1:	2C22F51DA35177AF95472FA0510E2D3A68622539
SHA-256:	13F45F8D40B89D09AFBE2D69BC4DF16B5C0850A189DD736632A1A557363F833E
SHA-512:	D31F06A194F2B0D7B2EE115AE0B343D4A3A5D8A0D44FD12ED7431E236A6E7E4A14A5FC3D01F7F5F90935503D1A219004CAFAED15305CABDDC16D644972B5DC07
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Sikkert s.k er sl.tt av . v.r forsiktig",.. SEARCH_TOAST_SUB_HEADING: "Sikkert s.k holder deg unna skadelige omr.der i s.keresultatene.",.. SEARCH_TOAST_BODY_TEXT: "Vil du ha et forsprang p. skurkene med ekstra s.kebeskyttelse?",.. SEARCH_TOAST_OPTION: "Ja, sl. p. Sikkert s.k n.r jeg starter nettleseren p. nytt.",.. SEARCH_TOAST_DONE: "Fullf.rt",.. SEARCH_TOAST_HEADING_COMPLIANT: "Du har ikke Sikkert s.k . v.r forsiktig",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Sikkert s.k holder deg unna skadelige omr.der i s.keresultatene.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Vil du legge til Sikkert s.k for . ha et forsprang p. skurkene?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, legg til Sikkert s.k i nettleseren min og endre standard s.kemotor til {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",.. SEARCH_ENGINE_YAHOO: "Yahoo",.. SEARCH_ENGINE_YANDEX: "Y

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6746
Entropy (8bit):	5.350454241399734
Encrypted:	false
SSDEEP:	192:CHSyoqPxfaPVFJ1bshox+a3uz27w8iLt9ls3cLt3CPiMWbW3pDLrFoz:C2J4jtjbSLBu
MD5:	81258082BB27A266AE5CC94C59295DA6
SHA1:	3A49F9BB69CBD9C96615E760602BC622AF0AF686
SHA-256:	2ADB77A7AB4747994695442447B99A266E7E7E8C7F5506135A7541A93F9B23A2
SHA-512:	E23A851EE97D23C8781B142C45C6A1299C738B0C596B584A82244E2FF0E7D8F34829C90892C72DCA3200FED855576D8BE4FEA1B69BC014764F69E123CDD2F5E6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Beveiligd zoeken is uitgeschakeld. Wees voorzichtig.",.. SEARCH_TOAST_SUB_HEADING: "Met Beveiligd zoeken kunt u de riskante sites in uw zoekresultaten vermijden.",.. SEARCH_TOAST_BODY_TEXT: "Wilt u de criminelen een stap voor blijven met extra zoekbeveiliging?",.. SEARCH_TOAST_OPTION: "Ja, schakel Beveiligd zoeken in nadat ik mijn browser opnieuw heb gestart.",.. SEARCH_TOAST_DONE: "Gereed",.. SEARCH_TOAST_HEADING_COMPLIANT: "U hebt Beveiligd zoeken niet: wees voorzichtig",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Met Beveiligd zoeken kunt u de riskante sites in uw zoekresultaten vermijden.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Wilt u Beveiligd zoeken toevoegen om criminelen een stap voor te blijven?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, voeg Beveiligd zoeken toe aan mijn browser en verander mijn standaardzoekmachine in {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7048
Entropy (8bit):	5.612686248999138
Encrypted:	false
SSDEEP:	192:Cp4EhuYbEvbH2jQWjlykLbLJLA1keuRgR1kv6z+tU9k8ir+IQB1y0g8CmYrvBjyS:Cp4EhuYbEvbH4QWjlykbpA1keuRk1kvh
MD5:	B1A40A7AE497B0265460FB4E98A2FE12
SHA1:	F7290F61D39DC7E7F739104B34B22405F75A594E
SHA-256:	398771FE8E033E6FAF7B30EE9058620C059DFB9DF17B05A0413789C801446473
SHA-512:	D7BD9DF9046F069336C06A34D76CE06774D225760663C81C596B603F691EDAF984EE5AD0B16190DFD9CF4FF1F5E19739C48039968231DBD137FEA8CA694F7632
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Uwaga! Funkcja bezpiecznego wyszukiwania jest wy..czona.",.. SEARCH_TOAST_SUB_HEADING: "Funkcja bezpiecznego wyszukiwania eliminuje niebezpieczne witryny sieci Web z wynik.w wyszukiwania.",.. SEARCH_TOAST_BODY_TEXT: "Czy chcesz uprzedzi. zagro.enia dzi.ki dodatkowej ochronie wyszukiwania?",.. SEARCH_TOAST_OPTION: "Tak, w..cz funkcj. bezpiecznego wyszukiwania po ponownym uruchomieniu przegl.darki.",.. SEARCH_TOAST_DONE: "Gotowe",.. SEARCH_TOAST_HEADING_COMPLIANT: "Uwaga, nie masz funkcji Bezpieczne wyszukiwanie",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Funkcja bezpiecznego wyszukiwania eliminuje niebezpieczne witryny sieci Web z wynik.w wyszukiwania.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Chcesz doda. funkcj. bezpieczne wyszukiwanie do przegl.darki i uprzedzi. zagro.enia?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Tak, dodaj funkcj. bezpieczne wyszukiwanie do przegl.dark

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.759734064648731
Encrypted:	false
SSDEEP:	12:7Ha6F06FXOAdhcUbz4wpHyHK6IPHCkgeSV6YcQkpkT:7HrLFOAdiIppSq6IPL/kT
MD5:	96C10F5583829A447BB3E96EA07D968F
SHA1:	E39F4E6DC976E1A3F0DEC7F745631D86FBD41CBF
SHA-256:	C727D79117AD4A83AA17ED7CE0D0FB098A2A5039173EAC01C92B12AF6E7AC340
SHA-512:	4732230730BA4C992BF78A89DE394805F689E2BD3C6D9008B54C6C5A1663B0640064E89D3F8508CB9B0D1EAF9C607247571232D442B38440A508B26D407EA3BA
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Slu.ba Bezpe.n. hled.n. je vypnut. . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING: "Slu.ba Bezpe.n. hled.n. v.s ve v.sledc.ch hled.n. upozorn. na rizikov. str.nky. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Chcete zapnout roz...enou ochranu p.i hled.n., abyste byli v.dy o krok nap.ed p.ed hrozbami?",.. SEARCH_TOAST_OPTION: "Ano, chci po restartov.n. prohl..e.e zapnout slu.bu Bezpe.n. hled.n.",.. SEARCH_TOAST_DONE: "Hotovo"..}..//A67B35F2B26DB4024368C8CD7B01BAD188FAE65FD7A969FB79A1C1FD21D5D413202AED7D7792C32B727349316530A3F0EF55FEA81741C1C7161369650F0C3FCC++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.528553109151588
Encrypted:	false
SSDEEP:	12:7H0Qs8HQMHQs8f2aw5VL0bdhPLjWR8exneWDdrSFR:7Hfs49wsC2aw5t0bdhWR5xevb
MD5:	F45B2A9337A91045416B05E5D6350B46
SHA1:	FCAB82D965DB57E3DC4EE19367A2CF074E1F0BE1
SHA-256:	BB39146E680FCCA635E224B60FEAE67683F40D57381192F251CF6C47B4FFEE5B
SHA-512:	223A9B01A62862366250210B7A717BD193A5236D1A090BF305FDB3C7B3809182399087B8FB693371AC789FFB13E3423EEC463EEE4924B3834827DB72ED5D68F7
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Sikker s.gning er sl.et fra . v.r forsigtig",.. SEARCH_TOAST_SUB_HEADING: "Sikker s.gning markerer de potentielt farlige websteder i s.geresultaterne. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vil du have ekstra beskyttelse ved at g.re dine s.gninger mere sikre?",.. SEARCH_TOAST_OPTION: "Ja, aktiv.r sikker s.gning, n.r jeg har genstartet browseren",.. SEARCH_TOAST_DONE: "F.rdig"..}..//79C0E46E58CC66C13CEDB46A55B6984D90A6506EDE7815BD0C8137324A442CCEBC3DACD5137ECCA8B0EDDE57F528B433FD0D77ADEFE1EDDB09BEC3362BBDD6AB++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	626
Entropy (8bit):	5.464009302258339
Encrypted:	false
SSDEEP:	12:7HV5hKfCvXCQtROXlU1dhIQvQA3yDYBGNJXJWWqEQT5dssUi:7HfhKf+X08dbCYgOfQsb
MD5:	D6345C882D149C61851B0CC9254A0C6D
SHA1:	8C583127AEECB8E692AC251081D41B9FD894EC69
SHA-256:	ACB10C7741E32D3134F744D46BA646F886C0331AC8CD45573A263806A4BC4D58
SHA-512:	03715C9B20AB01C9DAFF6002A9A6CDA4D941A59E3A161609C166E82E6853EC9B384C27335D800BBF32F6E42346A5FC2471D37F018724A29FF351E779C0ED5296
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Achtung: Sichere Suche ist deaktiviert",.. SEARCH_TOAST_SUB_HEADING: "Mit der sicheren Suche werden Sie vor risikoreichen Websites in Ihren Suchergebnissen bewahrt. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Wollen Sie mit zus.tzlichem Suchschutz Bedrohungen immer einen Schritt voraus sein?",.. SEARCH_TOAST_OPTION: "Ja, ich m.chte die sichere Suche nach dem Neustart meines Browsers aktivieren.",.. SEARCH_TOAST_DONE: "Fertig"..}..//8F491A7EBD019BE34C090ECCA665EF6637FC1BAE3C2DC77277E79D884E31B6AD1839A15289E751EE418A25E25151F18369DD26C833102E40612FB2F984529173++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	966
Entropy (8bit):	5.127334372170101
Encrypted:	false
SSDEEP:	24:7HzMnpI0MXLr28dNWGmr3/TaMTyNu6XXnFsm:SS268drbn6nD
MD5:	0ED321CDB0CEC8856AEC74AA5E1FEC91
SHA1:	2EF8C72A3436F8EAE3F80E27806B56CE4ABE8A54
SHA-256:	36745001E81B54F25719152AC893A2B17A03479091841BCEE076EAF1C50FE280
SHA-512:	97BFE892DFD61CAF20AAAB9A35FD2568B7FB162D5DFE1BFAC6223C5B0E524EBEEF52442B63A7F286408DB2F4FD0E503985CE338DD27F147D7FB6E91E8C99CE2B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ". ....... ......... ..... ................, .. ..... ...........",.. SEARCH_TOAST_SUB_HEADING: ". ....... ......... ... ........... ... ........... .......... ... ............ ........... {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "...... .. ......... ..... ... .... ....... ... ... ....... .. ........ ......... ..........;",.. SEARCH_TOAST_OPTION: "..., .. ............. . ....... ......... .... ... ............ ... ............ ..........",.. SEARCH_TOAST_DONE: "....."..}..//CF32436F098F55C62807230BE7A1CBC65710B9B13A956B097B02239E8093F5538A7452B670D42201A706EAE060131AAB1C5166B8E39FDE25E0D701C4380B4A5A++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	546
Entropy (8bit):	5.458332413295379
Encrypted:	false
SSDEEP:	12:7H4HIWFH3npSuVJTsdhIEfRXK9m/NaU/Jn3LQUn/cB:7H4NXpSuVJTsdjfRXKIVaa3LBnkB
MD5:	C2D05034862C9871517F84152A7F5330
SHA1:	E0F8A21A16C75AA553A73584DCDCA1F81E588693
SHA-256:	321B867FC2A7F6A00AC40CAD169F9A7F94FD406D96AC831A37F9C06F169FD03D
SHA-512:	B674C4B05B5B25A791D2BFF73D03319F31FBFC3A07FADEDCFB92E3185928272A0B556E8AE68412E244D9B228F1F2D28CC298C4BB1B98F2B590A521F54F46B86E
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Secure Search is off . be careful",.. SEARCH_TOAST_SUB_HEADING: "Secure Search steers you away from risky sites in your search results. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Want to stay ahead of threats with extra search protection?",.. SEARCH_TOAST_OPTION: "Yes, turn on Secure Search after I restart my browser",.. SEARCH_TOAST_DONE: "Done"..}..//C9328EE2150B67F88305A6862B55E026CB65AC4BEA332C60A1B617A13E1FAFA298938190D194768073FA72300DD97E8A74E59F41FC5EB1CF448ABBA9770A4955++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.528783007466517
Encrypted:	false
SSDEEP:	12:7H1b6YjvHDkYdhDOnKjHZ/QC5MHYRTh49KjGrdymOn:7HRHDkYdQneZ/7kYRTcd0
MD5:	48E70D7A83790773C63E80264EF31E3D
SHA1:	8FAD710F8BE20796166724E85FB96B8AD32CF77C
SHA-256:	9FE36B7274ABD6EBA1B6AEC5D9F60364DDE0D0844A552ED9C80540CA91369DB4
SHA-512:	84955E334A9C5FF7437F0BEB646C1DFEB8E8401230922185691620A674F5E4249BF889279F29CF5794FF1CF621FD70ED5867143A09D60EDDADD6F15F75A35DBD
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "B.squeda segura est. desactivada: tenga cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura filtra los sitios web peligrosos en los resultados de sus b.squedas. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".Quiere ir un paso por delante de las amenazas con una protecci.n extra en sus b.squedas?",.. SEARCH_TOAST_OPTION: "S., activar B.squeda segura despu.s de reiniciar mi navegador",.. SEARCH_TOAST_DONE: "Listo"..}..//03A642FC7B59D633E9BE3DDB8BDF938E4BB503D4481D7268F4832973EAF95DE60A6FB301D0EBB4EB78952AE76E0C8693DF8E9FE50FBC5873D31CEC34E9D29082++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	590
Entropy (8bit):	5.535321065860119
Encrypted:	false
SSDEEP:	12:7Heaf6Yrsi5KD/DdhDybH62P5MHrS2Rp7+QtEgrQ:7HdLsiUDLd0rXPkm2Rp715Q
MD5:	83B78B5CD297CCF82258541523FE345D
SHA1:	1352868394212BF4E80BDFB438D8766C1F40C7E5
SHA-256:	8559EA10FA19A22FB43206B904833CB546A5E0DC86F7EE942A4B66A80D75995C
SHA-512:	9B9C369EDFC547C446BF9E6572E79D2B3D45930E46F84E07AE303CF386CED6E4F2207C848FE7CA1E53CDF8DF9571CE6F18299BB1556CCB35316E25D844FD06F0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "B.squeda segura desactivada: tenga cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura lo aleja de sitios peligrosos en los resultados de b.squeda. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".Quieres adelantarte a las amenazas con protecci.n de b.squeda extra?",.. SEARCH_TOAST_OPTION: "S., activar B.squeda segura despu.s de que reinicie mi navegador",.. SEARCH_TOAST_DONE: "Listo"..}..//25FF67F05FA5C8A1C28E4354601BB0198A4E5741526A75B1D569FFB12BE728A1DB2E0A2338DDDADA65E59777FE2BEDA67A3DAE82381CBB697B140F4BD29E1DBC++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	594
Entropy (8bit):	5.548077592397297
Encrypted:	false
SSDEEP:	12:7HpBjkIHMjpJNnddhFyXLcE6P8ljSy3FJHzWaZHVKkLo:7HpBBHsNnddeXInP8lmSFcaukU
MD5:	B65B794FA9A8E72C03752E8EF327D569
SHA1:	EDAB12FA0FE5ED67B3E235FF433900AED00F8386
SHA-256:	924AB949B89817C7C1A1647D569D9C3E53FE6AEB694A3B0E2D02AEF94A9CB673
SHA-512:	EAA40B46F5770EB91FAE225026B772BE429A4F2C3BF89C735A35B3D500250CFCE77FCEE0249EFE06BD5B48B4075A4E9EED06A1103C4A510D695C5A6B4E73D432
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Varoitus: suojattu haku ei ole k.yt.ss.",.. SEARCH_TOAST_SUB_HEADING: "Suojattu haku suojaa sinua vaarallisilta verkkosivustoilta, kun suoritat hakuja. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Haluatko pysy. askeleen edell. ja hankkia lis.suojaa hakuihisi?",.. SEARCH_TOAST_OPTION: "Kyll.. Ota suojattu haku k.ytt..n, kun k.ynnist.n selaimen uudelleen.",.. SEARCH_TOAST_DONE: "Valmis"..}..//014B317A1CB6ED982FF08B913CF9AAF3236AE2960D026BEC8711520249A34723B7171A06170D1DD826D45A2C3FF0EE061030B3B905C73F72A1C2B0D9E6541021++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	619
Entropy (8bit):	5.431597566455389
Encrypted:	false
SSDEEP:	12:7He5LuGrtBdhLjwQ8SlK3woEEn6RUfxXaLxbdq0Lp6h:7He5LustBd5wwlK3/EaVfx+b3pU
MD5:	C90B482F0B4077AC7AF5CB784273FB00
SHA1:	FCC744964DC259D95944DD49310697602F3623AB
SHA-256:	9A534E3D3F10D734771E5C88356F41162E752138BF4EC451BFC611D8E5ADF969
SHA-512:	E47B121803CE6AF73AC7D7FD001684FD7EBA4721530095EF9EA943D2DAA02C2DBB7D66E9E3383D9078A409B81400CF659D8B4613104D85C600B4F51838DD14C0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Attention! Recherche s.curis.e est d.sactiv.e",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e .carte de votre recherche les sites internet risqu.s. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vous aimeriez garder les menaces . distance avec une s.curit. de recherche accrue?",.. SEARCH_TOAST_OPTION: "Oui, activer la recherche s.curis.e quand je relancerai mon navigateur",.. SEARCH_TOAST_DONE: "Termin."..}..//56258EC1905CCC73CA2F61D78B0CF086735236201D9BFA1A106BAA1988121D72F15957244ACF4D53A0EA36A9A7B9B6925C00712CD3849F1770AF2AD8A55C8CE1++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.4965558895011535
Encrypted:	false
SSDEEP:	12:7HQ7vJmt/5Tdh0tTdQzFOQ8S4NKXzpvxdD8CbY/pQQn:7HQ7vJmtJdWtTOpKNKX9Jd4Cb+QQn
MD5:	97F083C203123A656540ECF6F9485854
SHA1:	408E19C5C0DA671348F7EDABAF0D618C7387EBF7
SHA-256:	3DBD4F3C9C0F0FC2F0054AE74E9B96FD859A2B64BAF381F2438795ACC0EC9951
SHA-512:	652E65C3C5EFEA0839D35FFBFC70C631D81FEA3CAD3E42EEE04061304CF53654ED353C622AF8E12FEA4E0E7E640B965A8BE931938B17BD68473AB11D2686C2BE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "La recherche s.curis.e est d.sactiv.e. Soyez prudent.",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e .carte les sites dangereux dans vos r.sultats de recherche. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vous souhaitez garder une longueur d'avance sur les menaces avec une protection de recherche .volu.e.?",.. SEARCH_TOAST_OPTION: "Oui, activer la Recherche s.curis.e apr.s le red.marage du navigateur",.. SEARCH_TOAST_DONE: "Termin."..}..//E1748E5B424EFCA08783DAA99176588B8632DE4892B71C4620347F51435642839948634703857977A42C3D9D64ED909C04BE25897176D28D5B2235F8AC5B31F8++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	642
Entropy (8bit):	5.559514823273629
Encrypted:	false
SSDEEP:	12:7HA+vZMuIg9s7sdhXNrY+Au1HQu8TPnATP6sgk6dun:7Hb2g2sdrkiQuI8jqun
MD5:	D78AE84604173E2A6873EEBB646D8452
SHA1:	8EC58AEFFD3485AA04BF0F082CABC559951A838B
SHA-256:	2EF2C578081A21C85D52B2EB54186F894FAF412E9DF55F947B7B589F61B09E09
SHA-512:	F8E4BE42B499D419B89E52AC72E7E196239B4DE5CCA6439CFB7F90F7B80BADCD74452757C6B0A0B5FFAFF6B1FEA54CDF96EE3D05EAAB4381DFB046E56E3E5BCB
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Isklju.eno je Sigurno pretra.ivanje - budite pa.ljivi",.. SEARCH_TOAST_SUB_HEADING: "Sigurno pretra.ivanje dr.at .e opasne stranice podalje od va.ih rezultata pretra.ivanja. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".elite ostati nekoliko koraka ispred prijetnji s dodatnom za.titom pri pretra.ivanju?",.. SEARCH_TOAST_OPTION: "Da, uklju.i Sigurno pretra.ivanje nakon .to ponovno pokrenem preglednik",.. SEARCH_TOAST_DONE: "Gotovo"..}..//E4A510DB2139763FD242A28C2B52CDD08F5882F354E8DEDED2DC1BE3EB7F98C6D52E89D242B10112AAE6BE8A9C09DAC2866C2DD2E19D3F835011302B8E81FB9A++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	703
Entropy (8bit):	5.673203190107354
Encrypted:	false
SSDEEP:	12:7HeBdauIvxgWeBdiituB7XcdhM2Frd0XR0WMruMYNSIt5d9XUL126R9zEDeE5m2Z:7HeBdauK0Bd5olXcdyiry1MSFNSEd6Li
MD5:	FC1396F48460677D3BFA12F47B9C5B5D
SHA1:	A9DAEDC2E00118814AD40C84C5FA5D9003870CAA
SHA-256:	094139B3BEB6497A466547798AB77B35E79764B13C86D24B8AA1DBA44BC2D28B
SHA-512:	0DDC73F36CC307CAD92419EFE68A2D79855DCF06D7ABCB0FBEB9F0527E1BCCB2BECDF57F505903E758C6907F9CD2761F040ABC45CF4DDC951A00876358DF5040
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "A biztons.gos keres.s ki van kapcsolva. Legyen .vatos!",.. SEARCH_TOAST_SUB_HEADING: "A biztons.gos keres.s funkci.val elker.lheti a keres.si eredm.nyek k.z.tt tal.lhat. vesz.lyes webhelyeket. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Szeretne egy l.p.ssel a fenyeget.sek el.tt j.rni az extra keres.si v.delemnek k.sz.nhet.en?",.. SEARCH_TOAST_OPTION: "Igen, legyen bekapcsolva a biztons.gos keres.s funkci., miut.n .jraind.tottam a b.ng.sz.t",.. SEARCH_TOAST_DONE: "K.sz"..}..//540C762B7A42C84A2AB8D07031EEA3C1202769514985094032187AEB16AE002C1258BA57D1E95D8F4CDA663D949D3AB6917C9432049A1CBA03993E8A797584C5++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.432215594838549
Encrypted:	false
SSDEEP:	6:qsXHYKsW+x+2uvch4pilrtAfaJMdFEhKDP+ku1xvVyvCxNA+EfHOXORkHQgUprCU:7HtDdilrtAfzdhDK1+aYfHKHQgtrM2ON
MD5:	5E716FBF9E4CDEBEE3147A7351E1161F
SHA1:	4BDCE44894C785C8AFBD85ED122CBA78B4049B7D
SHA-256:	8A42D0B8DFF1F6A2292DC4EB65F5AAA864B891A0F6EACA8F6322002D59C99630
SHA-512:	51E06762FDBB0B91A024437BF9DF5DBA1EFB8DEE29D8510F9C3DFAE1CE7774E8D5F965E091EE6B3B696907D29F4BA9D18D59F628010FE3C0713DE2560315CEE7
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Attenzione: la funzionalit. di ricerca sicura non . attiva",.. SEARCH_TOAST_SUB_HEADING: "La ricerca sicura ti indica i siti rischiosi nei risultati della ricerca. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vuoi tenere alla larga le minacce con una maggiore protezione delle ricerche?",.. SEARCH_TOAST_OPTION: "S., attiva la ricerca sicura al riavvio del browser",.. SEARCH_TOAST_DONE: "Fine"..}..//5CF95A5F6424E8ED4D8DE7BF1CB016373EB9B3D19F68BA3409A5CA9C7DC2A19658C256F1A376A0E3794602DD49C570A3A5E437BD2DE48507118012649464A992++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	640
Entropy (8bit):	5.9649428270061176
Encrypted:	false
SSDEEP:	12:7HUWisRqhWYcXYDkNWdhx8HWER9QilSh5RWmxISFvZ/J+A01J:7HUTOqvngUdcHbLZIrv/J+Nz
MD5:	285E55D2C5FF9AD95BB3C751D2256EE5
SHA1:	2924217BB1C762CB1CA66BFC8FE9674F8F9E3256
SHA-256:	CE3D7A3AE8587E65EC1784A4A1D3B97496736FF8524F910F06F2857834EE7D1E
SHA-512:	AB6195975A9E4152C2194EA9CF68C426532CD6471B6CDBD82EEEB6FCF2F0E4FF1B683C2C6F983699D0F6027116F12D3BCC17D4A1252B79F934F1A3B79E3B96B3
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".... .................",.. SEARCH_TOAST_SUB_HEADING: ".... ........................ {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".........................",.. SEARCH_TOAST_OPTION: ".................. ..........",.. SEARCH_TOAST_DONE: ".."..}..//6ED793660C2471A6824D051E83BC460B6FCEFE5185B3C34FBFCD824BA66C43159036E50B1AE04DAEA320D48B24077EFF01B7C38DE2D629112E5C4F85D6DD7079++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	610
Entropy (8bit):	5.957248011283335
Encrypted:	false
SSDEEP:	12:7HRgq8EDFj2FcdhkbQ2sIm8kAT8ryds4lDxlD/:7HvhEcd2BsIm8kg8+dllH
MD5:	54F5AB8BFD7C7BB482E83449537069D9
SHA1:	311C294315FCB274C05F12B22C4364CCEFC66D85
SHA-256:	F4DC897661F86BE3C7FA579A5F9595953A17E2FBC822178CD41BD36060BFC041
SHA-512:	BA60E63D0B2096C8B1B7CA63CE96C647A0561706FCDF3989AD77A639821EC169024FEB2944FA9F0FB65057B71CFD2651E606DDF74526F0056F08D1652E5285FF
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".. .. ... - ......",.. SEARCH_TOAST_SUB_HEADING: ".. ... .. .. . ... .... ...... {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".. .. .. ... .... ... ........?",.. SEARCH_TOAST_OPTION: ".. . ..... .. ... . .. ... .......",.. SEARCH_TOAST_DONE: ".."..}..//DC2C9A2DA98ACBE2776458332A8F303ECD2AD85277D1FB4AB38521861D7A3B846A332E3E7ACE14673CB022FBCE6D009ECC95545D8E44D1298B8D3DECB60C3028++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	571
Entropy (8bit):	5.566707916928538
Encrypted:	false
SSDEEP:	12:7H0QhMHQjBUW4J9wdhPtkwxWsNWvIdraAMwnBJ:7HfhMwjIwdhywQsIvDdIBJ
MD5:	6D0E869A4BF80C04C6EBB6570CAE7ABB
SHA1:	670F5552F2E4DB417BA771A73B68CC4D27436FA7
SHA-256:	199E10AA7480DF07CD059A624069BF7A5CB09BC6621D77187B33B4E86FEEC675
SHA-512:	4CDB125946A64F5B1EAD0960A0A0116757DA938DBC4165FC6A98ED168DFF1DDC8526EC6EEBD8AA623C46546FA6F97D994D511F37CC4A3032B367B5FF86851311
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Sikkert s.k er sl.tt av . v.r forsiktig",.. SEARCH_TOAST_SUB_HEADING: "Sikkert s.k holder deg unna risikable omr.der i s.keresultatene. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vil du ha et forsprang p. trusler med ekstra s.kebeskyttelse?",.. SEARCH_TOAST_OPTION: "Ja, sl. p. Sikkert s.k n.r jeg starter nettleseren p. nytt",.. SEARCH_TOAST_DONE: "Fullf.rt"..}..//E087744E80A27E07D6D069B118EACF249AB713EB86E6C00859CC8C4C698B476A31FA587D9142055CFD9B37416B1D4D000D60E04C6090A489964409F3C69BBEDC++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	602
Entropy (8bit):	5.5176277924834345
Encrypted:	false
SSDEEP:	12:7H7AySxXeOzOqodhIMLfcPkQkfM7HmrZzpR4z:7HzSxOBqodrLfccQk8eoz
MD5:	EA196FF8327924C3FC9DA8D32558F489
SHA1:	31809CE5AAF94FE5BB7917DDCFFBFD7F5A4122EA
SHA-256:	14B0DA7941BE511010F14B64E149367462C7720182E28B3EB5949925042303D7
SHA-512:	41BBB6E5C86258843095F8116479511B3FFEED893DB75B60F0FDF9CA874F8B34C947572F7C5B134C9995BEF6CE5752AC73CD97B7912A10E85E36862236E4065C
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Beveiligd zoeken is uitgeschakeld. Wees voorzichtig.",.. SEARCH_TOAST_SUB_HEADING: "Met Beveiligd zoeken kunt u de riskante sites in uw zoekresultaten vermijden. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Wilt u bedreigingen een stap voor blijven met extra zoekbeveiliging?",.. SEARCH_TOAST_OPTION: "Ja, schakel Beveiligd zoeken in nadat ik mijn browser opnieuw heb gestart.",.. SEARCH_TOAST_DONE: "Gereed"..}..//97E9CC6D89E07DAD4C6A7AC4E5A09E944212FA7BCB511C8D4D8B04D4033A0577CB9406699991DFA1A8953DE99049C7FDC6656137BFBCA12DC88B764DE6F3C5A5++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.697089942945035
Encrypted:	false
SSDEEP:	12:7HRmi53Lw8i53LE6PU3LOdhc1FKb3LCoPY3LcBbdsmQxfhcYKI:7HRZFuFIfSdi+jeoPMibdHQxpcY
MD5:	8BEB2821942FC802A30210EDA5821635
SHA1:	01624440F3D1B5D09EB24ADC10C41642C1D61F50
SHA-256:	44F1E2D8F8D8E23E5F05DA229C10A4CBFCEA3CEEB5D4EE88AC080DCD99D32671
SHA-512:	EFC74C81D3D0886EE031F4818F13D5539A5AB3DECCD81750136B41F4495036638E2A452717A8F63ACD20BD10B3B3DE682209B1D0B19517244BAF39606F977968
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Uwaga! Funkcja bezpiecznego wyszukiwania jest wy..czona.",.. SEARCH_TOAST_SUB_HEADING: "Funkcja bezpiecznego wyszukiwania eliminuje niebezpieczne witryny sieci Web z wynik.w wyszukiwania. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Czy chcesz uprzedzi. zagro.enia dzi.ki dodatkowej ochronie wyszukiwania?",.. SEARCH_TOAST_OPTION: "Tak, w..cz funkcj. bezpiecznego wyszukiwania po ponownym uruchomieniu przegl.darki",.. SEARCH_TOAST_DONE: "Gotowe"..}..//2998610CC867995E520DB76E34E2634C9F8302D3F5CD4E0039ED1756247B24757B93804388576ABDE0EB5BCAD77C8A2EE48AB99EB2A9F161D4DCDD4089A56201++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	572
Entropy (8bit):	5.528682758278599
Encrypted:	false
SSDEEP:	12:7HcwalVTVGGWF/CdhEVMBoPcw7pVl9jR+aRVnO4ShvhyWgjn:7Hu6F/CdGVMBoPcwXlrmhIL
MD5:	F67A261A4C267C9C8DD6974FEBA623A1
SHA1:	3DB6C7620F8D553D7D5968895A486D3F1FAF8E6A
SHA-256:	B4D7BA7191BDBA4CCEC8018022BE8981846A12E752A3734B5C60B56B2B1D3599
SHA-512:	6E9BFCCEA10EC2457149023E504CD09A2B16D7C289B4EBC579DA02046370F75D56C1034198B57B38F5234C376993F3D1CE75748BE544B65C23BD86511D2CF59B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "A Pesquisa segura est. desativada - tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A Pesquisa segura evita os sites perigosos nos resultados da pesquisa. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Quer ficar longe das amea.as com prote..o extra?",.. SEARCH_TOAST_OPTION: "Sim, ative a Pesquisa segura depois que o navegador for reiniciado",.. SEARCH_TOAST_DONE: "Conclu.do"..}..//2F43E1F35708238590D85D196224DF0671DB3EA33BEB7F05EA60862CC4B1A3172C7DD9C0DC9808F7173F0733AED9082582691385C83E43483D196E94CF126F7B++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	597
Entropy (8bit):	5.524548049127313
Encrypted:	false
SSDEEP:	12:7HcQyVTuEcc3WhZ2dhvGUO9N7tOsKVDVJU5nUbq0R:7HNlhZ2dRGUcNgsOpC6bJ
MD5:	F82E4B1FF2966B79141CEE9808F59DE9
SHA1:	181358EA659AA6CF391E251093E66F99EE1B5ECC
SHA-256:	F06BD0396F48DCB09E4A57D3537A130C6EB767DC41CD5259967E3475DA38355F
SHA-512:	7BE6B9180D9D7DE5F1760263024F86E1F249F2876825A63E278ECD791D551926D83297BF22C81CB33237DF601BE227AFA557F7EEBC29D5623B6BF7317A59B84B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "A Pesquisa Segura est. desativada . tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A Pesquisa segura ajuda-o a evitar sites perigosos nos seus resultados de pesquisa. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Pretende evitar as amea.as com a prote..o de pesquisa adicional?",.. SEARCH_TOAST_OPTION: "Sim, ativar a Pesquisa segura ap.s reiniciar o meu browser.",.. SEARCH_TOAST_DONE: "Conclu.do"..}..//A047EAEC180DCF812292589C152C019AD8FDE870DB3FFD4D1F00F0EC91D5BFC24C761A087333BB9EF54B5B8B841A68A33876E7BF3BD2072722773C37E60351E5++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	837
Entropy (8bit):	5.2617125055461385
Encrypted:	false
SSDEEP:	24:7HYytHN6yt20qJNs2OSo7dL2IlIX2tCFe82W3oYUF7O:8yNN6yJqjbOS6LiX2A+Lp6
MD5:	3BF03E64BD9B64C5579E087FF97A538B
SHA1:	DCB3A05D2C25F195CF771DA10E354B97CBD59E76
SHA-256:	D1A37B62C37A001069DD4EE53FF772EDA0EC8EF483A1C9CB832B3BC75870370F
SHA-512:	0D6D6914203AB184510D9984ADE7B52E1EF836430519F66E5A8A3552897CE8F3A9B3BB7E1250C8CD95CD2E28D38F9F2E9AD1E3102E04B6E6489CD27712D6ECE0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".......... ..... ......... ...... .........!",.. SEARCH_TOAST_SUB_HEADING: ".......... ..... .. ........ ... ........ .............. ....., .............. . ........... ....... {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "...... .......... .. ..... ... ...... .............. ...... ......?",.. SEARCH_TOAST_OPTION: ".., ........ .......... ..... ..... ........... .........",.. SEARCH_TOAST_DONE: "......"..}..//C6560BE9D78F96E058E6E05B89C845EC789D6212FC8DD4CB48E75145513D5C172626AF3EF7EA9661CBB807DA8D0EA7F2131EFB95AAF07B54E49940B82BDB182A++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	649
Entropy (8bit):	5.779174545626526
Encrypted:	false
SSDEEP:	12:7HLxCHLIOdhcUdOVzpG4Br0r2afSMN7lJh:7H9C0OdiSOVzpG4BAr1qMfJh
MD5:	4F566D17AB183F3DB6C497DA8CDD7CC1
SHA1:	4C73D4A57FA4F5A8FB490527196A0E0C290DF401
SHA-256:	095AD3C3F146248F1E943E724FCDC6A4030C615EE0F45208548D12E8DEE4F2DF
SHA-512:	906AF77DD38F0C7E779D1AB52B33DC10878ECB46E17FC99841D4592651DB2EE996C86CFE17E89403B5A448599B3929D28E183F28711DD70D280265C7673BC99F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Zabezpe.en. vyh.ad.vanie je vypnut. . d.vajte si pozor",.. SEARCH_TOAST_SUB_HEADING: "Zabezpe.en. vyh.ad.vanie v.s chr.ni pred nebezpe.n.mi lokalitami vo v.sledkoch vyh.ad.vania. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Chcete ma. n.skok pred .to.n.kmi v.aka zv..enej ochrane pri vyh.ad.van.?",.. SEARCH_TOAST_OPTION: ".no, zabezpe.en. vyh.ad.vanie zapn.. po re.tarte prehliada.a.",.. SEARCH_TOAST_DONE: "Hotovo"..}..//EF66BEE059BDC1DB7A3CAB583FE3B4C3A0271C9605448C773D9B7DC79A7DA1CE2950604E783548DA7E2C9BFAC30C895B97D528E28F6F66BFB6130DA0CB2A7671++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	605
Entropy (8bit):	5.612429548791973
Encrypted:	false
SSDEEP:	12:7H3ORkfi2TAdhX3UbQytlQuhUHF/K65J7h:7H38kfwdqvQuhUHFX5
MD5:	F8303893A9813AF0365CEAA62AAF84D6
SHA1:	92DB10274E7173E4340D79AE49203E4DA15457E0
SHA-256:	83F2A7D1FF466EA1C15CDECB9AC5DA1C4F78BC4DD7A147BFFB4E35772802AAAD
SHA-512:	33A7B675592604FF2F81A39291296D13B22F72021FD39145CFFE440D9B95C6736E2D5220318749A84A84C9DF99C71566442932D7551627658A7A9718EC8C43B0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Bezbedna pretraga je isklju.ena . budite pa.ljivi",.. SEARCH_TOAST_SUB_HEADING: "Bezbedna pretraga vas .titi od rizi.nih lokacija u rezultatima pretrage. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".elite da budete u prednosti u odnosu na pretnje uz dodatnu za.titu pretrage?",.. SEARCH_TOAST_OPTION: "Da, uklju.i bezbednu pretragu nakon .to ponovo pokrenem pregleda.",.. SEARCH_TOAST_DONE: "Gotovo"..}..//9C767C13579F4E41DCD8AAD10354163256025D4A9965F9ECFCDEED03A4D2AC4181956EB0BB80BA222F2CEB79AF6E932DF013092F5B7506D72940937EBB264C50++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	574
Entropy (8bit):	5.656193529966936
Encrypted:	false
SSDEEP:	12:7Hmg2AbjgZyDzL0HD4WkdhPN4McUQ4N94ij8rcaiMaR4k:7H7DbEgLLdVWMHN94i1zMaGk
MD5:	ABB3570408090273D58C16C7F0C37D04
SHA1:	393ED1E745BF4E7CBFD43FA441942C35BF88C784
SHA-256:	851ED7CEC35E54546D2E7DCB2C1C1BA280DFBB574169413200B3D8DC34515F1D
SHA-512:	CC8EBA97042FF47A27D64030799446DBBEBF21F673B4194A8F1860AE6DFE67A0C36B8355DC7E8FB712B7FACF4F1714195F97D864F3CF87165717C8E83C68F7F5
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "S.ker s.kning .r avst.ngd . var f.rsiktig",.. SEARCH_TOAST_SUB_HEADING: "S.ker s.kning h.ller dig borta fr.n riskabla webbplatser i s.kresultaten. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vill du vara steget f.re hoten med extra s.kskydd?",.. SEARCH_TOAST_OPTION: "Ja, aktivera s.ker s.kning n.r jag har startat om webbl.saren.",.. SEARCH_TOAST_DONE: "Klart"..}..//BFBBBD136797651813E4C430C2217150E46D175F8975DFB1B4F535C5D7DF17C6A4A23A5AFB071CAE81F61657A5BFEA79B9906888B0218E3EE59042D7D281685F++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.606762960214377
Encrypted:	false
SSDEEP:	12:7H0i4Hb00hCdh29T1pGQMlwrX96UOZ+kqTR9Tcb4RGCkg3:7Hl4phCdA6VlwLM+kaFG9g
MD5:	A65E712C257DEE8A4DD5C0EF6864D31D
SHA1:	F9D138FBFCD39A8355C5A60DD50079CF76F39DE0
SHA-256:	04EF1F102ED7974F4A2EF0247CF88EAD521DFDF3F3BB689E407595D0C702D738
SHA-512:	0498E715C337DA177B9DF4AC6906BD778F0F275BB312C34F9E1A890E8E56D4E1FD753A2FCADB2C9EBD438F783D4EA32ACD865241955D8CD7A30838168FFB7DC1
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "G.venli Arama kapal., dikkatli olun",.. SEARCH_TOAST_SUB_HEADING: "G.venli Arama, sizi arama sonu.lar.n.zdaki riskli sitelerden uzak tutar. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Ek arama korumas. ile tehditlerin bir ad.m .n.nde olmak ister misiniz?",.. SEARCH_TOAST_OPTION: "Evet, taray.c.m. yeniden ba.latt.ktan sonra G.venli Arama'y. a..",.. SEARCH_TOAST_DONE: "Bitti"..}..//D589DDEEB55F9559E239A9ED134F9096E8FEEC57684ECFDA784F957625B2480CF5E0C9BFB82A81BE7239A848E89EA690EC4B7C98943C1C3290FB0848E01E15F0++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	547
Entropy (8bit):	6.228975522871746
Encrypted:	false
SSDEEP:	12:7HshRETCqdh2fDviKYE4aCeynRbWOSmKUd33g:7HshVqd8rviKYEzP0lp33w
MD5:	CBCED1858B943CD6B0EA3B816BCD2AC2
SHA1:	DEC0F008AA5B588FB35FB41BC2D7C2220BF27D4C
SHA-256:	B503A1BDB90D6255FF7A89939DE37D84397DADF7B52A5E9D40E249268C8E0F67
SHA-512:	9BE508CAAC1078552882F4221774BA0F39D331FB34B359128B0D321077B19348CA0DF9D22E358AE45E6EBE48A7E1E076E2BF7AC6220C2AEA8A2926C4EA5A7C9A
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "....... . .....",.. SEARCH_TOAST_SUB_HEADING: "...................... {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".....................?",.. SEARCH_TOAST_OPTION: "...............",.. SEARCH_TOAST_DONE: ".."..}..//316AE60E0488780F042FC4309E60B287030A1A0209F6585F0348E0031AEED4AA31F0F3BB33262333921F6E22929BF3EF4DDC6B1BD0867593AFFC1F8D988FAFB7++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	555
Entropy (8bit):	6.210202655573197
Encrypted:	false
SSDEEP:	12:7HamgrADLhZINcBjdhVfDaCBasqeDIYeONqgU46GbVgh2Ks:7Ha/cDtZINSdfrtarphWqgUPGx3Ks
MD5:	69BA8E176C989CF63F5868EFC6D60583
SHA1:	760A2B2A1AFB9A787EA594963EFBB6EF463015BB
SHA-256:	7BC8902B73397E412E6B48157E452F2FE9359FB9ED3CD75988DE7450E9A6D262
SHA-512:	A2E6B4C3581E72649E9D85202907BB02A618B32D0FB5CEA1DE95BA635B4B6D3101E9297BB715D8903656C48165737B48851E9A78CA917F4827F11FA31ED0A4B1
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "....... - ...",.. SEARCH_TOAST_SUB_HEADING: "........................{0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "......................",.. SEARCH_TOAST_OPTION: "..................",.. SEARCH_TOAST_DONE: ".."..}..//F2BE7A879948665A8E01EAF50BDE423B2C9C0C2155BE544D3E12B8E54845406A4383CFA4D27EFA8FE29C840AB190939228DAD1D6D1307F7234B103B3F4482F97++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6977
Entropy (8bit):	5.347951072814867
Encrypted:	false
SSDEEP:	96:CGsKDNR4J7qXQBLHEtvJd89CuvJd29Fx7sXYld4+e:CoDNR4x+tvJd89CuvJdMDwXcd4+e
MD5:	33C136FEDB051E72CC1E0F341E20C83A
SHA1:	4048CC5C378E1BD19BCC70F3FB3FDD3A72BF16D4
SHA-256:	B50F2AE22798F6A2FCFBA0C663DAEFB1000C42E0E9DA3BB103A0DC24316381CF
SHA-512:	4B512436C4E1B07E45B8B31A238D397E47A2A0C17F68E4803898AB008D5AC58AD0A12D1EBCC3FD0743FAF69D3D05022B5D80C0D369647F7F47B592810EBE5B3E
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "A pesquisa segura est. desativada - tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A pesquisa segura evita os sites perigosos nos resultados da pesquisa.",.. SEARCH_TOAST_BODY_TEXT: "Quer ficar longe de pessoas mal-intencionadas com prote..o de pesquisa extra?",.. SEARCH_TOAST_OPTION: "Sim, ative a pesquisa segura depois que o navegador for reiniciado.",.. SEARCH_TOAST_DONE: "Conclu.do",.. SEARCH_TOAST_HEADING_COMPLIANT: "A pesquisa segura n.o est. ativada - tenha cuidado",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "A pesquisa segura evita os sites perigosos nos resultados da pesquisa.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Gostaria de adicionar a pesquisa segura e se antecipar aos criminosos?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Sim, adicionar a pesquisa segura ao meu navegador e alterar minha pesquisa padr.o para {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",.. SE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7070
Entropy (8bit):	5.355743915783795
Encrypted:	false
SSDEEP:	192:Chka9ILBeycgfmtmud0l9zEYmud0lkVHed0g57c2:ChknLBeycgmtm5PmqHypc2
MD5:	0AE21E93E4644B94CB8DBFCE43CFE098
SHA1:	70C1125A119ACF2FE8DD547D1101E2AED81DF488
SHA-256:	255AB312FBA977F99D15C206B957429911382FE0649B5EEA7AD8B8C6201385B6
SHA-512:	9346A3D53DF0B9AE370C1F481EF833AED8BF9C36E5C862695A492E1001D23624E5CC330AE151E2FE78E6E8F12E87865FED9686209DD95AD06BA5A2340DD17031
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "A pesquisa segura est. desativada . tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A pesquisa segura ajuda-o a evitar os sites perigosos nos seus resultados de pesquisa.",.. SEARCH_TOAST_BODY_TEXT: "Pretende evitar os utilizadores mal intencionados com a prote..o de pesquisa adicional?",.. SEARCH_TOAST_OPTION: "Sim, ativar a pesquisa segura ap.s reiniciar o meu browser.",.. SEARCH_TOAST_DONE: "Conclu.do",.. SEARCH_TOAST_HEADING_COMPLIANT: "N.o tem a pesquisa segura, tenha cuidado",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "A pesquisa segura ajuda-o a evitar os sites perigosos nos seus resultados de pesquisa.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Pretende adicionar a pesquisa segura e antecipar-se aos malfeitores?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Sim, adicionar a pesquisa segura ao meu browser e alterar a minha pesquisa predefinida para {0}.", // {0} SEARCH_TOAST_*.. SEARC

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10279
Entropy (8bit):	5.118506357193327
Encrypted:	false
SSDEEP:	192:CDxFR6OsBNVZPV/y/Vm1R1ut52Gu5U0DLTDGga:CDxFR9I1yI1R1utQGuV5a
MD5:	6CD0D44F69035CBB670938380BF2605B
SHA1:	31DEC9449977978233851AE1BDB0B1C4E46EFACE
SHA-256:	F0EE32305174CF76CA70D872EA7D37D8E629A22DBB8D76331141D3ED33C4E1E8
SHA-512:	C578E204BFCBED9E12959612FFB4AEC6966A09B8DA371331722929EFF5A2261396160F76C393BD670037BF797AE8DDB7CBA2715FAA0737E81E93ED1BE5FF2566
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".......... ..... ......... ...... .........!",.. SEARCH_TOAST_SUB_HEADING: ".......... ..... .. ........ ... ........ .............. ....., .............. . ........... .......",.. SEARCH_TOAST_BODY_TEXT: "...... .......... .. ............... ... ...... .............. ...... ......?",.. SEARCH_TOAST_OPTION: ".., ........ .......... ..... ..... ........... .........",.. SEARCH_TOAST_DONE: "......",.. SEARCH_TOAST_HEADING_COMPLIANT: "...... ........., .. ... .. ........... .......... .....",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: ".......... ..... .. ........ ... ..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7406
Entropy (8bit):	5.695401371316783
Encrypted:	false
SSDEEP:	192:CgGE6x3pVIczmqoU5t9gga9BC9ge4rShI+:CgGE6vH6XU5t9gga9BC9grSO+
MD5:	41BAE1971FAA8CD5A9EF1905BC67EEF1
SHA1:	9038C11A30AD4B4A188BF2CC5E73AECD6B237340
SHA-256:	AED1ECCA31434ACEB8155D48AD0563AB42ABDBDBC687226CA4381F85D125E7AF
SHA-512:	A619F88F233ACE020373E3568FDA6FF37F19647344850CC7FEFE0FF0ABC84A03B3A1E9D8DA68437EC4391C85705503A40FE10AB7CA9CA5AEB0002BFEA9465EFF
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Zabezpe.en. vyh.ad.vanie je vypnut. . d.vajte si pozor",.. SEARCH_TOAST_SUB_HEADING: "Zabezpe.en. vyh.ad.vanie v.s chr.ni pred nebezpe.n.mi lokalitami vo v.sledkoch vyh.ad.vania.",.. SEARCH_TOAST_BODY_TEXT: "Chcete ma. n.skok pred .to.n.kmi v.aka dodato.nej ochrane pri vyh.ad.van.?",.. SEARCH_TOAST_OPTION: ".no, po re.tartovan. prehliada.a zapn.. slu.bu Zabezpe.en. vyh.ad.vanie.",.. SEARCH_TOAST_DONE: "Hotovo",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nem.te zabezpe.en. vyh.ad.vanie . d.vajte si pozor",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Zabezpe.en. vyh.ad.vanie v.s chr.ni pred nebezpe.n.mi lokalitami vo v.sledkoch vyh.ad.vania.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Chcete prida. zabezpe.en. vyh.ad.vanie a.zachova. si ochranu pred mo.n.mi .to.n.kmi?",.. SEARCH_TOAST_OPTION_COMPLIANT: ".no, prida. zabezpe.en.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6881
Entropy (8bit):	5.510938385141793
Encrypted:	false
SSDEEP:	96:CDvPQbt+oOuDdY9XXHci4ERt9UFE+fa9f+i9UFED9FV77GewuWZv9zl:Cj8at9UF89/9UF+TWZv9h
MD5:	E1846247A5FA71788D1C7F2B2ADD5381
SHA1:	A95E77CC002BDF89646B160EA87E9C9E7863D201
SHA-256:	A14932E1CFDDB7188F31F7567521B6EBE388F8E09DC8362875AA66A7038DDB1E
SHA-512:	D3076D6B6444B2B4FBD3EDC363EECE09AAD0A898DCB6742DC656409653D2F558ED188414021A03CB36013D37E454DC1D4E8BD2CFFD2EED88EEBB48124C446175
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Bezbedna pretraga je isklju.ena . budite pa.ljivi",.. SEARCH_TOAST_SUB_HEADING: "Bezbedna pretraga vas .titi od rizi.nih lokacija u rezultatima pretrage.",.. SEARCH_TOAST_BODY_TEXT: ".elite da budete u prednosti u odnosu na .lo.e momke. uz dodatnu za.titu za pretragu?",.. SEARCH_TOAST_OPTION: "Da, uklju.i bezbednu pretragu nakon .to ponovo pokrenem pregleda..",.. SEARCH_TOAST_DONE: "Gotovo",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nemate bezbedna pretraga - budite oprezni",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Bezbedna pretraga vas .titi od rizi.nih lokacija u rezultatima pretrage.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".elite li dodati bezbedna pretraga i ostanite napred?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Da, dodajte bezbedna pretraga u moj pregleda. i promenite podrazumevanu pretragu na {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",.. SEARCH_ENG

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6625
Entropy (8bit):	5.492009405699846
Encrypted:	false
SSDEEP:	96:CPWmMbkZdHSzoz9jp2rqntY25Sfs99FGlTuBLz704oH30wBSt:CwbkOEtJ5SfsTzpEkw0t
MD5:	B1DF6BA791BCF053C1E0AD87F92D6429
SHA1:	44EC6FA81A573B48E8FBD250D3C58B0A2BFE13B9
SHA-256:	C688A7798F7DC757CE014FCB424FB1AEF331151C47A1FA76415E6E773006E7D6
SHA-512:	BEA76AA5016602D3415F31E6D0EC092355BCD94BDC86F95D033D4B51173D63D78F95835AC260F017C4959C114A035A5E62A1479BB8D6F80CAD27FBAD94CB2969
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "S.ker s.kning .r avst.ngd . var f.rsiktig",.. SEARCH_TOAST_SUB_HEADING: "S.ker s.kning h.ller dig borta fr.n riskabla webbplatser i s.kresultaten.",.. SEARCH_TOAST_BODY_TEXT: "Vill du vara steget f.re skurkarna med extra s.kskydd?",.. SEARCH_TOAST_OPTION: "Ja, aktivera s.ker s.kning n.r jag har startat om webbl.saren.",.. SEARCH_TOAST_DONE: "Klart",.. SEARCH_TOAST_HEADING_COMPLIANT: "Du har inte s.ker s.kning . var f.rsiktig",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "S.ker s.kning h.ller dig borta fr.n riskabla webbplatser i s.kresultaten.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Vill du l.gga till s.ker s.kning f.r att h.lla dig steget f.re skurkarna?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, l.gg till s.ker s.kning till webbl.saren och .ndra standards.kningen till {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",.. SEARCH_ENGINE_YAHO

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6975
Entropy (8bit):	5.543613821188072
Encrypted:	false
SSDEEP:	96:CcHgbQsEEkAWex0JFMRhtSgyLyowlSgB9FerI7ur22yp98fx:Ci6hMJF6t1yLyt13wrnr9yp9gx
MD5:	2237C3E41136D6667C86DF571EE6C3A2
SHA1:	1150F1647DF304C112B5E890AA461D183835A0B9
SHA-256:	E4B50C4D2B1DB7ECB550B60D60A6F76E483BA2BB198BF0F89819F88A6A1E1479
SHA-512:	394D59F662146F8EAA5EE927F1F198EA1589E04F4B3923F57C3AF698ADE0D4B769B57C3C13C20E0B65B8D956FDF5A348ED113C2D5DD310F2800A0A8F8EEE4A95
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "G.venli Arama kapal., dikkatli olun",.. SEARCH_TOAST_SUB_HEADING: "G.venli Arama, sizi arama sonu.lar.n.zdaki riskli sitelerden uzak tutar.",.. SEARCH_TOAST_BODY_TEXT: "Ek arama korumas. ile k.t. adamlar.n bir ad.m .n.nde olmak ister misiniz?",.. SEARCH_TOAST_OPTION: "Evet, taray.c.m. yeniden ba.latt.ktan sonra G.venli Arama'y. a..",.. SEARCH_TOAST_DONE: "Bitti",.. SEARCH_TOAST_HEADING_COMPLIANT: "G.venli Arama'ya sahip de.ilsiniz, dikkatli olun",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "G.venli Arama, sizi arama sonu.lar.n.zdaki riskli sitelerden uzak tutar.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "G.venli Arama'y. ekleyerek k.t. niyetli ki.ilerden uzak durmak ister misiniz?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Evet, G.venli Arama'y. taray.c.ma ekle ve varsay.lan aramam. {0} olarak de.i.tir.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing"

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6330
Entropy (8bit):	6.34518050109868
Encrypted:	false
SSDEEP:	96:CUk5RhhRDj8mxeX+lE8D9VkbXtK6XKS9FgXap7B0CR:Ch/LxeXqEsGtBX/Dp9LR
MD5:	419C578A530B1B4966EF11B32DF36B11
SHA1:	048089BD7CB1B31C9B242BFA389A31C99EF70902
SHA-256:	B91612028487C1933A0B801B0356C53413668B76BE4C7B73A3062FA863E12BCB
SHA-512:	722896D3724529FC9FB088CD4F84422593156C37B65E5B977DCED409410A5FFD4842018416A2C663E6CD8274164043477DE22C79DB29FE7F3A80D26EDD2388E2
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "....",.. SEARCH_TOAST_HEADING: "....... . .....",.. SEARCH_TOAST_SUB_HEADING: ".....................",.. SEARCH_TOAST_BODY_TEXT: ".......................?",.. SEARCH_TOAST_OPTION: "................",.. SEARCH_TOAST_DONE: "..",.. SEARCH_TOAST_HEADING_COMPLIANT: "......... . .....",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "......................",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".......................?",.. SEARCH_TOAST_OPTION_COMPLIANT: ".......................... {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",.. SEARCH_ENGINE_YAHOO: "Yahoo",.. SEARCH_ENGINE_YANDEX: "Yandex",

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6347
Entropy (8bit):	6.328128090918464
Encrypted:	false
SSDEEP:	96:CGhla0tPlgm6w6KdmnPZ1cSDGFtMDjNOWMDjB9FEKrYimnKF:Ci7dgtOfSStMPNOWMP3wimnKF
MD5:	743BF2EB32E6F51BD5749DB7D268277B
SHA1:	74C1AF92AED7076AFC0970A3AC635F870BDFA10D
SHA-256:	BAB19E8216CD37737812299E8AC4F1EA3B4C58A73EA58E5156F88B8C0E8E15F1
SHA-512:	AB9660436E41ADEEF4685F8C0D04CE47872E9447361910B887A97A3F7C8A80D5C111A9675D5AD7DF68CE75A054727DC00F7BB2D4B968B6546ECD55DABF3F1E11
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "....... . ...",.. SEARCH_TOAST_SUB_HEADING: ".......................",.. SEARCH_TOAST_BODY_TEXT: "........................",.. SEARCH_TOAST_OPTION: "...................",.. SEARCH_TOAST_DONE: "..",.. SEARCH_TOAST_HEADING_COMPLIANT: "....... . ...",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: ".......................",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".......................",.. SEARCH_TOAST_OPTION_COMPLIANT: "........................... {0}.", // {0} SEARCH_TOAST_*.. SEARCH_ENGINE_BING: "Bing",.. SEARCH_ENGINE_YAHOO: "Yahoo",.. SEARCH_ENGINE_YANDEX: "Yandex

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2562
Entropy (8bit):	5.693216924518234
Encrypted:	false
SSDEEP:	48:UjbcgNu0dSJUGlJ6qfveziXpAlJ2bRQmC3ptQfMmIm42wudadOlOfm92Nokz2nzz:UjbcgNurGGlJRemXalKRQmgpt4MmImi8
MD5:	C7F4A6357698ECE30D8826CF600D9F57
SHA1:	33D9ED01A3ACBCA4DEFEB8A20EAE84D534E13094
SHA-256:	2CFB13FA4C5768005F332140DA8BC866BF5FC26F475B8BB9911C3EA416DA8E99
SHA-512:	EB174047C1CD7BD62618FA30E7612CB5E852402CCED7159E5D79B5C0A2A83492450AF778A6EAD1B9A7F3FBD7BA6A0B220F71D3372EFE953AAEFB514A182A30DA
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "V odinstalaci nelze pokra.ovat, dokud nebudou zav.ena v.echna okna prohl..e.e.<br/>Kliknut.m na tla..tko OK automaticky zav.ete v.echna okna prohl..e.e. Kliknut.m na tla..tko Zru.it tuto akci zru..te.",.. ADMIN_WARNING: "Aplikaci {0} nebylo mo.n. odinstalovat, proto.e jste k po..ta.i p.ihl..eni jako u.ivatel s omezen.mi opr.vn.n.mi. P.ihlaste se jako spr.vce syst.mu Windows a zkuste to znovu.",.. KEEP_FREE_PROTECTION: "Ponechat funkci Ochrana p.i proch.zen. internetu",.. NO_THANKS_UNINSTALL: "Ne, d.kuji. Chci ji odinstalovat",.. CANCEL: "Zru.it",.. NO_THANKS: "Ne, d.kuji",.. SURE: "Samoz.ejm.",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Odinstalace aplikace {0} prob.hla .sp..n..",.. SURVEY_OFFER: "R.di bychom znali v.. n.zor. Pora.te n.m, jak m..eme tento produkt je.t. vylep.it.",.. SORRY_TO_GO: "Je n.m l.to, .e jste si aplikaci nenechali.",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2321
Entropy (8bit):	5.413111714037938
Encrypted:	false
SSDEEP:	48:U9XpCmXa0Roqce7Coh4C3zOur+BYHexiAWFY502OUhMYI5Lp6+ZaKJq4U3xi:U9XpbXaUz3x+BYWivW0uinhEaq4U3xi
MD5:	FA058A79432385F0F1CA487015C4ABD5
SHA1:	159CB0A4261B72B87C09E93063E62400B19D85A3
SHA-256:	C1FBDD582112E398D63E4475798B67FB576EEFC1B8E86151C8480991BE26B6AE
SHA-512:	EC8B5A8EE8A2A237BC3ADD0BE13D86FF9B89B75586EE9F3CDA0BD4F100DCBB8FEBD5046E2BAAC2C392886F165DCB0CCC7EE8244B00844AF0203DC85669EE4907
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Lukke alle browservinduer for at forts.tte med at afinstallere softwaren.<br/>Tryk p. OK for at lukke alle browservinduer automatisk eller p. Annuller for at afbryde.",.. ADMIN_WARNING: "Du kan ikke afinstallere {0}, da du er logget p. computeren som begr.nset bruger. Log p. som Windows-administrator, og pr.v igen.",.. KEEP_FREE_PROTECTION: "Behold webbeskyttelsen",.. NO_THANKS_UNINSTALL: "Nej tak, afinstaller den bare",.. CANCEL: "Annuller",.. NO_THANKS: "Nej tak",.. SURE: "Selvf.lgelig",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Afinstallationen af {0} er f.rdig.",.. SURVEY_OFFER: "Vi vil gerne h.re din mening. Hvordan kan vi efter din mening g.re dette produkt endnu bedre?",.. SORRY_TO_GO: "Vi er kede af, at du forlader os.",.. UNINSTALLING: "Softwaren afinstalleres ...",.. START_HEADER: "Vent! Vil vil savne dig, hvis du afinstallerer",.. START_SUB_HEADER: "Og du vil ogs. savne all

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2527
Entropy (8bit):	5.382106839424675
Encrypted:	false
SSDEEP:	48:UYDdXJ6UXJbcC87UQT9zw/eCJlgf0IyYuYL16OhrHAoKKmJvDkoKT:UydXTXOs6fIYXLhgokkoC
MD5:	D218F3EA4FB5552D213BC3FBB974A789
SHA1:	FF4236337E7C8D978F609D8861491DD225A91880
SHA-256:	9D91E00909533ED832E1DDF31191B837DBD6CDAC5B6F5D42A639A81D2BB7F861
SHA-512:	EC62DCF7C4BEE2612114B36897EB03A530584738A229F2463A9862E54287F9B730548F5241DC247BE7F28E3799CD008E4D40E1AC66F037E393913FCFD20F8429
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Die Deinstallation kann erst fortgesetzt werden, nachdem alle Browser-Fenster geschlossen wurden.<br/>Klicken Sie auf 'OK', um alle Browser-Fenster automatisch zu schlie.en, oder klicken Sie zum Beenden auf 'Abbrechen'.",.. ADMIN_WARNING: "Sie k.nnen {0} nicht deinstallieren, da Sie bei Ihrem Computer als Benutzer mit eingeschr.nkten Rechten angemeldet sind. Melden Sie sich als Windows-Administrator an, und versuchen Sie es erneut.",.. KEEP_FREE_PROTECTION: "Web-Schutz behalten",.. NO_THANKS_UNINSTALL: "Nein danke, bitte deinstallieren",.. CANCEL: "Abbrechen",.. NO_THANKS: "Nein danke",.. SURE: "Sicher",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Die Deinstallation von {0} wurde erfolgreich beendet.",.. SURVEY_OFFER: "Wir freuen uns, von Ihnen zu h.ren. K.nnen Sie uns mitteilen, wie wir dieses Produkt noch verbessern k.nnen?",.. SORRY_TO_GO: "Schade, dass Sie unser Produkt nicht mehr verwenden m.cht

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4045
Entropy (8bit):	5.016975341785504
Encrypted:	false
SSDEEP:	96:U4iYsFeBkg78VLgPHKM6V6WaLq/tit7lO7Tx:U4iiam8hgPj6V6W0q/titcB
MD5:	C5CA5DD123E53490FAE55F29C415E06C
SHA1:	C628E959210BFB0943C62E06E5E744B898F3B23A
SHA-256:	0DCED8524AAA1ECA4321C7DDA73110D817959C1CA5A48F01CC4A8224898725CF
SHA-512:	0907D60D3C56EB98564DF48D5B57363546BCDB5E6F41BD9C61BF469279CAA7725628840790615A662D25E683814727201F18CBB43FFE45E3D4E86680C4E33245
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: ". ......... ............ ... ...... .. .......... .. ... ........ ... .. ........ ... ............ ...........<br/>....... OK ... .. ........ ........ ... .. ........ ... ............ .......... . ....... ....... ... .........",.. ADMIN_WARNING: "... ........ .. ........... ... ........... ... {0} ..... ..... ........ .... .......... ... .. ....... .. ............ ........... .......... .. ............ ... Windows ... ......... .....",.. KEEP_FREE_PROTECTION: "......... ... .......... Web",.. NO_THANKS_UNINSTALL: "... ........., ..... ..........

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2170
Entropy (8bit):	5.395289459153673
Encrypted:	false
SSDEEP:	48:UawX1F1LVSHccWK2aFe3ymc9oqTLvmLtwbvORLxe/p:UxXfhQpe3ymco0uLtRLxex
MD5:	0B828BE10AFEA9960874C99F12DC7418
SHA1:	584DB88DB13FC7E2B82AB9A91878C1FA89DD8499
SHA-256:	CA2D94433B4DDFD80F3FFB26FCD687D1ACD1ACA5ECB75436347A436449B3AB17
SHA-512:	CF77610682A284C18B38BA7FDE6C975B7195434D72D0F66990B516EEF28C9A7BF4E936E0D5D3BAA93062EF52BF2730B56E56D39E98CE71625C3232B20469C8DD
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Uninstallation cannot continue unless all browser windows are closed.<br/>Press Ok to automatically close all browser windows, or Cancel to abort.",.. ADMIN_WARNING: "You can't uninstall {0} because you're logged in to your computer as a Limited User. Please log in as a Windows Administrator, and try again.",.. KEEP_FREE_PROTECTION: "Keep web protection",.. NO_THANKS_UNINSTALL: "No thanks, just uninstall it",.. CANCEL: "Cancel",.. NO_THANKS: "No thanks",.. SURE: "Sure",.. OK: "Ok",.. SUCCESSFULLY_UNINSTALLED: "You've successfully uninstalled {0}.",.. SURVEY_OFFER: "We want to hear from you. Can you share your thoughts on how to make this product even better?",.. SORRY_TO_GO: "We're sorry to see you go.",.. UNINSTALLING: "Uninstalling your software now...",.. START_HEADER: "Wait! If you uninstall, we'll miss you",.. START_SUB_HEADER: "And you'll miss all the good we do, like:",.. WE_SCANNED: "

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	5.366404605432002
Encrypted:	false
SSDEEP:	48:Uop2w+XfxK626IEkLmHVR9zgD/1jBv2a82Vj6Aux9M8KBkgnQ:UzwqfxnjVgjvv24KxS7nQ
MD5:	A68E1E45B723049A0B4BC7C0C6C6C2DA
SHA1:	416BA68C2E68E4D321AFF6659256065325D2F1F6
SHA-256:	45169328CAD7C4045D2FD034A08C403E3F17084F35DFF17C8B9C001C82FC5846
SHA-512:	5AA8A7BAEBC9C2D651441F0FBBFA29C115F1BE7B0335DDA53400E1FC12A86D634C78A3B4A0A9252B7388204DB230D9FA73FEC7E064D7385F063724EC3F9F8595
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "La desinstalaci.n no puede continuar a menos que cierre todas las ventanas del navegador.<br/>Pulse Aceptar para cerrar autom.ticamente todas las ventanas del navegador o Cancelar para anular el proceso.",.. ADMIN_WARNING: "No puede desinstalar {0} porque ha iniciado sesi.n en su equipo como usuario limitado. Inicie sesi.n como administrador de Windows y vuelva a intentarlo.",.. KEEP_FREE_PROTECTION: "Mantener protecci.n web",.. NO_THANKS_UNINSTALL: "No, desinstalar",.. CANCEL: "Cancelar",.. NO_THANKS: "No, gracias",.. SURE: "Claro",.. OK: "Aceptar",.. SUCCESSFULLY_UNINSTALLED: "Ha desinstalado {0} correctamente.",.. SURVEY_OFFER: "Queremos saber su opini.n. .Puede compartir sus ideas sobre c.mo mejorar este producto?",.. SORRY_TO_GO: "Sentimos que deje de utilizar el producto.",.. UNINSTALLING: "Desinstalando el software...",.. START_HEADER: "Espere. Si desinstala, le echaremos de menos",.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	5.391934460146082
Encrypted:	false
SSDEEP:	48:Uo72wwXfxjn6v6IEkLX/wrN9gZ0o/0BjBfjTz2VhSZ6c9VTC0Cj40P:U/wUfxnIwancfjTpVTC0S
MD5:	C4828195B4501DD2009B690C5D0F2966
SHA1:	8E75769E86C59B31227A30FE1CEC9D69C3D55AA4
SHA-256:	1854299318ED7487C8CB6B822A63FE5A6F0C7A2802ECF26F6AE531E1E6719936
SHA-512:	CDA774F18C5442B082A76715B5DA4DB48753CA04FBEEC82F402453718F3ADE20C79BF81D689515BE89548352B01E19E1BEE9C6079EDD38EE8E7238B5C5BD2400
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "La desinstalaci.n no puede continuar a menos que cierre todas las ventanas del navegador.<br/>Presione Aceptar para cerrar autom.ticamente todas las ventanas del navegador o Cancelar para interrumpir el proceso.",.. ADMIN_WARNING: "No puede desinstalar {0} porque ha iniciado sesi.n en su equipo como usuario limitado. Inicie sesi.n como administrador de Windows y vuelva a intentarlo.",.. KEEP_FREE_PROTECTION: "Conservar protecci.n web",.. NO_THANKS_UNINSTALL: "No, gracias, desinstalarlo",.. CANCEL: "Cancelar",.. NO_THANKS: "No, gracias",.. SURE: "Claro",.. OK: "Aceptar",.. SUCCESSFULLY_UNINSTALLED: "Ha desinstalado {0} correctamente.",.. SURVEY_OFFER: "Queremos saber su opini.n. .Puede compartir sus ideas sobre c.mo mejorar este producto?",.. SORRY_TO_GO: "Sentimos que deje de usar el producto.",.. UNINSTALLING: "Desinstalando el software.",.. START_HEADER: ".Espere! Si desinstala, lo ext

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	5.353871204604032
Encrypted:	false
SSDEEP:	48:UrCot/9DbtMfbzwx1kF08hjltMEwTZVyY+vRVZY2f3gvaid5:UrHmMx2BJt8TDmRVzu
MD5:	3DD9FC5259E4177AE74BA92E12FED761
SHA1:	9C65A8F5DDB3964E644D08F7571ED7C2F63F1938
SHA-256:	5972A2ECC6A05EF4E0D563B29C53729B6EFDC50C99D7F01258D9EA5F1DE12867
SHA-512:	B7C6BD53C813D2D2F6D22D7D1D67B4E62C4BED952ACC6F80F3EDF7D3A950F62408C1715A1E9FC9D4293B5AC9FC311B025117AD9081F76DE4707BD12E0100206E
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Asennuksen poistamista ei voi jatkaa, jos kaikkia selainikkunoita ei suljeta.<br/>Sulje kaikki selainikkunat automaattisesti valitsemalla OK tai keskeyt. valitsemalla Peruuta.",.. ADMIN_WARNING: "Et pysty poistamaan sovelluksen {0} asennusta, sill. olet kirjautunut tietokoneeseen k.ytt.j.n., jolla on rajoitetut oikeudet. Kirjaudu Windowsin j.rjestelm.nvalvojana ja yrit. uudelleen.",.. KEEP_FREE_PROTECTION: "Jatka verkkosuojauksen k.ytt...",.. NO_THANKS_UNINSTALL: "Ei, kiitos. Poista asennus.",.. CANCEL: "Peruuta",.. NO_THANKS: "Ei kiitos",.. SURE: "OK",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "{0} on poistettu.",.. SURVEY_OFFER: "Kuulisimme mielell.mme sinulta palautetta. Haluatko kertoa meille, miten voisimme tehd. tuotteesta viel. paremman?",.. SORRY_TO_GO: "Ik.v.., ett. et halua jatkaa tuotteen k.ytt...",.. UNINSTALLING: "Poistetaan ohjelmiston asennusta.",.. START_HEADER

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2674
Entropy (8bit):	5.363360543638875
Encrypted:	false
SSDEEP:	48:UZbbplCgKbHGou9Uz0NHKVfNV7jUtmjV0fkJmTMOo8MXIHe5QXZhrgKHqeTnWpR:URbpEhDvVF5jUqckJXBIHe5scqqeTna
MD5:	1CB299051AEA27C2A9B2F6492055FD0D
SHA1:	6D5B3B30602B5B02C3DEBA7889BF6DDC511A04D4
SHA-256:	F99E310309FAE8E74982590FDCFDFAAE936C8260508BB9197E91B9C43557687C
SHA-512:	8EBA1F9B0E5E9839B753B1BE9EF19D97AB934C25150214DF0A34CD2CC1D56F7C0CE14ED8FA4560F80D5B8BBD593C075111A9CD4F1336FA726EC61714C99F593E
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "La d.sinstallation ne peut pas se poursuivre sans avoir ferm. toutes les fen.tres du navigateur.<br/>Cliquez sur OK pour fermer automatiquement toutes les fen.tres du navigateur, ou sur Annuler pour abandonner.",.. ADMIN_WARNING: "Vous ne pouvez pas d.sinstaller {0}, car vous .tes connect. en tant qu'utilisateur disposant d'un acc.s restreint. Veuillez vous connecter en tant qu'administrateur Windows, puis essayez de nouveau.",.. KEEP_FREE_PROTECTION: "Garder la protection Web",.. NO_THANKS_UNINSTALL: "Non merci, d.sinstallez-la",.. CANCEL: "Annuler",.. NO_THANKS: "Non merci",.. SURE: "Bien s.r!",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Vous avez correctement d.sinstall. {0}.",.. SURVEY_OFFER: "Nous souhaitons conna.tre votre opinion. Seriez-vous dispos. . nous dire comment nous pourrions am.liorer ce produit?",.. SORRY_TO_GO: "Nous sommes d.sol.s que vous nous quittiez.",.. UNINSTA

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2626
Entropy (8bit):	5.400500768428987
Encrypted:	false
SSDEEP:	48:UT3FlNKBwOdm79zoIuKntX3OPwnIeruBTCtnSo8sprasnmNN3bqI5b:UTVfsEtX+iIeq8XUsmNluI5b
MD5:	961921C236E3369D24D9811DF15CE373
SHA1:	C5E80EC059CB03193896DB2446666C3EE2991DD8
SHA-256:	36639960A6C69FB5B87065B1975B70E61B2D8D09669732968EA17F5428DA6F40
SHA-512:	86495F724D8BC4ACCE61A81B18104200CDAEC5388B3C35072C0C37CF002B44ECDCCA7C9F7337DC7CF9607A79140A10B80B28B2027219A0C5A79B00CA4E9F6ACA
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Impossible de poursuivre la d.sinstallation tant que toutes les fen.tres du navigateur ne sont pas ferm.es.<br/>Cliquez sur OK pour fermer automatiquement toutes les fen.tres du navigateur ou sur Annuler pour interrompre l'op.ration.",.. ADMIN_WARNING: "Vous ne pouvez pas d.sinstaller {0}, car vous .tes connect. en tant qu'utilisateur limit. sur votre ordinateur. Connectez-vous en tant qu'administrateur Windows et recommencez.",.. KEEP_FREE_PROTECTION: "Conserver la protection web",.. NO_THANKS_UNINSTALL: "Non merci, proc.der . la d.sinstallation",.. CANCEL: "Annuler",.. NO_THANKS: "Non, merci",.. SURE: "Bien s.r",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Vous avez d.sinstall. {0}.",.. SURVEY_OFFER: "Nous serions ravis de conna.tre votre opinion. Si vous avez des id.es pour am.liorer ce produit, n'h.sitez pas . nous en faire part.",.. SORRY_TO_GO: "Nous sommes d.sol.s de vous voir p

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	5.439917459212257
Encrypted:	false
SSDEEP:	48:U4qRJGbmxWQuD28CEnxSP+vuR4S0OaysKXXFrQR:UxiRNC83kPEu30uRWR
MD5:	40A746A016B07C69C965FA8DD655FE50
SHA1:	4545DC09B17F2FB507C32B0BB1A8E5CF8CA8AE82
SHA-256:	082674595DD7027E86634B6B2D7AD7A66C74C97763CCA46BE637214569FB3D9F
SHA-512:	1658DC236F57840BCE736C1C6BF3BF75C7E21F89620BCBE98842B6BF5009DAE2FB4004A4FB46595D0EF15FA6E907ACB2CDF9D866407211BEF0D1811F613D675D
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Deinstalaciju nije mogu.e nastaviti ako svi prozori preglednika nisu zatvoreni.<br/>Kliknite na U redu da biste automatski zatvorili sve prozore preglednika ili Odustani da biste prekinuli proces.",.. ADMIN_WARNING: "Ne mo.ete deinstalirati {0} jer ste na ra.unalo prijavljeni kao korisnik s ograni.enim ovlastima. Prijavite se kao administrator sustava Windows i poku.ajte ponovno.",.. KEEP_FREE_PROTECTION: "Zadr.i za.titu na webu",.. NO_THANKS_UNINSTALL: "Ne, hvala, samo je deinstaliraj",.. CANCEL: "Odustani",.. NO_THANKS: "Ne, hvala",.. SURE: "Naravno",.. OK: "U redu",.. SUCCESSFULLY_UNINSTALLED: "Uspje.no ste deinstalirali {0}.",.. SURVEY_OFFER: ".elimo .uti va.e mi.ljenje. .elite li podijeliti s nama svoje ideje za pobolj.anje ovog proizvoda?",.. SORRY_TO_GO: ".ao nam je .to vi.e ne.ete biti na. korisnik.",.. UNINSTALLING: "Deinstaliramo va. softver sada...",.. START_HEADER: "

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2561
Entropy (8bit):	5.59463320361829
Encrypted:	false
SSDEEP:	48:Ud/4sBMK+ZvbkFzo5lQiw9Azz8eFRHJev0Dq4aVvBQtju:Ud/PBMKN6lu9aVFR4e2lBqju
MD5:	2E8C48320AB0BB595B042664838DF29B
SHA1:	C6E964E35FA28694521912021058C2EC0E822FB7
SHA-256:	D2B8CF28CB3AC71428087C5AB9A050F1481654AC2AC26271681834F7EB730B74
SHA-512:	BC22C295D38DAC53B416B63DD897D7C706E0C391917AC03848F20A08B6E4C367E729D1301423FC491F0EC869242340A5CD07711DA317BA3B2A8425390B6C7962
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Az elt.vol.t.s csak az .sszes b.ng.sz.ablak bez.r.sa ut.n folytathat..<br/>Az OK gombot megnyomva automatikusan bez.rhatja az ablakokat, a M.gse gombbal pedig megszak.thatja a m.veletet.",.. ADMIN_WARNING: "A(z) {0} szoftver elt.vol.t.sa nem lehets.ges, mivel a sz.m.t.g.pre korl.tozott hozz.f.r.s. felhaszn.l.k.nt jelentkezett be. L.pjen be Windows-rendszergazdak.nt, majd pr.b.lja .jra.",.. KEEP_FREE_PROTECTION: "Webes v.delem meg.rz.se",.. NO_THANKS_UNINSTALL: "Nem, egyszer.en t.vol.tsa el",.. CANCEL: "M.gse",.. NO_THANKS: "K.sz.n.m, nem",.. SURE: "Rendben",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Megt.rt.nt a(z) {0} elt.vol.t.sa.",.. SURVEY_OFFER: "Sokra .rt.keln.nk a v.lem.ny.t. Megosztan. vel.nk, hogy v.lem.nye szerint hogyan tehetn.nk m.g jobb. ezt a term.ket?",.. SORRY_TO_GO: "Sajn.ljuk, hogy nem tart ig.nyt a szolg.ltat.sra.",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2426
Entropy (8bit):	5.322252249699027
Encrypted:	false
SSDEEP:	48:UUKu3r7X85X6/5Ouzl676xLqVDSdEfCXqYQ0d0ddfbOfXT:UDE/M5puk68VDcEK7vSdS/T
MD5:	2799E7A413493577AF9715740260F2DB
SHA1:	CE35828643BA3A43113E0CB704726D18110898A3
SHA-256:	927400B29E63585A67F8CE003945BB916E042BA43E6C0228325C5B8014F2A100
SHA-512:	8DEBA9EAF7EC9C54D46A08AE62E8E11859D3EB59B52C996432DD85E7085EFD62FFA76CF1DC731ED38AEEE0D894ECC8677EF01D327B91B2E42B888727346D6C64
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Per procedere con la disinstallazione . necessario chiudere tutte le finestre del browser.<br/>Premi OK per chiudere automaticamente tutte le finestre del browser oppure Annulla per interrompere l'installazione.",.. ADMIN_WARNING: "Impossibile disinstallare {0} in quanto l'accesso al computer . stato effettuato come utente con restrizioni. Accedi come amministratore di Windows e riprova.",.. KEEP_FREE_PROTECTION: "Mantieni la protezione Web",.. NO_THANKS_UNINSTALL: "No grazie, disinstallala",.. CANCEL: "Annulla",.. NO_THANKS: "No, grazie",.. SURE: "Certo",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Disinstallazione di {0} riuscita.",.. SURVEY_OFFER: "Vogliamo sapere la tua opinione. Vuoi condividere la tua opinione per migliorare ancora di pi. questo prodotto?",.. SORRY_TO_GO: "Ci dispiace che tu abbia deciso di lasciarci.",.. UNINSTALLING: "Stiamo disinstallando il software...",.. START_HEADER: "

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2813
Entropy (8bit):	5.729912252976952
Encrypted:	false
SSDEEP:	48:UmgtjeIgCS7v06vDxzezcu5dbwaIVvOaaI9nCiGSGfKi4Z0YX+NrVqf:UmgtjP6r3dzevdUnkbf4ANrVqf
MD5:	22FCF64D1740E2D77B075D9E4E3DB489
SHA1:	071EDB28AD439E60012D13BDBD68D83054BE12CF
SHA-256:	9BDC40DB43A1DE21DEF5F12C4B69B87F9C9A51BF9D5CD93D0312E62DCDDDCDAB
SHA-512:	518CD3EAC38B18AE96C896E938C42994995AFF1577AD1E41BEF673BF11725F948F94C0FDC7FA09F4E424BD885A95F7254BE170D22875A129A82396FD55FEE8FA
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: ".......................................<br/>[OK] .............. ...............................[.....] .........",.. ADMIN_WARNING: "{0} .........................................Windows ............................",.. KEEP_FREE_PROTECTION: "..........",.. NO_THANKS_UNINSTALL: "....",.. CANCEL: ".....",.. NO_THANKS: "...",.. SURE: "..",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "{0} ..................",.. SURVEY_OFFER: "...........................

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	5.959647743731553
Encrypted:	false
SSDEEP:	48:UJfHnXcKfYWPiQrinx8fhU5aN0jFnSBra8ABYWajyqYOAl5us3aTu:Upv2n0C5aejF4raNYdXAis+u
MD5:	3969E821F52E3CF3947DCCF035F8CCA1
SHA1:	61CE2023832D3F72E203029D4ED2960DB4CDD8E7
SHA-256:	C9D78042F878842821CB79E3DEA8DAF26D60BE27D753C507185AA423153B21F1
SHA-512:	145E95EB097E2442CEDA42ADDE7C8E878A47D9AF647DBDBB587AF946F965CB423434FA6D8BD3C7F75B6B8DEBB492C546E1CFCCF7CC4D667097B9E9ED5A2859DD
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: ".. .... .. .. ... ... ... . .....<br/>... .. .... .. .... .. ... ... .. ... .......",.. ADMIN_WARNING: "... .... .... ..... .... {0}. ... . ..... Windows .... .... . .. .......",.. KEEP_FREE_PROTECTION: ". .. ..",.. NO_THANKS_UNINSTALL: "..., .....",.. CANCEL: "..",.. NO_THANKS: "...",.. SURE: ".",.. OK: "..",.. SUCCESSFULLY_UNINSTALLED: "{0}. ..... ........",.. SURVEY_OFFER: "... .... .. ..... . ... .. ... .. ... .........?",.. SORRY_TO_GO: "... ..... .... . .. .... ......",.. UNINSTALLING: "...... .

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	5.392661368033981
Encrypted:	false
SSDEEP:	48:U2AUYbOdeMb72i5iur+vrJBFJZG5biH7kFJqSCLUhS0TGpCaiSV5BXU:ULkX2G+vNBFSbiHIFCAc6SFXU
MD5:	ECCD14D9476AD9568A462C44AC560D38
SHA1:	EF4C414FC373E7503CCA2694E08210775D278898
SHA-256:	762C5DB534FCD652A8BE16258AEEC9A6059EFD5B73F1E22E13B3D4556DEC559F
SHA-512:	12FA0FDC23F3748AC6C64902C4FE6BFD62F2EAF4A3F3399A0710C4648E92EE0787303ED21E4E45F95D97B27F67B8688AC18750189948C8B04319B7948DFA3A98
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Avinstallasjonen kan ikke fortsette f.r du har lukket alle nettleservinduer.<br/>Trykk p. OK for . lukke alle vinduene automatisk eller p. Avbryt for . avbryte.",.. ADMIN_WARNING: "Du kan ikke avinstallere {0} fordi du er logget p. datamaskinen som en Begrenset bruker. Logg p. som Windows-administrator og pr.v p. nytt.",.. KEEP_FREE_PROTECTION: "Behold webbeskyttelse",.. NO_THANKS_UNINSTALL: "Nei takk, bare avinstaller det",.. CANCEL: "Avbryt",.. NO_THANKS: "Nei takk",.. SURE: "Ja visst",.. OK: "Ok",.. SUCCESSFULLY_UNINSTALLED: "Du har avinstallert {0}.",.. SURVEY_OFFER: "Vi vil gjerne h.re fra deg. Kan du dele dine ideer om hvordan vi kan gj.re dette produktet enda bedre?",.. SORRY_TO_GO: "Det er synd at du ikke vil fortsette . bruke oss.",.. UNINSTALLING: "Vi avinstallerer programvaren n...",.. START_HEADER: "Vent! Vi vil savne deg hvis du velger . avinstallere",.. START_SUB_H

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2363
Entropy (8bit):	5.340284316944054
Encrypted:	false
SSDEEP:	48:URHXIzXIV2xo3lID6XgocC7h7kBzyNkIK+2L0LgSPGxetBt/XktFOFVQ9k:UhXOXgYGi6XgAgtIKtLeOw3Fm2
MD5:	6A66EE6ABAE69D09704C8465C2BE63C1
SHA1:	95211444BDFDE8FAFEC2DB52D78C359A3B8B3572
SHA-256:	67A1EAAAF6CE4CA61FC9AC9FA5B1D90C35339F423B16B1E0ADAC862722CCE264
SHA-512:	BC3E71D37FBDCAFC3AD5417A56E770197B9A2A44B168E0266BBB8235D7C8D576132B19616CD87A6C0DA6902DCFC7DE37EDF7F41F161E44A8274412875E60F039
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Verwijdering kan pas worden voortgezet wanneer alle browservensters zijn gesloten.<br/>Klik op OK om alle browservensters automatisch te sluiten of op Annuleren om af te breken.",.. ADMIN_WARNING: "U kunt {0} niet verwijderen, omdat u bij de computer bent aangemeld als Gebruiker met beperkte rechten. Meld u aan als Windows-beheerder en probeer het opnieuw.",.. KEEP_FREE_PROTECTION: "Webbeveiliging houden",.. NO_THANKS_UNINSTALL: "Nee, installatie verwijderen",.. CANCEL: "Annuleren",.. NO_THANKS: "Nee, bedankt",.. SURE: "Goed",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "U hebt {0} verwijderd.",.. SURVEY_OFFER: "We horen graag van u. Kunt u ons laten weten hoe dit product nog verder kan worden verbeterd?",.. SORRY_TO_GO: "Wat jammer dat u ons gaat verlaten.",.. UNINSTALLING: "Uw software wordt nu verwijderd...",.. START_HEADER: "Wacht! We zullen u missen als u de software verwijdert",.. START_SUB_HE

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2456
Entropy (8bit):	5.641110154707962
Encrypted:	false
SSDEEP:	48:Ux6l/L182ZR1tM7T4K95K19ehLvfZhKXdWjpLTLkR:U4lBXZjKWCfEeXy
MD5:	5B393AF12CF56BDE33BB41D5FB89ABC9
SHA1:	D0F13653ADADF4EBE40E951E9EA8995B818536D6
SHA-256:	79A9FF723429F727237AF34300009E6E98873BD2B246BE0340A3EF1278375F77
SHA-512:	9DA06F15BBF26B37E0A33FDDDC298B0441C50618EAEE3797F485D2DC5E025897C5DAD46D99F818E795A9663E6B157FFC8AB4E481E38C2E30C5179250D509593A
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Nie mo.na odinstalowa., dop.ki wszystkie okna przegl.darki nie zostan. zamkni.te.<br/>Kliknij przycisk OK, aby automatycznie zamkn.. wszystkie okna, lub przycisk Anuluj, aby przerwa. proces.",.. ADMIN_WARNING: "Nie mo.na zainstalowa. programu {0} z powodu zalogowania na komputer jako u.ytkownik z ograniczonymi uprawnieniami. Zaloguj si. jako administrator systemu Windows i spr.buj ponownie.",.. KEEP_FREE_PROTECTION: "Zachowaj ochron. w sieci Web",.. NO_THANKS_UNINSTALL: "Nie, dzi.kuj.. Odinstaluj.",.. CANCEL: "Anuluj",.. NO_THANKS: "Nie, dzi.kuj.",.. SURE: "Pewnie",.. OK: "Ok",.. SUCCESSFULLY_UNINSTALLED: "Program {0} zosta. pomy.lnie odinstalowany.",.. SURVEY_OFFER: "Chcemy pozna. Twoj. opini.. Jak mogliby.my ulepszy. nasz produkt?",.. SORRY_TO_GO: "Przykro nam, .e musimy si. rozsta..",.. UNINSTALLING: "Odinstalowujemy Twoje oprogramowanie...",.. START_HEADER: "Czekaj!

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2373
Entropy (8bit):	5.3991318171346725
Encrypted:	false
SSDEEP:	48:UHC6Unw+8DeoRMzBDzXGZ077FG/BjS7kjd6AGBhofQ1Tl:UfUdkM1zk8Bw47kjZchofQJl
MD5:	4F01279B1B5E8C6B27C3D7B4F82CABCC
SHA1:	3FB820542A717DE1600A981084C4134299816AE3
SHA-256:	EE4CA6BE700D57B0B591F84C6962DD5796238980EB08B990DF0109DBE85D7A2D
SHA-512:	DB0082517C282B99A18ECF873A6D114BEC0AA8B6A7A52A093779206A6EA47333B2BE16F7009EAE15268C3DC8B225528D0507C741FD8C72C7CE2134BAF86AFF09
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "A desinstala..o poder. continuar somente se todas as janelas do navegador forem fechadas.<br/>Clique em OK para fechar todas as janelas do navegador automaticamente ou clique em Cancelar para interromper a opera..o.",.. ADMIN_WARNING: "N.o . poss.vel desinstalar o {0} porque voc. est. conectado ao computador como um Usu.rio Limitado. Entre como Administrador do Windows e tente novamente.",.. KEEP_FREE_PROTECTION: "Manter a prote..o na Web",.. NO_THANKS_UNINSTALL: "N.o, obrigado. Desinstale o programa",.. CANCEL: "Cancelar",.. NO_THANKS: "N.o, obrigado",.. SURE: "Claro",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "{0} foi desinstalado com .xito.",.. SURVEY_OFFER: "Queremos saber a sua opini.o. Deseja compartilhar suas ideias para tornar esse produto ainda melhor?",.. SORRY_TO_GO: "Lamentamos pela sua sa.da.",.. UNINSTALLING: "O seu software est. sendo desinstalado...",.. START_HEADER

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2369
Entropy (8bit):	5.417925556594748
Encrypted:	false
SSDEEP:	48:UDlURTq+8ZxNHRSMMy7EVW14P9SZPkDPIjQ7AV2iEc5KQx4S:UxUOitVQsDf7FQx4S
MD5:	5D6C808BA667190CAD83363B2FED2E4F
SHA1:	774CF559EB2D70977E9EB1E4A584A9E9752FB9AC
SHA-256:	2D8E8EF39E746DE9D0AD7680144D600AC5F94FD0EA08467A5016BC4A1209FD50
SHA-512:	2E989F57B6E6DE9AAFB9111ECFBA2B7D1F12E7C361A11CCD944D8D042DAAE890742AB3109A0658A6B0C764FF39BC4D140D5B49E8F0B9240A2F39238F75C3FA90
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "N.o . poss.vel continuar com a desinstala..o sem fechar todas as janelas do browser.<br/>Prima Ok para fechar automaticamente todas as janelas do browser ou Cancelar para cancelar a opera..o.",.. ADMIN_WARNING: "N.o . poss.vel desinstalar o {0} porque tem sess.o iniciada no seu computador como Utilizador Limitado. Inicie sess.o como Administrador do Windows e tente novamente.",.. KEEP_FREE_PROTECTION: "Manter a prote..o Web gratuita",.. NO_THANKS_UNINSTALL: "N.o, obrigado, desinstalar",.. CANCEL: "Cancelar",.. NO_THANKS: "N.o, obrigado",.. SURE: "Claro",.. OK: "Ok",.. SUCCESSFULLY_UNINSTALLED: "Desinstalou o {0} com .xito.",.. SURVEY_OFFER: "Queremos ouvir a sua opini.o. Pode enviar os seus coment.rios para tornar este produto ainda melhor?",.. SORRY_TO_GO: "Temos pena que nos deixe.",.. UNINSTALLING: "Estamos a desinstalar o software...",.. START_HEADER: "Aguarde! Se desinstalar

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3465
Entropy (8bit):	5.092558984060542
Encrypted:	false
SSDEEP:	48:UxdXe3T+ZqUelORd3BZjNfGqhHmLgw0ZIsgUKacbkgmhVXAT1Wh9vr:Uxt3xPfGqhHmkwKIyK+hx1
MD5:	3894769DC28D30208855F94DCCFD4168
SHA1:	52B61C781D05EE9F318FED0832BB4D979D88D451
SHA-256:	B95F32AE4352B29AB360832875AC0CF56A10F399AD89A339107A07D93B48F7A3
SHA-512:	058679DEA3F3253F66B17D35C652A4F3C01748BFFB88E2FB58A4A67E28A4D85F63CE16A6269CC2AA7FF09B9216A962AC1EED069E57839BF070F357F0AE69B427
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "..... .......... ........, .......... ....... ... .... .........<br/>....... ...... .., ..... ............. ....... ... .... ........, .... ...... ......, ..... .......... .. .......... .........",.. ADMIN_WARNING: ".......... ....... {0}, ... ... .. ..... . ....... ... ............ . ............. ........ ....... . ....... ... ............. Windows . ......... ........",.. KEEP_FREE_PROTECTION: "......... ...-......",.. NO_THANKS_UNINSTALL: "..., ........ ....... ...-......",.. CANCEL: "......",.. NO_THANKS: "..., .......",.. SURE: "......",.. OK: "..",.. SUCCESSF

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2602
Entropy (8bit):	5.6764474895696155
Encrypted:	false
SSDEEP:	48:Ujo34jWoRebkIk8Am7/fz8x9kJghJhuaO+PUi53yqUA29nsYvrOs3VkDf:UjP1Ik8AajJMaavUi5RVgsSisiDf
MD5:	87679CCADC27AC2AB544A58A5C65A363
SHA1:	45815B384616819971F803E728C16CF1952741AC
SHA-256:	1C56F07EFB91156997ADF137087A74F3679AFF64A9B533F31226E98599B2926B
SHA-512:	96C37F5B35AE6029DAB9CC0E93AE64B0E17869BD1F89A49B9DF71B3A75AF4CB596867A628F3DD4C038137A467B823321887567CA1DC4D79532DF54BB7A54956C
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "V odin.talovan. bude mo.n. pokra.ova. a. po zavret. v.etk.ch okien prehliada.a.<br/>Ak chcete automaticky zavrie. v.etky okn. prehliada.a, kliknite na tla.idlo OK. Ak chcete odin.talovanie zru.i., kliknite na tla.idlo Zru.i..",.. ADMIN_WARNING: "Aplik.ciu {0} nem..ete odin.talova., preto.e ste sa do po..ta.a prihl.sili ako pou..vate. s obmedzen.m. Prihl.ste sa ako spr.vca syst.mu Windows a sk.ste to znova.",.. KEEP_FREE_PROTECTION: "Ponecha. ochranu pred webom",.. NO_THANKS_UNINSTALL: "Nie, .akujem, odin.talova. ju",.. CANCEL: "Zru.i.",.. NO_THANKS: "Nie, .akujem",.. SURE: "Iste",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Aplik.ciu {0} ste .spe.ne odin.talovali.",.. SURVEY_OFFER: "Radi by sme poznali v.. n.zor. M..ete sa s nami podeli. o svoje n.vrhy na zlep.enie tohto produktu?",.. SORRY_TO_GO: "Je n.m ..to, .e sa l..ime.",.. UNINSTALLIN

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2387
Entropy (8bit):	5.479304308903774
Encrypted:	false
SSDEEP:	48:Ub2RwcC6S2hGDlCEVFS/+uhRpTSQOa/YmAXXRTuALG:UiKRE8ha/HhiQ70l2
MD5:	8BC994D650D947D14B8661E50B8AC578
SHA1:	FD682BC4D14FAE29FAC6FC7DCCCA53CB0975E48D
SHA-256:	E4B3F8A32778F00E6D201FB6AE21845864D4A4F8940CD594FA3F7C3EC7290366
SHA-512:	F85224E31CA0813F50102FA1A12DA0E5784623481F119A8735925470C5F926EA80458D5348BEF02E0FC92831B78FA626639C5117ED3DCDBFEEAE29B3BC43DD6B
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Nije mogu.e nastaviti deinstalaciju dok se ne zatvore svi prozori pregleda.a.<br/>Kliknite na dugme .U redu. da biste automatski zatvorili sve prozore pregleda.a ili kliknite na dugme .Otka.i. da biste odustali.",.. ADMIN_WARNING: "Ne mo.ete da deinstalirate {0} zato .to ste prijavljeni na ra.unar kao ograni.eni korisnik. Prijavite se kao Windows administrator i poku.ajte ponovo.",.. KEEP_FREE_PROTECTION: "Zadr.ite Veb za.titu",.. NO_THANKS_UNINSTALL: "Ne, hvala, deinstaliraj je",.. CANCEL: "Otka.i",.. NO_THANKS: "Ne, hvala",.. SURE: "Naravno",.. OK: "U redu",.. SUCCESSFULLY_UNINSTALLED: "Uspe.no ste deinstalirali {0}.",.. SURVEY_OFFER: ".elimo da .ujemo va.e mi.ljenje. Mo.ete li da podelite sa nama svoje ideje za pobolj.anje ovog proizvoda?",.. SORRY_TO_GO: ".ao nam je .to odlazite.",.. UNINSTALLING: "Sada deinstaliramo va. softver...",.. START_HEADER: "Sa.ekajte! Ak

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	5.462902927462967
Encrypted:	false
SSDEEP:	48:U2OwbAtfP5E+Ht3zni7IL8wPt2i6W7GvCZCjXAPPeMHi2iwsuwmwO8+:ULwq7t38IfFN7JCaPeMCH45
MD5:	8C557CA6088724AF8E03C406F640659F
SHA1:	B438C82499BFE6D9221C0D66F87CC788804DC79F
SHA-256:	74C33F504F75C36B013A9A072DB6E9C78587F0E98713A6C5EF71F0E3008D34F2
SHA-512:	C1F75FAECBE4D2085281BB09558AA8FDB0CD105FA742C3CF589472908123C39703B76B2CC5709C911C74CB98D0960C265787365D167E155F24D4E17A49D27F7B
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Avinstallationen kan inte forts.tta f.rr.n samtliga webbl.sarf.nster .r st.ngda.<br/>Tryck p. OK f.r att st.nga alla webbl.sarf.nster automatiskt, eller p. Avbryt f.r att avbryta.",.. ADMIN_WARNING: "Du kan inte avinstallera {0} eftersom du .r inloggad p. datorn som begr.nsad anv.ndare. Logga in som Windows-administrat.r och f.rs.k igen.",.. KEEP_FREE_PROTECTION: "Beh.ll ditt webbskydd",.. NO_THANKS_UNINSTALL: "Nej tack, avinstallera det",.. CANCEL: "Avbryt",.. NO_THANKS: "Nej tack",.. SURE: "Ja tack",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "{0} har avinstallerats.",.. SURVEY_OFFER: "Kontakta oss g.rna. Vill du dela dina id.er om hur vi kan g.ra produkten .nnu b.ttre?",.. SORRY_TO_GO: "Vi beklagar att du l.mnar oss.",.. UNINSTALLING: "Avinstallerar programvaran nu ...",.. START_HEADER: "V.nta! Om du avinstallerar kommer vi sakna dig",.. START_SUB_HEADER: "Och v.rre

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2590
Entropy (8bit):	5.536665147078364
Encrypted:	false
SSDEEP:	48:UrK+A3WqDVZRmSXdypNsXHp8QbTBtW+R+jNvSvp2DAw0kxnfcOKef3gtkSp:UW3WQyQXHpHHBw+R+x680GfF3gtvp
MD5:	205BAE1D8BA8E42C28F298C98E9D2EF5
SHA1:	C8F67089665AAFFE01025DD74628F1173053046F
SHA-256:	BC3844A2F492B19C46EE00BAE901D336B5B345988669C7E431B5286F945319EF
SHA-512:	AAFFA894122AE8CCE3C0E36E055609B171FE01470A76939CD6149BF82B9F589BF183C217AE502184E68BBFAFF285A64F96C4DFFC05A1DA8AF7647C177794A4C7
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "T.m taray.c. pencereleri kapat.lmadan kald.rma i.lemine devam edilemez.<br/>T.m taray.c. pencerelerini otomatik olarak kapatmak i.in Tamam'a, i.lemi iptal etmek i.in ise .ptal'e bas.n.",.. ADMIN_WARNING: "Bilgisayar.n.zda S.n.rl. Kullan.c. olarak oturum a.t...n.z i.in {0} uygulamas.n. kald.ramazs.n.z. L.tfen Windows Y.neticisi olarak oturum a..n ve yeniden deneyin.",.. KEEP_FREE_PROTECTION: "Web korumas.n. tut",.. NO_THANKS_UNINSTALL: "Hay.r, te.ekk.rler, kald.rmak istiyorum",.. CANCEL: ".ptal",.. NO_THANKS: "Hay.r, te.ekk.rler",.. SURE: "Tabii ki",.. OK: "Tamam",.. SUCCESSFULLY_UNINSTALLED: "{0} uygulamas.n. ba.ar.yla kald.rd.n.z.",.. SURVEY_OFFER: "D...ncelerinizi ..renmek isteriz. Bu .r.n. daha iyi hale getirmek i.in neler yap.labilece.ine ili.kin d...ncelerinizi bizimle payla.abilir misiniz?",.. SORRY_TO_GO: "Gitti.iniz i.in .zg.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2207
Entropy (8bit):	6.357021965471494
Encrypted:	false
SSDEEP:	48:UtM+PzEwQSBjFt9CNLX15qklwzATPXtrVV/:UPftMtFzwzUtrH/
MD5:	8DE85FB37CE8242DA375736AAB1AB0F4
SHA1:	CC768287178B9803DDB970D20A107AEE9B3B07C9
SHA-256:	F120A3640A56FF0CBE6F7F065C79B8D033E86218C87674CDB0AB0E17B7865FFE
SHA-512:	A0C2198C9EFC4F934BD7E8EE9A31EBAF3BA1F69E9161BC70B69E6F5E47B450B43FE9F3D7861115086A00F6521B12C723879A49BD0974D1D5F5064AD89E43F12A
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "........................<br/>...............................",.. ADMIN_WARNING: "..... {0}.................. .. Windows .............",.. KEEP_FREE_PROTECTION: "......",.. NO_THANKS_UNINSTALL: "........",.. CANCEL: "..",.. NO_THANKS: "....",.. SURE: "..",.. OK: "..",.. SUCCESSFULLY_UNINSTALLED: "...... {0}.",.. SURVEY_OFFER: "........... .....................?",.. SORRY_TO_GO: "............",.. UNINSTALLING: ".........",.. START_HEADER: "...! ................",.. START_SUB_HEADER: "............

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2271
Entropy (8bit):	6.361740709430026
Encrypted:	false
SSDEEP:	48:UtQEPQWGitIGg3V4BxFrtYqbu1bRqAO5qgggF3pA5BX5r:UCEjAqxHsG5eEpAr5
MD5:	6516115D820CFC9B41A2444A81452155
SHA1:	5771C7A798F9459E8565864978C39D52372ABA08
SHA-256:	91C9C1F63FA1BE2784514444C4CE06A35DCF062E6687070D9FC39C04711F32BF
SHA-512:	7FF2789D3568A08071CF3E9AA3A9BE515842E11ECF8066A3E82B95D7BC36A60FA5096A25128B0D55F0D74FC7C88D4BAEB4FEF448A01EAE51B36BEC346D41B95C
Malicious:	false
Reputation:	unknown
Preview:	var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: ".........................<br/>. [..] ............... [..] ...",.. ADMIN_WARNING: "....... {0}..... [......] ....... .. Windows ..................",.. KEEP_FREE_PROTECTION: ".. Web ..",.. NO_THANKS_UNINSTALL: ".............",.. CANCEL: "..",.. NO_THANKS: "....",.. SURE: "..",.. OK: "..",.. SUCCESSFULLY_UNINSTALLED: "....... {0}.",.. SURVEY_OFFER: ".......... .......................",.. SORRY_TO_GO: ".................",.. UNINSTALLING: ".............",.. START_HEADER: "................",.. START_S

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.407231782531542
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPHE1:Yo6KUtjVLk4t94iU3KNoT8u8akE1
MD5:	7AEE5069D680D8432A1FFEB2FF25A7D7
SHA1:	4F7C3B8661FF0AB80063101D4868A19550D16066
SHA-256:	642D60617D95B66A27486449EB3BDEE93E89F8F3EC53C08D06C627E1BF8524A1
SHA-512:	76CC5F75DC630A3F4E7F8BC0D3D913290B0DA4B77146B4B9F837E0D629C5A4D81298ABFCEB849ED0CCA98410BB8C2BB1D3442938FD0D2ED21FCD871ACED2F32C
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.407348293160654
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPJHm:Yo6KUtjVLk4t94iU3KNoT8u8ayG
MD5:	7C8A1D2EE8136C3D9BBBA17AB4CBE4B0
SHA1:	07C49E34452B258C33E305364D4FC875007D0904
SHA-256:	A241878C56A23EB10D367E03D4BFC098FF381FBD4219554C0768D95353DE9CB7
SHA-512:	A403FC2B49FB473BD7928627C31E7CCF45F5403323AE40349685EEE22558079B7A327C4D71653E288AD3BB11C339643EC47859B8DB7918F652DC6F2BACAA499B
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.408589049376687
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPS:Yo6KUtjVLk4t94iU3KNoT8u8af
MD5:	A7DE1CE03DDE1CB71EEACD9ABAEDD0A0
SHA1:	BE8250E96D1F230F03BCA058996C157A5AAA2A2D
SHA-256:	C43331052E1194608F90FD00B13C2FFF010B3FA3B0158FB96385C09D0BD91CCA
SHA-512:	DEAE7D7085335CEF237271053D067019E7CEA5CC3F6AD0B678291626373AAE180F025F263CD992B9E4FE5074635EEC58C174E546B268938CE583C58B1EE05BCF
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.4147881915717555
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPkIM:Yo6KUtjVLk4t94iU3KNoT8u8aV
MD5:	3FC1B3C3340315E7B89C3566EE801024
SHA1:	AEA7B30655B42B595058169ABE97FD8EC065C0B0
SHA-256:	7141E345C5C9997A83DC8951E63C5382616DBA764A171645586BEAF7F38CBA7C
SHA-512:	5BB5ACCB7EAF034E72D1B2F265E6096101E187D7E37AB63F30DAEB85560DC96D6376E30FC4D3CA3E5F544EE9F454994F89DD0A99102F3DEED0E235D6124D3B35
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.415118153351878
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPiv:Yo6KUtjVLk4t94iU3KNoT8u8aNv
MD5:	159702A972EA4C703C297EADFB66CB68
SHA1:	6B5C807883783C4ED801F55FF6E0153178723DD1
SHA-256:	0551A3FD29DC910423B5C8F905765254FAE1ADEA29FAD3958ECC4A82962CE960
SHA-512:	E5B7F5A12B2927E6E3FD69CAD5759C6A09392F358826C22CE632FBC6615BEEF84F11344C93C86F804C424AC42D2997507EE2491045FD7FBA139CD73A593990F7
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.412387704998021
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPM0:Yo6KUtjVLk4t94iU3KNoT8u8a90
MD5:	C78AC78FE88882384D4D21DB81D110E4
SHA1:	0F2DE11B9881900038982581547CEB71DEBC39F9
SHA-256:	55CF56C82691F11B23E6D6FC4CDEA1A42CB1D93FF580C2C8C0FF2EE00C989BB5
SHA-512:	21795B9A0D5D0E219ABF3FC2E47D05B54DFF5515759133013F49849C9B34374483140B33A7A0CFBBE9EB78DB400A78095DA0E359C638A358418DF9B643A2A116
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.415608749152867
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPftr:Yo6KUtjVLk4t94iU3KNoT8u8aQt
MD5:	EF1694161C568F2F62E7CDBB539F6395
SHA1:	CA300859DB96EC06A935EFEF0E6DF281DC506A7E
SHA-256:	CB59625098DDB734EF60A80934913D0CF0577FC3D2217D1EE3AF6647C5FEADC3
SHA-512:	63C68ACBC392DF96567DC6B3F05A01F8B3B25A8BB2E78124DE83B6E4E6D6A568B671D975405CACFE5B0A36C017348F5B24530DA770709B018D244EB857B98E47
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.410331038502083
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPS2Sy:Yo6KUtjVLk4t94iU3KNoT8u8aiSy
MD5:	15008569E32057851EFB67F6CBCF300A
SHA1:	5DDA0F325901B790EF3D2ED4941F08666D77ABF6
SHA-256:	87B96CC95068AE4CE13F6999C4ED6E519DF5F9A29FA09D5779AEC6BE9AF9C252
SHA-512:	DA2C90C255F52D243F046EB756CB1709D4255B5AB87FAA765D6088DE966DEB308E326AA8D0CC724D4F32FDCEDFED1BF9DB6F423B9694221941FC458E6CEAE743
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.411184002158305
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPDBw:Yo6KUtjVLk4t94iU3KNoT8u8av
MD5:	9DBC572429CB488C496FF6CB7271826D
SHA1:	E4AF7FE05DF12AB466C409FE64B7B4296FBAEBAE
SHA-256:	9B4A39176DB960824618B6E2BBE5BFC11ED3BDB0CA291F7099BFDD154E61DC68
SHA-512:	FDF8C695B7D6DFAD6385797675AD5AC07A2B9654AF88D5EAE9603640E35276E4E661E72FD242E096B51D14C57082DCA81D366E4312596ACBB23BBE1F11F34D28
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.4213991293123085
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPs:Yo6KUtjVLk4t94iU3KNoT8u8ap
MD5:	AA0C7F3B0B8D5F6ABE0749F441637021
SHA1:	FB59F32EE34D092F0DD0355DB2BDD51435DD6FB2
SHA-256:	E8F83A9413000874A24D5B3B1FF3CC6722CADE31F5FC9D97B131F4037359C2A1
SHA-512:	590ADC3384B5A18E11E4AD153D65778708694F44EC74B2624D6AD831D4EB5A8ABD03BAB7E125E2330FCE6649BD40DB3FE174A80758C9F8A90ABDE1A4B71E18A1
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.423847089549462
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPy:Yo6KUtjVLk4t94iU3KNoT8u8az
MD5:	15F8785EBA56E434ADAA6BA1ADC92017
SHA1:	ADF2640895645019129DB5038C197C98BC1800CF
SHA-256:	46B7CB93032BE78DBE895D245D2061BAE61080C6C28421122D75BF2C47ACE594
SHA-512:	5AA7A2CECD4F66E6AA22C28E965BC2D6C889EB6ABF63805CA64F9270CB24EA781E9EB3E7C926648511D63B5B897AC2F38FAA1E22D4756729FF5BC623E5169A31
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.409632553855686
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPI:Yo6KUtjVLk4t94iU3KNoT8u8al
MD5:	6D2E586858BBDA0F2B692F6444E2747E
SHA1:	B61DEC9C1478C6ADBEE9F952603DA57489B8D09E
SHA-256:	43CEE2943DC589187D2BDDA1B0DFEE5BECD4F403F083C8543C9135DE4038F1CB
SHA-512:	6951332F4CD4A25E706304F4C530C071DF1ED3E4D7135D77A2B4D1009C7630F0183807B776FCEC0AD5627CDB3453D55809FAE88DF5EE1762CDE5A077C092DFB7
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.416549640198606
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPhmi:Yo6KUtjVLk4t94iU3KNoT8u8aM
MD5:	EB0A60CEFE50F7B83DCA90F96B0B1AAD
SHA1:	058973EDA84144F099DA08FD62E4FD4E1B851E56
SHA-256:	534F45B0BEB4B9C7A8B9335E065EA69FA1612AD5BC4B6ED4CB0C2E8985D9C9CD
SHA-512:	BADEDCA1C8AC64A3AA96963C4E04CC6871167E19F5B99F3A558BCAD1C7B82F6892B34E9A5349499109E363080DA380667AE133EF3E0943FE833B04A6911631ED
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.405448779596633
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aP4p:Yo6KUtjVLk4t94iU3KNoT8u8aB
MD5:	36EA4EEAE172F5098266317B1465E4F7
SHA1:	46163C9C9C6F6E3F5A8BE4D0119717745EB7AB9A
SHA-256:	F6AD5FC9D958113DA82C9FAF84B5FBB867FCC8A319252DB65871BB0B70846863
SHA-512:	0039DCC13714EB142204468E21F947FCEA1E1C13C66A6E7F447FD9661DCE5F67BE2A2C0BB55EFC21318B07CA6AD3216309AD69E01F1DFEE10BC30ABBF41ECFDB
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2008
Entropy (8bit):	5.900750435435238
Encrypted:	false
SSDEEP:	24:7vzEJoY7j197RD0AQUSRrNyEimWAwHM3+i3PZOHsciY/oY7BL+svTa6vRjj:/ZYt9iAQhRwEimWQ+i3YBLztvTLRn
MD5:	4CB2AF03F45490709EAD4C899988D5B5
SHA1:	E16D5D92891852E5A045FC82AC1BF14DC7A68FC0
SHA-256:	2A9A030AF477D61BC9C0717501BAE9A7CA7EC181B722ABDF673DD44D285CD4AC
SHA-512:	180E6A5EF56F269BBD17EA2A64836419D885FB0B9425ABB1751F1A6E1FFDB4034E346995F848B1BD822F59C26E903B06821B75F8237C852ADAB8B55977E3477A
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: ".. ... ... ... .... ... .. .... ....",.. UT_WSS_TOAST_TITLE_COHORT_2: "McAfee. .. .... .. ",.. UT_WSS_TOAST_TITLE_2: "... .... ... {0}.(.) .. .. ..",.. UT_WSS_TOAST_TITLE_2_STRONG: "... ..",.. UT_WSS_TOAST_DESC_1_VAR_1: "McAfee. .. ..... .... VPN, .. .. .., Premium ...... ... .. . ... ......",.. UT_WSS_TOAST_DESC_1_VAR_2: ".. . ... ... ... .. ... . .. .... ......",.. UT_WSS_TOAST_DESC_2_VAR_2: ".. McAfee. .. ...... ......",.. UT_WSS_TOAST_DESC_COHORT_2: ".. .... ... ......, .. .. .., VPN, .. .. ... ... .... ......",.. UT_WSS_BUTTON_ACCEPT: ".. ....",.. UT_WSS_BU

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.417085046687419
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aP97:Yo6KUtjVLk4t94iU3KNoT8u8aw
MD5:	20CE71B55F517285B14EDC34ED00132D
SHA1:	C44ECC5DAF92ADAE35B70C61A4E7E282168217E3
SHA-256:	E9C90824498E1E94C46A9BDC7929F90FE8C6EDA0BA5534A4C78CE40B56A7DFB8
SHA-512:	58B528693146F64EDDA3F5D835B89E368D62C061023022B7E6E3175A72482B5B2A5F276F305CBFF87B43122DCDC4F9B9BC0E6F377B5BE803B5270C3E55799CC1
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.413316531557305
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPOe97N:Yo6KUtjVLk4t94iU3KNoT8u8aps7N
MD5:	FE2775CA801BDDDAE9AE44C80BCD1E71
SHA1:	D7A2485AD2BBCA725D49E0B6D66E888A37FFD096
SHA-256:	B1DD4EF17C7021590C35B86502008450B3CD3B74A37528F4C83433EE0311E884
SHA-512:	2B415B75A7F083BAF7370B61470C61C2087126596EFD4C44C74700CB0AA9AFE7553CF57644C5D744088CB0A3BCFCA89E05C28E5FE7DF00A1E5C1B4198528057A
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.415716249022304
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPDPN:Yo6KUtjVLk4t94iU3KNoT8u8aYN
MD5:	860829C034680E0EE7A4E75626E4CAB3
SHA1:	0E0FF1D7243EF8EFBE9FDDE706C256A83C2BB35E
SHA-256:	005908710C5BDBBAD28C27D896396BF80E4367D6452C5339833BC5E4D950B071
SHA-512:	CB3177379973B226C77DF04AEF008751962431784E16127AD6231C4D33574C5931480E69ABB78D3AC34A288B0255F47ACE8F3331112FCF3DAD41824DC103CE16
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.415174310910745
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPKmA:Yo6KUtjVLk4t94iU3KNoT8u8anmA
MD5:	72C947E0C73A92D2BC88974655309D6E
SHA1:	0F2808CB9D2B3E24F44A368CE7B3A3FD360CB6C6
SHA-256:	7D073562BBAF438971344A679B6307392E76D65F5AEEACA009A5509FC866361F
SHA-512:	295E52FEC87D391E48535810C7FF21962729A20C8A016E3F54896105F2C201A702F4BA8DF71A28DF88643CC39D46D3D9C410BA8FA4CD99850A21D40ED989D8E9
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.420624429806909
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPNvwd:Yo6KUtjVLk4t94iU3KNoT8u8acQ
MD5:	F9C6C6CEBCCB2F131CB17C165A132489
SHA1:	5F63BAC92395B1FAF3D2D1CB0A9286713CE0D892
SHA-256:	279EDEB2587121DFB5A18D12602AD6B1E310548BF4842F04C711615FE788E597
SHA-512:	1DC981131B60CF532661BBA6797F99E7544CC7C1DEA582E61D8D83B6938A0A7A06979312FE47AC2C3BB4EF857ABD98550982189785CF0409C5FA3414F9527571
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.409534624525337
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPMGQ:Yo6KUtjVLk4t94iU3KNoT8u8aZGQ
MD5:	2261A38689D802D7D473BA0F8EAC33CC
SHA1:	8290929C28A215907184D85FED4F7021595FB82A
SHA-256:	8DBC3E995DD10F54C6AAD574794628AF5512CD6220670598DAF4EF858DB1EBA3
SHA-512:	0DE469E7590555475A9F15238445CA28C822478B143690F9D9C60F458478FAC939749E0803A70AC5B62FD9C371A0D1528B3F0165D817DBC4FFC1853549017AEF
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.418749167344785
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPvO:Yo6KUtjVLk4t94iU3KNoT8u8a/
MD5:	DD2AE774322D179F8647B5554EF01D07
SHA1:	416F325884BB7606D58CB4A2E7DE70CEEEC9AA53
SHA-256:	9BFCF4518B759895FD805F15172135572161D4B666BEF04F9D1C3F0434C0098F
SHA-512:	5BFBDFE52AD4DCE0F082D13CB9C1E52A4FF43AC7B32A844C174743BB688233F503915A551C3DE45C88647A677910530834736F1B3BEE855AC7D0506860F86AF0
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.413962058959067
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPh:Yo6KUtjVLk4t94iU3KNoT8u8aY
MD5:	602209ECA45FDA657E8C1BEE2757E908
SHA1:	475F9F59F8F4463F4E1DABD65BFA20212559ED99
SHA-256:	8675C5C5325D6DA861C968AA3A930DD4F14CB13AD64CB998E59EF9997163BB0F
SHA-512:	80A17466B5B40FF00EF7E8BD2A5722522813710018D63F722518FC780652EB490B64DAEC9E2014CC6DC249B5C011EA3E7899986164602A4C6EDD525B273425B1
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.4168213566205035
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPLb:Yo6KUtjVLk4t94iU3KNoT8u8am
MD5:	DAC028F697B041905405B7A55CF9B3D8
SHA1:	12CB2C73A13B477A4C9EF97693C981CEF70A0495
SHA-256:	B9B0ABF7400B5E8DA39CB3342227663EB5A1A8BA94DFBFC32743F704AD4D3165
SHA-512:	939B4475A827129BDA9EF2AFA9645C57E225F856EAA524ED64190B2C89AF41045A6531A8CE01F8C48163C608127A6647CCA9C266BCCEE3CF8BAF17262F17B618
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.420724091177496
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPX:Yo6KUtjVLk4t94iU3KNoT8u8ae
MD5:	B6C3FF864D7FA9C1392D05E35C8965F2
SHA1:	79E32880F755537FE6D243B8AB087690695409C8
SHA-256:	74F5671397517563CADD82661FEB43DD7019D639DCD617E38A38C95C5E53CC2C
SHA-512:	5A065D1FEE2C92742FD54F686E26C1930535A797173CD8B59428DBAADB43B72EA8DC7E5AF0381217F259B89E571B2E565232528515F36B47B89478C784E450B1
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.413720478136642
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPwHzE:Yo6KUtjVLk4t94iU3KNoT8u8apTE
MD5:	A11EA2CFF5ED13CE23C922D928E501FE
SHA1:	C788C8D8B3F4B51CF789BFF4FE21B8FE42B64B4A
SHA-256:	82D40D35B004CE215E8A62432D0366815888F8DDB3AEA7D8BE64C5737ACCCF37
SHA-512:	88F3C3F75C4BD45591161D1B43362D2100584C9408538EBEDE48570793DDC2E169CB40498D2B44F1169BDA0B9A429218023A8B9A114AFE6E8C8E1D867FBFAF3E
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3601
Entropy (8bit):	5.416615657180649
Encrypted:	false
SSDEEP:	96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPeU:Yo6KUtjVLk4t94iU3KNoT8u8aFU
MD5:	A92FF8A341F7310AA2D53A6812AB70DD
SHA1:	E7B0DAB07ABCC1A033CB642A21729D3ED70CB2B3
SHA-256:	9E146246C4CA8CA15AB051492C7BE66EA6D839BBE3FBCBB28E77A73B57579253
SHA-512:	A1725D76E0CE45D2E18EDE3067D28EDCC6D7F5268C0B914D80D4EA983E9D9024AA291E68B758FC1AB83A6203BAB192A3A35EDDDB2641C7166C9424F58C001141
Malicious:	false
Reputation:	unknown
Preview:	var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	5.76394653464386
Encrypted:	false
SSDEEP:	24:6cPy7dadSybOjRlnkggpHlnEAKETUy6fQXKb6fMocWjq1ic9I5RND:PyRaSgCLyZgfQaCMocWjeBSD
MD5:	F54102459770DF7B184D3F94E30BE47E
SHA1:	B9E5C05D6DEA1423A372AF7F6F636D25E78F2F71
SHA-256:	4CBF621E9656C2D933038D44F8DF11B778705CB58B44B672A3276790816C8CB7
SHA-512:	F045F21FA457A013126902DB74763747C9C92CE190CA887C3FEC7CC0A166CD94D16F3DBBD7738FF57A9B6DAB819C01AF7A997E9C585DC9DFA4465C3948D5C763
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Z.skejte aplikaci {0}",.. BANNER_RIGHT_TEXT: "Zrychlete proch.zen. internetu",.. TITLE_FIRST: "Zdr.uje v.s nep..jemn. automatick. p.ehr.v.n. vide. p.i pr.ci?",.. CONTENT_FIRST: "Proch.zejte internet rychleji pomoc. aplikace {0}. Zastav.me automaticky p.ehr.van. videa, kter. zpomaluj. prohl..en. webov.ch str.nek.",.. TITLE_SECOND: "Posledn. uji.t.n. . chcete zastavit automatick. p.ehr.v.n. vide.?",.. CONTENT_SECOND: "Aplikace {0} zastav. automaticky p.ehr.van. videa, kter. zpomaluj. prohl..en. webov.ch str.nek. Pokud o aplikaci Web Boost nem.te z.jem, nebudeme se znovu pt.t.",.. NO_THANKS: "Ne, d.kuji",.. YES_GET_IT: "Z.skat aplikaci Web Boost",.. LICENSE: "Licen.n. smlouva",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Prohl..en. o ochran. osobn.ch .daj.",.. PRIVACY_URL: "https://

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	5.487491669051489
Encrypted:	false
SSDEEP:	24:6cPVdSoggneOKTDy3DHZXQTDITDy3DHM1qrjgHMf8WpK8+kd83hnc:P/SojnMDkD5+DWDkD/CMf8W7d83hnc
MD5:	13B2434317B0B38EF2792AB705206345
SHA1:	C19DC3A0557DDBC22648DB8315327DB04E49D7C4
SHA-256:	CBE430AD526C866792FB1879C3BA38950F6D96F0CFE143C0D55959E76CDC830D
SHA-512:	A20BAD1268832606FFD782F9269712B74B5B29063702B4409203F97BA48A409088EDCF1E1A5A5AE26B3CF0777548A6B99EF48D84F020179C0CDFFA833B1CE2D4
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Hent {0}",.. BANNER_RIGHT_TEXT: "G.r browseren hurtigere",.. TITLE_FIRST: "Bliver du sinket af irriterende videoer, der afspilles automatisk?",.. CONTENT_FIRST: "Med {0} kan du surfe hurtigere p. nettet. Vi stopper automatisk afspilning af videoer, som s.nker hastigheden, n.r du surfer p. nettet.",.. TITLE_SECOND: "Vi sp.rger lige for sidste gang: Vil du stoppe automatisk afspilning af videoer?",.. CONTENT_SECOND: "{0} forhindrer automatisk afspilning af videoer, som s.nker hastigheden, n.r du surfer p. nettet. Hvis du ikke er interesseret i Web Boost, sp.rger vi dig ikke igen.",.. NO_THANKS: "Nej tak",.. YES_GET_IT: "Hent Web Boost",.. LICENSE: "Licensaftale",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Meddelelse om beskyttelse af personlige oplysninger",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "N.r du kl

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.487386177119065
Encrypted:	false
SSDEEP:	24:6cPRPcuFic3c4kEZkxQ0jwkIWDBpfCdEIfkSWFHw1H4lQ:PRkU3c4xZEjw1WLmhfBWFQNOQ
MD5:	E6D5A79F8479478591D19C9FD64D95E2
SHA1:	D6542CDD4F65FF5D7C5D674E04E97777C2EE956A
SHA-256:	B9C3248A92773ABA2F96541805F279991222496FAAC39D309D04062C43690398
SHA-512:	FBF2ECF3F1B2731AED498691441EE4BED3125252D49C985245EC8A668D38921C225586B8EC106C879F8853CD3F57A0F24D71E6D69F8C9AA17B54215D202F99B9
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "{0} herunterladen",.. BANNER_RIGHT_TEXT: "Surfen beschleunigen",.. TITLE_FIRST: "Wird Ihr Browser durch st.rende automatisch wiedergegebene Videos verlangsamt?",.. CONTENT_FIRST: "Surfen Sie schneller mit {0}. Wir stoppen die automatische Wiedergabe von Videos, die Ihren Webbrowser verlangsamen.",.. TITLE_SECOND: "Letzte Nachfrage: M.chten Sie die automatische Wiedergabe von Videos stoppen?",.. CONTENT_SECOND: "{0} stoppt die automatische Wiedergabe von Videos, die Ihren Webbrowser verlangsamen. Falls Sie nicht an Web Boost interessiert sind, fragen wir nicht mehr nach.",.. NO_THANKS: "Nein danke",.. YES_GET_IT: "Web Boost herunterladen",.. LICENSE: "Lizenzvertrag",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Datenschutzhinweise",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Durch Klicken auf {0} stimmen Sie Folgendem z

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	5.283036706036633
Encrypted:	false
SSDEEP:	24:6cPcdh0GeuxX+8PFGIPg+c8NS0I5mmiKfQOQryfRXCWkHW3Fx6bDoQ:Pah0G1+8NHc8mv46fIWkHW3FxlQ
MD5:	B28F08D9D120296DD7379C5B1FCE322F
SHA1:	8C2B2BD8B55A95CA917AB56C321F07413A2705C2
SHA-256:	394C322A45C33C8254E953825D51100A72F4E46C89FF9572363FFBAFDF856C07
SHA-512:	38EEF39D106F7BC7DF10C0AC319BDD282A6D01B6A6F2974832152777A003684645B7953E614A276B5F2FE080BED92022BE49D3C592433ADE48BF960A19254E34
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "......... .. {0}",.. BANNER_RIGHT_TEXT: ".......... ..........",.. TITLE_FIRST: "........... . .......... ........ ........... ...... ... .............. ...;",.. CONTENT_FIRST: "............ ........... .. .. {0}. .. ........... ... ........ ........... ...... ... ........... ... ......... ....",.. TITLE_SECOND: ".......... .......: ...... .. ......... ... ........ ........... ......;",.. CONTENT_SECOND: ".. {0} ......... ... ........ ........... ...... ... ........... ... ......... .... .. ... ... .......... .. .............

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	5.552455583118876
Encrypted:	false
SSDEEP:	24:6cPSdHKCjkAyNRtOzeWaAb5LOze8WRSonGfQX0CWP9AS1Xu96:P0/nyNRtlWhb5Ll8W2fQJWPuii6
MD5:	131FE8225F2B28BFE00167EA3608463D
SHA1:	5B6B53CC8E5D7676D7D32542FCCF48C69119E7E9
SHA-256:	E369F35EE15A52B0E6AA0759C3B0B1785A498373D7ADCACC5025825B92BCF7CE
SHA-512:	D03B544505825FA6303F12CC34E8BB5B5E5A7C92B3B56095DF39496A315C66C06540C54B0A6A6E476BEB0ACEC841E011E322283A4C5BE68C9264FFCC405CF61F
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Get {0}",.. BANNER_RIGHT_TEXT: "Speed up browsing",.. TITLE_FIRST: "Annoying auto-playing videos slowing you down?",.. CONTENT_FIRST: "Browse faster with {0}. We'll stop videos from auto-playing and slowing down your browsing.",.. TITLE_SECOND: "Checking one last time--want to stop auto-playing videos?",.. CONTENT_SECOND: "{0} stops videos from auto-playing and slowing down your browsing. If you're not interested in Web Boost, we won't ask again.",.. NO_THANKS: "No, thanks",.. YES_GET_IT: "Get Web Boost",.. LICENSE: "License Agreement",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Privacy Notice",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "By clicking {0}, you agree to our {1} and {2}."..}..//9E99FEA1E878016010E39E6DC0DE4B424DC67639A9399F9B0643DCC646F46E2D56D344353AB38A6D83222FBA1AEC13C6B1FECD0B5B79A0290C08B9D71BF420A4++

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	5.508548537767092
Encrypted:	false
SSDEEP:	24:6cPDV7dKPMce+abJtZ5hZUsMNei5hZGSHGNf9gnW+l5wUIoMMy:PJRCMceXbJrnAeingfGWWwp
MD5:	579ED2FBA0194F27E0C1BC969FAC1237
SHA1:	4B8257DFB5F63E8F4D4E7E4EB5395ABBCF409AAB
SHA-256:	1EE8715394BBD8CDCEEB30BBA8F0DF8CCDCDBB7467FC058DAAC2CCA8BFD6D768
SHA-512:	ABA83877080BD9D71ED5685AD11271B26EA378AB22ABAB1BFCD2C7C55ECC23CFABB17810F24FEEB0F584505E0B7BDCD9A7F5B719DDB169101F5BAB9C5496FB08
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Obtener {0}",.. BANNER_RIGHT_TEXT: "Acelerar navegaci.n",.. TITLE_FIRST: ".Los molestos v.deos de reproducci.n autom.tica entorpecen su trabajo?",.. CONTENT_FIRST: "Navegue m.s r.pido con {0}. Impediremos que los v.deos se reproduzcan autom.ticamente y ralenticen su navegaci.n por Internet.",.. TITLE_SECOND: "Se lo preguntamos por .ltima vez: .Desea detener la reproducci.n autom.tica de v.deos?",.. CONTENT_SECOND: "{0} impide que los v.deos se reproduzcan autom.ticamente y ralenticen su navegaci.n por Internet. Si no est. interesado en Web Boost, no volveremos a preguntar.",.. NO_THANKS: "No, gracias",.. YES_GET_IT: "Obtener Web Boost",.. LICENSE: "Acuerdo de licencia",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Al hacer clic en {0}, ac

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	5.5178296478987585
Encrypted:	false
SSDEEP:	24:6cPydhtceEumJUqeJmyUe8EFXjeseZqSHGNf9gnW+l5wODrsmv/Rxe:PUhtceEumJUqePUeVtjes5fGWWw8rseG
MD5:	485CE525D1681CB0335635844CE2D16C
SHA1:	6E2AD982F5C160C70DAB9AFC14FC48F6AB3814D9
SHA-256:	7A1FE444633AEC47F054F4A7E92A05E09143F9B5C6F6299F78D578EF89CA6DE3
SHA-512:	2DB7CCA137FF04EFF48881335F16E34432328AEF38599B6FA0D6D418A92C5D944139EB8D15FFE2AF90547AF163B5C118BF0B73195F824518C83EB9F105BD80F8
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Obtenga {0}",.. BANNER_RIGHT_TEXT: "Acelere la navegaci.n",.. TITLE_FIRST: ".Los molestos videos de reproducci.n autom.tica lo ralentizan?",.. CONTENT_FIRST: "Navegue m.s r.pido con {0}. Detenga la reproducci.n autom.tica de videos que hacen m.s lenta su navegaci.n por la web.",.. TITLE_SECOND: "Su .ltima oportunidad: .desea detener la reproducci.n autom.tica de videos?",.. CONTENT_SECOND: "{0}detiene la reproducci.n autom.tica de videos que ralentizan su navegaci.n por la web. Si no est. interesado en Web Boost, no volveremos a preguntar.",.. NO_THANKS: "No, gracias",.. YES_GET_IT: "Obtener Web Boost",.. LICENSE: "Acuerdo de licencia",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Al hacer clic en {0}, acepta nuestro {1} y {2}."..}..//C2B8

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1104
Entropy (8bit):	5.533658820853766
Encrypted:	false
SSDEEP:	24:6cPNdI11Y5jxKjrdTcv+qjYbKjrdT7vVa6EafIWd+HqniEKa0:Pnc65jxKjJAfEbKjJPgafIWoKiEKa0
MD5:	A3A2F699DF89C7FFABACBBAF5E8E91EA
SHA1:	C4206710CD670742CBC34361E33DBA7D619A7B98
SHA-256:	939E01CD1C3F7F0859032FA561A2863450924D7FD0B97A39A11E19C277247310
SHA-512:	8B5875EFB797BBB834F2D6934FCBB5B53A3D2E518E7482D0BC66660AC50FD6A8EC716B08B91111D7429AC82525133C1D01F6F0F2C5C3EAE7B4C2E96B20CE63A3
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Hanki {0}",.. BANNER_RIGHT_TEXT: "Nopeuta selailua",.. TITLE_FIRST: "Hidastavatko .rsytt.v.t automaattisesti k.ynnistyv.t videot menoasi?",.. CONTENT_FIRST: "{0} nopeuttaa selailua. Est. videoita k.ynnistym.st. automaattisesti ja hidastamasta selailuasi.",.. TITLE_SECOND: "Tarkistetaan viel. kerran . haluatko est.. automaattisesti k.ynnistyv.t videot?",.. CONTENT_SECOND: "{0} est.. videoita k.ynnistym.st. automaattisesti ja hidastamasta selailuasi. Jollet ole kiinnostunut Web Boostista, emme kysy asiasta uudelleen.",.. NO_THANKS: "Ei kiitos",.. YES_GET_IT: "Hanki Web Boost",.. LICENSE: "K.ytt.oikeussopimus",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Tietosuojaseloste",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Kun napsautat {0}, hyv.ksyt seuraavat: {1} ja {2}."..}..//6BC0EB1C50CF3FFD4B84644E29

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.4615085428947125
Encrypted:	false
SSDEEP:	24:6cPFd4FWZ8+GS85J9gUPIk6J9gU1qqKGfvW//e5Tqa:Pv4gZ8+GSYJmFJmsfvWO5ea
MD5:	69819CE4DC8655E86739F337A5555D75
SHA1:	21787FF52D6B715E237B5993DCE8666412C9255E
SHA-256:	B2CC919665286EE503930CFEBBB13D9E5516868A26BC3024246EB772B3CE36F9
SHA-512:	076D738C5CF42A4AFB8B505D34A6B90A4D560412B51547C2940FE54B8C8B6EE29BFF4D78410B92B6B1DB02538DD87C60525F11339C31C8C0674EC500D363D2E2
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Obtenir {0}",.. BANNER_RIGHT_TEXT: "Acc.l.rer la navigation",.. TITLE_FIRST: "Votre navigation est-elle ralentie par la lecture automatique de vid.os?",.. CONTENT_FIRST: "Navigation plus rapide avec {0}. Nous bloquerons la lecture automatique des vid.os pour .viter un ralentissement de la navigation.",.. TITLE_SECOND: "Nous vous le demandons un derni.re fois.: souhaitez-vous bloquer la lecture automatique des vid.os?",.. CONTENT_SECOND: "{0} bloque la lecture automatique des vid.os pour .viter un ralentissement de la navigation. Nous ne vous sugg.rerons plus Web Boost si vous n'est pas int.ress..",.. NO_THANKS: "Non merci",.. YES_GET_IT: "Obtenir Web.Boost",.. LICENSE: "Contrat de licence",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Avis de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "En

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1198
Entropy (8bit):	5.521864656488031
Encrypted:	false
SSDEEP:	24:6cPFd4n2vFhChN8zp42hBWxH+3wjq4CfjdW/kL5CQs3z:Pv4n2vbCN8V5ohCfhWMCv3z
MD5:	F526BBC946F3A205AA2580896B6B3EC0
SHA1:	EA8645820EAD666BB89DF118B1A3EAAC490B2C9C
SHA-256:	7F3D20629C69800A3580FB09BE734C98FCFBC3A1152A71DF8A295EAE963ECA1A
SHA-512:	9146CC663F313E292B48D9900296E064D3557222771A091DA4E9211AEEA013EA973175E088512C8A5CC13CCA338EF0D8DC4E3585DD2DC1363478CF21C445227C
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Obtenir {0}",.. BANNER_RIGHT_TEXT: "Acc.l.rer la navigation",.. TITLE_FIRST: "La lecture automatique des vid.os ralentit votre navigation.?",.. CONTENT_FIRST: "Naviguez plus rapidement gr.ce . {0}. Nous emp.cherons la lecture automatique des vid.os afin qu'elles ne ralentissent pas votre navigation.",.. TITLE_SECOND: "Derni.re v.rification.: vous souhaitez bloquer la lecture automatique des vid.os.?",.. CONTENT_SECOND: "{0} emp.che la lecture automatique des vid.os afin qu'elles ne ralentissent pas votre navigation. Si vous n'.tes pas int.ress. par Web Boost, nous ne vous demanderons plus.",.. NO_THANKS: "Non, merci",.. YES_GET_IT: "Obtenir Web Boost",.. LICENSE: "Accord de licence",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG:

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	5.571215841594757
Encrypted:	false
SSDEEP:	24:6cPuddK6oPnF2h0fPnFvydoZSfgBoW7ZFr7QCk:PAoJmyh6fgBoW7ZJ7w
MD5:	DA2E7828EFC93D58710B8B04C7DB6B7C
SHA1:	E61801A70F111D824D2D37A13BA725841D3A03C9
SHA-256:	C9B609BB21FCB96A8CC9B43415DA4A025CF2B252084C354C3AB9492CCABC2C1D
SHA-512:	137FAD175ACE386426DB257CD4728A4F35B51ACB1114366D660EB51F6F06F893A2A45F604F1DE189919CFBA63F0096D8CE0D4910F47419D9B38F7C74692ED099
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Nabavite {0}",.. BANNER_RIGHT_TEXT: "Ubrzaj pregledavanje interneta",.. TITLE_FIRST: "Uznemiruju.e auto-igranje videozapisa koji vas usporavaju?",.. CONTENT_FIRST: "Br.e pretra.ujte pomo.u {0}. Sprije.ite automatsko reproduciranje videozapisa i usporavanje va.eg pregledavanja interneta.",.. TITLE_SECOND: "Najnovija provjera - .elite zaustaviti reprodukciju videozapisa?",.. CONTENT_SECOND: "{0} sprije.ite automatsko reproduciranje videozapisa i usporavanje va.eg pregledavanja interneta. Ako vas ne zanima Web Boost, ne.emo vi.e pitati.",.. NO_THANKS: "Ne, hvala",.. YES_GET_IT: "Nabavite Web Boost",.. LICENSE: "Licencni ugovor",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Obavijest o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Klikom na gumb {0} u nastavku prihva.ate sporazum {1} i {2}."..}..//6F7F

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1214
Entropy (8bit):	5.6769032253660585
Encrypted:	false
SSDEEP:	24:6cPUXeUzUbI0mSCkFThSCfHPMDy7n7fn6ocWPjf50na:P6Ub06f6ocWtB
MD5:	14D55D48B2DAAB5D23A90A56740DB83D
SHA1:	06B83CD384EE32A026E0D9FA6A6DB0EE7ABFAE55
SHA-256:	DB9BB39DFCF5D4AC3828B61D048D8576C4EB2AA2CDB06FF31F50F74BB1D4605E
SHA-512:	0DD40B480A3C149006BE6180279F2580E20877A0462F57BCB30693BF1B8ADAA72B0921147E9C90CBB9C4B01EB3FC6F36EE5356EEAE1EB0415F38A529EC942D08
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "A {0} let.lt.se",.. BANNER_RIGHT_TEXT: "B.ng.sz.s felgyors.t.sa",.. TITLE_FIRST: "Bosszant., automatikusan elindul. vide.k lass.tj.k munk.j.t?",.. CONTENT_FIRST: "B.ng.sszen gyorsabban a {0} seg.ts.g.vel. Megakad.lyozzuk a vide.k automatikus lej.tsz.s.t, ami lelass.tja a b.ng.sz.st.",.. TITLE_SECOND: "M.g egyszer megk.rdezz.k: meg szeretn. akad.lyozni a vide.k automatikus lej.tsz.s.t?",.. CONTENT_SECOND: "A {0} megakad.lyozza a vide.k automatikus lej.tsz.s.t, ami lelass.tja a b.ng.sz.st. Ha nem .rdekli .nt a Web Boost, akkor nem k.rdezz.k meg .jra.",.. NO_THANKS: "K.sz.n.m, nem",.. YES_GET_IT: "A Web Boost let.lt.se",.. LICENSE: "Licencmeg.llapod.s",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Adatv.delmi k.zlem.ny",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	5.442339973712701
Encrypted:	false
SSDEEP:	24:6cPMd7T0JakK38gx/SS11ZuBWMfjkWFt8pMlgsb:PKX0Jah37yWMfjkWFypbsb
MD5:	C2D5DF9D8F15A3A2222C8FF4032B3024
SHA1:	C0E320D9C38FDEA60A824E7108206F9AC5AB131A
SHA-256:	C2B1CD64E33D247C90D81951B1EA6D2E80F691D9853D99ED30A8C79BB877AA5B
SHA-512:	FF51D4F261EB2B6EA7CCE2ED48BD598F6B4C1F0BFEB861D4C790F209EAB43242750D0F6D71554B6632A6B94DC7B6DA40FED3B2CA4B14506D9BEA6780341ED356
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Ottieni {0}",.. BANNER_RIGHT_TEXT: "Accelera la navigazione",.. TITLE_FIRST: "I fastidiosi video che si riproducono automaticamente ti rallentano?",.. CONTENT_FIRST: "Naviga pi. velocemente con {0}. Bloccheremo la riproduzione automatica dei video che ti rallentano la navigazione sul Web.",.. TITLE_SECOND: "Ultima verifica: vuoi bloccare la riproduzione automatica dei video?",.. CONTENT_SECOND: "{0} blocca la riproduzione automatica dei video che rallentano la navigazione sul Web. Se Web Boost non ti interessa, non te lo chiederemo pi..",.. NO_THANKS: "No, grazie",.. YES_GET_IT: "Ottieni Web Boost",.. LICENSE: "Contratto di licenza",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Notifica sulla privacy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Facendo clic su {0}, accetti il {1} e la {2}."..}..//7DA7C0F7B5065EB5A12CA5

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	6.007059551298109
Encrypted:	false
SSDEEP:	24:6cl/yRv8dFdqOdsgWOep2Ht+LRvcsvifh2AWtu8tgF/r:VyRv4dqqspnDRvbifwAWt+FT
MD5:	F47A7A53FD48042F80738E7AEC813386
SHA1:	E0DC87C2DF59BEF4EE194380D9085D13181B15A6
SHA-256:	6F466413BA056DF0311C2D14FDFBA8553D6E05EC20F4035DFDAA67182EF60129
SHA-512:	CCDE4CCDA7B18DD336DFA7FD42A154048FB582E694068C29F446D46B7E635E3463FDBF8492B69435CF003AD35E043061E956351B36692F698DE90CE87E13CE9F
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: ".....® .......",.. BANNER_LEFT_TEXT: "{0} .....",.. BANNER_RIGHT_TEXT: ".........",.. TITLE_FIRST: ".......................",.. CONTENT_FIRST: "{0} ......... ...............................",.. TITLE_SECOND: "...........................",.. CONTENT_SECOND: "{0} ................................. ................................",.. NO_THANKS: "...",.. YES_GET_IT: "............",.. LICENSE: "......",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "........",.. PRIVACY_URL: "http

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	6.064975827470784
Encrypted:	false
SSDEEP:	24:6cxJLqkS5WCtU2htU6iiZTjfbWIYlgv5EliI:rlKi0fbWIYOxXI
MD5:	07B988A86B01952414B864A4D8B4C6C9
SHA1:	7D6AD541D19A02F9B88A326FE53E70D071FF4F45
SHA-256:	DF05FD881E418F72177B6D67A92A55282F401F08799841BAB2C4DB658C265E37
SHA-512:	34AC1B3CAA2C3CFE8CDF8B6E35C5D91B4CA1CFEF86B553344DBFE3FA40F676335DEEE1D6459C26E36AC30F44CB11F6E232D432D57D1052BB213FBA70EBCAF3C0
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® . .. ..",.. BANNER_LEFT_TEXT: "{0} ..",.. BANNER_RIGHT_TEXT: ".. .. ..",.. TITLE_FIRST: "... ... .. .... .. .. ... .....?",.. CONTENT_FIRST: "{0}.(.) ... .. ... ........ .... .. .... .. .. ... .... .....",.. TITLE_SECOND: "..... ........ ... .. ... .......?",.. CONTENT_SECOND: "{0}.(.) .... .... .. .... .. .. ... .... ..... . .. ... ... ..... .. .. ......",.. NO_THANKS: "...",.. YES_GET_IT: ". .. .. ..",.. LICENSE: ".... ..",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: ".. .. ....",.. PRIVACY_URL: "https://www.mcafee

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	5.495580321113206
Encrypted:	false
SSDEEP:	24:6cPymdI+c1iPRRj+7+yR+2nr4rtR++Moj+wnMfQwsHWpdGCIVo+h:Pyoqg5QJ/etrMojMfQPW3GzoI
MD5:	05309DA086E29EB352618269D79BB53C
SHA1:	B36EA94398C3919E03BE6FBF46950F31852E5150
SHA-256:	87ED48CE753A2F817AC3C973CF505FC4244BE4B8A891AD26208383FDA65AB9D0
SHA-512:	E1FAA43BED6FB99FFD45D54725CD8ACB4723D4402CB6E4C438AC1142FDA74C59C15FA6B0B1B8C013DACA187C3BC5CB5D45D684D7591C921DFDB1AF3EC8312A7B
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "F. tak i {0}",.. BANNER_RIGHT_TEXT: "F. opp farten p. nettsurfingen",.. TITLE_FIRST: "Sinkes du av irriterende automatisk avspilling av videoer?",.. CONTENT_FIRST: "F. raskere nettsurfingen med {0}. Vi stopper videoer som spilles av automatisk, slik at de ikke sinker nettsurfingen din.",.. TITLE_SECOND: "Siste sjanse . vil du stoppe automatisk avspilling av videoer?",.. CONTENT_SECOND: "{0} stopper automatisk avspilling av videoer, slik at de ikke sinker nettsurfingen din. Hvis du ikke er interessert i Web Boost, vil vi ikke sp.rre deg igjen.",.. NO_THANKS: "Nei takk",.. YES_GET_IT: "F. tak i Web Boost",.. LICENSE: "Lisensavtale",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Personvernmerknad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "N.r du klikker p. {0}, godtar du v.r {1} og {2}."..}..//993D6614A86BD47E19

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	5.441186407010889
Encrypted:	false
SSDEEP:	24:6cPMdeWjkB8UjFpXIMtRBviSqLwz4tRBviV3rEFihdEMtB2pQXbEnWtB221G++VO:PKeWniFpYMtz1qDtzsr7djPuQQWPxGbO
MD5:	2A58C2C85DC3440F5C3D2AE340359D00
SHA1:	2F9D03FBA2BC5A155511DC32978A50EEF6FB88B5
SHA-256:	CDE91C092362572695FEDEEBC09F432F969CAD44AB7760D5357C2A22D4E4234E
SHA-512:	EFA948D04DAD757300D5498C41FAE0EC38462C3C9411A438DD8B3183E6F5DA86896AA8F6482C2AAFFC72AE1B0A314CA8C8DC4445B1A6A0ACC2A68C4085DB3F8A
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Download {0}",.. BANNER_RIGHT_TEXT: "Internetactiviteiten versnellen",.. TITLE_FIRST: "Trage prestaties door irritante video's die automatisch worden afgespeeld?",.. CONTENT_FIRST: "Sneller internetten met {0}. Wij voorkomen dat video's automatisch worden afgespeeld en uw internetactiviteiten vertragen.",.. TITLE_SECOND: "Weet u zeker dat u automatisch afspelen van video's wilt stoppen?",.. CONTENT_SECOND: "{0} voorkomt dat video's automatisch worden afgespeeld en uw internetactiviteiten vertragen. Als u geen interesse hebt in Web Boost, vragen we het niet meer.",.. NO_THANKS: "Nee, geen interesse",.. YES_GET_IT: "Web Boost downloaden",.. LICENSE: "Licentieovereenkomst",.. LICENSE_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. PRIVACY: "Privacyverklaring",.. PRIVACY_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. AGREEM

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1217
Entropy (8bit):	5.674978904956985
Encrypted:	false
SSDEEP:	24:6cPGdrelNj+8d2gQwYsklKGoTE3abMfXMGGnWjM/z9UqEW1m2j:PIrevjvd2gRcljfmWjXMj
MD5:	36F9D4618E56B3DF336564E691E630DA
SHA1:	2F90F9C1AF4A12138114FABB29A5045F90B0B016
SHA-256:	524B6019564E52C289063CB68EF261F7E2B959306F010AB0E0FC6E7017CDBD13
SHA-512:	0B8CFF2B6DF92D4E3554E350E9F3C6BF4C1113BC8CFB5C72B44179F631272C6065DC4B4DDC88443DE6786C6C7A59C6780C70B81BA7E5D3D3B790E4D3120D3306
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Pobierz produkt {0}",.. BANNER_RIGHT_TEXT: "Przyspiesz przegl.danie Internetu",.. TITLE_FIRST: "Irytuj.ce automatycznie odtwarzane filmy spowalniaj. Ci prac.?",.. CONTENT_FIRST: "Szybciej przegl.daj Internet dzi.ki programowi {0}. Powstrzymamy automatyczne odtwarzanie film.w, kt.re spowalnia przegl.danie sieci.",.. TITLE_SECOND: "Sprawdzamy po raz ostatni . chcesz powstrzyma. filmy przed automatycznym odtwarzaniem?",.. CONTENT_SECOND: "Program {0} powstrzymuje automatyczne odtwarzanie film.w, kt.re spowalnia przegl.danie sieci. Je.li nie interesuje Ci. program Web Boost, nie spytamy ponownie.",.. NO_THANKS: "Nie, dzi.kuj..",.. YES_GET_IT: "Pobierz program Web Boost",.. LICENSE: "Umowa licencyjna",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Informacje o ochronie prywatno.ci",.. PRIVACY_URL: "https://www.mcafee.com/legal",..

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1162
Entropy (8bit):	5.519383265039112
Encrypted:	false
SSDEEP:	24:6cP4djLetDhf8CL369L3yM03Byf9HWfOBICY2m:PmjLifLq9LCMhfBWGBIC+
MD5:	DC8EEF5EE3D9EB8DFDDC3DC7C7ADB5D3
SHA1:	91C651D7BE09D4A94AEC2DBBFC7C9A844D76A634
SHA-256:	5FB0CD9911D536C89A98E4CB5AB2379A4A95C5D6DF0CB1B7EBA362181A6F4D6B
SHA-512:	AB289CDECEB14C1744DCF2AA2427D7BB1E332C973E60009E6BF140DB80A9DDF856E4C76CFE753A757BBC641CADE6C8DEBA10B7C2015A04A9C34AD8AB8F0A2FFF
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Obtenha o {0}",.. BANNER_RIGHT_TEXT: "Acelere a sua navega..o",.. TITLE_FIRST: "O v.deos irritantes de reprodu..o autom.tica est.o atrapalhando voc.?",.. CONTENT_FIRST: "Navegue mais rapidamente com {0}. Interromperemos v.deos de reprodu..o autom.tica que desaceleram sua navega..o.",.. TITLE_SECOND: "Conferindo uma .ltima vez. Deseja interromper a reprodu..o autom.tica de v.deos?",.. CONTENT_SECOND: "{0} interrompe v.deos de reprodu..o autom.tica que desaceleram sua navega..o. Se n.o estiver interessado no Web Boost, n.o perguntaremos novamente.",.. NO_THANKS: "N.o, obrigado",.. YES_GET_IT: "Obtenha o Web Boost",.. LICENSE: "Contrato de Licen.a",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Ao clicar em {0}, voc. concorda com

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	5.505488488198548
Encrypted:	false
SSDEEP:	24:6cP3dWF+fYGGxf5SQ03x6Sf9HW3XjQlaTb:Ptq+Arf5SQIbfBW3XUlG
MD5:	35BFBCD88C0626BC050539EBC2F1066B
SHA1:	31AAB037003C15CDB897B25B76F80E5DA83EB01A
SHA-256:	64247E718734C496B0A02FA652EE904EE5D3DDF5F980B68FACA675AC1845D00E
SHA-512:	148690BF7B8E5FFF6F1545973B079A37FF11CF33E2582AA82169F64EF5E223AD6D5457F2C9F5F9BE3A983A5DEEB10CBC37127373F55AEC24D58301065D666717
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Obter o {0}",.. BANNER_RIGHT_TEXT: "Otimizar navega..o",.. TITLE_FIRST: "A reprodu..o autom.tica de v.deos . inc.moda e atrasa o seu trabalho?",.. CONTENT_FIRST: "Navegue mais rapidamente com o {0}. Impediremos a reprodu..o autom.tica de v.deos que reduz o desempenho da navega..o.",.. TITLE_SECOND: "Vamos confirmar mais uma vez, pretende impedir a reprodu..o autom.tica de v.deos?",.. CONTENT_SECOND: "O {0} impede a reprodu..o autom.tica de v.deos que reduz o desempenho da navega..o. Se n.o est. interessado no Web Boost, n.o perguntaremos novamente.",.. NO_THANKS: "N.o, obrigado",.. YES_GET_IT: "Obter o Web Boost",.. LICENSE: "Contrato de licen.a",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Ao clicar em {0}, aceita o nosso {1}

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	5.252142407380732
Encrypted:	false
SSDEEP:	48:PKgN6a39f9+sVX0Rws35BONfQrWW5SU4j:Watf9HVE2sJBDgj
MD5:	FDA1B470115613F7F1772E5EBCA11933
SHA1:	290D5C22924641E57358BDD325A3CAB3BB7B2236
SHA-256:	C6F6CAE5F3A6EA8E622E2E84274082AD4B073513B6E01B8D80686C1C687ABB10
SHA-512:	D9817406AA129ED013F031A2CF6E6EDFA2EC050ECCA818B82DC3A4EE20105CD1172CD83433F2422474B1297F636A76457DBF0D3ED1C6A96BF3C43287720416FD
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "........ {0}",.. BANNER_RIGHT_TEXT: "........ ........ ........ ...-......",.. TITLE_FIRST: ".......... .............. ............ ..... ...... ........?",.. CONTENT_FIRST: ".............. ...-........ ....... . ....... {0}. .. ........... .............. ............ ............, ..... ........ ........ ...-.......",.. TITLE_SECOND: "........ ....... .......... ............... ............ .....?",.. CONTENT_SECOND: "{0} ......... .............. ............ ............, ..... ........ ........ ...-....... .... ... .. .

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	5.764512673480726
Encrypted:	false
SSDEEP:	24:6cPGd2mcJsq8vMi8zJ0+46fQXwWjel4Be5lXt:PINesPtKFfQAWjw4iXt
MD5:	1CC87CA40B12BCE96E8F71C5367BF3A4
SHA1:	27079CEC94688B007171912B8093C7B2B6311736
SHA-256:	43142BE02A86B7BC0D43F557C8AC52E1237702219B79C43B840E0A2F8A83D092
SHA-512:	0FD98CAA5722AE3167043BCA303216FAAF598F4B76A2934EC992A350E5ADE1000711E8B94AA38FC9EB13329BD14B7ADC6DAD6AAF58F99380ECD4031674532BD6
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Z.ska. produkt {0}",.. BANNER_RIGHT_TEXT: "Ur.chli. prehliadanie",.. TITLE_FIRST: "Spoma.uje v.s otravn. automatick. prehr.vanie vide.?",.. CONTENT_FIRST: "Surfujte r.chlej.ie s {0}. Zastav.me automatick. prehr.vanie vide., ktor. v.s zbyto.ne spoma.uje.",.. TITLE_SECOND: "Naposledy sa p.tame: Chcete sa zbavi. otravn.ho automatick.ho prehr.vania vide.?",.. CONTENT_SECOND: "{0} zastav. otravn. automatick. prehr.vanie vide., ktor. v.s brzd.. Ak nem.te z.ujem o Web Boost, nebudeme sa op.ta. znova.",.. NO_THANKS: "Nie, .akujem",.. YES_GET_IT: "Z.ska. Web Boost",.. LICENSE: "Licen.n. zmluva",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Prehl.senie o pou..van. osobn.ch .dajov",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Kliknut.m na tla.idlo {0} ni..ie vyjadrujete s.hlas s

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	5.575374492160051
Encrypted:	false
SSDEEP:	24:6cPud3hBmY2dFwHPhtDmY2dFWoZ1fjjWxK7EXLO:PA3hBmY243mY2HfPWxKoX6
MD5:	0708D7C8BA2784874DC2DA7CBE63A39B
SHA1:	66C61A1871DC53182F0E54626489DFA5DB8E7DDA
SHA-256:	AE3C6A03075595051AE7DFE32FCC92C24106136681EBB6FAAD6235419E83EC10
SHA-512:	34D431F29579856A0E57B80A62CDAEE4D6DEF4C35949E6A87498142B3CA1B39EFD8A6E594CA81190A1257FC355E2E8C7F8E20275C8A685F62BDC01EAA945C3CB
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "Nabavite {0}",.. BANNER_RIGHT_TEXT: "Ubrzaj pregledavanje interneta",.. TITLE_FIRST: "Uznemiravajuc.e auto-video snimke koje vas usporavaju?",.. CONTENT_FIRST: "Brzo pretra.ite {0}. Spre.ite automatsku reprodukciju videa i usporavanje va.eg pregledavanja interneta.",.. TITLE_SECOND: "Proveravate li poslednji put - .elite da zaustavite automatsko reprodukovanje video zapisa?",.. CONTENT_SECOND: "{0} spre.ite automatsku reprodukciju videa i usporavanje va.eg pregledavanja interneta. Ako vas ne zanima Web Boost, nec.emo ponovo da vas pitamo.",.. NO_THANKS: "Ne, hvala",.. YES_GET_IT: "Nabavite Web Boost",.. LICENSE: "Ugovor o licenciranju",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Obave.tenje o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Klikom na {0}, prihvatate {1} i {2}."..}..//84E25EC7A69C02D3A5

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	5.591204113246994
Encrypted:	false
SSDEEP:	24:6cPYodlhp2AtRW5Tm0XECCyK45Tam0XEEHh6qrTojI/HfMXGWNIqYO3EP:PYWXYAbWRmsEkTamsEEBbHYIffRWqqYh
MD5:	7BDA5B599B7C01A075E7BEFC7813F8D9
SHA1:	EA17D8D828753E4D8C447BFE2815E4C2382FE285
SHA-256:	086D16DBC19B63433C58DFC3B1335613F36CF0828E5809953F2514415A4837AF
SHA-512:	5A3B63ED3615CD93F24A28651052AE3065D958741A1100CC49EF20264CEE41C47575F02CC152F0CEED97F3E0791F6E68033CB315B0C3CF6069F0EBCCA2DF614D
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "H.mta {0}",.. BANNER_RIGHT_TEXT: ".ka hastigheten p. surfandet",.. TITLE_FIRST: ".r datorn l.ngsam p. grund av st.rande automatiska videoklipp?",.. CONTENT_FIRST: "Bl.ddra snabbare med {0}. Vi stoppar videoklipp fr.n att spelas automatiskt och sakta ner ditt webbsurfande.",.. TITLE_SECOND: "Vi fr.gar f.r sista g.ngen . vill du stoppa automatisk uppspelning av videoklipp?",.. CONTENT_SECOND: "{0} f.rhindrar videoklipp fr.n att spelas automatiskt och sakta ner ditt webbsurfande. Vi fr.gar inte igen om du inte .r intresserad av Web Boost.",.. NO_THANKS: "Nej tack",.. YES_GET_IT: "H.mta Web Boost",.. LICENSE: "Licensavtal",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Sekretesspolicy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Genom att klicka p. {0} godk.nner du v.rt {1} och {2}."..}..//0A8D87FBA3E9D5

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	5.6776998815564585
Encrypted:	false
SSDEEP:	24:6cP/XRGHmeqM6+bBNLefXtexcJYOEvKxUew53ksNefXtexcJ6dp7hVE9tClfs2Q+:P/XRGHmelbBFevBuv7ew53NevBS1nwOv
MD5:	4E56193A3297B1E9557ED39BA94AC37D
SHA1:	29F70D83EEB12818ABDE4F3CF11B34729DCFC238
SHA-256:	29E87C4E0E70CCFAA287DB987DD43C7A1E5EC11ACC9D67811C6AB1352EAEA6F0
SHA-512:	529DCFF15C8D845E5D5C02E1C2AE53100DCA4064CC804D53EB676F11EAC0ECC01063C92D0D33C9591E42C26EE272414C5D8CF8197DAD78DACEDA43726DCF0847
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: "{0} Uygulamas.n. Edinin",.. BANNER_RIGHT_TEXT: "Web'de gezinmeyi h.zland.r.n",.. TITLE_FIRST: "Otomatik olarak oynayan can s.k.c. videolar sizi yava.lat.yor mu?",.. CONTENT_FIRST: "{0} ile daha h.zl. g.z at.n. Otomatik olarak oynayan ve web'de gezinmenizi yava.latan videolar. durdururuz.",.. TITLE_SECOND: "Son kez soruyoruz, videolar.n otomatik olarak oynat.lmas.n. .nlemek ister misiniz?",.. CONTENT_SECOND: "{0} otomatik olarak oynayan ve web'de gezinmenizi yava.latan videolar. durdurur. Web Boost'la ilgilenmiyorsan.z tekrar sormayaca..z.",.. NO_THANKS: "Hay.r, te.ekk.rler",.. YES_GET_IT: "Web Boost'u Edinin",.. LICENSE: "Lisans S.zle.mesi",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Gizlilik Bildirimi",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "{0} d..mesine t.klayarak {1} ve {2} ko.

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	6.419947674670556
Encrypted:	false
SSDEEP:	24:6cyPdC/0RFVLakZxaoK4K1nfmHWMm3YEp35a59:yVC/0VLvLVSf4WMP0pa59
MD5:	84E101F05A1D8DFC8203992A3DDC538C
SHA1:	F91528105EC2C247FF1219B7C4CB9A49CCCCD08B
SHA-256:	A8BB08EA1EF24652E3B46FC4DB556DAF5096AA9E3FE54DDC87DDA2AD8E70525A
SHA-512:	AEE1CA900B85B3D1AC0BE63D88F6DE8CE50D92CA64EB2ED688866EDFDF6CB5B33AFC98C9492B1C6561C46031B98ECA4F4B566644166987C96BA3A7427CD06DA7
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "...® Web ..",.. BANNER_LEFT_TEXT: ".. {0}",.. BANNER_RIGHT_TEXT: "......",.. TITLE_FIRST: "....................?",.. CONTENT_FIRST: ".. {0} ........ ........................",.. TITLE_SECOND: "....... - ...........?",.. CONTENT_SECOND: "{0} ...................... .... Web ...............",.. NO_THANKS: "....",.. YES_GET_IT: ".. Web ..",.. LICENSE: "....",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "...{0}.........{1}...{2}.."..}..//7392544C576623D176BE930552620216E5645406C01C5F6E7A7320D326DBB260F969

C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1018
Entropy (8bit):	6.391792382062579
Encrypted:	false
SSDEEP:	24:6cPGdRXudZh7df/9cIDlcFesbfOKU6D8Gfg1WJ9nsUW:PIBudv5H9cIDMy9opfg1WJul
MD5:	3417F073D100541863A6F190EA76806D
SHA1:	10BE0EE88EC22B3FAF87CB33273A09B2D4708F47
SHA-256:	C85F6C7A5CC3A3C27834B514D29B12C951463E9A268C4C8E5066E586D9E05CF4
SHA-512:	7E59B4D646A5468B4B6EB9E4A72004D57BB1516E1A4D32896361777226DECF33CFD463C6218A5A1DF33A19A387A8BB2C83EA14F9BD4B04367823C894A1B1AA7E
Malicious:	false
Reputation:	unknown
Preview:	.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee® Web Boost",.. BANNER_LEFT_TEXT: ".. {0}",.. BANNER_RIGHT_TEXT: "....",.. TITLE_FIRST: "...............",.. CONTENT_FIRST: "..{0}....... .....................",.. TITLE_SECOND: ".....................",.. CONTENT_SECOND: "{0} .................. ... Web Boost ..............",.. NO_THANKS: "......",.. YES_GET_IT: ".. Web Boost",.. LICENSE: "....",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: ".....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "...{0} ......... {1} . {2}."..}..//9AFD782E1B1F9B182C57AD02121A13AB2D4F54FD44623F2859ACE68B1E3B481CD5899C087FDDACB0F70D23236BD597B5B35214EA3DFF8B36

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-cs-CZ.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.258396992693107
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+WGVEBJ:+sv+K5+CtTFCqsUz0AUoey+W3
MD5:	E432BCBFEAEE87385B02C9DAEC7A45E9
SHA1:	C9C73D49A369E3D0A4387CC1C8289781D02E26AB
SHA-256:	FC89B93845F3C3BDFE7E2C9FF404F609F1142AE0BB5D57CB0117292845DC8952
SHA-512:	A9010CD5297C8F69A08DE80FD55FC134999AC4CCF110054F663647D0FB56CE97F316A30206C086FCCB5C2746DE4568082B50B60AB4F0A72B607D1204D6F1AC54
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-da-DK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.259824917218896
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+YBd:+sv+K5+CtTFCqsUz0AUoey+Ud
MD5:	E6EFCC58CBF3FE188B5EDFC4240FE3D5
SHA1:	5652ED16B3912AE1F76597242B7EB1F192CE3669
SHA-256:	75EB15463242D7D9B90E466DB77489E015254AD444B9F8E2308DBAC2E5263B22
SHA-512:	C7AEFA04D440C571443D79E03CFCA5073EEB7281CCBE63344055A3825A024E5EE5DC7213F55DAF14FB671114961EE1A74686D42C4760D27C65D9D97A8E2CC0DE
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-de-DE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.262808439303815
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+lahZ/:+sv+K5+CtTFCqsUz0AUoey+yt
MD5:	126B2664A339D6FB8760D9BC73D84B55
SHA1:	E2556275507C23846D9414DA062CAC4F96053FA3
SHA-256:	211FF910A8B682DE88F830EFB649DA450459A5F2720A8C3C257E2AE26B7FB629
SHA-512:	02432A45A49E9EEDE719C1080E636C46CC95DE9EBBEB9C0E721B4FE59B65730CC74BDD4C0BC97D107E18A54BBC4A6BCB056E0733002D8A49DB82761583F8B6A2
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-el-GR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.250514396470622
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+SI2ds:+sv+K5+CtTFCqsUz0AUoey+SIIs
MD5:	1BB5007EC821846E7EAAE50BEE29400B
SHA1:	BE0989E86A7172189636F05F1F463B3C17A3E34E
SHA-256:	4BD58D77C2C4F882CD43C33BC8993EBD59AC3E9AFC880AFCF4F72E33044D1D84
SHA-512:	947EE2282D03EA5365B267FCB0699B98592EA7551B5FBA9D889AF3AB804CC69C6E4B73E2DCCDD12FB49598C1CFCCD19B94CBC33C3D9D8903F9337C79A92B79C7
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-en-US.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.263656257316456
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+I:+sv+K5+CtTFCqsUz0AUoey+I
MD5:	1E90B6FB58BB719BF9F5CD844D034BDB
SHA1:	8893DB6AB509181BE7B7D2D00C784018A9ECA572
SHA-256:	2B1682DC92FD2C2321E4B476BE92B3304CFDADD861E3B13950ED34BB9CDD7D9C
SHA-512:	34233711361780DD80F1BB23C4775F579A852C0D1128D5AE70A42E4717370634C2E611BDC766CF79C80C0B8A9357044878C80E4DC390BD355FB3B2A8E99D6994
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-es-ES.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.2605492733783175
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+CZc77:+sv+K5+CtTFCqsUz0AUoey+Cu
MD5:	D5422C671A29AA13C14D7592DEC8C162
SHA1:	6CBA757577FB01565C2C6912275CB1B8E14CB7EA
SHA-256:	E496D07EFDC11A97C68BBAB2C0AEDF6A6F49371386EC77E690783E18A2C43050
SHA-512:	7D866BD057830573242702C71F2A445EF0631512C21BBE703177E221EEF753CC20DBCA2A28290BE5CC8DC6D1EF2C8354EA5E034F2E1AB10A1C1D9FF9A59F45A5
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-es-MX.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.254703293295225
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm++XXR:+sv+K5+CtTFCqsUz0AUoey++x
MD5:	61653455E8DEF7888F9CB0305F75C3D3
SHA1:	37A83C001A4FAAF312058312E3B1E3BB5070794E
SHA-256:	1B6346FE64AA3AA5B572B2E1DBFF18B202E284CD1014570FFC8ADE585B302E81
SHA-512:	1279F29FBC0C54534E44B9AEA8AF306227FBB1F726EA296F9ED51E5D4AAFC4B02638C24614B5CD75FA1DDBC326D7B7B44868AC1365056765036ECAE5D8D7477B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-fi-FI.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.254081460877839
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+UcY:+sv+K5+CtTFCqsUz0AUoey+UcY
MD5:	D6D659D7E29C11B9E71BA9751526CB50
SHA1:	EC814A32A55FC4F13B8519A970F689D7908CC019
SHA-256:	C3DA01FC85ABB3B8CB4F4B8DEFC76843733DEE8466326BDEDA33CBE9A86FCEB0
SHA-512:	18CCA3171271C7AB4226DC320B187DFD9C6F0A4F0D847EC26F1A567746100F00EA12D554EF2E14D661BB0970C0969BFEB921335F435604A5951FFE7D12F9A1DF
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-fr-CA.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.2638417304080045
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+0Ot3R:+sv+K5+CtTFCqsUz0AUoey+X
MD5:	61AB3CB0B261855CB17B76E3D7F27D26
SHA1:	4349E21E6E15CD0D61F85BC1CFE9BDE70317D3DD
SHA-256:	633C448DD139ACA42DC3509FCBE527A4153866202333F2C0C88515A43BE1E605
SHA-512:	2AB8C9A917568590CDD6BBE40EF8DF6C55B353B9B3729B269371C0092DC44DF90DD40BDC066318F1F69A2288E7AA32BF7FA216ABF56F54D62E09909E61032280
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-fr-FR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.251513708787733
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+XiH:+sv+K5+CtTFCqsUz0AUoey+XiH
MD5:	840D2073938FD66D7A56E02448B9A230
SHA1:	95764ADB48EE7225E1F0D371C7DDF6EBF210C637
SHA-256:	AE1CE41872A33CC4B4F1273864CF4BC808074217241ED0D493D182957B2A6112
SHA-512:	7531B35137835AEC7082DF2BA510E3955BC9F13FE841258EF6E78ABE5808951E69031F057CF7D83FDAAEB056C11643772A17908007B8D23B26FB4CC4F349A9D4
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-hr-HR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.25353170947426
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+HC0H:+sv+K5+CtTFCqsUz0AUoey+N
MD5:	B3A70D45CC18F358A88E113AC75A7D3D
SHA1:	AF7BD5421F57D25DDFAFB96C546390037BBF6E65
SHA-256:	D1CD05409FC1AE19B3CC6C1EC49CCFA0E95B003ECC571A0FCA2061AFBA40A84F
SHA-512:	3115C373D5BE4D37AE386F2C1E4FA3041C93C135CD18E763720EBE4252AD8F17553A92B1B93D8AB9DB01A40A712DDE73476B289AB3C4B4C5DCC6588E72E680D4
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-hu-HU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.255949296478074
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+Ifu:+sv+K5+CtTFCqsUz0AUoey+IG
MD5:	98067AE43967A82251E84B12DF85A8DD
SHA1:	BA03DE00AD8AC8D72B096A22B508532326412A75
SHA-256:	F4E6129E4FFE64D3225555F8961BAC90504C569E5303C3F456CD294DC72C38A2
SHA-512:	C87F36EC6BEF278DA19225CC2205FEE7D554CF9D3F4D54F631D3753055EBF1C0C9279E74BF5BCBC0DD3649B67AC03F41B3B7857BFEE766B6AC9264903CA613E5
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-it-IT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.258223944351212
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+ODp:+sv+K5+CtTFCqsUz0AUoey+ODp
MD5:	DD1186C6BB7182CDF944230B1B84F203
SHA1:	E58384D55EFB0A8152B5E7FB0D284D207A6DAB45
SHA-256:	FC2573AE44024F026E9A9AE007CA594FE54A28676F239ECED87685BB30AC44AE
SHA-512:	4A4B10C87BD0E669367E53BAFAC245886AD01D121F22A6C1AB10123B3C2F6568615384A5151351BA2EF9FE3FBBF8E53F87E030122CD60264D196300153909C2F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-ja-JP.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.259613989507533
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+AgF:+sv+K5+CtTFCqsUz0AUoey+AgF
MD5:	8C853F6B7169EF767B1F017C94A9C4E1
SHA1:	9F2F9C85FDEA7ED4845B7081F431910DAE26CD2D
SHA-256:	CF47F23BD610847A655C8A47E6F60B69B98D45AAFEC698FD1653558C852D043B
SHA-512:	ED87256EB48D800DF9E45974FF25416C6AD77C4B3B7EF86033431C492D3CB1B3E5D3CA5F2D02C980B68EAF3F39FC30DAAA1FFC777B8CFA592178945244296669
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-ko-KR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.2600583102008995
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+m/L:+sv+K5+CtTFCqsUz0AUoey+4
MD5:	656A807AC0F85B10B4DB8B216B2DC980
SHA1:	8558EDAFA608F45EB3E9E17DC0134B62CB897E78
SHA-256:	C08314FD308DFDA2F14DED5349365265F52CC1E1320408361E7054EDEBB55C53
SHA-512:	62FD7E8223ADBA7D3EAEA0B6B82F974BAE1EB14D44E8D5A0EED81E4EDDB98A0B215C8D9CC8376227D50C8156337FD175AAFB9FA30557EDF9E828A936BDE90BD6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-nb-NO.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.248998140820009
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+cjsq:+sv+K5+CtTFCqsUz0AUoey+isq
MD5:	6514A95AE330C5D2683459597D58C37B
SHA1:	430CC77A327D419D4533F83798E26BEE083CAE2A
SHA-256:	001C4FCC89B67489E2411234F073DB503A7933A9E1F1A59A7FF0C4A4939A665A
SHA-512:	4B83C152090D821645747337FB5CB1969EA6005CB904305FAC604852A4D4A2FAD07D605801A7ABEB9A996DD8D10B8D76F8BC57AC2371B0A7596C9186D9E7B162
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-nl-NL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.260620329900719
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+W2dAE:+sv+K5+CtTFCqsUz0AUoey+zaE
MD5:	C65EFFBACA197A8D9CA072224878B643
SHA1:	AFD7A47E7F80D643D25758EFD17D5D21D9C358E5
SHA-256:	AA2B28702812F9409C3AEE27DA276C033ECA263A844C2A7FCEFD3E512602107B
SHA-512:	050C6C7D996AD9DFD172A80037FE9DEF4FA76A39C0FB66F788A49AF6BDA8210ABBC578C8C7EB0AA6C5E18E74C46220270C66CDBB3870B41F6C5560291C2F22E0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-pl-PL.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.251543116510892
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+o6CE:+sv+K5+CtTFCqsUz0AUoey+p9
MD5:	805BE65BE7B1D7AD11E3F863C0150BF7
SHA1:	6BEDA8787C4DC77F6E2786AD6FD14065F86C4D7E
SHA-256:	C6B46F920C88EA3A5A7868210777F1D5E2A7973DA67F55D7CF99640F6CD2E94E
SHA-512:	553F8A437A2386004841502E7BE0C9907AA9932E8380B68BA8896C25C359AB6C95A38DE8C9F0E6AC6BF79364751435427A685F87C0227A877536B936A0BAC3AF
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-pt-BR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.261405399661556
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+hRb:+sv+K5+CtTFCqsUz0AUoey+h5
MD5:	9EF0C9182629E170C9E16E43E6F90690
SHA1:	D67A7CF4983B3EA6072CA71F2B65CAED9B6475BB
SHA-256:	C8851B89019F0813F72F663F3CE2719D90F550B2614509EC57D9DB04E29C1AC9
SHA-512:	07D04A0974C88FA5E59920DC07E81479BF1A302FD6F86D23C0E95FA3FD6ED95B195EAE1E12850838777B999CC8A5AFCA30735867F7EAFBE2D3D4A9FC7945FBFC
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-pt-PT.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.256083418253126
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+Qzw:+sv+K5+CtTFCqsUz0AUoey+Q0
MD5:	F3D9F679EC31E66B130C5871DEE58722
SHA1:	7E21735951A97D2D8ED7487D3B5F1F191EBFD77E
SHA-256:	0F5E604136E1DDE1C3E8CB8762E5CD64DB6BDE8B5E3CAF2B218FC64E56754A9D
SHA-512:	A3EA27F6233F57C2214BFEF771C6343ED707BD6F2848C92BC52FFED2C762479FFB1D7E002AAE827F88CC53196140D9877C902B3678DEF0E8D4C5B7E03C9063C8
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-ru-RU.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.255546558926164
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+vpW:+sv+K5+CtTFCqsUz0AUoey+vpW
MD5:	10962FD6D81F7A79DB040C06AE4FA863
SHA1:	EA4974C8E87A6750B98871F57B05CEA32C6B09BF
SHA-256:	D975E34EBCBB7E9B5101CF5F40F58E9E16FE0DF2294406CB4D5B6E5E2F006A5A
SHA-512:	E829D7BBA63A14A8245EB136100A3849C82AF2FE907DB176681C595972E489D8DD16D6EB05E183F6E96CA3CE51A33952C320477C4B1AFC8D1A48D0435F928FC2
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-sk-SK.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.2532747748847735
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+jCKM:+sv+K5+CtTFCqsUz0AUoey+eh
MD5:	F1C6B997B574193DCD77D44AB9B78073
SHA1:	4D0EAC7FD271E1F041617D87AD92489E351F8961
SHA-256:	DEE4F60EABAC986018071548E7F0F77BF66F03450AE401F5450EA9B789FB8176
SHA-512:	A50A9B90795D68F9B3E19786A56DE4356543D0202386EFDF3890AD1668280639FFCD1EB91FFA9F02D0404CA13BB89B5FB7520ACEA25DA65C303023B441E4BA6B
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-sr-Latn-CS.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.2622157735547015
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+8fon:+sv+K5+CtTFCqsUz0AUoey+8Q
MD5:	9CCCA4570394E0014A51D72E9ECF8C42
SHA1:	E83B00354C2F117CDE79A43C6953861C195398E4
SHA-256:	E3ED5753787ACF7D31F18288E652E3323B461C7CFB5F0DD6B228A81236206242
SHA-512:	EDCEB6766615B45051FD8B42CFAC3D022A7175510C14039508D53B1F064254FC601D9A69CD95DEB165B0EBAEB9267861EA1500459E7420AE98571BA9B1B4B1B6
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-sv-SE.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.254832247014533
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+8t7:+sv+K5+CtTFCqsUz0AUoey+0
MD5:	0E72C34904BB337A1B2909C310330D6F
SHA1:	24C3C3C6089E8059F4AAC2050B0A26B086560481
SHA-256:	A85ED88B1C02CF883025E8D0474C871BE0C9FA9817D9F3C0913396FC231EE562
SHA-512:	E7A8AC3143EAF5876BE04BFF46132EAE0EBBCFFEB1836305AD47B038B804F1883FEDF63A6D016C1280F4DCABA8CDD1245F9D4219EDD128B61DB31603CDF0C6A0
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-tr-TR.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.253321666648074
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+XK35n:+sv+K5+CtTFCqsUz0AUoey+XK35
MD5:	EBEAE489FF5C8DBBD4AD2A3F99F294A5
SHA1:	207304D34820AA4890A592761E7A6C96AB894678
SHA-256:	EC9C7D27EB7E8DA4F813D8FC9A1C660C4AC78DE7294A09EF28C7C74FE945CA43
SHA-512:	B48DA615E4451015EF904ECCF9BCD674B3F2155F048681301F7DD36BE5A47F2E3D5C5120A8967B5E16EF33931C6C75AFC62DB7B3C38916A52F3C3BCDD3C72C8F
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-zh-CN.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.256021270909863
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+pdz:+sv+K5+CtTFCqsUz0AUoey+pdz
MD5:	D98340907E2989D36710CAE1A391C46B
SHA1:	4EF3EB1BE0B02B27818074D52A4F2F7F0033B55F
SHA-256:	940396650E9E79B4EB98C7D7C41B74814888D842D2F2E75C5B61A12C4C6203A4
SHA-512:	0A05A24B376045890037E5D35698BDBC74D09EB41BFE4067AF158654900D8DE989892419860EC50805072EDBFBA958D2C602E6A4AD1F9FF6F47662588A61F920
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-zh-TW.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	5.248306985193893
Encrypted:	false
SSDEEP:	48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+Icf7y:+sv+K5+CtTFCqsUz0AUoey+Iyy
MD5:	6BE9DC917E4C659D83CB4533AE7CB74C
SHA1:	74E5C0950C1C56D3E3E5117DE3D1C3294B50E802
SHA-256:	2AA02C6435FE5BC168708527B326603FD09029FFAD710E3FA256ECA0734F5B81
SHA-512:	6A213018FBC5CEF58993F3A1FBD638ADDDE2205A50D87C86674BF437BBFFF91DC137478C40369BF254B070099680045ED531BA2B0F334D811FA639F9C2371AED
Malicious:	false
Reputation:	unknown
Preview:	var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

C:\Program Files\McAfee\WebAdvisor\logic\aj_logic.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3326
Entropy (8bit):	5.567277301909763
Encrypted:	false
SSDEEP:	48:+eV+P0Xf5pdsQmrPiNl/U0cHLKDJea6xVIfXUckHUTkZ6yXbo06Ev+3TvU:+GPQiNl/aHLZBIfsnyU
MD5:	D0CDD67F306C7F58ABAC34A57AA6C51B
SHA1:	46E59009A79F415CA091F1F228084D2EBDAED2EB
SHA-256:	92859B567075AB982C59ACA251BFCC0B829E97BAF7B05A60480CDF532623487E
SHA-512:	3A9686EA9D13ECB97A0B2CDDA9DF59F31EBE308BB4244921CEC0304107E5C6E849DDB83723730D735FFD7A78CB911EB5E8A2CC933FBB9B36F9F170A5289FE0CB
Malicious:	false
Reputation:	unknown
Preview:	.LJ.......... 6...9.......9...'...B...6...B.......X...6...9.......9...'...B...+...L.......9...B...6...9.......9...'...6.......B...&...B...L....tostring)[BL]: is_aj_blocked: end, returning .is_active1[BL]: is_aj_blocked: standalone installation.get_oem_implementation.[BL]: is_aj_blocked: start.info.log.core........~6...9.......9...'...6.......B...'...6.......B...&...B...6...9...9.......9...+...'.......)...B...).......X...).......X...6...9.......9...'...6.......B...'...&...B...+...L...6...9...9.......9...+...-.......B.......X...6...9.......9...'...B...+...L...-...B.......X...6...9.......9...'...B...+...L...6...9...9.......9...+...-.......'...B.......X...6...9.......9...'...6.......B...&...B...+...L...5...=...).......X...).......X...6...9.......9...'...B...'.......J...X...6...9.......9...'...B...'.......J...K.........Ewacore:mfw\packages\webadvisor\aj_toasts\wa-aj-toast-toggle.html8[BL]: aj_logic.get_template: returning toggle toastGwacore:mfw\packages\webadvisor\aj_toasts\wa-aj-toast-che

C:\Program Files\McAfee\WebAdvisor\logic\base_provider.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	5.795742244285048
Encrypted:	false
SSDEEP:	24:6t+y/a+4+NlKfObbD97TVSHXt27AJCUjNGggWmRpOGOePKjNAACpcXP2kzv:5y/BKful6t2gCqXXm3Oh0KxAACpZI
MD5:	8AC5AD19AB789FD4368E255D6F3CB4AC
SHA1:	565305E183C61620ABEF53DE7668C6101A790C24
SHA-256:	0BBC2D5A0B4F84664642456E021EC8BB2A6236C70CFB97820776D9DF9ABCBABC
SHA-512:	818116197F8759D6E5AE0FC8983186C19A14CAF6629EAD62B202C535537AD087A847D77345F358FFC86308F78792AAF392E28D0D4ED5C0490D8F4ED2040405E2
Malicious:	false
Reputation:	unknown
Preview:	.LJ..8.......=...=...=...K....providerName.providerId.priority........+...L...........+...L...........+...L...........+...L...........+...L...........K...........K...........+...L............6...9.......9...'...6.......B...&...B...'...4...'...J...Hfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\wa-sstoast.html3wacore:mfw\packages\webadvisor\wa-sstoast.html.tostring0[BL]: calling get_toast_template_path with .info.log.core........'...L....default........'...L....DefaultSearch........+...L............6...9.......9...'...6.......B...'...6.......B...&...B...6...-...B...X...6...9...9.......9...+...............B...E...R...K......SetBrowserSetting.BrowserUtils.utils.ipairs., browser_type=.tostringM[BL] calling Base_provider:fill_url_settings_with_the_same_url with url=.info.log.core......%.?6...9.......X...6...4...=...6...9.......X...6...'...B...5...7...6...9...3...B...7...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=

C:\Program Files\McAfee\WebAdvisor\logic\edge_onboarding.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4336
Entropy (8bit):	5.733403715661443
Encrypted:	false
SSDEEP:	96:/1Ac6XFUsXEoTc+rrvVXnM/EdtsgJfQMxgkB:/mUsXEqrjVyEbpZQNkB
MD5:	609DC65066531B32B93EEAEA5A8EFC82
SHA1:	BCE318A4DECB4E82E26BEC38629FEB26D706D548
SHA-256:	01E4BE5D4833F91AAC40087BD4180BB33FCC77BBCD36C3F59E617557C845BA26
SHA-512:	D20445BF6C2DC7E37E43C40C3271CD80A602316C007143DCB1D0FD36A60A53A463F8B0419074D8347387298BD7E22AC046AC173BD61A422D0A916F99D12FA132
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........;6...9.......9...'...B...6.......9...6...9...9...9...9...-...B.......X...6...9.......9...'...B...+...L...6.......9...6...9...9...9...9...-...B.......X...6...9.......9...'...6.......B...'...&...B...+...L...6...9.......9...'...B...+...L......common_checks: end., won't proceed.'.tostring$common_checks: extension state .get_extension_state*common_checks: registry entry present.edge.BrowserType.BrowserUtils.utils!has_extension_registry_entry.browserSettings.common_checks: start.info.log.core.........'6...9.......9...'...B.......X...-...B.......X...6...9.......9...'...B...K...6.......9...+...'...-...B...6.......9...'.......B...6...9.......9...'...B...K.......!schedule_edge_ext_check: end.on_edge_check.SetEventTimer.timerFactory.edge_onboarding_check.GetOption.settings2schedule_edge_ext_check: common checks failed#schedule_edge_ext_check: start.info.log.core......A...6...9.......9...'...B.......X...-...+...B...-...B.......X...6...9.......9...'...B...K...6.......9...+...'...+...B.

C:\Program Files\McAfee\WebAdvisor\logic\ff_monitor.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3446
Entropy (8bit):	5.579102473392893
Encrypted:	false
SSDEEP:	96:8QlNSU52MBNIsd+eE+Zo1PsLjgjg2kYIf0TfdXdWos:8YSU5pd+IZo1PBg2kYw0TfdXdWos
MD5:	5B7EB0E89EFFFA2FBBCE4B4981E17A1C
SHA1:	3C37705377C5C68BC8FCF6858BFE21E8A0CEC682
SHA-256:	2C1F7BE541980BB24F6560900D700A324D6707CB39D120E71DA6F02B6DF8CE9D
SHA-512:	7BDB450AA073E4C38B880725412A1826E67CFC02B24732218BF271D1F3DF95F5405E826F4D0C0D6944A0CEC822D576CC4F0B00F72B19E7AF76AA7B0E88E956F6
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........T6...9.......9...'...B...6.......9...6...9...9...9...9...B.......X...6...9.......9...'...6.......B...&...B...+...L...6.......B...).J.....X...6...9.......9...'...6.......B...'...&...B...+...L...6...9...9...9...9...6.......9...6...9...9...9...9...6...9...9...9...B.......X...6...9.......9...'...B...+...L...6...9.......9...'...B...+...L....common_ff_toast_checks endBcommon_ff_toast_checks: WA extension is installed and enabled.ff_wa_ext_id.get_extension_state.ext_enabled.ExtensionState$ supports registry installation%common_ff_toast_checks: version .tonumber.tostringIcommon_ff_toast_checks: failed to get Firefox major version . Error .err.ff.BrowserType.BrowserUtils.utils.get_browser_major_version.browserSettings!common_ff_toast_checks start.info.log.core......#.l6...9.......9...'...B...6...6.......9...+...'...)...B...A...6...9...B...6...6.......9...+...'...)...B...A...6...9...9...9...............B.......X...6...9.......9...'...B...K...5...6...9...9...9...=...6.......9...+...'

C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	5.793217174774446
Encrypted:	false
SSDEEP:	48:qChuRIL5WuR0dyMGhKz7uRu49UEtnS2VzWGLk5a2TB+2QSY1jAHCn:qChuzuOGovuFNtnNzk5FTAdSwAHCn
MD5:	0172B34AF7C25D2647596ADFC729F2E8
SHA1:	0623B506A6297EC19EDF4EDB47256404E708628E
SHA-256:	7B2EA58776A72883124610173532DBF92E4A69B246B11AB9D56A586AED6C0DA7
SHA-512:	EEDC89052CFEB79AE960F5544CA2224809C51168808E59F196B20611F1EFCD2D29FC99348689E1B4F7E42B457B38880929BA3CEDE0BD19B2CD29961DB22505B9
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...8.......X...8...L.......X...+...6.......9...............B.......X.......X...+...<...L...6.......)...B...K....error.include.external.loaded.package.........5...'...6.......B...X...6...........B...E...R...K....require.ipairs.MFW\core\.....logger.dkjson.json.utils\stringUtils.utils\browserUtils.class.win32helper.utils\common_utils.........5...6.......B...X...6...6...8...'.......&...B...E...R...K....Module does not exist: ._G.assert.ipairs.....external.settings.subdb.telemetry.utility.browserSettings.registry.timerFactory.........5...'...6.......B...X...6...........B...E...R...K....require.ipairs.logic\.....usage_calculation.MiscUtils.providers_selector.base_provider.ss_logic.oem_business_logic.ff_monitor.type_tag_utils.tests_logic.aj_logic.edge_onboarding.oem_utils\oem_util.oem_utils\oem_utils_wss.oem_utils\oem_utils_wps oem_utils\oem_util_selector.oem_utils\affid_monitor.........5...'...6.......B...X...6...........B...E...R...K....require.ipairs.telemetry\serializer

C:\Program Files\McAfee\WebAdvisor\logic\miscutils.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	5.696523953297714
Encrypted:	false
SSDEEP:	96:XXeeAM6JLtWOVh7jqJlkN48gkaxwSCTNOhTCMZ+XTT:ne08tWOGJlkJgkaOBNOheMZKT
MD5:	84D11F6272BF83F52DAFBDDF72FE3752
SHA1:	C09A709B172B54F946B3EF0D41A4B54810F316D3
SHA-256:	AFDE57B2C2D81545EED2EE01DCEA02D87900337C8967A5158728FC514200AE52
SHA-512:	0457F32E9515FCCDBAC74E7626C466197CDB129F4C7AB5C5622F700AF973D39255C34D9744D57B960A7C9DBE420B2C53A6F8B293B63EB45E30CE680ED286EF57
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........$6...9...9...9...6...9...9...9...B...)...-...9...'.......B...6...9...9...9.......6...9...9...9...........)...B.......X...+...L...-...9.......D......string.GEO_ISO2.SYSGEOTYPE.GetGeoInfoA.char[?].new.GEOCLASS_NATION.SYSGEOCLASS.GetUserGeoID.kernel32.Win32.core..........6.......9...+...'...'...B.......X...6...9.......9...'...B...6...9...9...9...B.......L....GetUserLevelGeo.MiscUtils.utilsH[BL] GetGeo: Got empty value of SystemGEO, falling back to user GEO.warn.log.core..SystemGEO.GetOption.settings.........6...9...9...-...9...9...)...)...'...B...A...9.......X...+...X...+...L......handle+{B3251298-6CD7-4C88-A541-A62A7500D233}.OpenMutexA.C.Win32Handle.Win32.core........8-..."... .......X...+...X...+...6.......B.......X.*.....X...6.......9...+.......6...6...9...9...9...........B...A...A...X...6.......9...+.......'...B...6.......B.......X...6.......B.......X...6.......9...+...........B...L......(current<setting).days_elapsed.common_utils.utils.core.tostring.SetOption.settings.st

C:\Program Files\McAfee\WebAdvisor\logic\oem_business_logic.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10019
Entropy (8bit):	5.8252780405068565
Encrypted:	false
SSDEEP:	192:76Qa+8YiRGQLtdF4ivOiTZc2qa+aBa+SU0FKgv+GFKD57eL3nYysNRJUgM:76Qa+8YAGQLdHOG1qDI/SDKg2GFC57ed
MD5:	14860B3CF80E140BAF4728D0A6024917
SHA1:	AFD61DCF44380B8496F42686B308FC8150807EEC
SHA-256:	FA269FBD72355257F25A52875B1E2D3FCD0DFE15EFA2653F5D36750B67C5C811
SHA-512:	4474DE28B075655E1C01F7DBFD2FE68DF290744DEEAB958A77C06DDDDDEB9893978908F031988AC007914B00F26801DE1C636255D61E1D7FC4386FED2645C8D8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........J6.......9...+...'...)...B...6.......B.......6...9.......9...'...6.......B...&...B.......X...6.......9...+...'...6...6...9...B...A...A...6.......9...+...'...'...B...+...L...6.......9...+...'...)...B.......X...6.......9...+...'...'...B...+...L...6...9...9...9...6...6...9...B...A...........'...D....MinimumDaysElapsed.MiscUtils.utils.(interval=0)3DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_UNINSTALL.(just set).OEM_WSSUninstallDateState.time.os.SetOption.tostring.[BL] WSSUninstallDate = .info.log.core.tonumber.*WSSUninstallDate.GetOption.settings.........V6.......9...+...'...+...B...6.......9...+...'...)...B...6.......9...+...'...'...B...6.......9...+...'...'...B...6.......9...+...'...'...B...6.......9...+...'...'...B...6.......9...+...'...'...B...6.......9...+...'.......B...6...9...9.......9.......B.......X...6...9.......9...'...6.......B...&...B...K...6.......9...+...'.......&...'...B...K....NoError.RecoveryAttemptLastError_.tostringA[BL]: SetSearchOfferAllowed: nil browser string

C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\affid_monitor.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	5.668084909814748
Encrypted:	false
SSDEEP:	24:63UVIdvLArX2wGdyUB8DIu6agFVIW17rF89lMLpFmJpFKlmPfJ2V:2UVI+X2wOy0FVIW7589yDypFKlmPfgV
MD5:	38D81CC80487896AD6789F428C395601
SHA1:	863E344611611F532096A657BC225A8233E58460
SHA-256:	C005A5F8C42F8C1840572CD2FDA0F57C5750F8069FB6F71997B1CF4E3935BBA5
SHA-512:	E084F6A546AF25D329D8B3ED245C17CDB2DE704C36AAB82CF26BAC053FEC98DDB4D74357BF3049605D985558E890346F51F47C808A82E09BB5AA28C6B405181E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........{6...9.......9...'...B...6.......9...+...'...-...B...6.......9...'.......B...6...B.......X...6...9.......9...'...B...K.......9...B.......X...6...9.......9...'...B...K...6.......B...6...9.......9...'.......&...B...+...6.......9...+...-...B.......X...6...6.......9...+...-...'...B...A...6...9.......9...'.......&...B.......X...6.......9...+...-.......B...+...X...6...9.......9...'...B...6.......9...+...-.......B...+.......X...6...9.......9...'...B...6.......9...B...6...9.......9...'...B...K........wps_affid_check end.apply_customization.wps_utils,wps_affid_check: applying customization.wps_affid_check: affid is not updated yet.SetOption1wps_affid_check: current WA saved aff_id is .0.does_setting_exists$wps_affid_check: wps aff_id is .tostring'wps_affid_check: wps aff_id is nil.get_aff_id/wps_affid_check: wps implimentation is nil.oem_utils_wps.wps_affid_check.SetEventTimer.timerFactory.wps_affid__check_period.GetOption.settings.wps_affid_check start.info.log.coreB.......*...'..

C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_util.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.07313681759058
Encrypted:	false
SSDEEP:	12:6f0a/55P8Z+U3bTs3IdtnugLBGgiO6CaMAEWMiXY+CSZlCi5:68aMZdTs0ugLBx2ChAEWMiPrC8
MD5:	2464F6D8E5B4DA3297CB9717CAFAA296
SHA1:	40CF24CAEFE1FFEF2CBAEAE74BC5A1B8A4EAEFEE
SHA-256:	5927F27EA2660AB7A8739143DF53D8E82252EA024F5DFD80CA5EEF794FF86160
SHA-512:	8F86762F889BFD937910AD568C8D8CE09600E9CDEE7957939E71503C58157442F2AD5CFB631F113500B8CA7DC479601BAA9E1C4E315E4E560452A5C53723E017
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........K...........+...L...........+...L...........+...L...........+...L...........+...L...........+...L...........+...L..........."6...9.......X...6...'...B...6...9...3...B...7...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=...6...3...=...K.....is_active..get_expiry_date..get_activation_date..get_install_date..is_trial_active..is_trial..is_installed.oem_util..class.core.class.require.core._G...//E07B01EFCCBFD3D60E0DF9FF50212AC34EE7DE47EABFF7AF10B477DA5FCB0FCEAB1DBE9ED94C3A12A1D49C64EC8FEA30E256C112FAE348C554C3ABC8B16D5DAE++

C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_util_selector.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	672
Entropy (8bit):	5.316587326544983
Encrypted:	false
SSDEEP:	12:6DmOMYinnQlYelgLOphYfR2MQyPiOhYfQIMBFSWbKsvkLKgZ9FshBYO:6nVMeNwfR2MQsmfQIMBFkssp9GIO
MD5:	8FEF779163EEBD92C74BA9C2967FB738
SHA1:	AD80693340F99B8019A6EA6344345EE7A5F7242E
SHA-256:	3700BD78831EB69D4A729D1A36B3EC2BBA600A5B7F69712E520FC2952B551007
SHA-512:	6BD4F449E02BCA3AE65FE5191A87E79513B533977B67FCDF9FD60831BC44C35E40F998986CD2F1BE770CC4BFFD19F12B056B27EA1CF5FFBA5A7C8C96E6006FA7
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........46...9.......9...'...B...6...B.......X...6...9.......9...'...B.......9...B.......X...6...9.......9...'...B...L...6...B.......X...6...9.......9...'...B.......9...B.......X...6...9.......9...'...B...L...+...L...0[BL]: get_oem_implementation: wps installed2[BL]: get_oem_implementation: wps_oem not nil.oem_utils_wps0[BL]: get_oem_implementation: wss installed.is_installed2[BL]: get_oem_implementation: wss_oem not nil.oem_utils_wss([BL]: get_oem_implementation: start.info.log.core+.......3...7...K....get_oem_implementation....//4AB5318EB6BBCBF7AE11EC9B59607943D929F7B67D342A45F32BCD44D1EBBFB04BAB7B90FD64E9C9EEBE137FF5AA20AF284D53DC021B1369548F83B80E1937BD++

C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wps.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5363
Entropy (8bit):	5.600833832306523
Encrypted:	false
SSDEEP:	96:WHn6GmsvZ6o4xjk8mxfFDMkJH40m9sjvqFXf+2s3VH9bTllRUZU:U6vyfJvmAtvlJuZU
MD5:	B33F2D4F712476C8658E94F39C5828CA
SHA1:	226B88767118589F19664F43323CD606DBE91E1F
SHA-256:	AC93BF6D1593BF730A1F1177C1B52FEC77EF88FE4B4641A8194D6BADBB415A4A
SHA-512:	B5F0813A9C46A410B4A157637CDF76D2FF590078DCC0F6C45572FA7EE66E0B562FBEAF0FE30D3F890EAAFEF32294375EA7A94F821CAE61D65399C8403DCF3B65
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........?6...9.......9...'...6.......B...&...B...6.......9...-...B.......X...6.......9...-...B.......6...9.......9...'...B.......X...6...9.......9...'...B...K...6.......B...6...9.......9...'.......&...B...6...9.......9.......B...6...9.......9...'...B...=...K........wps_data5[BL]: oem_utils_wps:constructor: parse succeeded.decode.json1[BL]: oem_utils_wps:constructor: setting is 0[BL]: oem_utils_wps:constructor nil setting([BL]: oem_utils_wps:fallback to v1 .get_setting.wps_utils.tostring.[BL]: oem_utils_wps:constructor. self is .info.log.core........;6.......B...6...9.......9...'.......&...B.......9...-...B...6...9.......9...'...6.......B...'...6.......B...'...6.......B...'...6.......B...'...6.......B...'...6.......B...'...6.......B...&...B...6...9...5...=...=...=...=...=...=...D......sec.min.hour.day.month.year....sec..min..hour..day..month..year..time.os...:. .-([BL]: wps_date_to_lua: parsed date .match)[BL]: wps_date_to_lua: input string .info.log.core.tostring.........6...9....

C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wss.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2385
Entropy (8bit):	5.578935120777878
Encrypted:	false
SSDEEP:	48:eYWhvpfcvH72EQvevwdH85FkRkBjvFV4sl1z:2lpfEH7hQ6wdeFkRkBbz4slF
MD5:	EE8BEBE308B8759E44F001FAE52922D0
SHA1:	A5CB9260810FA4673BD4CFE5389DEADC8077DA4C
SHA-256:	D367DD87BF2E810098C042211FCB7E7A02D93722C3E087B1BF9C5F09E21CCF85
SHA-512:	592FFFD97723A2D99C4A31AB353BA543BED19E5946BBDBD95CEE291921735C1757932BED9EA1902CB5F1A5CC20972B25D9584C70C54A48E93505F1DBBEFA406B
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9.......9...'...B...6...9...9...9...D....IsSuiteInstalled.common_utils.utils%[BL]: oem_utils_wss:is_installed.info.log.core.........6...9.......9...'...B...6...9...9...9...D....check_wss_trial.common_utils.utils![BL]: oem_utils_wss:is_trial.info.log.core.........6...9.......9...'...B...6...9...9...9...D....is_active_wss_trial.common_utils.utils([BL]: oem_utils_wss:is_trial_active.info.log.core........46...9.......9...'...B...6.......9...'...'...B...6.......B.......X...6...9.......9...'...B...+...L.......X...6...9.......9...'...B...+...L...6...9...9...9.......B.......X...6...9.......9...'...B...+...L...L...:[BL]: oem_utils_wss:get_install_date null expiry time.SubDBTimeToOsDate.common_utils.utils>[BL]: oem_utils_wss:get_install_date data is empty string.;[BL]: oem_utils_wss:get_install_date data not a string.string.type.installed.vso.GetProperty.subdb)[BL]: oem_utils_wss:get_install_date.info.log.core........L6...9.......9...'...B...6.......9...'...'...B...6.......B...

C:\Program Files\McAfee\WebAdvisor\logic\providers\bing.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5743
Entropy (8bit):	5.845099323810125
Encrypted:	false
SSDEEP:	96:2/dh6DsRoC42Beao1CTdAe+VOleAGrLNPF0pBtw9CJkbKI3HIka:2/dhLRqy5dAZOlOXNP2p3bJoZ3Q
MD5:	8A3166C1FB771B3B9944B9D1668BB4C6
SHA1:	67C9A8A34F917ACA085DBB0ABB59FE17DAE2E1A6
SHA-256:	0AE3BD1393CEE7FB97FC8E9027E73C5DBC049B0866CA7F0E39A9EE6A4EA0E232
SHA-512:	2D276B9B688A3F5759FA04013DB2BCDB910ADE121F245C4F12D08410F9EDDFF790CB094ACE9FE3F435E334A121C750B2470A4C1E0031C178643073B4185DFAC7
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........E6...9.......9...'...6.......B...&...B...6...9...9...9.......B.......X...+...L...6.......9...+...'...6...9...B...6...9.......X...6.......9...+...'...'...B...6...9...9...9...'.......B...6...9...9...9...B...8.......X...+...L...6...9.......9...'...6.......B...'...&...B...+...L.... end"[BL] should_be_selected_impl .GetGeo.,.Tokenize.common_utils.AU,DE.BingCountrySet.Bing.Yahoo.SearchProviderCodes.ProviderForced.GetOption.settings.ShouldSelectBingOverYahoo.MiscUtils.utils.tostring&[BL] should_be_selected_impl for .info.log.core........-6...9.......9...'...B...6.......9.......6...9...9...9.......B...A...6...9.......9...'...6.......B...&...B...6...9...9...9...9.......X...6...9...9...9...9.......X...+...X...+...L....ext_not_accepted.ext_disabled.ExtensionState.BrowserUtils.tostring4y_for_b_extension_criteria: extension state is .get_search_extension_id.MiscUtils.utils.get_extension_state.browserSettings&y_for_b_extension_criteria: start.info.log.core........e6.......9...+...'...).

C:\Program Files\McAfee\WebAdvisor\logic\providers\yahoo.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15366
Entropy (8bit):	5.919417775422355
Encrypted:	false
SSDEEP:	384:0baij5R2F46vdSGGgOqkmnLKh0hyKc1BgjC7xBPFqLNmvC+xY:0bj1R2F4WgGGgOqkmnqkyKc1BXB+mzxY
MD5:	C724A0C867D7B42ECFCB3FC76562EFBD
SHA1:	B6903934F41F8380C99B0B924ADD6E503687AD96
SHA-256:	0F1236E67E94E140BB766D66281CD2DEF5E66E9995EA8EAF196D4374E1944071
SHA-512:	F5275B87C4AEA91D7843139247B53BF872C6CEB421AE94A54C84CEC6B7F0FB6AE158019FDA0EF1B4A809ECCD21A48423CE1FB0186C5332C66D3E58F6A456C2F3
Malicious:	false
Reputation:	unknown
Preview:	.LJ.........."6...9...9...9...B...-...8.......X...+...L...6.......9.......6.......9...+...'...'...B...A.......X...6.......9...+...'...+...D...+...L....."EMEA_COUNTRY_SUPPORT_ENABLED.HU EMEA_COUNTRY_SUPPORT_REGEX.GetOption.settings.RegexTest.utility.GetGeo.MiscUtils.utils.core........16.......9...+...'...-...B...6.......9...+...'...'...B.......X...6...9.......9...'.......&...B.......X.......'.......&...X.......6...9.......9...'.......&...B.......X...-...'.......'...&...>...K........)...^http(s)?://(us\.\|ar\.\|at\.\|au\.\|br\.\|ca\.\|ch\.\|fr\.\|fi\.\|de\.\|dk\.\|hk\.\|in\.\|it\.\|kr\.\|mx\.\|no\.\|es\.\|se\.\|tw\.\|uk\.\|cf\.\|cl\.\|co\.\|id\.\|nl\.\|nz\.\|pe\.\|ph\.\|sg\.\|th\.\|pl\.\|tr\.\|espanol\.\|ve\.\|vn\.\|malaysia\.)?search\.yahoo\.(com\|co\.jp)/search.(\?\|&)fr=(mcasa\|mcsaoff\|mcsaoffblock\|slv8-mcafee\|$AdjustRegex: regex addition is .\|,AdjustRegex: got special chrome frcode .info.log.core..YAHOO_CH_FR_CODE_REGEX_ADD.*YAHOO_FF_FR_CODE.GetOption.settings........7....X...+...L...9.......X.......X...-...6...9...9.

C:\Program Files\McAfee\WebAdvisor\logic\providers_selector.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1917
Entropy (8bit):	5.845256021122548
Encrypted:	false
SSDEEP:	48:iFZZRFnYQrEfyAb/taw2mx/YH8tEiwtRU1VWk+gOfU4s:iFz/REfyAb/Yw2mx/G8tEiwtyok+g0s
MD5:	098B0FFC536DA567D82ACDAE002FDC7A
SHA1:	2D7319EF536384EEB51874674386D777F6C52760
SHA-256:	155453DAE3DDC89ED01299E444C9ECC862F0A78080723486CC61C3C0AB37711E
SHA-512:	5750674144801F90B00E8D5B796A76F8EF1385D370CF8184C8B9A38786E75DB6C55EB86B49FC90FF670D129C9E60198C7EDAAA4E0C9959F551EF9BF52B5A02B9
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........`6...9.......9...'...6.......B...&...B...4...6...6...B...H...6...9...........B...F...R...6...9.......B...).......)...M...6...8...8.......9.......B.......X...L...O...6...9...6...9...9.......9...'.......6...9...B.......X.'.6...9.......9...'...B...6.......9...+...'...'...B...6...9...9.......9...+...'.......'...B...6...9...9.......9...+...'.......)...B...6.......9...'.......B...+...L....(empty)(fill_url_settings_with_the_same_url.Base_provider.SetBrowserSettingInt.(Unknown).ProviderToastedName.SetBrowserSettingL^http(s)?:\/\/(www\.)?yandex\.(com\|ru)\/search\/(\?\|&)fake_param=fake..SECURE_SEARCH_REGEXES.SetOption.settingsI[BL] ssProviderSelector.GetSSProvider nullifying settings for Yandex.Yahoo.ProviderToastedGetUserBrowserSettingWithSystemBackup.BrowserUtils.utils.Yandex.SearchProviderCodes.ShouldBeSelected.sort.insert.table.ss_providers.pairs.tostring/[BL] ssProviderSelector.GetSSProvider for .info.log.core.........6...9.......9...'...6.......B...'...6.......B...&...B...6.

C:\Program Files\McAfee\WebAdvisor\logic\ss_logic.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32108
Entropy (8bit):	5.892194849027686
Encrypted:	false
SSDEEP:	768:4yMfMXANe2NJ5kC+P7KfoSpVAk+4Xuw9PMr0/7wdUOxPN8w8R:4PfZMZC07iR+APL7wdUOxPN6
MD5:	90E8F4C9E571908566592FC834494AC5
SHA1:	AD3492D9C7DC9B236B8440D981FE4F12BD42DACE
SHA-256:	1E56120E8A7DF06069468AD0FA16B1186FCD01DE62C91C1500D685BA18CF4785
SHA-512:	3118C8C30EAB41CFB0279D93A2970D3B49259BB580E920DD669D84DB41EE6A8FB6F81A2009E0459FA0E2E2355E21BF0B7578BD2B5450ACF3FC3061958BA6B15A
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........76...9...9.......9.......B.......X...6...9.......9...'.......&...B...K...6...9...6...9...9.......9.......B...A...6.......9...+...'.......&...6.......9.......B...A...6.......9...+...'.......&...6.......9.......B...A...K....GetCurrentMinVersion.MinBrowserVersion_.GetCurrentMaxVersion.browserSettings.MaxBrowserVersion_.SetOptionInt.settings.GetBrowserStr.lower.stringLInvalid browser type passed to UpdateSupportedBrowserVersionDimensions.info.log.IsValidBrowser.BrowserUtils.utils.core........%6...6.......9...+...'...-...9...B...A...6...9.......9...'...6.......B...&...B...-...9.......X...-...9.......X...6...9.......9...'...B...-...9...L.....7[BL]: alt_triggers_get_cohort: setting cohort to 0.logon_unlock.tostring6[BL]: alt_triggers_get_cohort: settings value is .info.log.core.regular.alt_triggers_cohort.GetOption.settings.tonumber........16...9.......9...'...B...6...9...9.......9...+...'.......)...B.......X...6...9...9.......9...+...'.......)...B.......X...6...9...9.......9...

C:\Program Files\McAfee\WebAdvisor\logic\tests_logic.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10156
Entropy (8bit):	5.616068219227448
Encrypted:	false
SSDEEP:	192:26foLdghiM/EbC7gwwQN0pOFbGskXtOTemIVz9VFdi/fYxDfisGzNW5cmaO4:27hM/wCgaN0pOFbGskXtOTZIVz9VFdil
MD5:	E614A6B94EB6205940E6EDEC2CA450A3
SHA1:	D99F2CEA3AC031237C39F95B6A441DC566C395C8
SHA-256:	60ECADC785E39DAADCCECD5F7CA4033DF92ABFAC2A95848C6814F343F5BB4410
SHA-512:	347201629DC10FDF4AE9A798ECC08A378C1E771417D058A9F681552349DD8B530B6EEEC28056DA23BC1FE2AE366C0B09192E09097C24F173B92B4950F063A047
Malicious:	false
Reputation:	unknown
Preview:	.LJ........)...6...9.......9...'...B...6...9...9...9...9.......X...6...9.......9...'...6.......B...&...B...6...9...9...)...J...6.......9...+...'...+...B.......X...6...9.......9...'...B...6...9...9...)...J...6.......9...+...'...)...B...6...9...B...).......X...6...9.......9...'...B.......6.......9...+...'.......B...X..6...9...9...9...........B.......6.......9...+...'...)...B...6...9.......9...'...6.......B...'...6.......B...&...B.......X...6...9.......9...'...B...6...9...9.......J...6...9...'...B...9...6.......9...+...'. .)...B...6.......9...+...'.!.)...B...6...9.......9...'.".6.......B...'.#.6.......B...'.$.6.......B...&...B.......X.......X...6...9.......9...'.%.B...6...9...9.&.....J...6...9.......9...'.'.B...6...9...9.(.....J....ignore_within_timeframe.tests_logic.tt_check: end.no_toastAtests_logic.tt_check: time of date is out of limit. No toast., higher limit ., lower limit tests_logic.tt_check: current hour - .tt_higher_hour.tt_lower_hour.hour.*t.date.ignore_threshold_passed?tests

C:\Program Files\McAfee\WebAdvisor\logic\type_tag_utils.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2316
Entropy (8bit):	5.952340631132649
Encrypted:	false
SSDEEP:	48:nSmjnzqb8vdSdyQSiEdA/mlVias7aeKCRMB52R7N3K2ypeDqYj:n1iUsSiEiiIRaehk5ONa2CeDjj
MD5:	356099B39018BB09B9F5D76E32B1A9DD
SHA1:	A8792B6409906FBF613439C4119EA375204E1A0F
SHA-256:	6CCF943B320131AE916190ABBABF62CFD68D2BF49C8C0CB82ACEAC7EB6CE852B
SHA-512:	2F13A640A61E7A0743EE981E341136CBB9C561EA48ACC90B1E33F43D299418C2EA3C1F1810DBDEF57478AD4E63EA2372931B3C1972D8F2E4952F12D258DB71C9
Malicious:	false
Reputation:	unknown
Preview:	.LJ........(...6.......9...+...'...'...B...)...6...9...9...9...B.......X...6...9.......)...B.......6.......9...+...'...+...B.......X...6...9.......)...B.......6.......9...+...'...+...B.......X...6...9.......)...B.......6.......9...+...'...)...B...6...9.......'...B.......X...'...X...6...9...........B.......X...'...X.......6.......B...6...9...9...9...9.......X...'...6.......9...+...'...+...B.......X.C.6...9...9...'...'...)......B...'.......9...B.......X...6.......9...'...B...A.......'...'...6...9. .....B...6...9. .....B.......X.......X...6.!.....9.".................B.......X...6.!.....9.#.....B.......'.$.........6.......B...........'.%.6.......B...'.&.....&...L...'.'.........6.......B...........'.%.6.......B...&...L....type=E.M.G.type=F.EscapeA.HMACSha256.utility.len169+WMDgzyMpkvioeK5ZWOdq0SVmpw1jBePppGXgqisQ=.MachineGuid.QueryValue.IsValid.$Software\Microsoft\Cryptography.HKLM.Registry.Win32.typetag_includes_machineid.5.edge.BrowserType.BrowserUtils.tostring.find.%d+.match.string.Exp

C:\Program Files\McAfee\WebAdvisor\logic\usage_calculation.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2030
Entropy (8bit):	5.590473959875451
Encrypted:	false
SSDEEP:	48:fhO0Zf/+V+JJUh10pF/M1KsAwTh4Bdj5minH30vY3I+Cy:Q0nW0cUsABQiH/n
MD5:	8D0F3F265A0F5453F367700AA68B8C25
SHA1:	BC6436897B34F304A3698A7F9D73738CD900D92A
SHA-256:	7ACFE4EE9B28C2E7DE407602F3AED658ADE40EB69448917B0CBF53A495A6936A
SHA-512:	8F06E8385F1033B3CC3D548CB7B0292FAA6650B1EEBD865AEDEECC7A305D2D7FAF239447F4236969C62E0C7DE1C70F00477AD55EDCC7F1779D5D91BCAB6779D8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........P6.......B...6...9.......9...'.......&...B...6...6...9...9.......9...+...-.......)...B...A.......X...6...9.......9...'.......&...B...K...6...9...B...6...9...9.......9...+...-...........B...6...6...9...9.......9...+...-.......)...B...A.......X...6...9...9.......9...+...-...........B...6...9.......9...'.......&...B...K.......)calc_on_browser_start: end. Browser .SetBrowserSetting.time.os=calc_on_browser_start: session started already. Browser .GetBrowserSetting.BrowserUtils.utils.tonumber+calc_on_browser_start: start. Browser .info.log.core.tostring...........6.......B...6...9.......9...'.......&...B...6...6...9...9.......9...+...-.......)...B...A.......X...6...9.......9...'.......&...B...K...6...9...B...!...6...9...9.......9...+...-.......)...B...6...6...9...9.......9...+...-.......)...B...A... ...6...9...9.......9...+...-...........B...6...6...9...9.......9...+...-.......)...B...A...6...6.......9...+...'.......B...A...6...9...!...6...9...9...9...#...B...6...9...!...6...9..

C:\Program Files\McAfee\WebAdvisor\logicmodule.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4422696
Entropy (8bit):	6.571327417684914
Encrypted:	false
SSDEEP:	98304:z2gOPCanLDXRRdfkjiB2EfkiupmEqwbugui:z2znLDXRPMji9fwE4
MD5:	4A105F56FAA538B489D3CB8584A59FD7
SHA1:	D5E71B9B68D89B16FD6D47F806AACD3E18C18A8B
SHA-256:	EAD7609547D080ED39239F0A1226E8316EFB6A4FA0F2E3BBEE7CBB073F4E5D2A
SHA-512:	9667DD34D056FE0048637198647A13F85FBD91648188E79363460F7ECC72537D5B731165A041C681819619299A670D458067247F7B3F6E8795543B80F04C6D3D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$..........{@.c(@.c(@.c(..f)..c(..g)P.c(..`)J.c(..f)5.c(Z.f)A.c(.4f)n.c(..`)Y.c(..e)A.c(..g)A.c(@.c(A.c(..b)[.c(@.b(..c(..g)d.c(..g)..c(..f)w.c(Z.j)..c(Z.c)A.c(Z.(A.c(Z.a)A.c(Rich@.c(........................PE..d.....>f.........." ...$. 2.........P.*......................................PD.....ShD...`A..........................................=.<...,.=.......C.X....PA.t\....A.(~....C..f..\.:.p.....................:.(.....7.@............02.....h.=......................text...\.2...... 2................. ..`.rdata.......02......$2.............@..@.data...LF....>..>....=.............@....pdata..t\...PA..^...0?.............@..@.didat..@.....C.......A.............@..._RDATA..\.....C.......A.............@..@.rsrc...X.....C.......A.............@..@.reloc...f....C..h....A.............@..B........................................................................................

C:\Program Files\McAfee\WebAdvisor\lookupmanager.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2968728
Entropy (8bit):	6.554306523583675
Encrypted:	false
SSDEEP:	49152:qWKcM89toKCPjKteB8NqsL5m+9cNEZyGx/97YfTPLW1fGPQsBg:qW9o2zjLz9cIiPLWMP
MD5:	BE9CB3433D1284A7689B8EE7AFBB81FF
SHA1:	5B4A0416A138C47AF66556BBE2E1EF8229D35842
SHA-256:	90874835C2254624F9372B3B92FB3B9E90352F4E3DCD37B31B9EE05909F17652
SHA-512:	F25DCB278FCF217D61E453058F1C037F807A9734FB1CAFC6BA5D36B16101DB776E55796F991F10053DE5446910EAFA1A49DDA5640BA1D222D4E5BB3034204495
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........Y.K.8...8...8...@...8...@..c8...F...8...F...8...F...8...G...8...@...8..U....8..bM...8..aM...8..lM...8...@...8...8..m9...G...8...G...8...G[..8...G...8..Rich.8..................PE..d.....>f.........." ...$.B .........pt.......................................P.......F....`A........................................`.).T.....).......-.`....0,......0,.......-..V..\|.'.p.....................'.(...@.#.@............` .`.....(......................text....@ ......B ................. ..`.rdata.......` ......F .............@..@.data........ )..D....).............@....pdata.......0,......H*.............@..@.didat........-.......+.............@..._RDATA..\.....-.......+.............@..@.rsrc...`.....-.......+.............@..@.reloc...V....-..X....+.............@..B................................................................................................................

C:\Program Files\McAfee\WebAdvisor\microsoftedgewebview2setup.exe

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1785632
Entropy (8bit):	7.942738490429967
Encrypted:	false
SSDEEP:	49152:NSI3oiG08swq0fhLy0fEg6IGJIlq+S6O8:NSCG08sw3YyEg6IiYq8
MD5:	080FF9263F39F62DBDAE513C66B7B9D2
SHA1:	32DF585659003B10E7ED769932727D53480B9C34
SHA-256:	326CBB6CD7D6062B850337A50200C805CDCBF59A6E05818990E6352AC68B4935
SHA-512:	7A7A21D05FA8D2562A0598B254A25A49099AFA5EBD072DE391D9EE8DC30F57CD2830816C8A2B5997AE74C0B9924185334B15EC5CC3587B74C2E7957296E6E02B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.c......................................................9..............................................[...........Rich............................PE..L....R/`.....................t.......t............@..........................P............@.................................l)..x....`..,............... +...0..p.......T...................<...........@...............H....(..`....................text.../........................... ..`.rdata.............................@..@.data...\....@.......(..............@....rsrc...,....`.......2..............@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files\McAfee\WebAdvisor\resource.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	38328
Entropy (8bit):	6.3296688801046885
Encrypted:	false
SSDEEP:	768:pBr3M65R3Q2HiPvYXAMxkERVQ2Ps0UAMxkEDq:pt3xLg4isx1S7xxS
MD5:	5254CCD2156258B8E56D8D2E235FD2DC
SHA1:	749724E3180574AB238C74D5891ACC9B363B2EEF
SHA-256:	55AA4B5983444EF6E2D5D25E7298EB575AC4A945AA5E29FCA47A75AC1EE6D62A
SHA-512:	1F2627EAC246F3E52D38AC596D80B170E0CAB3F859F22E290F9AF6A8E44D8D1D5ED907717AEDEAB1814A086C3B546D713C1EB199C42B445D5B1E7FD7A366B757
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q=.0S..0S..0S..O...0S..OQ..0S.Rich.0S.........PE..L...)~>f...........!...$.....>...............................................`...... .....@.......................................... ..\:...........@...U..............p............................................................................rdata..\|...........................@..@.rsrc...\:... ...<..................@..@............)~>f........q...............)~>f........................)~>f........l...............)~>f............................................RSDS.p"...I.%=......c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdb........................GCTL....p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..`....rsrc$01....`!.......rsrc$02................................................................................................................

C:\Program Files\McAfee\WebAdvisor\servicehost.exe

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	879456
Entropy (8bit):	6.484399543018805
Encrypted:	false
SSDEEP:	12288:5xplQAEQs/OjuHAWpDg808FwOPBa56hzSsAyRa7Nz5/9tfJ4Ys7eu+uB1oWepSi8:5/+AgfY7J5/9tf+57eanrniUd
MD5:	AF384AA87E3D70F7A687C5C60DA2FB7F
SHA1:	32E4154EA9316BF82590E7480AE51283CB6B6E4C
SHA-256:	2976C862C9813B309F696F3CC96D516C96AA9B42545888615591D268F23F5762
SHA-512:	1CBB5DC5516D1143D022A1548893A2199491BAA4B1327B5AA0398BBE42FD4E7F5E1A484D6A1F15124DFF6D5D8BEBC728B58442DE388F34D1EAD78E7AB9F8A852
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.^'.h0t.h0t.h0tJ.3u.h0tJ.5u.h0tJ.4u.h0t..4u.h0t..3u.h0t..5ulh0tJ.1u.h0t..5u.h0t.h1t3i0t..9u.h0t...t.h0t..2u.h0tRich.h0t........................PE..d.....>f.........."....$............`3.........@..........................................`.....................................................x.......p...............`.......0...L,..p....................-..(.......@............................................text...<........................... ..`.rdata..\[.......\..................@..@.data...@........H..................@....pdata...............,..............@..@.didat.......p......................@..._RDATA..\...........................@..@.rsrc...p...........................@..@.reloc..0...........................@..B................................................................................................................................................

C:\Program Files\McAfee\WebAdvisor\settingmanager.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2031432
Entropy (8bit):	6.576852626864642
Encrypted:	false
SSDEEP:	24576:yqlCeOU5b8ZmtOr1xRWpWjK9XUXtJaDx0YincPHJNFudOAnaYUOG7ii2kSf:nJ5buGUFdJat0nnYTFoOCakiDSf
MD5:	1DDA4E57701E0CCCB6110C39C9358A82
SHA1:	6B94553FB9D5DCA7416FE732F5966BD9393DC65C
SHA-256:	B9233E27BC39D38DD73CFAEF09D08EAE86969D44C23BA839614D616B19ADAA76
SHA-512:	95FBC786CFA33361AE518C170027A8141A8448DE751ED8E7B998CFB058025CE4438C9CBA2F24F268E6364F63920216CDAD24C2CD1759485D1647EEEBC9FCE496
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C............`...q.....q.......................q........................................M..........Rich...........PE..d.....>f.........." ...$.F...\|......0........................................ ......,x....`A.........................................l..T....l..........h............"..H.......T$..p+..p....................,..(......@............`..8...xk..@....................text...\E.......F.................. ..`.rdata...%...`...&...J..............@..@.data....&...........p..............@....pdata..............................@..@.didat..0...........................@..._RDATA..\...........................@..@.rsrc...h...........................@..@.reloc..T$.......&..................@..B................................................................................................................................................

C:\Program Files\McAfee\WebAdvisor\taskmanager.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3863744
Entropy (8bit):	6.541530537788506
Encrypted:	false
SSDEEP:	49152:ZSCQDnx0inSiI8p5uJY6Fgzrx7r4HRbUr7ujvSUJ2STM1FG6AQzNyNpdNd9+z/JX:llFgzqKrFB5edkz/JX
MD5:	310ADA2A0DE1A11F8C0A29E926F53C28
SHA1:	4AAD466D23660FCF3340B7EBA26DEA504B7A089E
SHA-256:	60C25737A3BB2D8B6B12116F8D01DADA11CBB0FD619B0355D5C688C52EE33552
SHA-512:	EB54E9D09177E659306DFFAA065D84AE0EF8A0944CDCE1AF1AA8FD589A9E307A0A61E06637AF8DCB07DFCBD12DFCD411CA4B6B4CF8767236E661B6CDA83CD03E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........9.Z.X...X...X... ...X..i&...X..i&...X..i&...X...'...X... ...X... ...X..>....X...-...X... ...X...-...X...X..!Y...-...X...'..QX...'...X...';..X...'...X..Rich.X..................PE..d.....>f.........." ...$....F.......$......................................0<.......;...`A........................................ .5.P...p.5.......;.X.....9.......9..X....;..i....2.p.....................2.(...../.@....................5......................text............................. ..`.rdata............................@..@.data.........5..d....5.............@....pdata........9...... 7.............@..@.didat........;......*9.............@..._RDATA..\.....;......,9.............@..@.rsrc...X.....;.......9.............@..@.reloc...i....;..j...29.............@..B................................................................................................................

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\dimensionconfig.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	28025
Entropy (8bit):	5.608333549819949
Encrypted:	false
SSDEEP:	384:wYZsk3Xyhtjn8GF+TVUIkIZncsO5lNU4MtbKV3KVpA6OmlNMVeUa1dRc:z1HyvjGUIkIZcjxU4Md23KVxqeUa1dRc
MD5:	674B61376E37E134B00008FF05AC555B
SHA1:	02CCDF9ED717CEB3F24FD32EE245D93077258CA3
SHA-256:	0C5712C759EF99F68D0C1CCC9D273C5949FA4650768F506A6FB73E46FF557DD1
SHA-512:	4D6E4A97A787DD91672B4B18BA9A869DF12FF3D85C1F34CB03C970F5462FD0C73E2E182F2B6B517FDCB01EB9E124C96BF6DC4D7EB04E2068CF46BCBA39F6FD24
Malicious:	false
Reputation:	unknown
Preview:	.LJ..............5...5...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...5...=...5...=...=. .5.!.5.".=...5.#.=...=.$.5.%.=.&.5.'.=.(.5.).=.*.5.+.=.,.5.-.=...5./.=.0.5.1.=.2.5.3.=.4.5.5.=.6.5.7.5.8.=...5.9.=...=.:.5.;.5.<.=...5.=.=...=.>.5.?.5.@.=...5.A.=...=.B.5.C.5.D.=...5.E.=...=.F.5.G.5.H.=...5.I.=...=.J.5.K.5.L.=...5.M.=...=.N.5.O.5.P.=...5.Q.=...=.R.5.S.5.T.=...5.U.=...=.V.5.W.5.X.=...5.Y.=...=.Z.5.[.5.\.=...5.].=...=.^.5._.5.`.=...5.a.=...=.b.5.c.5.d.=...5.e.=...=.f.5.g.5.h.=...5.i.=...=.j.5.k.5.l.=...5.m.=...=.n.5.o.=.p.5.q.=.r.5.s.=.t.5.u.=.v.5.w.=.x.5.y.=.z.5.{.=.\|.5.}.=.~.5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...5...=...5...=...=...5...=...5...=...5...=...5...=...5...=...5...=...5...5...=...5...=...=...5...=...5...=...5...=...5...=...5...=...5...=...5...=...5...5...=...5...=...=..

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\dimensionhandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	511
Entropy (8bit):	5.2454897763885455
Encrypted:	false
SSDEEP:	6:6nK3qDJAov4TSv5JthWqD9SXtZpCOpCzuDNjmX+Et2/XpeUXHVIWHWI2E:6nKciT253BkbpCOpCzojmuEt2vpeUvlh
MD5:	10C589C2CA0A2141015DE1710CA8C560
SHA1:	BBC9119949AFFDFBE3288DB43B823431E6C8C27F
SHA-256:	5464C94AE2AE89AE7C76C2C682DF6FF8F4E1B5E7D2ABA6C8928A7E6FFE919B92
SHA-512:	CBEC7966B6D40E90FD76100F2E15476B3343F093B18A71AC7BE9DDE58D4AA619DF9845E9F076A1DE388B1F1EB0D8B64BE30CAADA8BFF0A0285FA79CA9FE2EDF8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..B.......6...'...B...K...)get_dimension_string not implemented.error........-...L.............-...L.................K.................K..............4...........=...3...=...3...=...3...=...3...=...3...=...2...L.....set_event..set_dimension_config..get_event..get_dimension_config..get_dimension_string.m_logger=.......4...7...6...3...=...6...2...L.....new.DimensionHandler...//BA9458E2226BCBFBB4CC2FAE442CACA869BE51BFBF887744C0A27A29CB66882C3D3B875CF0FC8BA12CC77CCA092331C948D74146258B59E2F373B340E00670AC++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\dimensionprocessor.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1773
Entropy (8bit):	5.600872339832399
Encrypted:	false
SSDEEP:	24:6aHDCc479uNYJHuh+DW2ISigoKgYdo//yWXmY5WQ2I7nPxz7heqlUJu0kNj45j4x:NecQXkiW2he52OX2IDJz7gqlsuPNk5ja
MD5:	B0F9C1A8EE5E0D4F9A7522332F47B451
SHA1:	C009AC8785F1B7B95273B2F227DF098FE5CA7B42
SHA-256:	191D64BD5AF045AEA5E53D8C52EE5416FD4BD85E51B16A0B478A9514A72D168A
SHA-512:	3B544FC422995A30C4537BF0DA8CB6264C7BF174E43387BDC6924A8BE509BE1C6FA97E4671C98FE9A9ACEBF5864EAE36851C89A55F7CA4D099EBA0DD659385BB
Malicious:	false
Reputation:	unknown
Preview:	.LJ...............X...9.......X...-...9.......9...'...B...K...6...9...B...H...-...9...<...F...R...K........pairs>Invalid dimension configuration supplied on construction..err.m_logger.dimensions........-...L.............-.......B...K.............-...L.................K............./4...6...-...9...B...H.&.....X...9.......X...6...'...9...&...B.......X...9...-...9.......-...B...9...B...5...=...=...<...X...-...9.......9...'...B...X...-...9.......9...'...B...F...R...L.........5Nil dimension handler configuration encountered.'Nil dimension handler encountered..err.value.config....config..value..get_dimension_string.m_logger.new#telemetry.dimensions.handlers..require.handler.dimensions.pairs........<....X...9.......X...-...9.......9...'...B...K...6...9...B...H.).....X.......X...9.......X...-...9.......9...'...B...X...-...9...8.......X...-...9.......9...'.......'...&...B...-...9...<...X...-...9.......9...'.......'...&...B...F...R...K........).qAn non existing handler configuration was present

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\baseaffidlookup.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.39366584225968
Encrypted:	false
SSDEEP:	12:6H0l3kvy33+O13I8xJ4MK2soWLIDvKNrcwR6s2k+tY:6UlU6+qsM32IWNIdvkl
MD5:	9F2DBC6A88858E21067AF0ADEDDD5713
SHA1:	43584F1D2FBFAC751909A479D6157677BC4B59FB
SHA-256:	1337583E5E6130334B3265EFF3D47F9EF143E075A36C7461C0653F3D784401E9
SHA-512:	FCCBF63373658F115DE9DAE2CFB48A6F37AFE5D53F70F19A9428B73AE293F42E308A0460DE32378B8DFCDB03A43FFE97A06034DFDD68CF4558F364DCD0CD5AF8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..t.......-...B...6...9.......'...B...7...7...6.......X...6...9.......)...6.......B.......L......sub.i.j.-.find.string.Z.......6...9...........B...9...3...=...2...L.....get_dimension_string.new.SettingsDBLookup........6...'...B...4...7...6...3...=...6...2...L.....new.BaseAffidLookup3telemetry.dimensions.handlers.SettingsDBLookup.require...//6A8F63F975933ED688D6398132A5FCA7A0167A477FDD51AAE00E1FE82BF69403B8E85967B0371CAF4B775AD8F97D083F52EF319695C4F223C2685B29AD62C3D2++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\bingpartnercode.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	477
Entropy (8bit):	5.485745848616418
Encrypted:	false
SSDEEP:	12:6wfMkRwlFXzF87fu8+O13I8xJ4McusoWLIDvKnj6tyJYO:6G+DF42zqsMcu2IWnj68Jj
MD5:	81508CA26570DC5A794A4511189D5EE0
SHA1:	A1708F1E8840134C3B47EEAE80A0F11D314FE478
SHA-256:	698273FCC3A8F70DBF4B5DFBBEE69C68D908E1E42557DCBBE0A29B22C31C8472
SHA-512:	DB1948B5AE7182DBA1671F16D3C6827F75DFE7658FEF84B1709C5EC3951874A5105F4F1F8234A6198F6B3257C22F3D277245122D7E4468B024E881932D597B44
Malicious:	false
Reputation:	unknown
Preview:	.LJ..u.......-...B.......X...6.......9...+...'...'...B...L...'...L......DISABLED.MC01.BingPartnerCode.GetOption.settings.23Z.......6...9...........B...9...3...=...2...L.....get_dimension_string.new.SettingsDBLookup........6...'...B...4...7...6...3...=...6...2...L.....new.BingPartnerCode3telemetry.dimensions.handlers.SettingsDBLookup.require...//97F8874C25D6C968394AFD4A25441830446BEE3E675AE6985A1C4DA808B855A36C75F3519A80C22F4E661401920DB0510AD53CC2EE144D06506C097667D5BC94++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\chromebasedbrowserversion.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	5.748077949431701
Encrypted:	false
SSDEEP:	24:6nknKRo8wzRaZaW0v8LvIWFlh5N/ucNbxPzQBOlkIE/vIf3OkO:mknKGAAWeUTlh5N2wFPzQBOlZXf3OH
MD5:	6F66062292A620D106743BD657C87841
SHA1:	593E54331A6CAAC927D5A8CD52788CF1B4A681C0
SHA-256:	AA75B1487DF291773793EA9E618A92D43442E6F904B5E66C607F8EB93F05731F
SHA-512:	BDC45D8C23973E22A7DC1C27CC6C0AC52EECBA45738CF247BD54C187F04D853392C9F2241682BE64AF17F70682FABCF689557367CDC1E5AA7FA6A7E1971371DF
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........!'...)...-.......)...M...-...8...6...9...9...9.......)...9...B.......9...B.......X.......9.......B...........X.......X...L...O...L......QueryValue.IsValid.options.root.Registry.Win32.core.........8'...'...-...9...B.......X...9.......X...-...9.......X...-...9.......9...'...B...L...9.......X...9...-...9.......B.......X...6.......X...6...9.......'...B.......X.......X...-...9.......X...-...9.......9...'...B...6.......D........tostringPCould not determine chrome based browser version. Returning default value..warn.%d%.%d.match.string..verion.value_nameRInvalid configuration specified for the chrome based browser version handler..err.m_logger.reg_value.get_dimension_config.pv.0.0.........6...9...............B...4...5...>...5...>...5...>...5...>...3...3...=...2...L.....get_dimension_string.....root.HKLM.options........root.HKCU.options........root.HKLM.options........root.HKCU.options.....new.DimensionHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\currentbrowserversion.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	664
Entropy (8bit):	5.423859544312155
Encrypted:	false
SSDEEP:	12:6XUQcG7lz1jyjs301RR2JZJA5tIFEb4Md+b/Iusoa8EeJKnPaiPyRF:6XTc4DjIgCcWuMdIjE/PpP2
MD5:	3C3FA6ABEDF5EF3B0FA4AC5AE5A94328
SHA1:	F24564DC3D2707ACEB43859CB8DF0B2EAD7E36D5
SHA-256:	87272C87A0E92F188FABE1B6BADF4A8DEB817E8B9C2940BDDEF35EA81F5E48C0
SHA-512:	917C8AA05908D09DB813F13C1819B7D92B4F48ED80E3BE7DC0510FBFE53EE48801DA1A9C0174D3ACB72C9B565FD9EC5D3397F978E2E9A5AD69F8CAAAB05D1F95
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........''...+...-.......X...-...9.......X...-...9.......9...'...B...L...-...9.......X...-...9.......X...+...6.......9...-...9.......B.......X...6.......B.......L........tostring.GetCurrentBrowserVersion.utility.minKInvalid configuration for the CurrentBrowserVersion dimension handler..err.m_logger.browser.Z.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandler\|.......6...'...B...4...7...6...3...=...6...2...L.....new.CurrentBrowserVersion*telemetry.dimensions.DimensionHandler.require...//19BA7D7119EECB42BEC7630F899C91A22716C813CF42B122328CA205C9498F354D8BF1848D91B1DB00F373D773A112FAD1F252DE1760B682EF5D395D83CA2A5F++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\dayssincesettingsdblookup.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	5.595338990593027
Encrypted:	false
SSDEEP:	24:6jJVmWXieFExUzPCD6P1NWcaJDYVysxlAsr/zMj82IW6Cejv4aAe8:QJwW5jPX1+JeTl+j82eXjv4pp
MD5:	430EA68B8F6C2A8894FAFC8282456B1C
SHA1:	EB3CE110103217C2DE48BB2D36918F9DE21A9DE6
SHA-256:	B6A2956D8B16A2AC1AB75C39AB66C46CF8382A391E57276EC1D904234E334033
SHA-512:	D2C112A279014CD7F90E0B362FBCF30D8EB946D7418FEB3539D5015AEB385C77C5809AB9F3A023593D879DBC9B51C9057EC65060BA4DEBD2A75900C64CF7E287
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........D6...9...6...9...'...B...A...-...9...B.......X...9.......X...-...9.......9...'...B...'...L...-.......X...-.......X...6...-...B...).......X...-...9.......9...'...B...'...L...-...6...9...B.......X...-...9.......9...'...B...'...L...-...!...6...9...-...#...B.......6.......D..........floor.math.NeverDeclined]seconds_since is default_no_value, toast likely never declined, possibly toast accepted..info.tostringcNo or empty seconds_since or less than 0 database lookup dimension handler (dimension string)..warn.tonumber..UnknowncNo settings configuration specified for days since settings database lookup dimension handler..err.m_logger.default_no_value.get_dimension_config.!t.date.time.os.i..........6...9...........+...B...9...B...3...=...2...L.....get_dimension_string.new.SettingsDBLookup............6...'...B...4...7...6...3...=...6...2...L.....new.DaysSinceSettingsDBLookup3telemetry.dimensions.handlers.SettingsDBLookup.require...//289EFB69A5C09772A7198F181D55AFDB8F329A435229BE12

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\defaultbrowser.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	960
Entropy (8bit):	5.734374192243616
Encrypted:	false
SSDEEP:	24:6UvNmjQ1TlioZmpV6YHTn3lgHSjrC+4iwx4PnM9E/9O0l19G:1cQ1xifpzHLl9jroim4E9YO0z9G
MD5:	3A8974BD6B157221E1FCAF9516B3811E
SHA1:	DFFEFCEE7F5F8960E94FBFF2FD44334C9876C93C
SHA-256:	4F3D46684FC6EBF342C868589F1345BDCB0A95F1BED028116414F7FBB5AA3933
SHA-512:	14D60F18C21D5858C6AC5B0FC40829EF96598E5703F54A99EFC874A8094ECC3FF2DFB5B9C1E643A7471D523C9C33DB3BDB7D7F77522F422A7F3F55A429AD2C5E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........!'...)...-.......)...M...-...8...6...9...9...9...'...)...9...B.......9...B.......X.......9...'...B...........X.......X...L...O...L......ProgId.QueryValue.IsValid.optionsRSOFTWARE\Microsoft\Windows\Shell\Associations\URLAssociations\http\UserChoice.root.Registry.Win32.core.........)'...-...B...6...9.......'...B.......X...'...X...6...9.......'...B.......X...'...X...6...9.......'...B.......X...'...X...6...9.......'...B.......X...'...6.......D......tostring.ED.^MSEdge..CH.^Chrome..FF.^Firefox..IE.^IE..match.string.UNKNOWN.........6...9...........+...B...4...5...>...5...>...3...3...=...2...L.....get_dimension_string.....options.....root.HKLM....options.....root.HKCU.new.DimensionHandleru.......6...'...B...4...7...6...3...=...6...2...L.....new.DefaultBrowser*telemetry.dimensions.DimensionHandler.require...//558C30A68277EC6180EC14AB9DB80FB0A4B4B6CB85CDDC3BCB614BE71D163EEC08EC312D78F18AFDD0C1FAD3BEBDC1B4ED72DF4918AE40CE5451B4B5D7FC0FC2++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\eventsupplied.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	710
Entropy (8bit):	5.558973814436003
Encrypted:	false
SSDEEP:	12:6+fl7XT767S0GwG5owMGpRXJAapC+uknxUCZIFET4M5soa8EeJK9vTuakFqT:6Q7Du+BwG5ow75P5uuJCM5E/BuDFs
MD5:	FE8F128AD06FDCB28BB39645246CFD59
SHA1:	B160AA85A02BD2D516B8DAEF2B9F6D3ACD2EFDE9
SHA-256:	E8CE423D84B82FD423375D4239717DD0CBCBDC7E811D5B1F3705639344A13517
SHA-512:	F386B8F7F5B9753D38DAECFCC7E0F728FD0AFE865C045EC65812785E595BCB0161D5A81A77118F30D075DF38EB5530308FDB20B82575BB2CE35F3159D1EBB96E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........%'...-...9...B...-...9...B.......X.......X...9.......X...-...9.......9...'...B...L...9...8.......X...-...9.......9...'...B...L...X.......6.......D......tostringLNo data found for event_mapping in the EventSupplied dimension handler.CInvalid configuration for the EventSupplied dimension handler..err.m_logger.event_mapping.get_event.get_dimension_config.Z.......6...9...............B...3...=...2...L.....get_dimension_string.new.DimensionHandlert.......6...'...B...4...7...6...3...=...6...2...L.....new.EventSupplied*telemetry.dimensions.DimensionHandler.require...//C47762B48444362AF2D5E97095372D21184B574F8201301BFE7C00DA35D84B55DBCA0FA085E30C5D55F44B76540C12F85144DF71B78769ACF1E930C0EFB2A773++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\externalutilityfunction.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	920
Entropy (8bit):	5.570922605080911
Encrypted:	false
SSDEEP:	24:6Ht1Gn4Lel9awpSLdVf507iUXU0Ol4lRYoM0JE/pnb3+9TZ:mt1venD4Vf5Ci4lRYt0Jm3QTZ
MD5:	D3807080D0AEC459D91011254BE4378D
SHA1:	56EDCD625F0EBFC8E4461DE0D827F96D765B82EF
SHA-256:	01D312E5962E805358C5C9FD240D2D16568875243D642C5C67428E207E7F1C5E
SHA-512:	6D2C81BAA36028E42FF3B9790FD626CD0634782E914595D43C5CCEF831BA79317BE407752535C43369D7B62730C8C05A99A26C4D3A14C35D29FDF9E12B3B59C8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........B-...9...B.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...'...L...6...9...+.......X...9...8.......X...-...9.......9...'...9...'...&...B...6...9...D...........B.......X.......X...-...9.......9...'...9...'...&...B...6...9...D...6.......D.....7) return invalid result. Returning default value...tostring0) does not exist. Returning default value. External utility function (.utility._G.defaultSInvalid configuration supplied to external utility function dimension handler..err.m_logger.func.default_no_value.get_dimension_configZ.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandler~.......6...'...B...4...7...6...3...=...6...2...L.....new.ExternalUtilityFunction*telemetry.dimensions.DimensionHandler.require...//6125F05538C54B0557109F8704AD8CA05E65FDEC6CE7106BD64B719E6FD5712F927CE0DF9C756BF7E28626487DCEAC611C6664FF3E3E780EBD588CC30C736AA3++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\featuretrackingfeature.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6942
Entropy (8bit):	5.636812549978688
Encrypted:	false
SSDEEP:	192:Zm/2qmnimFhKwEXL1IP2L59LfV/twUxYZX7XukNJK4wgcfCRKL1g+8FWwMT:omnbhKwEXL1i2L59LfV/twU+ZX7XHNJS
MD5:	DB0924634671345DECDBCEDE86F655E1
SHA1:	EE6BDB92D920C8404C12F394ADBB94E8225B0817
SHA-256:	0420CEC8AA18E41FCB05A31CB2F56616CCB2079A4621D4EF04A4A926D3E76769
SHA-512:	E916B061363D8568D1ED3105BA2393CF3ADE1B7F878E7741252D66EA5584F2116EFB14F8D65128550D75B443152CCC41E19E564E64A8776A36F7BBB6DF55156A
Malicious:	false
Reputation:	unknown
Preview:	.LJ..V.......-...........-...-...8.......X...-...-...8...-...-...-...8...8...J...K..........d.......4...6...-...B...H...........<...F...R...6...9.......B...)...3...2...L.......sort.table.pairs.........P'...-...B...X.I.'...).......)...M.>.8...9...8...9...8...9.......X.......X.......X...6.......9...6...6.......9...........'...B...A...6.......B...A.......X.......'...&...X.......'...&...X...8...9.......X...-...9.......9...'.......'...&...B...X...-...9.......9...'.......'...&...B...O...........'.......'...&...E...R...L........=2) was detected when processing FTF dimension..Invalid information for (.err%) when processing FTF dimension.'Skipping version information for (.info.m_logger.version.0.1.GetOption.settings.tostring.IsMatch.regex_helper.enablementCriterion.enablementSetting.scope..,.........6...9...............B...6...9...3...3...=...2...L.....get_dimension_string..FTF_Registry.FeatureTrackingFeature.new.DimensionHandlerj.......-...9...8.......X...).......)...M...8...9.......X...8...9

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\firefoxversion.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	944
Entropy (8bit):	5.744005443944445
Encrypted:	false
SSDEEP:	24:6Xkxmjh1TliozpoMMlvQceJuu5swJPlPIE/UvSv+:Wkxch1xiopUQceJ9lJPlwbSv+
MD5:	7FDC49747A935B1EEDD8826AFEA42D27
SHA1:	DFFC558A00CBB35B0DC9F40D9F612ECF4945EF5A
SHA-256:	9BC224DC1D789E6FEDD9732E0CA6CD3F0E3BE19A8D8EF770EE15F89615E7D023
SHA-512:	29CFA1C96F52728989ABFD6062D7A0825E25B0FA3B538DF74C3E7A25B178E0EC368CDA10C589349C50BF24F85884AAEA4661FA39B9B7E8E44EE263EA60135C43
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........!'...)...-.......)...M...-...8...6...9...9...'...'...)...9...B.......9...B.......X.......9...'...B...........X.......X...L...O...L......CurrentVersion.QueryValue.IsValid.options%Software\Mozilla\Mozilla Firefox.HKLM.Registry.Win32.core..........'...-...B.......X...6.......X...6...9.......'...B.......X.......X...-...9.......X...-...9.......9...'...B...6.......D........tostringKCould not determine Firefox browser version. Returning default value..warn.m_logger.%d%.%d..match.string..verion.0.0.........6...9...............B...4...5...>...5...>...3...3...=...2...L.....get_dimension_string.....options........options.....new.DimensionHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.FirefoxVersion.mfw.core.Win32Helpertelemetry.dimensions.DimensionHandler.require...//56A8A67EBF0106B10CA2779FFB8E37CFB4A379C3DCE3A7C824D302FE1078388B1F1E140BD838B9B3E7D8C1F5FF732A77FCD81742EA327B79FD5BB3577DFC22E0++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\freesysdrivespace.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	877
Entropy (8bit):	5.6459457487397975
Encrypted:	false
SSDEEP:	24:6q52F+CU2ua3My0VqQJsFDnjWM0rE/N87:b2F+CU2ueMy0VqQJsFDnjz0r57
MD5:	7A0C7743624AC355EF6E0BC19BF34CA1
SHA1:	5AD4039C6B832337CC6CFA2DE7BBEF4C6B4F94B7
SHA-256:	BA3B897FBD6319150C994B19D21F8E19E46F130D600FA1C52AF4173A0584ED35
SHA-512:	58841CC1824DE32A324A64C38669934E47E662C804C92302091723350FFE07E0CABE4C5D584787D71D3FE75E8093B6F12F16C5EC73420E100886741BE701761E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........4-...9.......9...'...B...6...6.......9...'...'...'...'...B...A.......X...'...L...-...9.......9...'.......&...B...6.......9...'...'.......'...&...'...'...B.......X...'...L...-...9.......9...'...B...6.......D.....#FreeSysDriveSpace handler: end.FreeSpace."?select FreeSpace from Win32_LogicalDisk where DeviceId = ",FreeSysDriveSpace handler: sys_drive - .(error).top.SystemDrive2select SystemDrive from Win32_OperatingSystem.Root\CIMV2.get_wmi_properties.utility.tostring%FreeSysDriveSpace handler: start.info.m_loggerZ.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandlerx.......6...'...B...4...7...6...3...=...6...2...L.....new.FreeSysDriveSpace*telemetry.dimensions.DimensionHandler.require...//C8B1B1805902FFE08ED1D48D165C132DCC2F05BFEFFEAC96759BF28ED2CD9493466FB82F0FAA8B25C78E6E43E1AE3F12588EF5612809C7D30CC9EF077838A71C++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\installdate.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1201
Entropy (8bit):	5.699257071003703
Encrypted:	false
SSDEEP:	24:6fliqFRnf5bpZwMySNCuHz2Hh1f95dMuaBUi8kxhlAV72IWp4uFIAxoSgU7n:4FBfZPwYD+1V4uaBUiXlk72CuFIAxoSZ
MD5:	1A63CF1CD303008E6A36903334D7A19B
SHA1:	9700319FEF59B69277BE422D7791C8BF0C392BC9
SHA-256:	D9CA237210FEB25489C8816DAB49E3A8ADECDE02F541E9E0974785B7B49320FC
SHA-512:	7E27EC0B30CE82DECD98738463B0C1A5442C6E9439638049113215EE16B6CB909EB42483EBA80EB48AAAC5BFB03426A3012B7B742C1003F7D06F1A53E6C6638C
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........-+...6...9...9...'...'...)...*...B.......9...B.......X...-...9.......9...'...B...X.......9...'...B...........X.......X...-...9.......9...'...B...X...6...9.......'...'...B.......L......-.gsub.stringVCould not find registry value (HKLM\Software\McAfee\WebAdvisor\EulaAcceptedDate)...EulaAcceptedDate.QueryValueDCould not find registry hive (HKLM\Software\McAfee\WebAdvisor)..warn.m_logger.IsValid.Software\McAfee\WebAdvisor.HKLM.Registry.Win32.core...........6-...B.......X.......X...-...B.......X...6...9...'...6.......B...A...6...9...'...6.......B...A...6...9...'...6.......B...A...6.......B...6.......B...6.......B...&.......X.......X...-...9.......9...'...B...'...L...L..........00000000=Invalid date returned. Returning default of '00000000'..warn.m_logger.tostring.!%d.!%m.tonumber.!%Y.date.os._.......6...9...........B...9...3...3...=...2...L......get_dimension_string.new.SettingsDBLookup.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.InstallDate.mfw.core.

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\isbissecuresearch.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	593
Entropy (8bit):	5.596438168731846
Encrypted:	false
SSDEEP:	12:6kmD0PplqVyCnxljwuG/duknxUCZIFEJnB4Ml2jsoa8EeJKlQeaey:6kmD0PLqoCxljoduuJ3WMl2jE/lQlj
MD5:	1855B04422A0347E9A45C40F7B4A467C
SHA1:	58437AD2367541F8543EBB1E155702D84E99B228
SHA-256:	E706A2746BC8AB74BCF4B39DD0A75FFE3C8B431CC8057F365EC2C875F95D4661
SHA-512:	911131569E00899D9FFCFD0B30D82C438CA7EEDBA938AC880790508A94DAF1F383F56C31267CCE2650E4525E5C144B15CAFEBE4F82AB8E4BFE12CA4E56440E75
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6.......9...)...B.......X...-...9.......9...'...B...)...L...6...9.......'...B.......X...)...L...)...L......search.yahoo.com.find.string3Received nil value for ISB default search url..info.m_logger.GetDefaultSearchURL.browserSettingsZ.......6...9...............B...3...=...2...L.....get_dimension_string.new.DimensionHandlerx.......6...'...B...4...7...6...3...=...6...2...L.....new.ISBIsSecureSearch*telemetry.dimensions.DimensionHandler.require...//1B2FCB9865F42870CD8E20982501FA4F40F061D630F416936852450C5110F4529D63747BDD9D16DE8FE96B02CEAEF5D98E693555746A6BE028214F89573C6A64++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\lastbrowserused.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	614
Entropy (8bit):	5.634544586033963
Encrypted:	false
SSDEEP:	12:6nR9pop/3wsbeRVMHkp/n09fN+O13I8xJ4MLgUsoWLIDvKH7Wdm7D:6nR9CpPkQA89fYqsMLV2IWHFD
MD5:	AD29D0072B66E96FE4656CC26C354E80
SHA1:	130DE2E13B3C03F8F2241B337EFCF9D40D857A7C
SHA-256:	C29DE43016BE99B970FE3AF4D0F03D25BCA0C0E81B5A729A51713495167267B0
SHA-512:	E20415A971E3E7080732802811787F106934076CAB9889D76AC8200119AD7634918BB6DD114F81CDF874FA390DEFFDE8DDCB965D36659C1B83E25BE0FD3FB2BD
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........!-...B.......X.......X...-...9.......9...'...B...'...6.......B...'.......X...'...X.......X...'...X.......X...'...X.......X...'...L........UNINITIALIZED.CH.2.FF.1.IE.0.OTHER.tostring.-15Invalid date returned. Setting default of '-1'..err.m_logger.Z.......6...9...........B...9...3...=...2...L.....get_dimension_string.new.SettingsDBLookup........6...'...B...4...7...6...3...=...6...2...L.....new.LastBrowserUsed3telemetry.dimensions.handlers.SettingsDBLookup.require...//37A26481151DE12746569C5A3774A4188C588E45DBA97416F4125F18F1C142FBB659EFE11F7B604A16079CF7888197FE0813AA446F7A0378BDF67790CFCDDC4B++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\lastoemcheck.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.471940393573248
Encrypted:	false
SSDEEP:	12:60w3maKqO61/NaVnEUhlWlOzE1LIrkSlTfu8cPkrI8xu4MVg3soWLIDvK50l22kd:69j1/Gn3o1L3SlT2pkxZMK32IWql22Yd
MD5:	33B2522222D83027DD2DD18EB4C875B1
SHA1:	25C3456F9403DF648A58990DE641BA50F8491694
SHA-256:	BF46EC1CDEE6DE371ACD9003BA3CC249AD19C1B5693D9BB4746E296145122F29
SHA-512:	2F3B90A264C0A893EE7A7D4297CF52EDF56489EE23E7A359D8780FD7B3B72A8E44B27E20E3051827AAE65FDFDFC431EAEEAD901987C85CAC0E9D253CFCBC983E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..4.......6...9...6...9...'...B...C....!*t.date.time.os........(-...B.......X.......X.......X.......X.......X...'...L...-...B...6.......B...6.......B.......X...'...L...6...6...9...6.......B...6.......B...!.......B...A...L........floor.math.tostring.(LastOEMCheck>current).tonumber.(LastOEMCheck=0).0.default....._.......6...9...........B...9...3...3...=...2...L......get_dimension_string.new.SettingsDBLookup\|.......6...'...B...4...7...6...3...=...6...2...L.....new.LastOEMCheck3telemetry.dimensions.handlers.SettingsDBLookup.require...//0F409B41E2E005EBBA88F0239EA551D020AA068203E65EDC4800A7D2A6D6F36442615E3FFB2286C4D7D8221903880765AAE8915302E186674CBACD471FA812BB++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\locale.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	624
Entropy (8bit):	5.546227687178299
Encrypted:	false
SSDEEP:	12:6+EeA2EmWWfFcFMEwgjZ7rcf/duknxUCZIFEC4M/3Usoa8EeJKjYibTtddOn:6+EeAmqWercXduuJRM/EE/RO
MD5:	ECA5A82936BF53C66300186CD81903E3
SHA1:	4D0C119159ED870B47396B981ED95068BA4CBA10
SHA-256:	3A69DBB4B853DD698E17FA2602E730AB80502EA949274B1D40FEDF5FEBBF3B68
SHA-512:	C579F320C49A9A757C49D6EA31706E5E288928F1FD464278BF9246CFD86A36C71263A38A7C0776CE026DA79A75922EFAA3C007C85196F4F9B21E01CC74B20360
Malicious:	false
Reputation:	unknown
Preview:	.LJ.........."6.......9...+...'...'...B.......X...6.......9...B.......X...6.......9...+...'.......B.......X...-...9.......9...'...B.......6.......D......tostring1Failed to update locale in settings database.err.m_logger.SetOption.en_us.GetLocale.utility.UNKNOWN.Locale.GetOption.settingsZ.......6...9...............B...3...=...2...L.....get_dimension_string.new.DimensionHandlerm.......6...'...B...4...7...6...3...=...6...2...L.....new.Localetelemetry.dimensions.DimensionHandler.require...//6C9C004C5F7425495976B8C75CEFF59EEE2904C137A969D7C4FB3CD27E2B6F6B6787490C62BE1B36C0682A38A0C5E093262ABD3537FB17D73947B991673D2294++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\msspstatus.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	5.636491145822077
Encrypted:	false
SSDEEP:	24:6iSHUuveVdlgG13CShqVJCaZRetV6mDlRiz6u5HMlMAIE/CgBBeM:o/v8lgGzqfCasDDlRizJ5slmQBBv
MD5:	B6CA989177187A3D783F5B4F3F87218D
SHA1:	11F7E02CE63F11FAAED7C0E27D8E82550C869281
SHA-256:	733E227FF52C897939FD0479D2C87F451A11359DD097705196436E276424522C
SHA-512:	EBE2357976A5113A6BAD080193553BFA9B6A7348ADD8A92EEDD2277B7F322626BF834B14DB359DB4A9788B0F246B4B6353D3665C852D27C3CE68A1F70B0D54D1
Malicious:	false
Reputation:	unknown
Preview:	.LJ..k...........9...'...B.......X.......9...'...B.......X.......9...'...B.......X...+...X...+...L....\|.&.%%.find........1-.......B.......X...-...9.......9...'.......&...B...+...L.......9...'...'...B.......6...9...'.......'...&...B.......9...'...B.......9...B.......9...'.......&...)...+...B.......X...+...X...+...L........Directory of .find.close.a.read." 2>nul.dir ".popen.io..\$.gsub%Unsafe directory path provided: .warn.m_logger........'...6...9...9...'.......)...*...B.......9...B.......X.......9...'...B.......X.......X...6.......D...X...-...9.......9...'...B...'...L...-...9.......9...'...B...+...L..... MSSp not found in registry..version_not_found1MSSp 'DisplayVersion' not found in registry..warn.m_logger.tostring..DisplayVersion.QueryValue.IsValid.HKLM.Registry.Win32.coreYSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\McAfee Security Scan............'...-.......B.......X...'...L...-...9.......9...'...B...+...L.......3MSSp default installation directory not found..

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\osflavour.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	796
Entropy (8bit):	5.728758151481667
Encrypted:	false
SSDEEP:	24:6U2hokcuel9pq0MexRV2Di7V7laIE/o0LXlRX:Ljk1eneoz7V7lXUXlRX
MD5:	C473AD50AE41F0AA265B6FD53DCC5029
SHA1:	624269C99B8029E88B05D263E3BD50F6EAEF1448
SHA-256:	54EF391A7A3B6BA64C2E928D5CF64FDE1CA4C0C7DDAAB3DC019B2B8B8ECBDCFE
SHA-512:	87EF2076B137BC745CC7E5FBA9ADDC572D8D30081CF5FAB5BC0465639C646B9F5BF6A7CA10A1325A90DA4868A3FE778F749B9FB89814B80D68F6A2E633C351AD
Malicious:	false
Reputation:	unknown
Preview:	.LJ........../'...6...9...9...'...'...)......B.......X.......9...B.......X...-...9.......9...'...B...L.......9...'...B.......X.......X...L...........9...'...B.......X.......X...L.......'.......&...L...... .CSDVersion..ProductName.QueryValueTInvalid registry configuration specified for registry lookup dimension handler..err.m_logger.IsValid1Software\Microsoft\Windows NT\CurrentVersion.HKLM.Registry.Win32.core.UNKNOWN...Z.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.OSFlavour.mfw.core.Win32Helpertelemetry.dimensions.DimensionHandler.require...//5CFB6B297E79BEBE816C0AA782529E628AD89B3976214160849E97DC12750ECD3DDFA400CD8C6179165C8DB48BE08F8517FB85DC3306B6B3CC0F7EC66E7600A6++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\percentagehandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1139
Entropy (8bit):	5.605749327252425
Encrypted:	false
SSDEEP:	24:6minD6l0Bt/poiwYe0HBJ2sF8uil4KIjEqE/+7Js:KnDM0Bt/ZPHB5pKs7Bu
MD5:	51B4E6C9A00E7A7CB3E0199C02FD9B12
SHA1:	AB57AFDC29F8D2E47A679E5405205C59F6F18AE8
SHA-256:	D5BED31D2B9E58195511144A9FFAD5FBE2A1A5E5D18231D507BE817EB9F4476C
SHA-512:	305806E45D9B33A12484A636089227076BF0567C29869C86C3DCF93F7D1C074DAB943A77D854DEDFE228D3E8432D45DD68320A611AE8C5787EE0AD336C963561
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........C6...9.......9...'...B...'...-...9...B.......X...-...9.......9...'...B...'...L...9.......X...9.......X...-...9.......9...'...B...'...L...6...6.......9...+...9...)...B...A...6...6.......9...+...9...)...B...A...).......X.......#...6...6...9.......B...A.......X...'...L......(Division by 0).floor.math.tostring.GetOption.settings.tonumber.(invalid config)]Invalid settings configuration specified for settings database lookup dimension handler..Denominator.Numerator.(no config)XNo settings configuration specified for settings database lookup dimension handler..err.m_logger.get_dimension_config.+PercentageHandler get_dimension_string.info.log.core...........6...9.......9...'...B...6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandler.PercentageHandler new.info.log.core.........6...'...B...6...9.......9...'...B...4...7...6...3...=...6...2...L.....new.PercentageHandler"PercentageHandler file loaded.info.log.core*telemetry.dimensions.DimensionHandler.req

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\postupdatereboottimelookup.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.574514341312559
Encrypted:	false
SSDEEP:	24:6kwX7ue9P+AP67aap522lxSOYypacVjK8AekoGFn+MYaE/EWxpCact:1ex+AP67aap5zxSspnKn+0bYaPd
MD5:	40FF003D4E887281D910F146DD66E236
SHA1:	916B1D9D9CD13E80C00EB394420094BB29B83505
SHA-256:	BFEFCE4F155C3BCFBC75AC4E95151A3FE4A06ECD0C976597A298C966EB579861
SHA-512:	EE84F181DC8CFEC786C7F02EB30A5D5E9E4AD25548C205DD649BC6C475105317069203D97833E5AEFBEAF5573C0B5AAC91B98F99519E9D5495527BF9F5595664
Malicious:	false
Reputation:	unknown
Preview:	.LJ..i.......6.......B...7...6...9...6...B.......X...U...'...6...&...7...X...6...L....0.len.string.str.tostring........n6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9...+...'...'...B.......X.......X...'...L.......X...'...L...6.......9...+...'...)...B...!...6.......B.......X...6.......9...+...'...'...B.......X...L...6.......9...+...'.......B...6...9.......B.......!...........!...........!.......)..'....X...)..'-.......)...B...-.......)...B...-.......)...B...-.......)...B.......'.......'.......'.......&...6.......9...+...'.......B...L......:.floor.math.SetOption.UpdateDelay.tostring.UpdateDelayDelta.pending.fresh.!VersionChangingRebootPending.InstallDate.LastUpdate.GetOption.settings..x0_.......6...9...........+...B...3...3...=...2...L.....get_dimension_string..new.DimensionHandler.........6...'...B...4...7...6...3...=...6...2...L.....new.PostUpdateRebootTimeLookup*telemetry.dimensions.DimensionHandler.require...//4F7395100B6E392345F54AD57EE93347DB31FA4F9AD4B53116FA4

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\profilescounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	574
Entropy (8bit):	5.631859811794459
Encrypted:	false
SSDEEP:	12:67k98ezZigQVAJ93mHln+zivcxC7YuknxUCZIFEeu4MXsoa8EeJKWu0ArcgzJgK+:6hezcZKM+GkXuuJsMXE/t61Vh
MD5:	32FF03C9F0FC9005C601701E4178215A
SHA1:	B970BE1F7A07F7EF9F050DF410FA528217F59CE8
SHA-256:	2CA715A37239809B2883EEAB9C3E2EBA7D9595CE1F388A7E1EF87477C27CF305
SHA-512:	E18EC14F3E80781E618099E240685EEB8B695192DD06F9D689F8F6EE72BA885A6567FFE096BABFCAA48DFCB6C6C69114DA2A2D96BC21A66610771B2A60E22140
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6.......9...B.......X...-...9.......9...'...B...'...L...)...6...9.......'...B...X.......X.......E...R...6.......D......tostring.SYSTEM.[^,]+.gmatch.string.0.Failed to get scopes.err.m_logger.GetUsersScopes.settings.Z.......6...9...............B...3...=...2...L.....get_dimension_string.new.DimensionHandlerv.......6...'...B...4...7...6...3...=...6...2...L.....new.ProfilesCounter*telemetry.dimensions.DimensionHandler.require...//232AE1AD57E0C175F40B4435507646BBA66EC8B40F7F9B4055CC50B22FA4DAA46A5E8F57B3FFA98AABAE9377DA520EE28E28B3815C5D0DC70DFE615F4281BF81++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\proxysubtypehandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	788
Entropy (8bit):	5.683170372765027
Encrypted:	false
SSDEEP:	12:66wlBRe6KwlRg21VUlaIhotoIKszNQ1amXWgAXrCD3czFAE5f4mO9IFEscFEC8sJ:61XVuaA6oNsgHnaDfxYEVE/GiMUHaN+
MD5:	8432F848850ADA226AFDF5A5EE9EC165
SHA1:	430A89871C263775592C35D8375CD7E9D70D705F
SHA-256:	7FFB5F57398F10C6F5867706AF7A1EDD891C389B3DB523042A6CFCCFE7DD787F
SHA-512:	610224EEE093C1E2D09E8A8FB81D1C2BA261721BF91218625BE9DD3018E09B77F33F14D756C7C1CDC1295C5C1050573736CFEACEE13254D8A8F28E239B15955F
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........<'...6.......9...+...'...+...B.......X...'...X...'.......'...&...6.......9...+.......)...B.......X...'...L...6.......B.......)...-...9.......X...6.......9...+...'...)...B.......X...-...9.......X...6.......9...+...'...)...B.......6.......D......tostring.ProxySubTypeFirefox.FIREFOX.ProxySubTypeSystem.SYSTEM.tonumber.-1._PROXY_PREF.StreamingHost.GTI_REST_URL.GTI_Streaming_Disabled.GetOption.settings.X.......6...9.......+...B...3...=...2...L.......get_dimension_string.new.DimensionHandler.........6...'...B...4...7...5...6...3...=...6...2...L.....new....SYSTEM...FIREFOX...ProxySubTypeHandlertelemetry.dimensions.DimensionHandler.require...//94297D00FA695EEC430AA2AA4E923C4558657F711954B9AF929024789C3B852383AAE2C9FCC9A105F3A5B8377CF4DB0392B3D1CC472AF227C894B756264CD519++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\proxytypehandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	745
Entropy (8bit):	5.623544609396992
Encrypted:	false
SSDEEP:	12:66wqeWhs8JczWhCg2h6OeCD3czFAE5fzyrsTjIFEtpWIfbDtsoa8EeJKDLT1yvnK:66dembJcSs6PDfLwiCIjxE/Arh0N
MD5:	A8658540AB75DE27DB7BACBA31A8CBB5
SHA1:	9F5C2AD911E196BFCA07BD254057CF5DF97AF461
SHA-256:	676534B8BB1DF6BF5ED3283D9A045F9F3BDBFB334EB684CF4049F3C59ECC091F
SHA-512:	0A24DC5133C4C613746DB54681A7247DA51C1B0CF9948F987A7027A00A8E995D8F0D5FD65610D3A9B1DD9EAF0D13BA26B93D55BF41142216000EA5B6301FFCBD
Malicious:	false
Reputation:	unknown
Preview:	.LJ.........."-.......9...'...B...'...6.......9...+...'...+...B.......X...'...X...'.......'...&...6.......9...+.......)...B.......X...'...6.......D......tostring._PROXY_PREF.StreamingHost.GTI_REST_URL.GTI_Streaming_Disabled.GetOption.settings./ProxyTypeHandler self.get_dimension_string.info.............9...'...B...6...9.......+...B...3...=...2...L.....get_dimension_string.new.DimensionHandler.ProxyTypeHandler.new.info.........6...'...B...6...9.......9...'...B...4...7...6...3...=...6...2...L.....new.ProxyTypeHandler!ProxyTypeHandler file loaded.info.log.coretelemetry.dimensions.DimensionHandler.require...//C44B17998582EDCF4AD8B37A4DBD2026579B73E4B59BC5BEF373B6F41EF0D566FD705CFB49D430906904F85A9BCA86C69B0FD395A5833D1D73C8F2CAC27353D4++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\registrylookup.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1256
Entropy (8bit):	5.666749269657573
Encrypted:	false
SSDEEP:	24:6g57OnQex+WvY9TwBD7PAjXgl1ge6rDt2LpdfFUpFe7xFLklUGIE/8tXwQcf+ghd:/qZxlvzvojgfgdDULpkALklSRwQ9Id
MD5:	B8A3CA9D1FF997BCB3A772B4DCF77A68
SHA1:	01D9A6E304E786E973DD4B3A90FEC8A01BCDAA5B
SHA-256:	B271DE1F4DAFC22FA66E770650BC60CB5DA60CBAA259B09BCD0F79FD6C46FAD4
SHA-512:	C283D9972609420059B60C59F539A31A22B8CE5F2E4A605C79A223719D6E2DE77E2A1B91F5AFA584E51350A4C5AE131CF50BE38B2B07299CD71026D678C549BF
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........m'...-...9...B.......X...-...9.......9...'...B...L...9.......X...6...9...B.......9.......X...9.......X...9.......X...9.......X...9.......X...-...9.......9...'...B...X.@.6...9...9...9...9...9...9...B.......9...B.......X...-...9.......9...'...9...'...9...'...&...B...X.'.....9...9...B...........X.......X...-...9.......9...'...9...'...9...'...9...'...&...B...9.......X...6...9...B.......X...9.......X...6...9...B.......X...'...6.......D......default_no_value;Invalid result returned for registry lookup on value (.QueryValue.)..) (#Could not find registry hive (.warn.IsValid.Registry.Win32.coreTInvalid registry configuration specified for registry lookup dimension handler..sam_desired.value_name.options.sub_key_name.root_key_name.tostring.default_no_keyONo registry configuration specified for registry lookup dimension handler..err.m_logger.get_dimension_config.Z.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandler.........6...'...B...6...'...B.

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\samrecoverable.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	851
Entropy (8bit):	5.709692332529722
Encrypted:	false
SSDEEP:	24:6AnfqeIYFxO8waLvpV53SxdMrE/xXWZh7:znfqlY7lwaLvpX36arT7
MD5:	4AAE1F947A2ABE8136B3EA99B6EAD698
SHA1:	CC8903DFC2414822082D791986E4B886C170B86C
SHA-256:	7EA3E4A47AD7102102A8B2D0D20889105B4707684A4D0451142A3C7A30453F12
SHA-512:	FF3283E458652AD454E66F4F316164C4F765B485F94A12F82B88F3704F449BAF78B902338D583DCBBA2FC7B9787214059B38DCDB8410C4049045F9130E4EB8BE
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........;)...6.......9...+...'...+...B...6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9...+...'...+...B.......X.......X.......X.......X.......X.......X...)...6.......D....tostring.oem_recovery_v2_disabled0DEFER_SEARCH_MINIMUM_DAYS_AFTER_WA_INSTALL3DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_UNINSTALL4DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_ACTIVATION0DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_EXPIRY.ShowSearchSettings.GetOption.settings.Z.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandleru.......6...'...B...4...7...6...3...=...6...2...L.....new.SAMRecoverabletelemetry.dimensions.DimensionHandler.require...//C8E66FCB3709B445029B4256E8F0AF3EE9ECC3B1D20B0CE077FA384E427DEBF30B8FAACE3CEF9A71423BC5E40303878E01DF54DB1F1D14391EEB347CEDEB5EA3++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\searchannotations.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	597
Entropy (8bit):	5.6079888686052435
Encrypted:	false
SSDEEP:	12:6A649K5bN23Rc9rGSxfzgYGAyKIFEJnB4MF3fsoa8EeJK+mnThtFXmmIVJ447Jn:6149KNEO9rGkBWMF3fE/+IHFCL447Jn
MD5:	3EDC5414DC135ACF5E3AFCABA2DD62CF
SHA1:	334A33998F98A195CB8D5624EAB92A7E2A8B5055
SHA-256:	1534F0235132619D10720A507E5BB0E31F599EBC62384091D070EC895A1B86BE
SHA-512:	8DFC67842833D276517074FD78756202B20EF2C5F6F421A082285988C8A3DFCD175B21BFC7345ED2FFEFE9F5941810C70841D1D2815E52C41615B860247E623E
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6.......9...+...'...'...B.......X...'...L...X.......X...'...L...X.......X...'...L...X...'...L...K....InvalidOption.AllSearchAnnotations.ALL.NoAnnotations.NONE.SecureSearchOnly.ONLY_SECURE_SEARCH..CurrentSAOInExtension_ch.GetOption.settingsV.......6...9.......,...B...3...=...2...L.....get_dimension_string.new.DimensionHandlerx.......6...'...B...4...7...6...3...=...6...2...L.....new.SearchAnnotationstelemetry.dimensions.DimensionHandler.require...//74EDADD62DC46071CA49BC4D1D99DE0C6FD91F12D6B2D6F8A5A7D98D059A0A60BB41CC22DDEBF480D5042E2AA780153A916B3C6971BBC35EECFCA38217DCC44F++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\sequencenumber.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	834
Entropy (8bit):	5.602362765264458
Encrypted:	false
SSDEEP:	12:6YGwlWhl/GUuftTJCd30vLTpopCe07iMNRtfYNiMYGAyKIFEK4MDrWbsoa8EeJKX:6PuNJCtsLCAHiWnQUMvWbE/0oXBQA2M
MD5:	6F0BA21E57D6FBA315EAC2A4FDDF8A9D
SHA1:	DCE4F9CF43DE25ED0FD1A76085D9BDEF603A3AE3
SHA-256:	C104BE36F09D44CB1C7FF791E617E500A2549AF187A75A7F0F4940C46A281929
SHA-512:	83D0910697007D72C0C9E60954AD188C4B46B691BD8F4CED96E9166F87508DE23E5B143395A12BF3567BB158E256939EEDB6D8FACAD4BC19989BA0468E63DBE5
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........G'...6.......9...+...'...+...B.......X...L...6.......9...+...'...)...B.......X.......6.......9...+...'...)...B.......X.&.-...9.......9...'...B...X...6.......9...+...'.......B.......X...-...9.......9...'...B...6.......B.......6...9.......B...).......X...U...'.......&...X...6.......D......0.len.string.tostring&Failed to update sequence number.;Failed to update sequence number after rollover event..warn.m_logger.SetOption.SequenceNumber.SequencingOn.GetOption.settings.OFF.....V.......6...9.......,...B...3...=...2...L.....get_dimension_string.new.DimensionHandleru.......6...'...B...4...7...6...3...=...6...2...L.....new.SequenceNumber*telemetry.dimensions.DimensionHandler.require...//884AF9C521FE5B6E4682FC2D2C1DEE2A19BAB8D66725AE6894643D5DF0C4B2C7D072BFD62F274C235ACD69173F68258AE5BE95CCAD28B8833C11CD0806AC0B14++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\settingsdblookup.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	811
Entropy (8bit):	5.529332571566126
Encrypted:	false
SSDEEP:	12:6viHHw7mniI8luL4Yvfsb97ZsCodUjb97ZsJArspC8tIFEs4M7xzsoa8EeJKSUQw:6v77Oi4L4iKqdUvsFLXM7pE/QtMLiwPN
MD5:	06B81C72D9E684E02E4F57E0D98B5D74
SHA1:	2FAA77CAEDF033E341F0EF72C26B5956E09A6612
SHA-256:	C525A2BBB6EC36AFA446B5523F6F9144C66E1F850AD5596126A805BD4EEC646F
SHA-512:	546DE78BECA067C4DBB41DFE5FAEA782C0A480D5EA27EA655DEE0FE297289E1AAE4D63F166F0696231A530CD967D697F07944CB93E008DB52640E2C350B3A503
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........+'...-...9...B.......X...-...9.......9...'...B...L...9.......X...9.......X...9.......X...-...9.......9...'...B...X...6.......9...9...9...9...B...........X...'...6.......D......tostring.GetOption.settings]Invalid settings configuration specified for settings database lookup dimension handler..default_no_value.setting_name.in_contextXNo settings configuration specified for settings database lookup dimension handler..err.m_logger.get_dimension_config.Z.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandlerw.......6...'...B...4...7...6...3...=...6...2...L.....new.SettingsDBLookup*telemetry.dimensions.DimensionHandler.require...//FFCF21751146DA69907699688DF2AC7ADA180489595965BC856A9834512FE835D864603CFECBC2B5539D65064D2DADD71ABC5B7ACC57C7E2CF8C2810D0EDFFD8++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\simplewmiquery.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	5.65335272529763
Encrypted:	false
SSDEEP:	24:61F2237FZPPi0pzsxOLs0tl17FDndMRPjE/yhbeP3n:WFZ3PPi0pqOLJPtFDnaRrxhiP3n
MD5:	4FD510B69F570AD1685ED4F5FBC82152
SHA1:	1C43BED9A9C6F6C558D572BE9619F5B0FE863E9D
SHA-256:	52F27C0E3C06E288EC1024288D6A65EC643455DC4305628C5D947F216834FE5F
SHA-512:	86FA0581B77DF92C6C208CD65BEDA7B260A0C60B5905F03AA67F0DD893EEBB3AA7DB36BE0AC22FBE6D4D796EE797ADEAA6D6F164C4D30EE2C1C8D0169C78A820
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........U-...9.......9...'...B...-...9...B...'...'...,...'.......X...-...9.......9...'...B...L...9.......X...6...9...B.......9.......X...9.......X...-...9.......9...'...B...L...X...6...9...B.......6...9...B.......9.......X...6...9...B.......9.......X...6...9...B.......6.......9...................B.......X.......-...9.......9...'...B...6.......D..... SimpleWMIQuery handler: end.get_wmi_properties.utility.aggregation_type.namespaceUInvalid settings configuration specified for simple WMI query dimension handler..field.query.tostring.errorPNo settings configuration specified for simple WMI query dimension handler..err.top.Root\CIMV2.(error).get_dimension_config"SimpleWMIQuery handler: start.info.m_loggerZ.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandleru.......6...'...B...4...7...6...3...=...6...2...L.....new.SimpleWMIQuery*telemetry.dimensions.DimensionHandler.require...//FDC5784CDCD0610B65142107D345FC9367CA7345288D4EDC8F818DDEBDA4D040AA4FD025

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\staticvalue.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	555
Entropy (8bit):	5.504002474100086
Encrypted:	false
SSDEEP:	12:63VMRLVUpCRryJAnDpC8tIFEXB4MWsoa8EeJKGFV6q7SashEvf:6mdVYeaolLkMWE/+6+NkGf
MD5:	2DAD5261E65F46E139061B46F691B79A
SHA1:	1B2286D22B4E7D6DB01878C9D812E69BEB8FD697
SHA-256:	F9BC3121DA0EB7008D87EA75B9508D314DBB1F3BD6FB50C77099CFFF71D600F3
SHA-512:	3D87AED088108340A854E8B847B737C5A35BFE189163CA89B9B33E81900F35519BA30C73C12FC90C98BB583F5EFAE5030A8961991F4A65388D841C2728C41A2B
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........'...-...9...B.......X...9.......X...-...9.......9...'...B...L...9...6.......D......tostringAInvalid configuration for the StaticValue dimension handler..err.m_logger.static_value.get_dimension_config.Z.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandlerr.......6...'...B...4...7...6...3...=...6...2...L.....new.StaticValue*telemetry.dimensions.DimensionHandler.require...//A53724C182237A1447D14B59F653434521F35A2DAA32D8BB2F4AD7EFCE86717649CA6A7095333E9ECB23C26436CC7F1E559052D1D3813EC162A5EAF85E4C61A9++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\suitestatus.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	861
Entropy (8bit):	5.591587532517702
Encrypted:	false
SSDEEP:	24:6LSgolbGXSPyKOq+/huuZwibRl4xAIE/UT6ix:+o1GiLR+/lRl4vLJ
MD5:	CF95013E7AACB0837D99FD08F8EDC081
SHA1:	98A2367B37ABFB8B35A0D5C2407F3E1650D83A91
SHA-256:	0805C512B646D7F7A6299CB4EB28BD6E23E02D109734546E1838A27AFDED0129
SHA-512:	FC6100C450F5D32DC0F9AC1E5B152BFEE388D8DFF0D7E1F47450FC8866A9915CD4FD5CF9632CA4CBE1484C591070D0F04480FEA0C23A02DDCD9C6E18F1EA493B
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........&)...6...9...9...'...'...)......B.......9...B.......X.......6.......9...+...'...+...B.......X.......6.......9...+...'...+...B.......X.......6.......D....tostring.Freemium.Orphaned.GetOption.settings.IsValid5SOFTWARE\McAfee\MSC\Settings\ApplicationInfo\MSC.HKLM.Registry.Win32.core......Y.......-...9...B...6.......B...........X...+...L...+...L......tonumber.get_suite_status..&.......-...9...D......get_suite_status.........6...9...............B...3...=...3...=...3...=...2...L.....get_dimension_string..is_suite_installed..get_suite_status.new.DimensionHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.SuiteStatus.mfw.core.Win32Helpertelemetry.dimensions.DimensionHandler.require...//DC79DB05C9ADCECCE6879C7BF1E491F469939F9E54A8FDAD9DB391A6336ABA34E732FB46104A04C9D4C7F5FC145A47CB898264C1237E7D687CDDC171BA86C310++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\telemetryversion.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	732
Entropy (8bit):	5.550345560547796
Encrypted:	false
SSDEEP:	12:64IJQlcBnmakbsAOwitZm9j4a8pCwUitZJAooDpC8tIFEs4MpUiH/Iusoa8EeJK5:64gwclma/AOwiKE7uiZqlLXMpUiHjE/5
MD5:	1B2F21A5922E4E39E128CD0893B2DF6C
SHA1:	20E92A638025556F1FE8AC9EBA8A55662102099D
SHA-256:	BABF9C8B536EF016F6A59250F5415EEE87E9F04FFBBFB8D14DCDB4B18E2A022E
SHA-512:	0675BA0D6F109523020B336165A5F614C810F36CCCF2338DA8BF23BDED8831A43513CD9DBCD0CEE9A42C50B3779E697D8D92B3297CCFC354B3DF30C822F1A252
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........%'...-...9...B.......X...9.......X...9.......X...-...9.......9...'...B...'...L...6...9...B...........X.......X...-...9.......9...'...B...9...L...L.....GUnable to read version data in TelemetryVersion dimension handler..warn.require.UNKNOWNIInvalid dimension_config for the TelemetryVersion dimension handler..err.m_logger.version_path.default_no_value.get_dimension_config.Z.......6...9...........+...B...3...=...2...L.....get_dimension_string.new.DimensionHandlerw.......6...'...B...4...7...6...3...=...6...2...L.....new.TelemetryVersion*telemetry.dimensions.DimensionHandler.require...//D53A715BAE8A9DF31BE9ED57A2FA9911F2AFC038204A16E4864CB966E7D837B37301D0551B8F443869CF60BD753BAD543E4F748F8696703EC2152F0E4BB370F0++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\updatepending.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	551
Entropy (8bit):	5.596838614146162
Encrypted:	false
SSDEEP:	12:6KIhjlRCEWzsgmXykYGAyKIFEPlr780Isoa8EeJKqAKqnXiHp:6TDA8g6y3lHNIE/qAKqnX2
MD5:	911E0943FC3C417DD43AA0A7A2A9E916
SHA1:	D4E711E764F2CDB43B1B276187EBF1FE04A13D96
SHA-256:	3061802CF2547F58CEA3C1C0374A40A4075B15EF995CFDBD46DAA3FEFCEE1D8D
SHA-512:	F1CA60BE15BB2A438333CB2AEBEC49327133A6094418253DC81F7280E836657944CCC3C1D418485714220544C1A35197334FCEFA946C8A78CA1CF46E157CEA2D
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...9...'...'...)......B.......X.......9...B.......X...'...L...'...L....true.false.IsValid-SOFTWARE\McAfee\WebAdvisor\PendingReboot.HKLM.Registry.Win32.core...V.......6...9.......,...B...3...=...2...L.....get_dimension_string.new.DimensionHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.UpdatePending.mfw.core.Win32Helpertelemetry.dimensions.DimensionHandler.require...//CBED428B9D026B16B535CF27B0B3BF190E3253D2E89B33203A414E375B24EB58B24DA4D50BBD358B541ED02BFB56747CF73CD4C412FD901D966F67D40723288A++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\updatependingversion.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	731
Entropy (8bit):	5.626894843565386
Encrypted:	false
SSDEEP:	12:66IhjlRCEKXKXnf/nuzT46iuatmXykYGAyKIFEQlr4+0Isoa8EeJKZa91xVVnOcT:6DDAHKPv8UhH6yolkjIE/Za9vVVnS1O
MD5:	A4A428BCB6BC35BC5C14FD6EFA89175B
SHA1:	65A70573FC859D3E682074FC24CDD7FEF03F1658
SHA-256:	2DFAAFAE0F2494978F60D862DAF24E0D47DD3C5C57A27883A2E5E23F47ED42FD
SHA-512:	056135B8FBCD40F99D3B008704C326EDEC077EE2DF8447714A36C9CCD2A30BA0BDDCED3C17A699475966AF854983CCB8F7EA32C2060C21CCDE58EE28EDE51387
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...9...'...'...)......B.......X.......9...B.......X...'...L...6...9...9...'...'...)......B...........X.......9...B.......X...'...L.......9...'...B.......X.......X...'...L...L.....FullVersion.QueryValue.UNKNOWN.SOFTWARE\McAfee\WebAdvisor.RebootNotPending.IsValid-SOFTWARE\McAfee\WebAdvisor\PendingReboot.HKLM.Registry.Win32.core...V.......6...9.......,...B...3...=...2...L.....get_dimension_string.new.DimensionHandler.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.UpdatePendingVersion.mfw.core.Win32Helper*telemetry.dimensions.DimensionHandler.require...//1DA6DCB73C2206EAF66189D67A912756E802C033FA115CAF0186A05E088287D1128E91635EA5C3C1223C85542783C72F6AD634E77496D6FB0482F394CA1AAC34++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpsdatesetting.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	486
Entropy (8bit):	5.531918028742958
Encrypted:	false
SSDEEP:	12:6Wm8lgkk0uknxFsmRA4MH0usoWLIY3pKVTmowBkGCGCHqE:6WtlgkbuuIm1MH0u2IY3k5DOnCGCHX
MD5:	408B17F7C456D4746DE8324FA719C277
SHA1:	6935064711244335F884E9BA00FE34B6076E8672
SHA-256:	6B93E29C3B3682036FC89AA55DC8A1F72853C5731EA80F36C07310E101D07BD1
SHA-512:	A9BDA19475F72CA2FEDF758DDD39A7D8B8D0026D3BD3E7CAF2541D242FD5B19131512B8EFDA4AC83A37DA12AD9559215378824BDCD08114C72A24EC720FE1B13
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9.......'...B.......X...6...9.......)...)...B.......6...9.......'...'...B.......L.....-.gsub.sub.^(%d%d%d%d)-(%d%d)-(%d%d).find.stringM.......6...9...............B...3...=...2...L.....format_output.new.WPSSettingx.......6...'...B...4...7...6...3...=...6...2...L.....new.WPSDateSetting-telemetry.dimensions.handlers.WPSSetting.require...//E464638243E4E2634C0AB85A15DD99B7F197F8D6408E6D79751E1ACD3BF3C1EED8FB9EFC9D15DB385CC3F94E01CF93C027DEB599A1D5BC61C45C2F810E8A807B++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpsdayssinceexpiry.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	5.645305467301911
Encrypted:	false
SSDEEP:	24:68K9YrN+Iuz8ecC4CrisVLAe0bVUkM0dabVtjue2JMAhk2IY3k1SNXGHWeW:FKuN+HcwDCe+/M0s20Ai2cS/T
MD5:	E65F99F6F0C7030D8BC9A73F87DF43D0
SHA1:	E7A6CA290646D3D642B4C88B6AD88AB08AE404D7
SHA-256:	C8CB9612D419B2C986B02BD63CFDDD3156F6D1983B7EDC666C98A14117233B91
SHA-512:	F88C9DD44ACDA32A1C8DE0E543F0DEE6E128BD3A98023BBC5A4E61D6F400813DBF48990974343AA4F72A68780E92DD21BA4296981CEE92A88FA6034898EBD697
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........J).......X.......X...6...9.......B.......X...6...9.......'...B.......X...)...L...6...6...9.......)...)...B...A...).......X...)...L...6...6...9.......)...)...B...A...).......X...).......X...)...L...6...6...9.......)...)...B...A...).......X...).......X...)...L...6...9...5...=...=...=...B.......L....day.month.year....month..year..hour...day..time.os.sub.tonumber.%d+.match.len.string..4.......6...9...6...9...'...B...C....!*t.date.time.os........:6...9.......9...'.......&...B.......X.......X.......X...L...6...9.......'...B.......X...6...9.......)...)...B.......6...9.......'...'...B.......-.......B...).......X...'...L...6...9.......B...6...9...-...B.......B...!...6.......D........tostring.floor.math.INVALID_DATE_FORMAT..-.gsub.sub.^(%d%d%d%d)-(%d%d)-(%d%d).find.string.NO_WPS_KEY.NO_WPS_SETTING.NO_INPUT_SETTING%WPSDaysSinceExpiry: input date =.info.log.core...W.......6...9...............B...3...3...3...=...2...L.....format_output...new.WPSSetting\|.......6...'...B...4...7...6...3.

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpssetting.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1424
Entropy (8bit):	5.728258176403919
Encrypted:	false
SSDEEP:	24:6UlTifnPNyUwcGuVHfyULClnA5RzKx39PtFmUc9GWk04RDSc3+WsY13UjseE/gBq:hTgN+O1ff5Uv1FfcIRDS1jsek
MD5:	BDFA3233C1A22A32BD365288FC625F57
SHA1:	5503B3A947658048BBC69499AA4564D6823B72B7
SHA-256:	5205B5E0EED3EC5DE8B78DA6082E883911DA93E5F01CA23BCB64AAE11CC0A474
SHA-512:	6B6AD9AA06D8891CA1883B675F534086E1E9A5E46B9FB4994614E3EA7226BE9EFF90944314BAF64F12F4B73D9F858884581B55DD2B0EC7735930FEE6F5F7E0A0
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........g....X...6...9.......9...'...B...'...L...X...6...9.......9...'.......&...B...6.......9.......B.......X...6...9.......9...'...B...'...L...........X.5.6...9.......9...'.......&...B...6.......B...6...9.......9...'.......&...B...6...9.......)...+...B...6...9.......9...'...B...6.......B...H...6...9.......9.......'...6.......B...&...B...F...R...'...8.......X...8...6...9.......9...'...6.......B...&...B...6.......D....WPSSetting: returning .NO_WPS_KEY. = .pairs,WPSSetting: parse succeeded. Json keys:.decode.json_parser%WPSSetting: wps json setting is .tostring.WPSSetting: key = .NO_WPS_SETTING)WPSSetting: returning NO_WPS_SETTING.get_setting.wps_utils.WPSSetting: setting = .NO_INPUT_SETTING+WPSSetting: returning NO_INPUT_SETTING.info.log.core........L............-...9...+...-...9.......X...-...9...-...........B...-...9.......X...6...9.......B.......-...9.......B.......L..........format_output.lower.string.lower_case.key.setting_namev.......6...9...........+...B...3...3...=...3...=

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpssuitestatus.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.467409333274798
Encrypted:	false
SSDEEP:	12:6UoUHVhElFJrsWm8dcfzOd4DITmu7TwFCZ/EK4MHEsoa8EeJKj+Jmlu6Wigh:6JMyqWm+coxjXw48MHEE/CWgh
MD5:	194891CFE53383772F1ED5F6A32EA7AE
SHA1:	2B81BF921689F6493947D07B22B4EB64A9AA5D04
SHA-256:	64E520B39E3E10A1E4795B6418F867EF5A0CF763F84A0B1D5A9B960B7446D76E
SHA-512:	758CF73E813F51F298CFD6D001D152E43B9A3FE02EFCC8DD7E5FE0A899267D987AF133B85CD68810A056FE7739E015B8F30389E4CB495BCF66F1D58D04001ED4
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........)...6.......9...B.......X.......X...6.......9...+...'...+...B.......X.......6.......D....tostring.WPSEverInstalled.GetOption.settings.is_wps_installed.wps_utils..&.......-...9...D......get_suite_statust.......6...9...........+...B...3...=...3...=...2...L.....get_dimension_string..get_suite_status.new.DimensionHandleru.......6...'...B...4...7...6...3...=...6...2...L.....new.WPSSuiteStatustelemetry.dimensions.DimensionHandler.require...//C1B03D4DEEC117E8532FDCB44FF28C56B98A8FCEDD7BE31175600BFCBED4FBF709ABFE354F9B35994DBA2FDAE210025BF6B1B732CCE6090155EB03D59072834D++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpstrial.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	461
Entropy (8bit):	5.536917675800623
Encrypted:	false
SSDEEP:	12:6rWo2O4Kwz77tdi9Guu7FsmRG4M/soWLIY3pKTenn1cWn3Ilpx:652O4K2HLikuu2m3M/2IY3khW3gL
MD5:	A031325725D110CFCD7C325CFF35BB8D
SHA1:	2E33D8E3E61875E52832D20E40110CED63B25C13
SHA-256:	53C54CE9EC85546122830B4F71B6C1DA07A046C585C89E3FFBBBCEC942834B08
SHA-512:	F0DEFB3FDA962AEC87FACB5454D9B8BA9E07352E33686993B5D5795965B858DFCD09892BC16003C5378DCBAE035147583F3F90C6E2CC0840F4B53299AB5EF266
Malicious:	false
Reputation:	unknown
Preview:	.LJ..............X.......X...'...L...X.......X.......X...'...L...X...L...K....0.Paid-Expired.Paid-Active.1.Trial-Expired.Trial-ActiveM.......6...9...........+...B...3...=...2...L.....format_output.new.WPSSettingr.......6...'...B...4...7...6...3...=...6...2...L.....new.WPSTrial-telemetry.dimensions.handlers.WPSSetting.require...//3A2C3A1B85DFE3A5300507C8296E0CA1A722955C5DEB944435E489042A0BBC5FBB808D3AF23C02B6893F392C396AAC3E43BDBA4A0E469D18D3DA2C53A58256E2++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wssaffid.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	651
Entropy (8bit):	5.733101559581756
Encrypted:	false
SSDEEP:	12:6Pr2oFtgLR4MxSmulXR1OOuknxUCZZQ+4MSQdsoWLIEKrCzW9hVOO:6qoFeLRJJwRNuuJcfMSQd2IjOz8hVh
MD5:	1126F5D358109ABACAB8B0EA6868AF41
SHA1:	338E00501DD56D1392FCB6C1A19AC2299BE6F247
SHA-256:	AD16DC5B7FB8999EAD73A019E41D789EBE1EBFB564038C3E498C2E88C377985D
SHA-512:	555ECB668A52D1719B712D6A7FFB0439F2F5207FB14A06DED8952933C0F95E0FF98A40E560B6BD871DA0781683816DF4FC6007FA63AB2D4071D80BBAE85E037F
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........#-...9...B.......X...'...L...6...9...9...'...'...)...*...B.......9...B.......X...'...L.......9...'...B.......X.......X...'...L...6.......D......tostring.NULL_AFFID_ERROR..affid.QueryValue.READ_ERROR.IsValid+SOFTWARE\McAfee\MSC\AppInfo\Substitute.HKLM.Registry.Win32.core.NO_SUITE.is_suite_installed...U.......6...9...............B...3...=...2...L.....get_dimension_string.new.SuiteStatuss.......6...'...B...4...7...6...3...=...6...2...L.....new.WSSAffid.telemetry.dimensions.handlers.SuiteStatus.require...//13A8EDFC36C37D395894A24F7999D08BEBFFB1DF554492DE000A092D0BB2F753804D7379079222595902EBC0BDD8873DC3775A3C7C9B67BAB8B73349ECFE8770++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsscspid.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.6260555132685015
Encrypted:	false
SSDEEP:	12:6JHg+kZtnOxroQ2vfrY1OvpCFeuknxUCZZQ+4MLnusoWLIEK912p96UjWI:6JALZecvTYkpuuJcfMq2IjH2XLjF
MD5:	4E6FC13BD82EADC81A309DE345E6E520
SHA1:	DC98B3A5E6E7D2D12582B599CF0FA9C6CF0320F0
SHA-256:	E621B353007E1B7E3D3761D6A8EF7DE7923F3E833E6010E1750C59C7564E3B04
SHA-512:	AA7DE4C4CEF873EE7C0C73C5C1DCF9307247A159D8C9E90BFA04493DC40D8E75709994E7043BCF2D65BD78B4D2DDD8100A9874AE62305505AF41D13872E69BC3
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........-...9...B...-...9...B.......X...'...L...6.......9...+...'...'...B.......X.......X.......X...'...6.......D......tostring..__not_available__.NO_CSPID.CSPIdValue.GetOption.settings.NO_SUITE.is_suite_installed.get_dimension_configU.......6...9...............B...3...=...2...L.....get_dimension_string.new.SuiteStatuss.......6...'...B...4...7...6...3...=...6...2...L.....new.WSSCSPID.telemetry.dimensions.handlers.SuiteStatus.require...//4C2D0246CA915B194F3984E0BAAB3880EF45FC1D49A0506A2521B93B362D7ED08179AB0F8CD4035E55721125A2265BDFA23084168FE7D81FFAC4E202CE2A131B++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsseuladate.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	682
Entropy (8bit):	5.5654749720650685
Encrypted:	false
SSDEEP:	12:6Lkl8gL+SeAXJV8ra71ObWLixqArstSgtlxm45haHCZEplra6hsoWLI/soWLI/3X:6ZFSeAZUmSWLPJSK5h14l9h2I/2I/6ef
MD5:	C4A25DF2E367B2E49359941B4425D42E
SHA1:	8442CAA5EDE9D8BCEC7FB4DF23EDC7BE4B949A77
SHA-256:	E5DFE70D755B9A0E4E6769C1187785CEA6663F2F27936EFC8D5EF33AB27F8559
SHA-512:	2CE8A063A9C966985FB4A61F2FD9B09F68A3AEC802C0EB571D2D9F8C7F191F7A429AE3328C519851A15CF495F4956602FD3F8DAA36A6EDC9ECEC0A4A80D1FA20
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........-.......X...-...9.......X...-.......X...-...9.......9...'...B...'...L...-...9...B.......X...'...L...-...D..........NO_SUITE.is_suite_installed.UNKNOWN3Failed to construct the WSS eula date handler..err.m_logger.get_dimension_string\|.......6...9...........B...6...9...............B...9...3...=...2...L.....get_dimension_string.SuiteStatus.new.RegistryLookup.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.WSSEulaDate.telemetry.dimensions.handlers.SuiteStatus1telemetry.dimensions.handlers.RegistryLookup.require...//7B41B3659D609EDB8C06F65701D96A9ED8B3C51A3675F7D8A50F30A7253F5799C97C6DB0E6D030DB18077A652DF823B8F87A3F4B2EC641D00CDB942E5F430AC6++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsspackagetype.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	495
Entropy (8bit):	5.556089236401764
Encrypted:	false
SSDEEP:	12:6YvKpYFpbmvzLuknxFso4MH2hAusoWLIPKnkVhzofeCSXG:6YvK2FcrLuuItMH2hJ2IynkVhzvW
MD5:	1BD99A89D395FACD8F41CA41BE4C29A1
SHA1:	06A3150116E0A6C71B935F7A9C71B3FD945DF554
SHA-256:	E47B8D3C36455CECC0E648F0CAD30C0117682697DE9D48802DD40B87AD95C627
SHA-512:	D8CF44EEA1C4F7A54AC09CD8063D2210D698613C025A8A556AA11C626E7816A0968EA2742E6A3EF6997C053BCDC30B19BC0D294628107081C19EAD4B1C58773E
Malicious:	false
Reputation:	unknown
Preview:	.LJ.......... ....X.......X...'...L...'...).......)...M.......9...........B...6...9.......B...).......X.......'...&...X...........&...O...L....*.byte.string.sub.M.......6...9...............B...3...=...2...L.....format_output.new.WSSSettingx.......6...'...B...4...7...6...3...=...6...2...L.....new.WSSPackageType-telemetry.dimensions.handlers.WSSSetting.require...//B4152E58E93B0D30F8C6E0BC9DCD07B09746330CFF384CE83BC9B121EE5E781A26CDDC9F9E4B2286A52937824CC0678A596C3291FED3BF8F7C93E09B750B8C59++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsssetting.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1442
Entropy (8bit):	5.778896431163995
Encrypted:	false
SSDEEP:	24:6YlP+rYW/mAENhRsWA6iTzvfg0lh+XjWwRfqNRV+mSWl8q49Scuh+WsYAZMn2Ija:NAElsWA6iTzblhajWCyT8Al8l9SDIunW
MD5:	771EBA2326A5B28DAF8DCA4428A18178
SHA1:	4F36DEDA50253685B13752C216940D09100B31DF
SHA-256:	DCDC6DF2BFAE3EE8577C563F8F0EDB53BF565A7CCDF3CF9BA8C7BB10C6118BB4
SHA-512:	F3B18422180F9D9EECB54B3C08F91AD5A43561CBE949D132E4F1932BAE62C3E95E754D63689E5159328F3460AD51BFDAEB31FC3BDCD2BBCF77804642833A5EA5
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........('...-...9...B.......X...'...L...6...9...9...'...'...)...*...B.......9...B.......X...'...L...6.......9...........B.......X.......X...'...X...6.......B.......L......tostring.UNSPECIFIED.GetProperty.subdb.NO_APP.IsValid#SOFTWARE\McAfee\MSC\SubManager.HKLM.Registry.Win32.core.NO_SUITE.is_suite_installed....t.......-...9.......9...'...B...L.....FBase WSS Setting handler format called. Returning original value..err.m_logger........K'...-...9...B.......X...9.......X...9.......X...9.......X...-...9.......9...'...B...L...-...9...9...B.......X.,.9.......X...9.......X...-...9.......B...........X...-...9.......9...'...B.......9.......X.......X.......X.......X...6.......9.......B...........X...-...9.......9...'...B.......6.......D........tostring?MD5 function incorrectly hashed data. Using default value..MD5Hash.utility.UNSPECIFIED.NO_APP.MD5EFormat function incorrectly formatted data. Using default value..format_output.NO_SUITE@Invalid configuration for the WSSSetting dimension handl

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsssettingexpiry.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	940
Entropy (8bit):	5.433077897705084
Encrypted:	false
SSDEEP:	24:68K9YrN+Iuz8it4CWVDPVrtjueXMd2IyJWPy:FKuN+Cdsfd2MPy
MD5:	0870970CDF448EFB6065025880D6BB94
SHA1:	A401DF2F26AF6ACE89649AA9D4C46073C1B468B1
SHA-256:	5F124941159F92D9A4F8DDDFFC8550C70436CACDDCD6070DA729A91A80C73A08
SHA-512:	0017F9D39B7C4DE75C78BC0528D09F11D30816234AC256173EF03EFCFCDBB9D18B25B3CA512D05F364C2E8D42CCFCB73359B4676431DB8B5AE94B49C65EF96B4
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........J).......X.......X...6...9.......B.......X...6...9.......'...B.......X...)...L...6...6...9.......)...)...B...A...).......X...)...L...6...6...9.......)...)...B...A...).......X...).......X...)...L...6...6...9.......)...)...B...A...).......X...).......X...)...L...6...9...5...=...=...=...B.......L....day.month.year....year..hour...day..month..time.os.sub.tonumber.%d+.match.len.string..4.......6...9...6...9...'...B...C....!*t.date.time.os.........-.......B...).......X...'...L...6...9.......B...6...9...-...B.......B...!...6.......D........tostring.floor.math.INVALID_DATE_FORMAT...W.......6...9...............B...3...3...3...=...2...L.....format_output...new.WSSSettingz.......6...'...B...4...7...6...3...=...6...2...L.....new.WSSSettingExpiry-telemetry.dimensions.handlers.WSSSetting.require...//0A6F74C1DA94C46846F4E6509F969C86B56EC26D9CA656128A7E91963AA3EE795223D348F2451F6987B7102BC419336C5D1924087F34F648E9ED18740CA49D99++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wssversion.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.70326826859418
Encrypted:	false
SSDEEP:	12:6Ox2oFtgLNzcP4XR1OOuknxUCZZQURlr7A0csoWLIEKNKAFlroKpVhn:6ZoFeLhcPwRNuuJcwlZc2IjhmKVn
MD5:	D8EB26D7D8D48314CB845AF21A62BA3D
SHA1:	8967BE6B3FD0EB91379949065695E7F3B56EBC41
SHA-256:	C1B3FE9036C88E24F98C46258867345E81F5888513D932FD5FF21D099C22AC10
SHA-512:	F76CC6F2F21744154FB9757AACA89D8E22BAEEA89C45AA5762BD3D0773B02D0949A353FEE95D2F9E407FBCA2C05C758E7A30F551572157D262001067CFD783EF
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........#-...9...B.......X...'...L...6...9...9...'...'...)...*...B.......9...B.......X...'...L.......9...'...B.......X.......X...'...L...6.......D......tostring..ReleaseName.QueryValue.NO_VER.IsValid.SOFTWARE\McAfee\MSC.HKLM.Registry.Win32.core.NO_SUITE.is_suite_installed...U.......6...9...............B...3...=...2...L.....get_dimension_string.new.SuiteStatus.........6...'...B...6...'...B...4...7...6...3...=...6...2...L.....new.WSSVersion.mfw.core.Win32Helper.telemetry.dimensions.handlers.SuiteStatus.require...//51AE1E71F90DCEED2C986AFCD6C78337E0D4373B5F00D9B911FD3E7CC8691A4010DBC6CD1808518C1FC64D1BB30CAE8DFC9DA5D9FC5E35351DA909F6286F2D90++

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsswps.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.623174665731814
Encrypted:	false
SSDEEP:	24:6ziuY/92CMhnEs6pJ7oLdoCnqyXgzysccVzoFnqy7g2ISNvt0Q+cOQluHRMvWJuV:3uU9+1JkSo4qCmJ1opqX2hNF0Q+clHvR
MD5:	8F9AE821D39BD9BC9338068DF61A1C5B
SHA1:	792E5EFE664C163A0D3F3770E7AFA78CFAAAFE39
SHA-256:	BE9518FBC1F6EA3B752368D6244FBE9B5FB609454362826A6029BBC74D91FAC5
SHA-512:	37E07C1896BBFD651F7568598EE8625EDEEB54F1163754316D93D457B54D0E612E136807017356F46E4A002ED32F4EFD94662D78D297340CA01585162F5FBB31
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........~-...9.......9...'...B...'...6.......9...+...'...+...B...6.......9...B.......X.......X.8.-...9.......X.4.-...9.......X.0.-...9.......9...'...B...-...9.......X...-...9...9.......X...6...'...-...9...9...&...B.......X...9...-...-...9...+...B...9...B.......X.=.-...9.......9...'...B...X.6.-...9.......9...'...B...X./.-...9.......9...'...B...-...9.......X...-...9...9.......X...6...'...-...9...9...&...B.......X...9...-...-...9...+...B...9...B.......X...-...9.......9...'...B...X...-...9.......9...'...B...L.........VWssWps: Expecting wss subconfig and wss handler in dimension config, but got nil.3WssWps: Nil wss dimension handler encountered..wss!WssWps: WPS is not installedVWssWps: Expecting wps subconfig and wps handler in dimension config, but got nil.3WssWps: Nil wps dimension handler encountered..err.get_dimension_string.new#telemetry.dimensions.handlers..require.handler.wpsjWssWps: WPS is installed, or WPS was once installed and dimension is SuiteStatus or SuiteEverTurnedOn.ch

C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\version.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	235
Entropy (8bit):	5.182157759415833
Encrypted:	false
SSDEEP:	6:8k4kikwIWmLQJX8n+OgydUFd1KVHE2C66y4XpVv:90kRLQJXcQdWPE3v
MD5:	3F8AE4FF352166FF91CD7C7D5C943573
SHA1:	6137538ED58FF8A471B303A08FEBDB61345D9F0D
SHA-256:	CEC3D2F004FFD768334A6FCD041488B637218A03B027CF8D907C4268C1A91511
SHA-512:	C086AC460233F6F8DEBBAA374A7357C718AE0A996E9357D313B9522902972BB197E6C1CCE9E9964C362AA98EAD986F92EDF047CF8E3965103D6CA3FA325B2CE8
Malicious:	false
Reputation:	unknown
Preview:	--$FileVersion=[VERSION_MAJOR].[VERSION_MINOR].[SUBMINORVERSION].[BUILD_NUMBER]..return "4.1.1.898"....//BCD6F533B96B03002BFF0DE7E7CA8ACDB93BFA5C086E5E33C69CB85057A7E097D602F547098A6560E823F428A45EE3082C6FEE7AAB043A78CC8D6E552B7C4600++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\eventformatter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	5.530651910403726
Encrypted:	false
SSDEEP:	24:6K1Jgy3rpRIDeoLrlv7KPryoWMikfGRZcuKjzjp7DrXHSjutPrVO:BcCIRvlQmDMaZSN3XucVO
MD5:	9BEBC5E057DDDCB24BD7F8179DA5EEED
SHA1:	CC983D4E313623D78AE0259A91BBC57125448EA5
SHA-256:	23744192672388948F5743DE3AC74B7479CF41D7F175074FA5F66C0EEED88248
SHA-512:	6AC91792FB7C55DDFE96A98E1AB02ED8D2B16448A452E70C03A6566ECF034B3A8C894B70C3F711CCEF3C33F568517464C5D7A2FA90A9A0C381C51FFB13FC04EF
Malicious:	false
Reputation:	unknown
Preview:	.LJ..$.......-...9...L......m_event_config$.......-...=...K......m_event_config........-...9...L......m_event........-...=...K......m_event".......-...9...L......m_dimensions".......-...=...K......m_dimensions........-...9...L......m_metrics........-...=...K......m_metrics".......-...9...L......m_extra_data".......-...=...K......m_extra_data........)....X.&.6.......B.......X...6.......B.......6...-...B...X...'...6...9...'...6...9...6...9...............B...A...A...&...7...6...9...........6...B.......E...R...L......gsub.replace.sub.byte.%%%02X.format.%.ipairs.tostring.string.type?.......6...'...B...K...&format_event_data not implemented.errorL.......6...'...B...K...3get_formatted_event_identifier not implemented.error......!.$4...5...=...=...=...=...=...=...3...=...3...=...3...=...3...=...3...=...3...=...3...=...3...=...3...=...3...=...3...=...3...=...3. .=...2...L....#get_formatted_event_identifier..format_event_data..encode_uri..set_extra_data..get_extra_data..set_metrics..get_metrics.

C:\Program Files\McAfee\WebAdvisor\telemetry\events\eventhandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2836
Entropy (8bit):	5.490724168738662
Encrypted:	false
SSDEEP:	48:mkeaI98lToMD9BJZKCqn3ma3wlwY7zmDg/75Zev5fqp4D9K74JL7SMHhsRK3DyX3:m3uDbJZJqn3maEme7vxg/hFh2K3uWmL
MD5:	F07D136902E3D381B1DE5A7C06FC7308
SHA1:	5E3D99A8A370F4BEEAA3200038967BC2E34CF8F6
SHA-256:	BE54D76CFE2877286B84A1BA70D5800726DCC91452642805E81C8F08134FAA91
SHA-512:	5F5DD58F91E68A663768D8F43878E472358D4184B6636CCE8E0E4B63EFA2D2EF1AF6E8DF3CB7F7F137809DC2887264334413EF508D4CEDCDFE3E5EBFD2BB712A
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........'...6.......9...+...'...'...B...........9...'...'...B.......6...9.......'...B...X.......X...+...L...E...R...+...L....([^,]+).gmatch.string.%s+.gsub.telemetry_deny_list.GetOption.settings.............K.............-...L.............-...L.................K.............-...L.................K.................K.............-...L.....D.......6...'...B...K...+handle_telemetry_event not implemented.error........-...<...K.............I-...9.......X.......X...-.......X...-.......X...9.......X...-...9.......X...-...9.......9...'...B...'...L...X...-...9.......X...-...9.......9...'...B...'...L...9...-...B...9...-...B...9...-...B...9...-...B...9.......B...9...B.......X.......X...-...9.......9...'...-...9...&...B...'...L...L.............5Invalid formatter supplied for telemetry event: .set_dimensions.set_extra_data.set_metrics.set_event.set_configCAn event name was not supplied in the telemetry event payload.._event_name.6Invalid event data suppied for telemetry handler..err.format_eve

C:\Program Files\McAfee\WebAdvisor\telemetry\events\eventtransmitter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	514
Entropy (8bit):	5.268068623538178
Encrypted:	false
SSDEEP:	12:6nbteRM5oA9hcXtGJ2gznkxiRM5ajmoCfSnTXGSGjl:6nbtNokhcXtGJxkxxajqfSrMB
MD5:	B7378839A7E520D54C20C74777F036AF
SHA1:	9A376DD3495B4FF80742434BB6E56503CD92191B
SHA-256:	F571FD6CEA4522EA02F9F3BA1818C683376F91C403740F4E40610DD09651BCE5
SHA-512:	5C8D6C2B2FB451A5A83674F4EF1096DF0850F7A2892E3ABB62E8FC873E4C4194222404C95D193B2D4071842F0A3D0D3AA2E02268A7C590BB4B7C5F7F6DD199C5
Malicious:	false
Reputation:	unknown
Preview:	.LJ..B.......6...'...B...K...)transmit_to_endpoint not implemented.error@.......6...'...B...K...'get_endpoint_value not implemented.error>.......6...'...B...K...%get_header_value not implemented.errort.......4...=...3...=...3...=...3...=...2...L.....get_header_value..get_endpoint_value..transmit_to_endpoint.m_logger=.......4...7...6...3...=...6...2...L.....new.EventTransmitter...//9624E4EF82072A03CCFA755184668AC580B9F2221C9E91CE6A662AD248D92C33080638BC1DE5BB4927D5FFB8275CE7C8065F0CDE8EF726C3E0863A58D65DCF94++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\formatters\eventformatter_aws.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4377
Entropy (8bit):	5.7210907742052015
Encrypted:	false
SSDEEP:	96:rvS4++y4QztwEGprKeJYYE8Wp1ZYqNM3G0fW3fiYlrdp:jSt9NhwXrKe58bC3Gscik
MD5:	C9D20E590B6C79F7EC818F7D06268E6B
SHA1:	EECDAB95FC82C8FA6364BCDD9F905912179E9423
SHA-256:	7CDD3302A889BA1B0DC941E7412F7442EF2739FD904FE3CAF158954005A274AE
SHA-512:	E11EAC377E13C0AADBC9C52153239F8AEAD1717D53024900E5B73DD0B421427EECE44E97F4E83FA8BF9DD54C50C8B51A84A88A7BD10159E595BFAC375189C5AB
Malicious:	false
Reputation:	unknown
Preview:	.LJ..?.......6...-...B...H.......X...+...L...F...R...+...L......pairs........-....X...-...9.......9...'...B...+...L...-...9.......X...6...-...9...B...H.......X...9.......X...9.......X...6...9...B...<...X...-...9.......9...'...B...F...R...X...+...L...+...L.....5Nil dimension handler configuration encountered..tostring.value.config.pairs.m_dimensions=Empty event data supplied for formatting dimension data..err.m_logger.............X...-...9.......9...'...B...+...L...-...9.......X...6...-...9...B...H...'.......&...6.......B...<...F...R...+...L......tostring.Metric_.pairs.m_metrics:Empty event data supplied for formatting metric data..err.m_logger......!.......X...-...9.......9...'...B...+...L...6...9...9...'...'...)...*...B...'.......9...B.......X...-...9.......9...'...B...+...L...X.......9...'...B...........X.......X...-...9.......9...'...B...+...L...'...-...9.......X...-...9...9.......X...-...9.......X...-...9.......9...'...B...+...L...6...-...9...9...B...H.M.-...9.......9...'...6......

C:\Program Files\McAfee\WebAdvisor\telemetry\events\formatters\eventformatter_ga.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3124
Entropy (8bit):	5.609038092105817
Encrypted:	false
SSDEEP:	96:fLZ+42VV09YI2zlp1sIQ+mjIG0fW3sdf8ge:fL44RyXzT1sIptGslfA
MD5:	383EC36FB97E888D9B13ADB5150DACEE
SHA1:	3A420C17D3E8A0251D9D40F3F307059156A51DB5
SHA-256:	7AF07CDB88D522773896462F38354C964F2B88FBDE4053906159D2605695C62B
SHA-512:	676942C5991B357F28B18A649804AE0781B686CDD387A1C507E5EF13AF38AB446D6749419E09881D31D059EF2D2FA588FCADEBA197DB0F69AABB49D8D012E455
Malicious:	false
Reputation:	unknown
Preview:	.LJ..L...........'...-...9.......B...'...-...9.......B...&...L......=.encode_uri.&?.......6...-...B...H.......X...+...L...F...R...+...L......pairs~.......'.......X...).......X...'.......X...-...9...6.......B...A.......'.......'.......&...L......=.&cm.tostring.encode_uri.1.h.......'...-...9.......X...6...-...9...B...H.......-...........B...&...F...R...L........pairs.m_metrics........._'...'...-...9.......X...-...9...9.......X...-...9.......X...-...9.......9...'...B...'...L...6...-...9...9...B...H.,.-...9...8.......X...-.......B.......X...-...........-...9...8...B.......X.......X...-...9...8...X...-...9...8.......X...-...9.......9...'.......'...-...9...9...&...B...'...L...F...R...-...9...9.......X...-...9...9...).......X.......-...-...9...9.......B...&...L............metric_id._event_name.) when processng event: -A mapping value could not be found for (.metric_value.pairs?Invalid configuration for GA formatter 'get_event_string'..err.m_logger.m_event.mapping.m_event_config.1.........v'..

C:\Program Files\McAfee\WebAdvisor\telemetry\events\formatters\eventformatter_json.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3452
Entropy (8bit):	5.632512353228418
Encrypted:	false
SSDEEP:	48:RXYMvS4+VjYlQJqnaMIwLuoJVvBSIQ0x/qbvdkZY4tuwQTdON7MrC9V2mUW3gMNe:rvS4++3PBKKY4tugdMrG0fW3fz2Z
MD5:	49CD3E7E4481483378E48C8FFB79526C
SHA1:	4AB51892B9895F05B31BDE50FF426125FC2AC640
SHA-256:	2A58391C650334E628C6B32652C70F39BAC8CACE041F12EE93BDAD6C652512F2
SHA-512:	E8C6508B493A9FA21725F6D20B07E34B6FFFF5D89430571D0FCD788814CE63C0FC6B305AA5918ACFA0181C2787C193AF03635F1B3ACE9DF614AFEE988D165331
Malicious:	false
Reputation:	unknown
Preview:	.LJ..?.......6...-...B...H.......X...+...L...F...R...+...L......pairs........-....X...-...9.......9...'...B...+...L...-...9.......X...6...-...9...B...H.......X...9.......X...9.......X...6...9...B...<...X...-...9.......9...'...B...F...R...X...+...L...+...L.....5Nil dimension handler configuration encountered..tostring.value.config.pairs.m_dimensions=Empty event data supplied for formatting dimension data..err.m_logger.............X...-...9.......9...'...B...+...L...-...9.......X...6...-...9...B...H...'.......&...6.......B...<...F...R...+...L......tostring.Metric_.pairs.m_metrics:Empty event data supplied for formatting metric data..err.m_logger..............X...-...9.......9...'...B...+...L...6...9...9...'...'...)...*...B...'.......9...B.......X...-...9.......9...'...B...+...L...X.......9...'...B...........X.......X...-...9.......9...'...B...+...L...'...-...9.......X...-...9...9.......X...-...9.......X...-...9.......9...'...B...+...L...6...-...9...9...B...H.-.-...9...8.......X...-......

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handleonnavigate.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.438210148159206
Encrypted:	false
SSDEEP:	12:6IWlLK4X9uR4MrCEu5JJKkkOMQFSSpUMqeO:6bLltJMmEuUkkOMnSCMqeO
MD5:	7083C9FDB33FFA247058547652D30265
SHA1:	10E3A6D69187076EDD835D4B23BB618A5BD8F616
SHA-256:	CE2D4F570972076F6226BD5053727D13A037A907509234C0C43D2B090AC84508
SHA-512:	76AC3297B18707BDF39CB0002FF3387F325D6E0F44441A85A905EE98E473535F8095D4A478ABCE8B937D282BE86E64BDFF5063B5DBD4488754A51E3C506CB56C
Malicious:	false
Reputation:	unknown
Preview:	.LJ..>.......6...'...D...)handle_on_navigation not implemented.errorZ.......6...9...................B...3...=...2...L.....handle_on_navigation.new.EventHandlero.......6...'...B...4...7...6...3...=...6...2...L.....new.HandleOnNavigate"telemetry.events.EventHandler.require...//EFF8E244B67AB9E2A103DEB12A24D01096F152651FE8EED9C2628357680824720B357BE150A6A4FC8B8D98ABC3B36D9AE83A6905EE5ACFB9D3E96F62C4777EA2++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\adblockcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	5.789521226645445
Encrypted:	false
SSDEEP:	48:Vh/mkG1vxDdLkUe4g1yL1azfiu2Z0nq3336cyN5/Rd+4p3ssJi2B5yGzO40hco0b:buPDd65712ZX33HkBrkvYjEK
MD5:	523EF945988E83B9E2022DBC3D615F9E
SHA1:	E53BB08D7ACFC76D1D48F010F8171D026DD7C222
SHA-256:	8171C237AD8D22D331D49F3141AD8ECB6852BD0CD9C0F1EECB6B2529DBDD53AD
SHA-512:	9B3DDC635BAD908256DC84E3B85C2FCE5A0FEF10264A64C3C7F2256F977DF02490A1C811A20520119A387AEAA1E4311E69D893C0740AF80116EE77078F3938AB
Malicious:	false
Reputation:	unknown
Preview:	.LJ............-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...-...9...B...+...)...'.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9...9.......X...9.......X...+...9.......X...6...9...B...........'...9...'...9...&...6...9.......'...&...B...6...9.......'...&...B...6...9.......'...&...B...6.......9...............B...6...9...B... ...6.......9...............B...6.......9...............B.......6...9...B... ...6.......9...............B...6.......9...............B...........6.......9...............B...+...L......SetOption.GetOption.settings._Occurence._TrackerBlocked._AdBlocked.lower.string._.tonumber.default_no_value.in_context.prefixFOEM Adblock counter handler called with an invalid configuration..AdblockCounter.get_telemetry_configVOEM Adblock Counter handler telemetry event called with an invalid configuration..err.tracker_count.ads_count.interaction_type.browser

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\blockpage.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	5.477029567856194
Encrypted:	false
SSDEEP:	24:6UAe99gul+OdtOMKqCC5Vg6pVgPVgUUMfEWE5XLZ+nAWLLEMVvU052fQ:Ae7gu/dTyXQePe9MfEWE5bZ+AWLLx5Hl
MD5:	0B0C74C74C9ADBA5C697BF728759687A
SHA1:	420C63D03B24ACF21BBA80FCE9012F813C9BABC7
SHA-256:	0308515CB014D2F25FDE9331936A62A3F72AFCC03752516E72E28573732D0EE5
SHA-512:	2BE64C14154711B29E24E78580B86E3A5D4B97EC7E250303713E3B77A596DE614CF908DF9C8D334A7EF41ABADACED5917FA73884F22C590A08438DC8F56C01C8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..y.......6.......9...+...'...)...B.......6.......9...+...'.......D....SetOptionInt.CounterPagesBlocked.GetOption.settings..........9.......X...9.......X...6.......9...'...D...X...9.......X...6.......9...'...D...X...+...L...K....msad.ads.blocked.Frame.msad.sites.blocked.PublishMessage.wssEventSender.Top.level.Typosquatting._event_name........2-...9...B.......-.......X...-...9.......9...'...B...+...L...-...9.......X...-...B.......X...-...9.......9...'...B...-...-...B.......X...-...9.......9...'...B...-...9.......X...-...'...=...-...9...D............transmit_telemetry_event.default.metadata-Failed to report block page event to WSS2Failed to modify CounterPagesBlocked setting.Impression.interaction_typeDEmpty telemetry information returned when processing block page.err.m_logger.get_telemetry_eventf.......6...9...................B...3...3...3...=...2...L.....handle_telemetry_event...new.EventHandlerh.......6...'...B...4...7...6...3...=...6...2...L.....new.BlockPage"telemetry.events.E

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\browser_host_launchers_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2597
Entropy (8bit):	5.73966935355903
Encrypted:	false
SSDEEP:	48:Uq1TSmh/5dSko6RPYzTzk8Gl5nt4uLxmnuCqI/l/dw1vlTtrRONcExMvdWig+Miz:Gmh/5dSNHCrtvQIgm1vlRS6EOz
MD5:	E2F6632971010E91064E95A6AC20B25D
SHA1:	6C26A9DB1B5568D003C36C424194BCA2E994CA14
SHA-256:	5B33E143874222A867A6A9D39F3663450A539BF5EE86420054CE81FC94B1135E
SHA-512:	8424F84A79160670F85616E15FE5E05051163CDBF783B2B390F8CFFE91E32A6BBEB69469CA2DB9F70BBA6EB689DA202E9EEEE18542A1ECD4ACA2C5B5BFD2157C
Malicious:	false
Reputation:	unknown
Preview:	.LJ............-.......9...'...B...+...-...9...B.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...L...6.......9...+...-...)...B...6.......9...+...-...'...B...6...9.......9.......B...6...9.......B.......X...-...9.......X...-...9.......9...'...B...L...+...6.......B...H...9...9.......X.......-...9.......9...'...9...'...&...B...X...F...R.......X...-...9.......X...-...9.......9...'...9...&...B...4...9...=...4...=...6...9.......B.......<...+...6...9...B...H...9.......X.......-...9.......X...-...9.......9...'...9...'...9...'...&...B...X...F...R.......X...9...6...9...9...B.......9...<...6...9.......9.......B...7...6.......9...+...-...6...B...+...-.......9...'...B...L...........6browser_host_launchers.handle_telemetry_event end.SetOption.signers_json.encode. and signer "signer object for executable .signers.new object for executable . found.object for executable .pairs.Number of entries exceeds telemetry limit.warn.maxn.table.decode.json.core.{}.GetOption.settingsCbrows

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\browsernavigate.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1932
Entropy (8bit):	5.590686408359143
Encrypted:	false
SSDEEP:	48:2KJlV06e4yTof023kfHe7guhLMrzKTzuF5cEuDq1lWU:NV06ePkHae1hkHLcEWqHx
MD5:	B196F8CC9713DD2E29A6D0B314AA42F2
SHA1:	6C756F55CF5AD5D29944412CD31CB97A51A37EB6
SHA-256:	F706F4D7F18466BEB506A7A4674914F55D504563070C41C32EBB3B3CDA003778
SHA-512:	7A7002CDC55D9BE0C405726415EF798ECA872B98BBBAEB72A3B4D7E66DF1FC90B10323D10D3459BEFB938C9E70447C35DC3EBA582594568DADC4E098FDF3A1BF
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........@-...9...B...-...9...B.......X...-...9.......9...'.......'...9...&...B...+...L...6.......X...-...9.......9...'...B...+...L...9...6...B...9.......X...9...9.......X...9...9...B...9...-...9...............B...9...B.......X...-...9.......9...'.......&...B...L......Failed to handle event: .handle_on_navigation.new.update_dimension_configs.dimensions.dimension_overrides.set_dimension_config;A global dimension configuration has not been defined..g_dimension_config.handler. Handler: 8Browser Navigate handler does not exist for event: .err.m_logger.get_telemetry_event.get_dimension_processor.........6.......X...6...9.......X...-...9.......X...-...9.......9...'...B...K...6...6...9...B...H...+...9.......X...6...'...9...&...B...........X...9.......X...-...5...=...=...<...F...R...K........config....handler..config..handle_on_navigation.telemetry.events.handlers..require.handler.pairs;A global telemetry configuration has not been defined..err.m_logger.events.g_telemetry_configy.......6..

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\commonlogicloader.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1199
Entropy (8bit):	5.805004212873645
Encrypted:	false
SSDEEP:	24:6NpCgnQBwRdSFCC4il8dtdxzhj/3d+kFtiuWeTOf/hbP:qCgnawRdSFWHjfd+seB
MD5:	B51E528635C38339019922CA16F9EF02
SHA1:	328BF6115B4E4415F36D14DA9FCE5BF5FA666FF9
SHA-256:	A2B774A9367368B2830E10230383043F4424E7A0F700B0B3D7A8F689A15CD6E2
SHA-512:	D0E1D706381B315323130C2ECA4C9FF46C948843732DE1E7F2AF33A247F828EBD289131AD531FF5084AB8FC5DA6C7B5E60ED3AAD0751460D66A151006ACFE940
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...8.......X...8...L.......X...+...6.......9...............B.......X.......X...+...<...L...6.......)...B...K....error.include.external.loaded.package.........5...'...6.......B...X...6...6...........B...E...R...K....requireFromLogic.pcall.ipairs.\logic\.....MiscUtils.providers_selector.base_provider.ss_logic.oem_business_logic.type_tag_utils........W'...6.......9...B.......&...6...9...'...)...B...6...9...'...B...6...9...9.......'...&.......B...9.......X.5.6...9...:...9...B...).......X.-.U.+.....9...'...'...B...6...9.......9...'...........&...B...6...6...........B.......X...6...9.......9.......B...6...9...9...........B...........X...6...9...:...9...B.......X...X...6...9.......9...'...B...K....loadSSProvidersCode end.FindNextFile.err.requireFromLogic.pcall.Loading script: .info.log...luc.gsub.cFileName.string.handle..luc.FindFirstFile.Win32.core.WIN32_FIND_DATA[1].new.void.cast.ffi.GetInstallPath.utility.\logic\providers\.m.......3...7...3...7...3...7...6...B...6...B.

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\contentsecuritypolicywasm.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1827
Entropy (8bit):	5.497546128801579
Encrypted:	false
SSDEEP:	48:BPBNPQCrLjzUK7cq1+ZgzW6A/46+sEF66CaJ5Kds:BpNP1LMIAWN+6tMs
MD5:	879E96F74F301A1CA39B7E4FE1AEFDAB
SHA1:	B8C5F8FA8B21C8E0DAEA4030666B6732017EA3F2
SHA-256:	8678AD45820758B846B6F26421CD655C7191CFBCDC195BE3F3EDFB36DD56E562
SHA-512:	7EE931F6564B327D0485E8A63230C28883431EE02AF69C8D4E88F3366E795D9148063FB7D9D9BBA399B0C6208632E769C52BDC255884E93B8774804E00CA4F9C
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........-...9.......9...'.......&...B...-...6.......B...8...L........tonumber2Inside get_counter_setting and the colour is .info.m_loggerd.......6.......9...+.......)...B.......6.......9...+...........D....SetOptionInt.GetOption.settings.........@-...9.......9...'...B...-...9...B.......-.......X...-...9.......X...-...9.......X...-...9.......X...-...9.......X...-...9.......9...'...B...+...L...-...9.......X...-...-...9...B.......X...-.......B.......X...-...9.......9...'.......&...B...+...L...+...L...........zThe counter did not increment successfully when processing Content_Security_Policy_Wasm. The counter setting name is .PREVENT_WASM^Event does not carry all required components when processing Content_Security_Policy_Wasm.err!Content_Security_Policy_Wasm._event_name.colour.policy.browser.get_telemetry_eventBInside handle_telemetry_event of Content_Security_Policy_Wasm.info.m_logger.........-...9.......9...'...B...-...-...B.......X...-...9.......9...'...B...+...L...K.........uBro

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\dailycounters.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2965
Entropy (8bit):	5.837073063203526
Encrypted:	false
SSDEEP:	48:8VFPRtpqYOuIcOMRKik1nsO2KslR/NWN7jhOMMsEAOVp/0wK2cDTOh26QMyfdRAR:YFP5qY9bK1V2pJqjh6sWtI8rifflhaL
MD5:	6209D42F4111FDB1364ABE78FE81D0D3
SHA1:	8131E408B0F40C4BE3B3763AF089795F3C598993
SHA-256:	123632C3989DC1395AABFEA2B10E9EC285D59E3CD7FAEB9C73ABF82DD24D59D8
SHA-512:	C8116399EA235921AA0309B708D637331E53FD0240045FBC1093E6C395FF095EF5060820591ED06AD09F2CA193E7C5D8ACC12902172575FF263E59336200A4C8
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9.......9...'...B...6.......9...+...-...)...B.......6.......9...+...-.......D......SetOption.GetOption.settings-Inside increment_toast_check_event_count.info.log.core.........^+...-...9...B.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...L...-...9...B...+...)...'.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9...9.......X...9.......X...+...9.......X...6...9...B.......6.......9...........'...9...'...6...9...9...B...&.......B.......6.......9...........'...9...'...6...9...9...B...&.......B...+...L......SetOption.lower.string._.GetOption.settings.tonumber.default_no_value.in_context.prefixEOEM Daily counters handler called with an invalid configuration..DailyCounters.get_telemetry_configUOEM Daily Counters handler telemetry event called with an invalid configuration..err.m_logger.triggerType.browser.get_telemetry_event..... .)...-.......9...'...B...-...9...B...+...+...)...+...'...4...'...>...'...>.......X...9.......X...9..

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\dailyping.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	5.6102145639698415
Encrypted:	false
SSDEEP:	96:KD6xV06enuLko8aSXretqa/tz/CoQNB5cTjamz4OyR:K8VrenuL0XrU/tz/CoQNSamzU
MD5:	39785CF3ACC751D7173093E7D11ADC69
SHA1:	3364B71A8745C3DF497CB406DE66DCC3DA1E9D0E
SHA-256:	3CBBACD5EBEEE38188BF3D6C18B40458FEAE54D39C55984DD43FD8675CF9D168
SHA-512:	A50B13BDD0DC67A59682201CA4475EFC6C9F5E63A5F3BCF8C781B57EA17E987F11790DF38042B64C7716E5BDC72312F2460E7A535688CFE3DA9BC0DEED7F1D88
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........M-...9...B...-...9...B.......X...-...9.......9...'.......'...9...&...B...+...L...6.......X...-...9.......9...'...B...+...L...9...6...B...9.......X...9...9.......X...9...9...B...5...9...-...9...............B...9.......B...-...<.......X...-...9.......9...'.......&...B...X...-...9.......9...'.......&...B...L....... succeeded to handle event: .info.Failed to handle event: .send_on_ping.new....metric_value..extra..update_dimension_configs.dimensions.dimension_overrides.set_dimension_config;A global dimension configuration has not been defined..g_dimension_config.handler. Handler: 4Send on ping handler does not exist for event: .err.m_logger.get_telemetry_event.get_dimension_processor.........'...6...-...B...H. .....X...9.......X...-...9...9...9...B...9.......X...9.......X...-...9.......9...'.......'...6...9...B...&...B...6...9...B.......F...R.......X...-...9.......B...K........set_extra_data.tostringG) has requested to have the following added to the event payload: .Event handl

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\domainnavigatedcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3282
Entropy (8bit):	5.854153126838354
Encrypted:	false
SSDEEP:	48:IWmahbRwTtnDsgLgYjnLHfXCwhXZT7D7hv8pKKh4s0r0fPi2iFizX5/ggZDfEtJd:I5ngs/XVN8bXihWjZDfEHrXp
MD5:	FAF916C772F946DA30A76E3EF30327C0
SHA1:	A64C20A0E6DF50E4541D9B9C8A9C1EAB5304C2D3
SHA-256:	C7E85FC156A4DE9A298F4CE3BF56A5A62B497EBCD1C3FBDFCACCB8E9127E1CE4
SHA-512:	EEC7A8DE2E9CA35C163F3E7DA72899F49B9D90D2476B991BFA1CD7AD3B89C71C471EC687E4D2F3C8BA19A422B8419BA669432F83BFFEC956BDF59D110634478C
Malicious:	false
Reputation:	unknown
Preview:	.LJ..n.......6.......B...H...6...9.......9...B.......X...9...L...F...R...+...L....domain.urlMatch.match.string.pairs`.......4...)...6.......B...H.......9...<...F...R...6...9.......B...L....sort.table.domain.pairs.........+...L...........\|-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...6.......9...+...'...+...B.......X...+...L...-...9...B...+...)...'.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9...9.......X...6...9...B.......9.......X...6...9...B.......9.......X...9.......-...9...-...B.......X...+...L...6...9.......'.......'...-...9...&...B...-...9.......9.......B...6.......9...............B.......6.......9...............B...+...L............SetOption._.lower.string.domains.tonumber.default_no_value.toboolean.in_context.prefixGOEM Domain Navigated handler called with an invalid configuration..DomainNavigated.get_telemetry_config.domain_navigated_disabled.GetOption.settingsGSearch Term handler w

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\downloadscan.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1781
Entropy (8bit):	5.681283969089115
Encrypted:	false
SSDEEP:	48:oeQDKesTJV5mAcmFMYeLPPTXEINGleqj6fZ+zAGXKlwqF:oeXegTmAcmFMYebkleK6UC/F
MD5:	6F38B71F2BE987E4B28780CACB23250B
SHA1:	0AA6AB08DF074B7C10A5A06DDAF19186DB462FE0
SHA-256:	20D0EF8C3BDF9DDB9C72B56A0B914448A0DD450CB965B07D05F44E5F0F9C0EE6
SHA-512:	F9B4391892F36E133B684533BCC7C86E943640D1F0CBA9E8A9EDBC9D8031A3413D973914819F46DDA2DC8121B0B45D7763F0A7DD76E5894573B9FAB4E16E9CFD
Malicious:	false
Reputation:	unknown
Preview:	.LJ..X.......6.......9...+...'...+...D...&DownloadScanSendProcessTelemetry.GetOption.settingsU.......6.......9...+...'...+...D...#DownloadScanSendFileTelemetry.GetOption.settings........;'...+...9.......X...'...X.!.9.......X...9.......X...'...6.......9...'...B.......X...X...9.......X...9.......X...6.......9...'...B.......X.......L...X...+...L...6.......9...+.......)...B.......6.......9...+...........B.......X.......L....SetOptionInt.GetOption.settings.msad.files.safe.AcceptRisk.msad.files.blocked.PublishMessage.wssEventSender.CounterDownloadsBlocked.Blocked.interaction_type.DownloadBlock.CounterDownloadsScanned.DownloadScan.name..........V-...9...B.......X...-...9.......9...'...B...+...L...-.......B.......X...-...9.......9...'...B...6...9...9...'...'...)...6...9...9...9...B.......X.......9...B.......X...-...9.......9...'...B...+...L.......9...'...B...9.......X.......X...+...L...9.......X...-...B.......X...'...=...9.......X...-...B.......X...'...=...-...9.......B...-...9...D........

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\formlogindetect.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2858
Entropy (8bit):	5.660251106582566
Encrypted:	false
SSDEEP:	48:PykkVZ6XJzUUPRRQRyv99mTk+ljfGXPoL8DX/gdkFF9wtRwK+cRJjKvV/gLCvwYI:AAXmkmvRGg6/FF9wkqSoL
MD5:	DB8AF3A609959C5D8F75DE005F0AB24E
SHA1:	3CA168DF90621F3855E76CDCB17B9F756ACC7207
SHA-256:	61B90F8BE359E5F8BD2B77F343BA2EA32B228389C48D0D3C60FE71E4ABE5F545
SHA-512:	55D080690BAE1A2CFE892E70EB06E14DAB6F396AC7231CC12DE7EEF1FC930A3E61E1823CEB92E1E4D80AF99806F1636FBA1F7D72E86846265AE5B3877D2FCD82
Malicious:	false
Reputation:	unknown
Preview:	.LJ..q.......'.......9.......B.......X.......9...'...'...B.......X...'...L.....^www%..gsub.match.%w+://([%w.-]+)%.(%w+)........f-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...6.......9...+...'...+...B.......6.......9...+...'...+...B...........X...9.......X.......X...9.......X...-...9...B...5...=...9...=...9...=...-...9.......B...-...9...B...9.......B...-...9...B...+...L...X.......X...9.......X.......X...9.......X...+...L...X...-...9.......9...'...B...+...L...K.......8Login Detect handler type is neigher form or login..transmit_telemetry_event.set_event.get_dimension_processor.set_telemetry_event...._event_name.FormLoginDetect.type..browser..url..count.1.name.FormLoginDetect.login.form.login_count_disabled.form_detect_disabled.GetOption.settingsOForm (login) Detect handler was supplied a malformed event for processing..err.m_logger.type.browser.url.name.get_telemetry_event........G-...9.......9...'...B...-...9...B.....

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\heronerrorslog.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2692
Entropy (8bit):	5.680846849656769
Encrypted:	false
SSDEEP:	48:JLDSErqpelylipRBAdRAGPHX7yPoJOpBDFyWoNRQ0jTPWHFOjQsYqgA388Gq:BuoqgpyOQJOHFyWciaaksq
MD5:	B7731FA3F6F77C4039B842F78DF8E88C
SHA1:	70E1352D0732D0492AE3E1C1FB30A1657DF2DA5F
SHA-256:	72125C521605BCEA56F761475510BBBB5505DC317516391959EBF6F4DA10E4CA
SHA-512:	10DD8D94A988C6C7A78EDBDD195CC578A65804D683D921C74E747F9F686A52F1021C2D766BB53CCF114701F63EB3F9857D4B347232A738A862107CD0990FE6A1
Malicious:	false
Reputation:	unknown
Preview:	.LJ........#...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...-...9...B.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9.......+...9.......X...9.......X...+...'...9.......X...9...6.......9...+...-...+...B.......X...-...9.......9...'...B...+...L...6.......9.......-.......B.......X.......X...'...X.......'...&...'...9.......X...9.......X...'...9...'...&...'...9.......X...9.......X...'...9...'...&...'...9.......X...9.......X...'...9...'...&...'...9.......X...9.......X...9...'...9.......X...9.......X...9...'...9.......X...9.......X...'...9...'...&...'.......'.......'.......'.......'.......'.......&.......'. .....'.!.&...6.......9.".....-.......B...+...L..........SetOption.}.{.,"metadata":.,"line_number":.,"error_code":.,"error_type":.,"function_name":."file_name":.".default.null.,.[-HeronErrorsLog heron telemetry disabled..info.GetOption.settings.default_no_value..

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\installedapplications.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1284
Entropy (8bit):	5.569931748518726
Encrypted:	false
SSDEEP:	24:6q+rPwnuaPUM2Xjd0BLqJ2Z9uKwKciAjQWllBBMlFelr5TAhU69NFjrV:d+rPwnuaPUzj+BewLuKwKHAjQY2KrwFF
MD5:	51AFF49C7B2E5687F8CABE8CC190B2FF
SHA1:	7227084C8A00D19870E3226D9B9DDA0EB830A410
SHA-256:	2B57D8409B26DE27501CC77991FCCE82730FB86829A17401254573E1EEEB0CCF
SHA-512:	62923074DA6E090B87863318D0BDEAC5C3EA1ABC60DF2975F3155CCE3E6B4137441DEA618D2A14449CB11E9208AA0C5542B62CF0F4979869E732BDC24563F200
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........+...L...........U-...9.......9...'...B...6.......9...+...-...)...B...6.......9...+...-...)...B.......X...-...9.......9...'...B...+...L.......X...-...9.......9...'...B...+...L...6.......9...B.......X...-...9.......9...'...B...+...L...-...9.......9...'.......&...B...5...=...=...-...9.......B...-...9...B...9.......B...6.......9...+...-.......B...-...9...D..........transmit_telemetry_event.SetOptionInt.set_event.get_dimension_processor.set_telemetry_event.applications.version....name.InstalledApplications.version..applications.._event_name.InstalledApplications applications json payload: .Nil payload so not sending.GetInstalledApplications.telemetryVer_to_send < ver_sent so not sendingVer_to_send = ver_sent so not sending.GetOption.settings@Entering InstalledApplications event handler's send_on_ping.info.m_logger.........6...9...................B...'...'...3...=...3...=...2...L.....send_on_ping..handle_telemetry_event Installed_Apps_Version_Sent#Installed_Apps_Version_To_Sen

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\installedextensions.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	5.676053309697312
Encrypted:	false
SSDEEP:	24:6hrRTr3yTmJ2LTD3gRoWf6xQ6FF9K6FXovjhSUAAtlEBABg5z9BStQ1MuVO:irh3Rc3gRoWfRqKhvjQUAAtWOmnktYMF
MD5:	84FFDB81D9E4297C3F4FE63C00960962
SHA1:	7CCB59E22DCF95DC9D330A7082F7CBC242A5EDAA
SHA-256:	A6DF1C3F267858F7CC7CA23D4A1A8DE30E1ED28AA1BE69383776FE4548E6B3A6
SHA-512:	D4B2B41519FD7DAF5EBE9D61DA6DF012E053ABB17AF553E8315B9C0FDDC0546B7773FC752CEADBFA08E3A29117E1EEF30DFC0384FB62E7BC3466653731D316E0
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........+...L...........\-...9.......9...'...B...6.......9...+...-...)...B...6...-...B...H.H.6.......9...+...-.......&...)...B.......X...-...9.......9...'.......B...X.5.6.......9.......B.......X...-...9.......9...'.......B...X.&.-...9.......9...'.......'.......&...B...5...=...=...=...-...9.......B...-...9...B...9.......B...-...9...B.......X...6.......9...+...-.......&.......B...F...R...K............SetOptionInt.transmit_telemetry_event.set_event.get_dimension_processor.set_telemetry_event.extensions.version.browser....extensions..browser..version..name.InstalledExtensions._event_name.InstalledExtensions. is *extensions json payload for browser: ANil installed extensions payload so not sending for browser .get_extensions_info.browserSettings8Ver_to_send <= ver_sent so not sending for browser .pairs.GetOption.settings>Entering InstalledExtensions event handler's send_on_ping.info.m_logger.........6...9...................B...'...'...5...3...=...3...=...2...L.....send_on_ping..handle_

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\ipc_stats_handler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1538
Entropy (8bit):	5.627456044852654
Encrypted:	false
SSDEEP:	48:P9kLI4iAgaG9D/IwKpkjqbdWi+tGnwM1n:dtaG9Dpbjg/
MD5:	ACD7807538351250261E3959C9FBEFD6
SHA1:	4CF55CC9C371321F8B1625FC9B629883D7F13D25
SHA-256:	2458CCE2733CCE8CBB9606B241E7C38F92924799C89DEFE2334561710243E728
SHA-512:	E9FBCA65014D1C1FA088D6F940A413FDD80FCAFC1EE38B3CB765671B60FE99089CEB277C03C3533DB5FC5BB62FF7F1473367FC701ADA8259F6F0E7B02F12E497
Malicious:	false
Reputation:	unknown
Preview:	.LJ..q.......6.......B...4...)...6...9.......'.......'...&...B...X...<.......E...R...L....]+.[^.gmatch.string.tostring.S.......-.......9...'...B...+...L.....-ipc_stats_handler.handle_telemetry_event.info........]-...9.......9...'...B...6...6.......9...B...A...-...9.......9...'.......&...B...-...'.......B...6.......B...H.7.-...'...6.......B...A...:.......X...:.......X.+.6...:...B...).......X.%.5...:...=...=...-...9.......B...-...9...B...9.......B...-...9.......9...'...9...'...6...9...B...&...B...-...9...B.......X...-...9.......9...'...B...F...R...-...9.......9...'...B...+...L.......'ipc_stats_handler.send_on_ping end5ipc_stats_handler.send_on_ping event sent failed.transmit_telemetry_event. = 4ipc_stats_handler.send_on_ping sending counter .set_event.get_dimension_processor.set_telemetry_event.count.stats_type....name.IPCStat.stats_type.._event_name.ipc_stat.count..tonumber.:.pairs.;.counter string: .get_ipc_stats.utility.tostring)ipc_stats_handler.send_on_ping begin.info.m_logger......

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\logicscripterror.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1461
Entropy (8bit):	5.449699126433896
Encrypted:	false
SSDEEP:	24:63uqzOLpKkGfeLSDAlcl+mzP4n3QnvIRRsInTWEpqaEsJVRLRnrfUkdWMML9KzH3:2ZEgveLSDtl+mzQAvYR3SEEaEsvRtr1j
MD5:	989789975DD20147607C271CDD8CA115
SHA1:	C2F77E8845CBCC77F84C32DA7CA2E55D69A18468
SHA-256:	E9AF4C91C9892894E7F95FDE26356A3EBF5D00C17CA7BFDD83A986E046FF7D6C
SHA-512:	276087B7044066FD8A592CC3EE670FD0D915571B03E8005DB0ED76D6BEECD829FE5E06A45A2B389F7AC672A4364871B761EF1F6B4737569EEB019B7AD0E0F988
Malicious:	false
Reputation:	unknown
Preview:	.LJ..R.......-.......9...'...B...+...L.....,LogicScriptError.handle_telemetry_event.info........]-...9.......9...'...B...5...6...6.......9...+...'...)...B...A...=...6.......9...+...'...'...B...=...6.......9...+...'...'...B...=...9.......X...9.......X...-...9.......9...'...B...+...L...-...9.......B...-...9...B...9.......B...-...9...B.......X...-...9.......9...'...B...6.......9...+...'...'...B.......X...6.......9...+...'...'...B...L...-...9.......9...'...B...+...L.....&LogicScriptError.send_on_ping end.SetOption-LogicScriptError.send_on_ping event sent.transmit_telemetry_event.set_event.get_dimension_processor.set_telemetry_event+LogicScriptError.send_on_ping no error.endPoint.LogicErrorEndpoint.errorMessage..LogicErrorMessage.errorCode.LogicErrorCode.GetOption.settings.tostring....errorCode..endPoint..name.LogicScriptError._event_name.Logic_script_error.errorMessage.(LogicScriptError.send_on_ping begin.info.m_logger.............9...'...B...6...9...................B...3...=...3...=......

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\lowsearchusertargeting.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3322
Entropy (8bit):	5.626487817954363
Encrypted:	false
SSDEEP:	96:EobQuIMP0wVFoHpliXLhhPcDs7+21LGg70WdSzk:EQ70w8J6cHg7Zdak
MD5:	EDDB62DD2CEBF99C24F2B9DF839C9AA3
SHA1:	998AEFB89AA957005834CA879B11163C7A23A688
SHA-256:	E4E86E9B37AF8680EC4F1C5EC69B00258402BC189E9550E0C828B8B193A9E692
SHA-512:	05BFAF46A9422466164DB318397662C10D5F21F0B58F36E3BB8A28892AA548D78A7B028DD7B60979DA0CB36933861DED59D7D9C04223E5F98D1A7A0475F9B0E7
Malicious:	false
Reputation:	unknown
Preview:	.LJ........2...6...9.......9...'...B...'...6...6.......9...+...'...)...B...A...6...6.......9...+...'...)...B...A...6...9.......9...'.......'.......'.......&...B.......X...6...9.......9...'...B...K...6.......9...+...'...+...B...6.......9...+...'...+...B.......X...'...X.......X...'...6...9.......9...'...6.......B...'...6.......B...'.......&...B.......X...6.......9...+...'...)...B...6...9.......9...'...6.......B...&...B.......X...6.......9...+...'...)...B...6...9.......9...'...6.......B...&...B...6...6.......9...+...'...)...B...A...6...9.......9...'.......&...B...6...6.......9...+...'...+...B...A.......X...K...6.......B...6...9.......9...'...6.......B...&...B...6...6...9...'. .....B...A...6...9.......9...'.!.....&...B...5.".=.#.=.$.=.%.=.&.=.'.6...9.......9...'.(.B...-...9.).....B...6...9.......9...'.*.B...-...9.+.B...9.,.....B...-...9.-.B...6...9.......9...'...B.......6...9.......9...'./.....&...B...6.......9.0.+...'.......B...6...9.......9...'.1.B...K.....9send_low_search_user_targettin

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\metriccounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1431
Entropy (8bit):	5.5499061183628635
Encrypted:	false
SSDEEP:	24:6RfbyDu5ID3ecfGtK2t2qefdlPMvzUbmkctm2MtKc4Lc5ks+A:Sfyu5IC42t2qeHME1n2xc4oK1A
MD5:	F024B1DFB2730D6767C9C2ACAC728B77
SHA1:	48D766E960515E9898CD232F32AD2D4A58792481
SHA-256:	B3B502451CB8CD3F81F7BFD9588CC9BA64EC5500A6721B369E8B773D88F27E5B
SHA-512:	196E4953F2B3FB09C0FFCE9DC2EEC799BB94E80E5470D070BD7AF06E731CC96F677BC64CB00B1C9DC5CB8450B759E4BE66D741A9C051B34D39B56389402F94F0
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........=-...9...B...+...).......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9.......X...+...9.......X...6...9...B.......6.......9.......9.......B.......9.......X...9.......X...9...6.......9.......9.......D......SetOption.max_value.GetOption.settings.tonumber.default_no_value.in_context>OEM counter handler called with an invalid configuration..err.m_logger.setting_name.metric_id.get_telemetry_config.........\-...9...B...+...+...)...+.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9.......X...+...9.......X...9.......X...+...9.......X...6...9...B.......9.......X...9.......X...+...6.......9.......9.......B...).......X.......X...9.......X...9.......X...9...9...=...=.......X.......X...6.......9.......9.......D...X...+...L...K......SetOption.metric_value.max_value.GetOption.settings.reset_count.tonumber.default_no_value.append_zero.in_context>OEM counter handler called with an invalid configuratio

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\navigatedtoday.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4062
Entropy (8bit):	5.548836098240396
Encrypted:	false
SSDEEP:	96:2vcwHPwydCpyX1ooaQNhyzDzqBi2SaoxszrwcHvh9A:2UwHPwydCp8ooauIzDzmi3aoeH5A
MD5:	7D362C1DE1477DE76CEA988F506E5243
SHA1:	60751E2A46596A9E7906848E3985D908D93608CC
SHA-256:	A0B50CC1F8BD8EDB869E767871902153C821EDCD56E8583CDD1DE25E59F52DDF
SHA-512:	C130C0B705AAE7AE534F501EB25361FC26A7412FD7BA1B1C19A528E1ED11214E9FA75E327BD59EFACED358DA2056DA6440B99632ED71DAC867DA21E61A292119
Malicious:	false
Reputation:	unknown
Preview:	.LJ..c.......6.......9...+...-...)...B.......6.......9...+...-.......D......SetOption.GetOption.settings.>.......6...9...6...9...'...B...A.......L....!*t.date.time.os..Y...........X.......X...6.......9...+...-.......&...)...D...)...L......GetOption.settings.a...........X.......X.......X...6.......9...+...-.......&.......D...+...L......SetOption.settings.Y...........X.......X...6.......9...+...-.......&...)...D...)...L......GetOption.settings.a...........X.......X.......X...6.......9...+...-.......&.......D...+...L......SetOption.settings...........6...9.......9...'...B.......X.......X...-...9.......9...'...B...+...L...6.......9...)...B...-.......B.......X.&.-.......-...B...A...5...-...=...-...=...=...=...-...9.......B...-...9...B...9.......B...-...B...6.......9...+...-...+...B.......X...-...9...D...+...L...-...B...-... .......X...-.......B...-.......)...B...-...........B...5...-...=...-...=...=...=.......=...-...9.......B...-...9...B...9.......B...-...B...6.......9...+...-...+...B.....

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\newtabcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2773
Entropy (8bit):	5.815567707758781
Encrypted:	false
SSDEEP:	48:ADSsjz5ADtkfWjtm4DmRta30IaZfiFeNWBv4dXrXjH2pxVwAjzO40W+p86EBle:AuvJB+/dOYDcz0p8xBs
MD5:	D53C1BD3C1C7F7DF5B6B172A7BD0A6B9
SHA1:	E60086708001BBEF5582AEA0344BECA00DA6466B
SHA-256:	CE41FCD6DC03E44203A6728495F6F861B0D5055ED8F0D0DC2D67397314E1D7D8
SHA-512:	935BFC01C8CFA835FC15DA77BEF4A9E09D46196C88CA30B1B1500EB65484D0ADD9007EE56CA0B7F7A155135FFB3D2DC82D2FAF71C2C388A12FD6827A5BDFDBB6
Malicious:	false
Reputation:	unknown
Preview:	.LJ............-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...-...9...B...+...)...'.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9...9.......X...6...9...B.......9.......X...6...9...B.......6...9.......'...9...'...9...'...'...&...B...6...9.......B...6.......9...............B...6...9...B.......X...6.......9...........6...9...B...A...6...9.......'...9...'...9...'...'...&...B.......6...9.......B.......6.......9...............B...........6.......9...............B...+...L......Impressions.SetOption.GetOption.settings.MaximumNumberOfShortcuts._.lower.string.tonumber.default_no_value.toboolean.in_context.prefixEOEM NewTab counter handler called with an invalid configuration..NewTabCounter.get_telemetry_configUOEM NewTab Counter handler telemetry event called with an invalid configuration..err.shortcutCount.action_type.browser.name.get_telemetry_event3Entering NewTab Counter Han

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\pushnotification.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2927
Entropy (8bit):	5.646248207343047
Encrypted:	false
SSDEEP:	48:lEIVPGKqKVUIG7JEx6XR+IxWRnhb3lzXdM2LCkPTbxYqTeSvCPGMGuah7uJnUtXf:lEGPGKqKVU3h3ctrMCCovHTeICPGMdnI
MD5:	2379D9E8ECF7BBFEFA1613FF55B26B72
SHA1:	3936C4B0B9973F61CFEC2197CC08C072BC6C1A26
SHA-256:	1AF46F33E6CBBEF85819E09465A7FFD89C490C9396C387E0929DC75F2D857D66
SHA-512:	90C314C8BFF10D76E599E57F8EBBC1DDA4D1209B4D705B6447C3CA5312C98084E6647D221F8521F0AF5586880C04990C26D514AD97E76D31F9430E5D23658A69
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........$6.......9...+...-...)...B...6.......9...+...-...)...B.......X...-...9.......9...'...B...+...L.......X...-...9.......9...'...B...+...L...+...L.........;PushNotification ver_to_send < ver_sent so not sending;PushNotification ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......6.......9...+...-...)...B...6.......9...+...-.......B...K........SetOptionInt.GetOption.settings.........'...6.......B...X.......'...6.......B...'...&...E...R.......X.......9...)...)...B...........'...&...L....].sub.",.tostring.".ipairs.[........()...4...6.......B...X.......9...'...B.......9.......B.......9...'...B.......9...).......B...........X...6...9...........B.......E...R...-.......B...........J......insert.table..:.sub.//.find.ipairs..........5...=...=...=...L....count.data.event_action....count..data..event_action..browser.ch.name.PushNotification._event_name.PushNotification.........-...................B...9.......B...9...B...9.......B...9...D......transmit_telemetry_

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\searchreset.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3219
Entropy (8bit):	5.488555050020129
Encrypted:	false
SSDEEP:	96:+nEGPoKkKVUm0/Vj7Egg6kLqIkjKlDgP9w03qIIp5d+6VNPN1CK:EEGPoKkK6hRgHg91qNHf
MD5:	6A34CF408C5D6DCB4C6B9E5D13D11E8C
SHA1:	ADBA3F19DEF5EAC41127A4978FED300673015D93
SHA-256:	61659A7343959C20D821501C7DCD50AF573D6FD6545F42C3B17D7BAC7F8A811F
SHA-512:	6DE1F655720DABEEA36E22F0A606B83291C8B60CE66E2FA3326974840BAC25B1F8EB0175E7203B97F8D4F07A1AFF0B79AEEAAB8F7C7D181B73A53B07764851D2
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...9...6...9...'...B...A...6.......9...+...-...)...B...).......X...)...L...!...L......GetOption.settings.!*t.date.time.os........$6.......9...+...-...)...B...6.......9...+...-...)...B.......X...-...9.......9...'...B...+...L.......X...-...9.......9...'...B...+...L...+...L.........<Running processes ver_to_send < ver_sent so not sending<Running procceses ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......6.......9...+...-...)...B...6.......9...+...-.......B...K........SetOptionInt.GetOption.settings..........-...9.......9...'...B...6.......9...+...-...+...B.......X...+...L...-...9...B.......-...9.......X...6...9...6...9...'...B...A...6.......9...+...-.......B...6.......9...+...-...)...B...+...L...6.......9...+...-...)...B.......X.L.-...9.......X...-...9.......X...-...9.......X.@.-...B...).......X...-...9.......9...'...B...+...L...-...=...-...B.......X...6.......9...B.......X...-...9.......9...'.......&...B...-...=...-...B...-...9...-...B...-...9.

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\searchsuggestcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2602
Entropy (8bit):	5.792574522520305
Encrypted:	false
SSDEEP:	48:8DSsjz5AKD4Ku9Ta/+figTJdYfl/N4tSuQ8P4i2LeY0zO4ttWpc:8uvK+8EZTEBMHQ8PfCMdAc
MD5:	461AEA14313F4DEFB85926603979FEA8
SHA1:	D1F47D767E29378B0351A86C57DCAAFA99250328
SHA-256:	C8D78B017027BB20EF190A9C37DF1BA1F98E6FE09A4D03D04D0CB746170126D1
SHA-512:	754CDEC7DEBF38A78C39AC534F5E2F43295770F7D0B4E31BA9ED8052AA65C8F321E8250459A4B33EFCACF62F6FE19990FA24AE690F46B690A9F4F3431EFC5E51
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........e-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...-...9...B...+...)...'.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9...9.......X...6...9...B.......9.......X...6...9...B.......6...9.......'...9...'...9...'...9...&...B...6.......9...............B.......6.......9...............B...+...L......SetOption.GetOption.settings._.lower.string.tonumber.default_no_value.toboolean.in_context.prefixLOEM SearchSuggest counter handler called with an invalid configuration..SearchSuggestCounter.get_telemetry_config\OEM SearchSuggest Counter handler telemetry event called with an invalid configuration..err.search_type.interaction_type.browser.name.get_telemetry_event:Entering SearchSuggest Counter Handle Telemetry Event.info.m_logger.......$...-...9.......9...'...B...-...9...B...+...+...)...+...'...5...5...5.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X..

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\searchterm.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5387
Entropy (8bit):	5.6732568139133654
Encrypted:	false
SSDEEP:	48:v2GmsH9ij/KtDUOdCQUkitR1rbJgYuQer6gYjOLLjmnJucaA2NaAqMlQOk1bh3B5:vNH6KWB/86gNLMrYXQOkbhDie8MMXa
MD5:	C1D971EC9E4704A08BC126E2EBEA7404
SHA1:	CA980FAD55B6574ECE74C6205736D3487E0BBF69
SHA-256:	E70C7BB5ECE95763D3183DD1495C13B4C4DF8411137D844169BA868243253D68
SHA-512:	5370848312546F5D0B44474DEF4D89607C292E045106C9F0CEA535C7A65DF45F22A123A55DF3064011E032DF7F04664641E2645B4BE233995FE26880BB38CCD8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..8.......6...9...6.......)...B...C....tonumber.char.string+...........9...'...-...D......%%(%x%x).gsubc.......6.......B...H...6...9.......9...B.......X...L...F...R...+...L....urlMatch.match.string.pairs........06...9...........B...7...7...6...9.......6.......B...6...9.......'...B...7...7...6.......X...6...9.......)...6.......B.......-.......B.......6...9.......'...'...B.......6...9.......B.......L......lower. .+.gsub.first2.last2.&.sub.first.last.find.string.2.......-.......-...8...9...D........firstIndicator........F'...6.......B...X.>.+...6...9...B...X...+...6.......B...X...6...9.......'.......'...&...B.......X...+...X...+...X...E...R.......X...+...X...E...R.......X...6...9...B...X...6...9.......'.......'...&...B.......X...+...X...E...R.......X.......X...9...X...9...'.......&...E...R...L.... .category.exclusion.%f[^%w_].%f[%w_].match.string.inclusion.ipairs.........+...L.............-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...-...9.......X...-...9.......9.

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\securesearchhit.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7651
Entropy (8bit):	5.668784126503203
Encrypted:	false
SSDEEP:	192:UD2R/OT7AVWyUDIj9zGLGrDGza3TsQNv0soa6:g+EUVWwj9zR/Gz6TXK
MD5:	1E329F45B74E93D672D22C417F87E998
SHA1:	36FEBD009652CCB3335797C8BCEE8D9A32FE3FFE
SHA-256:	98585A70701F1F547019EAE3EABAEEFFB2529C2A5DA728FFB7C94971CF78132D
SHA-512:	465B3B3E30760E237CCB361175F324E1800AC574E579CEFF1826F904D6C208BCF08513B63ADDCD1BEE62556C4D9090EC034E4096984A7D7CF980C6AECBEF4F3C
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6...6.......9...+.......)...B...A...6...9.......9.......'...6.......B...&...B.......6.......9...+...........B...K....SetOption.tostring. - count: .info.log.core.GetOption.settings.tonumber.........$6...9.......9...'.......&...B...9...9... ...).......X...U...........X...6...9.......9...'.......'.......'...9...&...B...5...=...=...9...=...L.......month..year..day..day., day: ., month: /Secure search hit add_month result, year: .month.year-Secure search hit add_month, num_month: .info.log.core..........!6...9.......9...'...B...6...9.......B...6...9.......B...6...9...........B...6...9.......9...'.......'.......'.......&...B.......L...., difference:., target_time: /Secure search hit days_until, start_time: .difftime.time.os!Secure search hit days_until.info.log.core...........~6...6.......9...+...'...)...B...A...6...9.......9...'...B.......X.f.6...9...'.......B...-.......)...B...-.......)...B...6...9...-...........B...A...6...9...-...........B...A...6...9.......9...'...B...6...

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\securesearchtoast.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2887
Entropy (8bit):	5.704212400755332
Encrypted:	false
SSDEEP:	48:HDNk2Kly+sCE86dqBAEuQKAS0+7RhPIcLm+2qUXfR2WqrDIM5Oo:jlKOn86U7uQZhct8Jw5
MD5:	95FB4900444FA10323D65CF34D504F5A
SHA1:	FF894E30901D72DF12987A44AC696C257AE0226D
SHA-256:	32840B4EAED3F90A7692F4B9270FB6609D7F4A0FC30C2C9A8B690C6CE5885969
SHA-512:	8582EC63F60155F874FA36143200E432A2C81039C67B7A30F5F14B22E5F845DCB542603F4100DA2AEDC6AC25382A8A50CEC4DEA86EDF7491F31FA31510CB8D89
Malicious:	false
Reputation:	unknown
Preview:	.LJ........<...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9.......X...9...7...X...'...7...9.......X...9.......X...9...7...X...'...7...9.......X...6.......9...+...-...9...&...9...B...X...9.......X...9.......X...9.......X...6.......9...+...-...9...&...'...B...=...6...9...B...-...9.......9...'...6.......B...&...B...6.......9...+...'...+...B.......X.D.6.......9...+...'...)...B...)...'.......X.#.6...9...!.......B...6.......9...+...'. .)...B...-...9.......9...'.!.6.......B...'.".6.......B...&...B.......X...-...9.......9...'.#.B...'.$.6.......X...'.%.....&...7...X...6...'.&.'.%.....&...7...-...9.......9...'.'.6...&...B...'...9.......X...6.......9...+...'.(.)...B.......X.!.6...9...!...B...).......X...6.......B.......6.......9...+...'.(.)...B...X...6.......9...+...'.(.....B...6.......9...+...'...)...B...5.).9...=...9...=...9...=...9...=...6...=...=.*.6...=...-...9.+.....B...-...9.,.B...9.-.....B...-

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\sendimmediately.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.342988422594243
Encrypted:	false
SSDEEP:	6:6WUWJL48s187K54wwU4oJ9Vsug8JAbyKWrVucu1ngjQKyhJddJO:6WNJL4XH54o4MV35JJKWrPu6jQjJ4
MD5:	35216B15300487BDA6D32AAD4250AEC5
SHA1:	CAF7ACA8A1846A6167FA39A27590442C9B345C50
SHA-256:	0DBEBA7B7F4E02C4A8A999D5483619DBEF12A7963A0C9F4EF47563EC98CD56B0
SHA-512:	8FBA4E3C683F8828FD6444F33FE47D7FA361F72695966C55E35458840245D09A9AB7DE238D9C4B1CC29F9946EBB1F20C505A38CC74590714794A079821BADD5E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........-...9...D......transmit_telemetry_event\.......6...9...................B...3...=...2...L.....handle_telemetry_event.new.EventHandlern.......6...'...B...4...7...6...3...=...6...2...L.....new.SendImmediately"telemetry.events.EventHandler.require...//7EF46D90BD45A8A1C8FA285D181AC5C33AC144FD16648387401EB1FC68BFFE8DC54EFE3E4E05980E9872AAB5EB4B167EF5F3A412A70504BC3F097665011E48B3++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\smareputationcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2733
Entropy (8bit):	5.810678771226106
Encrypted:	false
SSDEEP:	48:fZDSqxViOC0k8r/cnZ93tDTHKNas+fubKRt/4LrjbBVat+Uvkr0g1kDii2Bcaiur:fZuyk/h8YTZZubKRxcvNoI2G7dv9r
MD5:	3CBB56B97190939639ECBBACCE608B7A
SHA1:	4F4237352279E2E79FBEC8226AF57DBD3ECED728
SHA-256:	B2A686361753AE315C4F9B973FECA4074C00A28E26E6C379AB4360CAA356901C
SHA-512:	BEE603BA66796E41EA8FA8B9B4315F4C4544CA7D1F54AE1EAEC109C4E37E3644B44398A8D41478B37BD6C115A06EF5C6E0C2CFF285D8D679DF6A67935E2C30CA
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........g-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...-...9...B...+...)...'...'.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9...9.......X...9.......X...+...9.......X...6...9...B.......6...9.......'.......'...9...'...9...&...B...6.......9...............B...9... ...6.......9...............B...+...L......SetOption.GetOption.settings._.lower.string.tonumber.default_no_value.in_context.prefixMOEM SMA Reputation counter handler called with an invalid configuration..default.SMAReputationCounter.get_telemetry_config]OEM SMA Reputation Counter handler telemetry event called with an invalid configuration..err.count.color.site.browser.get_telemetry_event;Entering SMA Reputation Counter Handle Telemetry Event.info.m_logger.... .*...-...9.......9...'...B...-...9...B...+...+...)...+...'...4...'...>...'...>...'...>...4...'...>...4...5...>...5...>...5...>...5...>...5...>.......

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\wabadgenotificationcounter.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2478
Entropy (8bit):	5.751845140494356
Encrypted:	false
SSDEEP:	48:3DSqjdEmfSEpie56rnaafiIOmvu6iGFVFVTRwKhlqFIoi2dNqkzO4LdIjfe:3uQfD+a4HhXiwAZIPa7iDe
MD5:	32A4F95A9FFAF6E272CFBC27626B825E
SHA1:	8E752829D7A30AA038FBF15CAFF385AF8AC0523C
SHA-256:	07FA6E0DD02E0E7B34174A93BBA15D9FB845F98A28EFF7AE78E543804A9F9CA6
SHA-512:	52920E005A191EE5C2463AA8BB588E3436E1BCA98CEBEAD6E9656536646AC5F695368FFA0161CF8D37233F499951670A0043EE9A230E9A097537B3D5D5ECE48B
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........j-...9.......9...'...B...-...9...B.......X...9.......X...9.......X...9.......X...9.......X...-...9.......X...-...9.......9...'...B...+...L...-...9...B...+...)...'.......X...-...9.......X...-...9.......9...'...B...+...L...9.......X...9...9.......X...9.......X...+...9.......X...6...9...B.......6...9.......'...9...'...9...&...B...6.......9...............B...6...9.......6...9...B...A.......6.......9...............B...+...L......SetOption.max.math.GetOption.settings._.lower.string.tonumber.default_no_value.in_context.prefixROEM WABadgeNotification counter handler called with an invalid configuration..WABadgeNotificationCounter.get_telemetry_configbOEM WABadgeNotification Counter handler telemetry event called with an invalid configuration..err.count.feature.browser.name.get_telemetry_event@Entering WABadgeNotification Counter Handle Telemetry Event.info.m_logger...... ...-...9.......9...'...B...-...9...B...+...+...)...+...'...5...5.......X...-...9.......X...-...9.......9...'...

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\wssanalytics.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	734
Entropy (8bit):	5.492330376395228
Encrypted:	false
SSDEEP:	12:66mF5GlsglzZ7GlsggGlN5bW0oHQp3AnupBlyzRu+nGpIjHx4Xdf0qqV4M135JJz:66I5VglN7VggGlwQFAnup/Z+nPaNfPML
MD5:	7A1CF12D80DDC114D4192FE1FA0F9EA3
SHA1:	0DAC40F718785082400AF592E1C55BFB5AE4E778
SHA-256:	3F97A3FA8C242DC1F118C72C59259C0BEB0E85FC6FBDB11BE9A159F03811E31A
SHA-512:	2C687D48D853E79A54257CD656088179C6FA71257F58156B341CC9E983B1ADAC898B500433AD68A19652B2526F62CF2CC14FAA9B710AC6476D949BB3BE300A6F
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........#-...9...B.......-.......X...-...9.......9...'...B...+...L...-...-...9...8.......X...-...9.......9...'...B...+...L...6.......9...-...9...D..........PublishMessage.wssEventSender>Invalid message passed to WSS Analytics telemetry handler.messageGEmpty telemetry information returned when processing WSS Analytics.err.m_logger.get_telemetry_event.........6...9...................B...5...3...=...2...L.....handle_telemetry_event....msad.files.safe..msad.sites.safe..new.EventHandlerk.......6...'...B...4...7...6...3...=...6...2...L.....new.WSSAnalytics"telemetry.events.EventHandler.require...//07C7B0A4D290DA6F6363AE90EF8697169CD5E5F7634E3ABC89689456D8E2D384541B2EA0C90F2A85EF28FBE30F5C3A048FE9D0C6D0F9586B431F89CDBC82E306++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\wssanalyticsraw.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	582
Entropy (8bit):	5.517270660703353
Encrypted:	false
SSDEEP:	12:6x5GlsgyPAH6WfEFzMclyzRu+nGpIjHL4XH54o4MaL5JJKvhjC35FMAI:6x5VgyP6czMAZ+nPEX5oMaLUvEpQ
MD5:	A3114E8582651607093473638D9F68F9
SHA1:	F252EF9BAE5820B328088A3E1EC9D539425FF716
SHA-256:	563C845465D30C7DFCFC12762836B541F798E2A22B17EA6443ECE240F5B0BA0E
SHA-512:	1D46F1EFF05F93A3301F69FB5787C4C7A9971163296AFBD4ACA221C646FD2CAB794956B3CBB046C976BA22BF5A7C8DC6BE1CDF6F23C4CE34CD2E346BB00E2634
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........-...9...B.......-.......X...-...9.......9...'...B...+...L...6.......9...-...9...D........message.PublishMessageRaw.wssEventSenderGEmpty telemetry information returned when processing WSS Analytics.err.m_logger.get_telemetry_event\.......6...9...................B...3...=...2...L.....handle_telemetry_event.new.EventHandlern.......6...'...B...4...7...6...3...=...6...2...L.....new.WSSAnalyticsRaw"telemetry.events.EventHandler.require...//B14565C0152A58A87F778ED97AB95BED4550662F131759496C84A3B0B8BDD55EF7FDF1BF372B48FABA3969C132C9B7566C1A5E8E9634429CC4C28936325BA9A4++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\sendonping.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.405943148971105
Encrypted:	false
SSDEEP:	6:6AWBAok48s1SK0HL1WU4oJ9Xucjg8JAbyKTgKqWmYVsORKXNg9ayYMbe+:6AWa4XbgLT4MXFj5JJK+P4mXNryFbe+
MD5:	43446E7FBD2ED6615FA7A41383E847BB
SHA1:	657B7ECDEAF1A06DBEE1F4F615909BB1829A1855
SHA-256:	F3F6CCBC480837394F355E1B5A992D12F32863D8B3BF1838F9154AD8F8AB8A95
SHA-512:	CD8B503D22C86C58BEFD9AD7E98AE18C047B21C7C468C0B230CE43B50BA878713078C51FD8AA423D60EBED963AC22B54ABB008F44E9E81A59245AF908080F084
Malicious:	false
Reputation:	unknown
Preview:	.LJ..6.......6...'...D...!send_on_ping not implemented.errorR.......6...9...................B...3...=...2...L.....send_on_ping.new.EventHandleri.......6...'...B...4...7...6...3...=...6...2...L.....new.SendOnPing"telemetry.events.EventHandler.require...//27E37EFB40196584CD1EA57D59306EBBB0A7AFAC400F4BBE1F373D2B7A31064385CFAEAA9C1AD7D34D0EC3A38C98E657DBCB3F2D31626542C12E0CD1BA7C8B47++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\telemetryconfig.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32368
Entropy (8bit):	5.485058202694766
Encrypted:	false
SSDEEP:	384:DtjmpberiSoQXmV/Px1IEOyoT6XBt7QuX9GFymAkNV:0JiiiMPxyyoTq7lX9GA0
MD5:	30269BC1DEF2CB47150B232B290C07BA
SHA1:	0468F83507403C977164D229D90999E231ACF290
SHA-256:	23318F270AE80F357BB64D99DEEC0CD5CE6E833E043BF07B22DD32052A8A79DE
SHA-512:	0BBCD590871D29F5657BB14E1B231543DB3484A3205706936392BA139E659463F6A2C1542A806EF31285D4845CE81E30D91340459265CB3D5A4232C6D5B40EC9
Malicious:	false
Reputation:	unknown
Preview:	.LJ..............5.(.5...5...5...=...5...5...5...=...5...=...5...=...5...=...5...=...=...=...4...5...>...=...=...5...5...=...5...5...5...=...5...=...5...=...5...=...5...=...=...=...4...5...>...=...=...5.!.5. .=...5.%.5.#.5.".=...5.$.=...=...=...4...5.&.>...=...=.'.5.).5.(.=...=.*.5.,.5.+.=...5.0.5...5.-.=...5./.=...=...=...4...5.1.>...=...=.2.5.4.5.3.=...4...5.5.>...=...=.6.5.8.5.7.=...5.>.5.:.5.9.=...5.;.=...5.<.=...5.=.=...=...=...4...5.?.>...=...=.@.5.B.5.A.=...4...5.C.>...=...=.D.5.F.5.E.=...5.L.5.H.5.G.=...5.I.=...5.J.=...5.K.=...=...=...4...5.M.>...=...=.N.5.P.5.O.=...4...5.Q.>...=...=.R.5.T.5.S.=...4...5.U.>...=...=.V.5.X.5.W.=...5._.5.Z.5.Y.=...5.[.=...5.\.=...5.].=...5.^.=...=...=...4...5.`.>...=...=.a.5.c.5.b.=...5.h.5.e.5.d.=...5.f.=...5.g.=...=...=...4...5.i.>...=...=.j.5.l.5.k.=...4...5.m.>...=...=.n.5.p.5.o.=...4...5.q.>...=...=.r.5.t.5.s.=...4...5.u.>...=...=.v.5.x.5.w.=...5.y.=.z.4...5.{.4...=.\|.>...=.}.4...5.~.>...=...=...5...5...=...5...=.z.4...5...4...=.\|.>...5...4..

C:\Program Files\McAfee\WebAdvisor\telemetry\events\telemetryhandler.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2298
Entropy (8bit):	5.670325288487503
Encrypted:	false
SSDEEP:	48:3K1O3RnzJvZT0xdRmdTyDg1IlteIXwBf++wlFGAxBnGPqrjmRrSurJDr98AK:VvZTauEtRQcNxaJ5ti
MD5:	40EFA25D9511C8CD76BD62CC0FC6ED28
SHA1:	7083F3291FD104EC5CCFF55B92E6134B1F6B0261
SHA-256:	C4FCDA06AF774981610A12D4DF36DD1DE556AEA5051F9A0A34051AF48617A76F
SHA-512:	FD61B0012F05D1CB73BFC08731A50C21568F47A0381D3C26487B6B7B356A6EB8E986C6BA9B6D246EFD383EE75233359D05C599D912796781F632746EAC8FA9A2
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........66...9...8.......X...8...L.......9...'...B.......X.......9...'...B.......X...'.......&...6.......9.......'...B.......X.......X...+...<...L...6...9...)...B...'...6.......B...&...6.......9...)...9...9.......B...+...L....currentline.short_src.Log.utility.tostring%Failed to load package. Error: .getinfo.debug..include.external.mfw..^core%..^mfw%..find.loaded.package......%...6...9.......X...6.......X...6.......X...6.......X...6.......X...6...9...)...B...'...6.......9...)...9...9.......B...)...L.......X.......X...6...9.......9...'...B...)...L...6...9.......9...'.......&...B...6...9.......)...+...B.......X...6...9.......9...'.......'.......&...B...)...L.......X...9.......X...6...9.......9...'...B...)...L...6...9...9...8.......X...6...9.......9...'...9...&...B...)...L...9.......X...6...9.......9...'...9...&...B...)...L...6...'...9...&...B.......X...6...9.......9...'...9...'...9...&...B...)...L...6...9...6...9...6.......B...9. .....X...9. .9.!.....X...9.".9. .B...9...6...9.......

C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmit_aws.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1852
Entropy (8bit):	5.7090579919680255
Encrypted:	false
SSDEEP:	48:Y23cZu6+uxCDmxCSOpLhB8uhSZ1leqq6AXq6x3rAxQcNpzkJanuF/o:/ZiCDmxCFNhucSZ1le56QqUAQcNJ9f
MD5:	90211EE285324FD453E662A448B9D6E5
SHA1:	B3484A0E8C95649D9AE159827055A07B80D77C90
SHA-256:	B7A266BF64A885B4370B39104D556B709123C027620FDAEDBAC53D99D818830D
SHA-512:	C2E503F1C6E241D402F0ADFE92D4F1DA40F16158CD7E6C33EAC8FA8992D729BCEC75F80CE7F1947542CABB0E244A138F244B6D9248E38D66BAA8457635ECF8C8
Malicious:	false
Reputation:	unknown
Preview:	.LJ..O.......+...6.......9...+...'...+...B.......L....AWS_QA_Mode.GetOption.settings.........-...9...B.......X...-...9.......9...'...-...&...B...-...L...-...9.......9...'...-...&...B...-...L.........9Entered Transmit_AWS get_header_value and headers = <Entered Transmit_AWS get_header_value and QA headers = .info.m_logger.is_qa_mode......../-...9.......9...'...B...-...9...B.......X...-...9...B...-...9...B...-...9.......9...........-...'...'.......&...B...6.......9...........-...'...'.......B...X...-...9.......9...'...B...K.......=Transmission to AWS disabled by setting TransmitAWSNew..TransmitTelemetryEvent.sender.web.PUT.get_endpoint_value.get_header_value should_transmit_to_endpoint.Entered Transmit_AWS transmit_to_endpoint.info.m_logger<.......-...9...B.......X...-...L...-...L..........is_qa_mode........-...L.....[.......6.......9...+...'...+...B.......X...+...L....transmit_aws_enabled.GetOption.settings........&6...9.......B...6...9.......B...9.......9...'...B...'...'...'...'...'.

C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmit_azure.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.76937466877934
Encrypted:	false
SSDEEP:	48:azFRv6zh4yYuRzf9gTZz2LhQgd6zEeq63o6xFbSSFl0anuLI5Y:azjKhFtWTZkhZdKEe13oU5SSFbUKY
MD5:	89612C2832610B5408332FBCEC225125
SHA1:	7BFE9E1D4B3EBB97A9B3B37148935EFA22E2A5EC
SHA-256:	40C18DEC34FD5876E2D6F3DF158A78C19D927B95B4FB3D1B36461E5D860FF7C7
SHA-512:	6F6AF84C595D6F7BA98B1A8096FE57D1DAB1A7D9575AC8EC0494D5C7AE906557407C26BC59569E22F5CAAEC3A9F3D2DB7944E20653B2CF7AE39E65B726E897B9
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........N-...9.......9...'...B...-...9...-...B...6...9...6...9...'...B...A...... ...-...9.......9...'.......&...B.......'.......&.......6...9...-...B...6...9.......B...6.......9...-...............B.......X...-...9.......9...'...B...'...-...9.......9...'.......&...B...'.......'...-...9.......B...'.......'...-...&...L..............&skn=.&se=.&sig=.SharedAccessSignature sr=.hash: .default_hash_will_not_work7HMAC Sha256 function did not return the right hash.err.HMACSha256.utility.len.string...ttl: .!t.date.time.os.encode_uri4Entered create shared access token in lua azure.info.m_logger..I.........-...9.......9...'...B...-...9...B...'.......'...-...'...&...-...9.......9...'.......&...B...L........headers: ..servicebus.windows.net...Host: QContent-Type: application/atom+xml;type=entry;charset=utf-8..Authorization: .createSharedAccessToken*Entered get header value in lua azure.info.m_logger........,-...9.......9...'...B...-...9...B.......X...-...9...B...-...9.......9.......-...-...'..

C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmit_ga.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	582
Entropy (8bit):	5.54472158728917
Encrypted:	false
SSDEEP:	12:6VTVTtuIiCiuyws+YpOnkxiRM5DKCo4MVCqu67jKYC6Z4GpNoC:6tfiCiuPVkxxbtMVCf6K9KR
MD5:	174207C69662060821EECD30A386255F
SHA1:	584B499AFB50AA4AE987D9A35E739692EEAA22BC
SHA-256:	F67FD8374C82A7F58A90D2E0D7A6A7A07D486CDE6A501960750E28C088B206EC
SHA-512:	6F06FCB1107C8052B93D7A4509039246B63F2B01F4BDDCEA54003D5539169296A53CA47B21461E6C18A9C872B0E25635C8D879E6CB0A8A8D81EA81F98EC518F2
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6.......9.......'...'...'...'...'...B...K.....web.POST./collect!https://google-analytics.com.TransmitTelemetryEvent.sender,.......'...L...!https://google-analytics.com........'...L.............6...9.......B...3...=...3...=...3...=...2...L.....get_header_value..get_endpoint_value..transmit_to_endpoint.new.EventTransmittern.......6...'...B...4...7...6...3...=...6...2...L.....new.Transmit_GA&telemetry.events.EventTransmitter.require...//159FF38C1975B5C34464C3DB524BD224000DADD85693A250DEDC648B24287ADCED60CC833C1E07E24986FAE847F7E08B8AFAA8863F49E62C455C76DB03A35D3B++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmittimeout_aws.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	883
Entropy (8bit):	5.677927460774469
Encrypted:	false
SSDEEP:	24:65P2OfDKrzUgjFkEOpLh2uea1qRmhuh1rAZ4hMBLYW2ZnW5T/qs:qRrKf7jlOpLhzHUUhuh1cZ42BLWW5jz
MD5:	F6EE7228C587AA73A5C34F332900545A
SHA1:	39C835DD22DF530E93252005E815FE8A47A19393
SHA-256:	ECBFFB9097E15CB9A6753B43E7FAF72780FA78E5EA21F71482315534CD07D676
SHA-512:	5DEC074A462FEF17C275AC2BA3EA661F20100BEFFAD4FCBA7C0BF5B4B2B00F65DFDADAC527525C863331395473BB11E04DD3F10BF489FA18D1452DDF49FC0FEA
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........6-...9.......9...'...B...-...9...B.......X.$.-...9...B...-...9...B...-...9...B...6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9...............'...'...............B...X...-...9.......9...'...B...K.....=Transmission to AWS disabled by setting *TransmitAWSNew..web.PUT"TransmitTelemetryEventTimeout.sender.AWS_Telemetry_Flags.AWS_Telemetry_Timeout.GetOption.settings.get_resource_value.get_endpoint_value.get_header_value should_transmit_to_endpoint5Entered TransmitTimeout_AWS transmit_to_endpoint.info.m_loggerN.......6...9.......B...3...=...2...L.....transmit_to_endpoint.new.Transmit_AWS........6...'...B...4...7...6...3...=...6...2...L.....new.TransmitTimeout_AWS/telemetry.events.transmitters.Transmit_AWS.require...//E8B34337233BEE6298F47F62077D730B5689809891ED692206873061EAB9A9BCB5C4EDB81DA5A2D3C59A2379E1DB3445255EA2D124BB2944236926A1433D172B++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmittimeout_azure.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	855
Entropy (8bit):	5.721360893101492
Encrypted:	false
SSDEEP:	24:6vAqhEDwe2LhXVLhueOgR87viuZ3wMnLYF7106uB:QAqhEj2LhXVLsLgovjlnLOJ01B
MD5:	E3396259DBBA66DDA574C94659FAA016
SHA1:	23F091D238293EEBA7A0402FE1556528D76AA56B
SHA-256:	8A682B441BA6013CC523AF5FDB7296520E3FDE110EFD1F63852FE03A62DF1074
SHA-512:	E564CE753CEE35EBC7A211D4B8D02743F7AE5A39994F04F751FA356CEDC18AFCB2009B7342AB718C5AC059E67105DDA024D04F653C4C75ACA26C99B2C0AC6FF6
Malicious:	false
Reputation:	unknown
Preview:	.LJ..........*-...9...B.......X...-...9...B...6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9.......-...-...'...'...............B...X...-...9.......9...'...B...K........./Transmission to Azure disabled by setting..info.m_logger.web.POST"TransmitTelemetryEventTimeout.sender.Azure_Telemetry_Flags.Azure_Telemetry_Timeout.GetOption.settings.get_header_value should_transmit_to_endpoint.........6...9.......B...'...'...3...=...2...L.....transmit_to_endpoint7/wadp32h01/messages?timeout=60&api-version=2014-011https://cu1pehnswad01.servicebus.windows.net.new.Transmit_Azure.........6...'...B...4...7...6...3...=...6...2...L.....new.TransmitTimeout_Azure1telemetry.events.transmitters.Transmit_Azure.require...//5C186D41FD4055FC236E926654FBCAD6D01FA6BB1794A39019B81E3046AF6EB9FA9FDFDA0BBCE0BA6441775021DD404683F45AD55794F32C42A2E4A7499C441E++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmittimeout_ga.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	605
Entropy (8bit):	5.652003285567163
Encrypted:	false
SSDEEP:	12:6t0VIAe4Zrm2iCDuQLqk3Rf3ZSM5xXCX4MxOPLYjKkDTZLzx:66y4M2iCDueqk3RFxXCIM6LY2kD1Lzx
MD5:	3A0F9AFB5F6AE736DC53549CDE33C826
SHA1:	40CC46BCCCA650414A60790AB4D6F94B155AED0A
SHA-256:	4F8BFAE8DDCD3CA3E8FD5331928189620B73906B61A1E3369B4BE293C312DCAC
SHA-512:	C12E6243CDBF20A5F99747F51A52FB4E8B3F073804D2C715275296F85BA6B0DAAEF3BD62268D10524BFA9F00D3D6E357330709DE153A37F70D4B830B16AA0A08
Malicious:	false
Reputation:	unknown
Preview:	.LJ...........6.......9...+...'...)...B...6.......9...+...'...)...B...6.......9.......'...'...'...'...'...........B...K.....web.POST./collect!https://google-analytics.com"TransmitTelemetryEventTimeout.sender.GA_Telemetry_Flags.GA_Telemetry_Timeout.GetOption.settingsM.......6...9.......B...3...=...2...L.....transmit_to_endpoint.new.Transmit_GA}.......6...'...B...4...7...6...3...=...6...2...L.....new.TransmitTimeout_GA.telemetry.events.transmitters.Transmit_GA.require...//B6BB18795D256FD52098E126DEF5FA82FB3F190F4149E5C090F50EDFE745E231FB7CFAC47A36B865D877908E412679DA2BC4F667A70938343E293341CD121C26++

C:\Program Files\McAfee\WebAdvisor\telemetry\events\version.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	235
Entropy (8bit):	5.210394840073203
Encrypted:	false
SSDEEP:	6:8k4kikwIWmLQJX8n+Ogyd8VK5k4bdUhj5elV4V+ZvnFJA:90kRLQJXcW25eOVYuvnFJA
MD5:	0DE18845C0649E65BB955CDDC340B8C7
SHA1:	B70A097DB14B43D35C606860D94638BC890D0730
SHA-256:	BDDDE6B8A73D2F2277BCFFB8E1AE34CF1238161FA25F350C69FFA842E16F0CBB
SHA-512:	6F8AF2F90CCF474B19280993008CB7DCD9938E3098C8C467A393EC17C8C9E56EE8716101BE4E5B8AE8A8BFB9EA335A16AF08BE63D3BD6F207265B5DB4D4DAD01
Malicious:	false
Reputation:	unknown
Preview:	--$FileVersion=[VERSION_MAJOR].[VERSION_MINOR].[SUBMINORVERSION].[BUILD_NUMBER]..return "4.1.1.898"....//799A198156340D915A1DBAD80B335C43FC9F0068F8B846A355D3C31B906A2C7B236982319E67B0BC79E21BE2BBCA7763BE524D2D70B4544FCFA88344A9B4E403++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\download_scan_ui.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	5.059439346106341
Encrypted:	false
SSDEEP:	24:4cZZCLtlDbUM6OUdREsAAZZSmQcMIc+PcM6icd7FZFWtkZn:pCtlDbUiUPEsA4Fg+UfFnFXZ
MD5:	C7C3F008DCACFF4B60E42F47B360CFEA
SHA1:	298ADB267124D64489C8B7E14CDF8AD7E3E3AC49
SHA-256:	D2B06B541AA3F79B33D11B6045A428718FEBF22FAAC5D86C5455292186ADC92C
SHA-512:	F9A095A28F65BB88CA68A35B632CF788B157728C19B14F507FB4909A223C0DBF94682B15794894039DA24061D844FCB247F6B34AAB13B6034FA8C38A1D05F167
Malicious:	false
Reputation:	unknown
Preview:	var Download_Scan_UI = function(){.. this.elements = {};.. this.elements["name"] = "DownloadScanUI";.. this.elements["interaction_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["count"] = "0";.. this.elements["_event_name"] = "Download_Scan_UI";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.count = function(val).. {.. this.elements["count"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//D24D76A712FE78CF23C2981FA3C0E8E1CAC1D01C09586D5436F4BE8D06A96F323AE817778BB03B46D0541568C9DE9E61C6F03833B7

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\edgeonboarding.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	5.027477039325366
Encrypted:	false
SSDEEP:	24:hwaLteVUM6QcTQMs/mQc9cwPcM6oaccJFZE4fFJtoE:3teVUk4sKuwUsDgnf9foE
MD5:	DB618639C311C7D018A1723EAA9F728D
SHA1:	147D4C67F02589C18900531718F3EA44A7BCFB76
SHA-256:	F1CACB5478BC09E30DDA342F84E82EC83559B9833B1C915B10E7721A6C59FBDF
SHA-512:	8FBB77A582CD29405E1FABC5DB67A6390AB7495925C433125F3F5B5E8277CFCD5A90822C2376A7ABC289DD3089824BF723CB5ED262D83413D28D3E8FD80485B3
Malicious:	false
Reputation:	unknown
Preview:	var EdgeOnboarding = function(){.. this.elements = {};.. this.elements["name"] = "EdgeOnboarding";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "ed";.. this.elements["type"] = "default";.. this.elements["_event_name"] = "EdgeOnboarding";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.type = function(val).. {.. this.elements["type"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//15E2AC231D37C128A477A04B69B3F2FFC6ECA95D8474844FBB4EAAB96915D31F0BF45D5B143B91C8014B347EBEBE6E9FD95F0F92095B09346C8DD1F3548AE33

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\edgeonboarding.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	686
Entropy (8bit):	5.362499393952789
Encrypted:	false
SSDEEP:	12:6DbtRkb6KamGBXBiE0Lu02e+vo5I8o+2r4E4Mz7tKVUs6ynU2:6Hk2DdJvE5D2MMgIyU2
MD5:	9868C518B61C957DA5463BA957D90B17
SHA1:	7276A8535500500F0055E046835C61B914744A6A
SHA-256:	472C44BB14E70A6420516432306E733726A6F06F18F8BCA09FFE16DC675336EB
SHA-512:	53C46FF7975D167252ED7AE71BBB18F387F3D385CA92CDA8BCCE798A88BDE7964B70D8DBB98C4CC1FFF82A1B3560B4C5F046B91C221000EC90006A5280E4FE2D
Malicious:	false
Reputation:	unknown
Preview:	.LJ..............-...L...................-...L...................-...L...................-...L................4...6...-...B...=...6...-...B...=...6...-...B...=...6...-...B...=...'...=...6...9.......9.......B...L............encode.json.core.EdgeOnboarding._event_name.type.browser.action_type.tostring.name.........4...'...'...'...'...3...=...3...=...3...=...3...=...3...=...2...L.....Serialize..type..browser..action_type..name.default.ed.UNKNOWN.EdgeOnboardingY.......6...'...B...4...7...6...3...=...6...2...L.....new.EdgeOnboarding.core.json.require...//E40B0579E78D55C6E5C59AA242375F72CC5D2CB3C43BF870EE370B3D70F132491F39DCE45DEEA602E8FA4D8F7839B2074F1205F04C9FD5873EB786BBC429CFCD++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\edgesecuresearchonboarding.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.065252181672922
Encrypted:	false
SSDEEP:	24:hKLtQXQMM6QMUsZcucwPcM6XcaFZ1ioQQjo:GtQZkMUs6XwU4anoyjo
MD5:	56711443205DBEE0D0683798DE04F6A7
SHA1:	E6412E0BF24014E6879841C3CADFB6FE434DEF7B
SHA-256:	6F7031E3A68D17DBC2CE68E5410296DD0E903E54D1543B24D1797B25B9E0A7C6
SHA-512:	738C83383D6251BA937AA8E04F8B36A8987CDC32CA23A6192365C0932CECF30CA1136EFB197C80240B2104905120914A944DA466097FE8DEB00ECC3A86C81F94
Malicious:	false
Reputation:	unknown
Preview:	var EdgeSecureSearchOnboarding = function(){.. this.elements = {};.. this.elements["category"] = "EdgeSecureSearchOnboarding";.. this.elements["action_type"] = "default";.. this.elements["browser"] = "ED";.. this.elements["impression_type"] = "UNKNOWN";.. this.elements["_event_name"] = "EdgeSecureSearchOnboarding";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.impression_type = function(val).. {.. this.elements["impression_type"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//7AE73BB9B9FBCA65C1D2C1944F29409365A4AC20A1138A

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\edgesecuresearchonboarding.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	752
Entropy (8bit):	5.435233014241964
Encrypted:	false
SSDEEP:	12:6DbtRkb6KaWBXBiE0Lu842e+/OovtIGWoG5iF3v4MDa7tKvmHFcxrRRTdD:6Hk2DEIGMt0B5WgMDvmHixrRFdD
MD5:	D36AE5C5B64BDE91D16AC4C871066487
SHA1:	FC433EE2021966E0532CD4FD55821A7AC024AA69
SHA-256:	155DB8A8E56DF0434DEEAD676E5921865038C7DFA6603F683D2B42B014CA66C6
SHA-512:	7750DC4FA0314EEBD3F46B6677EA9D34D4B5857735A8CF2D4012E5D2AAC703C84B3E016B5A46B7E10AE3650E9D6A871F3B4ED0D76E7BF7C01F67F56297A09373
Malicious:	false
Reputation:	unknown
Preview:	.LJ..............-...L...................-...L...................-...L...................-...L................4...6...-...B...=...6...-...B...=...6...-...B...=...6...-...B...=...'...=...6...9.......9.......B...L............encode.json.core.EdgeSecureSearchOnboarding._event_name.impression_type.browser.action_type.tostring.category.........4...'...'...'...'...3...=...3...=...3...=...3...=...3...=...2...L.....Serialize..impression_type..browser..action_type..category.UNKNOWN.ED.default.EdgeSecureSearchOnboardinge.......6...'...B...4...7...6...3...=...6...2...L.....new.EdgeSecureSearchOnboarding.core.json.require...//0472C3D319C050C65772758DE68BD62E49B2301BEF4F08847C1095D2EA5C4FF83B0D1432BC1C4A9024331989E9BFED557FB6830E4B391F266C6F34FE5311E613++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\extensioninstallationtoast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	5.057653615858933
Encrypted:	false
SSDEEP:	24:L5hLt9DVUM6OUzvUsdwcucwPcM6iczfFZ3/qf6S:L5Ft9DVUiU7UsdlXwUPLn3NS
MD5:	F0F0DD847CE06CA97D93CFC8BC5FD7CB
SHA1:	A950D4E13655BC0385A71C4F17C3CA47B17AB9B0
SHA-256:	8D69F4A60842ADC4D44D485F1F51756D1FD1CA113FC1E63500918FD75D943DFF
SHA-512:	BA2C8CDF85B2217ABA17E7A15860E69DB7CE9A1CF6BAF49B6B62BB7CF6251158B3ECF0CD555A26AD20A5C140772AD2E33F6FF5FD3E1297D7B34D0312D242D1FC
Malicious:	false
Reputation:	unknown
Preview:	var ExtensionInstallationToast = function(){.. this.elements = {};.. this.elements["category"] = "ExtensionInstallationToast";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["sequence"] = "UNKNOWN";.. this.elements["_event_name"] = "ExtensionInstallationToast";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.sequence = function(val).. {.. this.elements["sequence"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//33D3B13A949278C716F09846244592C3F146976442DFE6C06B64A1A4FA79EF

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\fw_av_warning.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	861
Entropy (8bit):	5.108474425977437
Encrypted:	false
SSDEEP:	12:7WJwqwHwzyAdYETwM6RETwscWmQbwRo5AJbwzyAd1oBPbwM62ogFwfwS+axuraTU:7LtQbUM6OUsDmQcMIc+PcM6cFZS7hDE
MD5:	3A396B9AFE1C933046CAEE86659AAC78
SHA1:	E1706E5E31CC58665197A6922464BE550BEFDC6C
SHA-256:	5F1F3BFF6C0B7E2A9BB1ADF406A166DFAC35E62A52CB68399DDFE4860373E41F
SHA-512:	DDF98383058E956DAF31F563F25107F3EF5E1FF26AC457E36F7BBCA8740C9225DDF0BD6B43F6D12BA1AE1FAABCB79E34521B089996CF6C00FEC0C232C405F96C
Malicious:	false
Reputation:	unknown
Preview:	var FW_AV_Warning = function(){.. this.elements = {};.. this.elements["name"] = "FWAVWarning";.. this.elements["interaction_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "FW_AV_Warning";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//C569B16A5B9F5C02D595395C243623A8F650CE2F09B57CB615006B0F5D0B8793F581F88DA9CA1DC2E082593A134E4C8CEFBB2F02C0B2780905CDEBD1F1EB24E5++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\newtabextensionoffer.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	5.076728526401366
Encrypted:	false
SSDEEP:	24:RDhLtxVUM6OUDUs2cucwPcM6kcTFZYb6ujL:/txVUiUDUsvXwUdTnY+U
MD5:	74B0F3FBB9B6BD00077A3DAD3334E321
SHA1:	EC3DF40C39BAF554F88E8BAEF341E3456D425F90
SHA-256:	A459836EA97955B49445275620088B6B21998DB851359E8B0AFD37D7CA0D98C9
SHA-512:	882E0BFB8520684738FDBD38106F53770E79E9DB9D5A99ADCD7DB83C5DE7E1B74B13FE5F7C516DF9CEE12E1CFC103D9BE679A4B72AEC6777BBF5D4147BC4C9AC
Malicious:	false
Reputation:	unknown
Preview:	var NewTabExtensionOffer = function(){.. this.elements = {};.. this.elements["category"] = "NewTabExtensionOffer";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["variation"] = "UNKNOWN";.. this.elements["_event_name"] = "NewTabExtensionOffer";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.variation = function(val).. {.. this.elements["variation"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//2D1037F781D04CF9B38892705AEB629F1BED8D623A3003D6758849BF62A0160245D5536BA943B

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\onboardingballoon.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	5.068987633217678
Encrypted:	false
SSDEEP:	24:hfhLtEbUM6OUf1Us/mQcMIc+PcM6NTQcf9FZwYEgZfH1j1:XtEbUiUf1UsKg+Uxhf9nhf1j1
MD5:	B5AE66FFFA07B9B0CF1197272008E476
SHA1:	F5F272847827C8D1C38B322989FADC8049AF90DB
SHA-256:	1791690900C4FD05FC33B376BD02B37431287AB6323FB5D0A05D6CACC4CE7868
SHA-512:	73BF64E57F5F2636347CE22B02EF7DFFB19108E95683654AE2F128AB2B1A9D065C0A5346F56351A04A0DD52038ABDD8BD8362AF77AD9912C39C3C565BA7C9E19
Malicious:	false
Reputation:	unknown
Preview:	var OnboardingBalloon = function(){.. this.elements = {};.. this.elements["name"] = "OnboardingBalloon";.. this.elements["interaction_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["balloonType"] = "UNKNOWN";.. this.elements["_event_name"] = "OnboardingBalloon";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.balloonType = function(val).. {.. this.elements["balloonType"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//FD9067F17EA1B950C63115489DF20CE388F1082808D69D7E490BEB6C1697270E484081150A9D8

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\optionsdialog.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	860
Entropy (8bit):	5.09739975654482
Encrypted:	false
SSDEEP:	12:ROQWJwqwLlxojwY9QXDwM6RETwsRxo8DKrbwLuoSQbwY1oBPbwM62ogFwfw0JXbp:RvLt/K5M6OUs0cyQcTPcM6cFZoFjQ0
MD5:	06C6CC175CA088525460D1DDE4706162
SHA1:	F892EB7ADFCB614EC6C8FF858F0D6DC8DDE126C5
SHA-256:	E04BEC164B272E5373A5CA67C3C9F556D88285D4684CB5359FD21A296A39A3E1
SHA-512:	CD24C5E5DBB0BEFE1251CE2673BA5327E2912758961FA0397F59614303EBAED7A2578B68F7F56ED6B399CA1A9D13A48AF93C4F35C9FB758328A0C35DF905273C
Malicious:	false
Reputation:	unknown
Preview:	var OptionsDialog = function(){.. this.elements = {};.. this.elements["category"] = "OptionsDialog";.. this.elements["actionType"] = "Impression";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "OptionsDialog";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.actionType = function(val).. {.. this.elements["actionType"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//9D8FF4A66A2B1C8D1146394F2DA86C9821257CBAFD608FFB7135B2BB91BF101B354BEAC4C96FC3444A35113D048059C3101140B67382DF9BAE11D7E860FF38FD++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\productupselltoast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	4.919989510850699
Encrypted:	false
SSDEEP:	48:WFt4VUiU7UtUqmUjrUsCXwUPwId1j7nT1O:et4VUiU7UtUqmUjrU5X7PwId1jzT1O
MD5:	C52A1CF6592DFA8B4A0CD8B04DD20628
SHA1:	7C4899E6C428D23BBC468E36370708ABE0EB9178
SHA-256:	17FAAF545714CE92F8FCAEB1568CB71F800678637506A6D734F4C48EB5012033
SHA-512:	1A4F6FF2458E0A98E64FCB56AABE4264AE1954EA06D85CC8954F1B8DC22053BFE99715CF2EA69E42D4CDF4E12ED5E59CA85EAF84FFF3AF5BCEA72FA489E03092
Malicious:	false
Reputation:	unknown
Preview:	var ProductUpsellToast = function(){.. this.elements = {};.. this.elements["category"] = "ProductUpsellToast";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["sequence"] = "UNKNOWN";.. this.elements["product"] = "UNKNOWN";.. this.elements["variation"] = "UKNOWN";.. this.elements["trigger"] = "UNKNOWN";.. this.elements["url"] = "UNKNOWN";.. this.elements["_event_name"] = "ProductUpsellToast";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.sequence = function(val).. {.. this.elements["sequence"] = val.toString();.. return this;.. };.. this.product

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\protectionscore.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1033
Entropy (8bit):	4.961781853227125
Encrypted:	false
SSDEEP:	24:eLtj9UM6hUcvjQMs4mQchcoPcM6jTccv5FZvgjbrBP:0tj9U64stSoUwgn4H1P
MD5:	BE2589B5580CDDAE5D13319400D7474B
SHA1:	E011BEB3CFC219E7DABF40A21E873E94CC59DD90
SHA-256:	C22DD5993A2B90D140446EF74561E09F57D5A5001E9246DD7C026A6B72BC741E
SHA-512:	D19D1C743C7D05EC3FCEAEE34FC921B0E3AA025CF58C7CF96BA3CFDB8EB9C4BD7C0C68095B18C1EF23882F09E6399E9449291BE8DF480D2A460F7251421F7927
Malicious:	false
Reputation:	unknown
Preview:	var ProtectionScore = function(){.. this.elements = {};.. this.elements["name"] = "ProtectionScore";.. this.elements["event_action"] = "UNKNOWN";.. this.elements["browser"] = "ch";.. this.elements["toasts_count"] = "default";.. this.elements["_event_name"] = "ProtectionScore";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.event_action = function(val).. {.. this.elements["event_action"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.toasts_count = function(val).. {.. this.elements["toasts_count"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//9FBDDA3324F283596AC88E76988ED918A179C3CA14EE01986FF54B697C4AB3A95BA047148DD9F41A9BFB3B65A4950A606

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\pscore.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	981
Entropy (8bit):	5.032562317627676
Encrypted:	false
SSDEEP:	24:00LtQcM6jcQshmQc9cwPcM6oaccJFZXKcTV/L:FtQcP/swuwUsDgnXdTJL
MD5:	E4EEFC43EDA5D53EC7CAF099918DB83E
SHA1:	C863E7BDBE842548B9CAD62ABDF44A9993ECADDB
SHA-256:	C40BD2EED4DE4B15B2C739A95718FD8414DC9774B899D8BE1E409DD3B45BC6DA
SHA-512:	97B882391CC107C3C0963486404540CE274BF3724E48A864EA43197529D157F8091DCDB4AAD779D3AEE4EFA614DDBF764641FEE034CF99F6AABF71DC5ADC947D
Malicious:	false
Reputation:	unknown
Preview:	var PScore = function(){.. this.elements = {};.. this.elements["name"] = "PScore";.. this.elements["action_type"] = "UKNOWN";.. this.elements["browser"] = "UKNOWN";.. this.elements["type"] = "UKNOWN";.. this.elements["_event_name"] = "PScore";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.type = function(val).. {.. this.elements["type"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//71C04A93F56A6BED155F1CF1946DEB45D37AE5748A4B89C36330A59E2D49668FC7F25BB8ED21051FA5B2DCAAE904E182C2A5D4A162231BBE31361BC9E7881383++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\secure_search_toast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	4.866147230589644
Encrypted:	false
SSDEEP:	48:HFt9ZorU1Qi58eRls5XwUvgYmsQiAXX8O4nSM9J:lt9ZorU1N5PrAX7vgYmsNAHNaxJ
MD5:	D42DE70EAD6B85BF81400F762E28AD47
SHA1:	9EB5ED0D805BB367AA2E0C36FD57C2A757BA7726
SHA-256:	F924A636455CC635E205206298EDC6A39ECE9B0D755F609D5823B207B0D05B2F
SHA-512:	038ACEF5AF3DC15EB41B2941A9995E4FA4F0760126275BB8B21D7028AB5CF53D7C85011FABEE906D6940DF1A036F3E9CF5A08F8520DCAE407400E1415252CEB8
Malicious:	false
Reputation:	unknown
Preview:	var Secure_Search_Toast = function(){.. this.elements = {};.. this.elements["category"] = "SecureSearchToast";.. this.elements["action_type"] = "default";.. this.elements["browser"] = "default";.. this.elements["provider"] = "UNKNOWN";.. this.elements["toastType"] = "RegularToast";.. this.elements["metadata"] = "default";.. this.elements["response_time"] = "default";.. this.elements["toggle_count"] = "-1";.. this.elements["_event_name"] = "Secure_Search_Toast";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.provider = function(val).. {.. this.elements["provider"] = val.toString();.. return this;.. };.

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\securesearchstatechange.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	714
Entropy (8bit):	5.313033001513417
Encrypted:	false
SSDEEP:	12:6DbtRkb6KaiBXBiE0L+nAK+gUc6N+l5sxg0XE5I3B4M/Gtz7tKJytF9Hni6N:6Hk2DUAfPc6N+lus5IGMCgJytF9HP
MD5:	6C790EE1BBD15697BD9FD15556615572
SHA1:	07F686335F2C45B4BEF2E5CD3F796E79EA9C7233
SHA-256:	E0B1033303C13C6B7B60925F49CDCA256C4AA810CE213CF834AEBE7ED4256913
SHA-512:	2072AE48216734D54FEC4E1A8B78E3AB2BD87655F8ED62434DB1C2A171D45C19C7D32A1634C91D8FBC515E1C606DEC1AAAC6A351E31FF52BA0AC07BF4963E88E
Malicious:	false
Reputation:	unknown
Preview:	.LJ..............-...L...................-...L...................-...L...................-...L................4...6...-...B...=...6...-...B...=...6...-...B...=...6...-...B...=...'...=...6...9.......9.......B...L............encode.json.core.SecureSearchStateChange._event_name.prevState.browser.newState.tostring.category.........4...'...'...'...'...3...=...3...=...3...=...3...=...3...=...2...L.....Serialize..prevState..browser..newState..category.UNKNOWN.SecureSearchStateChangeb.......6...'...B...4...7...6...3...=...6...2...L.....new.SecureSearchStateChange.core.json.require...//0C3C3DDF3F0FC3F6FBC8884FEB865996BF278AFFD8663547A9012EE1665E259922E0F3DD956DEED7C6E84FDC1DB29871251A17220A14ECB8C041CFF5A2887BC6++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\survey.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	4.894292692007079
Encrypted:	false
SSDEEP:	48:ltgxDUQUWUVBUiUyJUiUs83NsxnudV7gyEUQneGqJVC:ltgxDUQUWUVBUiUgUiUf3NsxnudV7gUk
MD5:	FC02B4F0AD63BE92359E9162F9A2787A
SHA1:	8F2E07F1600159834535DCC74C7C7AB9FDCC6DEF
SHA-256:	0AB1D628730DFA2C0384AD750944F213012F01166C990A1E6EB1A52FC44C3AF1
SHA-512:	15CE821107930A9A14DB9C943FD7765D57B8E2261E1002F7F0CC7B39EC0165A06C38B66AC2F8D6FB07C436C168C604F4DE805B0B22DBB8B6A55ABB159DE20EC0
Malicious:	false
Reputation:	unknown
Preview:	var Survey = function(){.. this.elements = {};.. this.elements["name"] = "Survey";.. this.elements["survey_type"] = "UNKNOWN";.. this.elements["selection"] = "UNKNOWN";.. this.elements["experience"] = "UNKNOWN";.. this.elements["showTimes"] = "UNKNOWN";.. this.elements["interaction"] = "UNKNOWN";.. this.elements["payload"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "Survey";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.survey_type = function(val).. {.. this.elements["survey_type"] = val.toString();.. return this;.. };.. this.selection = function(val).. {.. this.elements["selection"] = val.toString();.. return this;.. };.. this.experience = function(val).. {.. this.elements["experience"] = val.toString();.. return this;.. };.. this.showTimes = function(val).. {..

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\survey_ui.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1355
Entropy (8bit):	4.927973801191775
Encrypted:	false
SSDEEP:	24:HYLtFiUM6OUxDUcPQMkQMsamQcM/cxPcM6qNXcxeccLQLrcKFZ02Ac:GtFiUiUxDUSGsTLxUONsxnW5Kn0w
MD5:	04FBFDED6873A8D16FBE6BA50E1DCC50
SHA1:	2C627DFE2F5CC65DD275C54A34D0A6AEEADD9765
SHA-256:	76145A7A4A2B8030121E2AE9C89902AFA2BCC73E57E33792C3EAE8B615A81D67
SHA-512:	B54F42A2583C020BFAAF159C7FC4B2D59ACE21A09E3819B7B292B04CF66CA5DD9A299266CAA94DE37B1FE0F280580E1CA00C4C0794AF18B290628BF05CD70779
Malicious:	false
Reputation:	unknown
Preview:	var Survey_UI = function(){.. this.elements = {};.. this.elements["name"] = "Survey_UI";.. this.elements["interaction"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["survey_type"] = "UNKNOWN";.. this.elements["selection"] = "default";.. this.elements["scenario"] = "default";.. this.elements["_event_name"] = "Survey_UI";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction = function(val).. {.. this.elements["interaction"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.survey_type = function(val).. {.. this.elements["survey_type"] = val.toString();.. return this;.. };.. this.selection = function(val).. {.. this.elements["selection"] = val.toString();.. return this;.. };..

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\toastcheckcompleted.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	5.078863284049842
Encrypted:	false
SSDEEP:	24:dLtUM6OUc7UdrUsMchPcM6mFQccLcd7FZU5D:JtUiU+U9UsRhUyLFnU5D
MD5:	0A038736A0BDAD849ABFC68546BF7819
SHA1:	2F0BD42826659AF0BD93CE26524B34A501311A7A
SHA-256:	10B4624F885A33CD0B9965E8A6316033C343D4385FE3C3AC98CB6DC2D0423644
SHA-512:	5C673433043544E674E266C13A256C8BB62D907FE7AB22C5A8151C4B1D215705E68FD68D14770C077F4025F3D0C89DC340737750E29A171ED749819B2B57F8E0
Malicious:	false
Reputation:	unknown
Preview:	var ToastCheckCompleted = function(){.. this.elements = {};.. this.elements["category"] = "ToastCheck";.. this.elements["browser"] = "UNKNOWN";.. this.elements["triggerType"] = "UNKNOWN";.. this.elements["count"] = "UNKNOWN";.. this.elements["_event_name"] = "ToastCheckCompleted";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.triggerType = function(val).. {.. this.elements["triggerType"] = val.toString();.. return this;.. };.. this.count = function(val).. {.. this.elements["count"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//5CB3BE8D6D1103DBE43DFC3F29ADC636BADB55A26AA016BF5B11E7B80A76873005DD83837899277701AD146301B48C60750F8

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\toastcheckcompleted.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	691
Entropy (8bit):	5.372227706729409
Encrypted:	false
SSDEEP:	12:6DbtRkb6KanBXBiE0LZW+tLVeS5sxg055qwIB4M67tK28xbb8Ga:6Hk2DmtZhuB5LM328xbb8R
MD5:	27182092AEAA581D1C142F1E0CC44060
SHA1:	B74215F78631DA55AE86F3530E7AB78D69AB2712
SHA-256:	79182DD4A9D77CF0ADAEE39F6D80CD71E90C90B8C0A8A6208BE70EC5FF6BA368
SHA-512:	07665CDBF2DAD14F1EE3B973A4F153BF5F517CBCECFAC8C1A270D2463BF368DF98E85E029FC4A8A653A26FDECE06F4ED566B9E113027CE33C8BF49B4C17AEAD9
Malicious:	false
Reputation:	unknown
Preview:	.LJ..............-...L...................-...L...................-...L...................-...L................4...6...-...B...=...6...-...B...=...6...-...B...=...6...-...B...=...'...=...6...9.......9.......B...L............encode.json.core.ToastCheckCompleted._event_name.count.triggerType.browser.tostring.category.........4...'...'...'...'...3...=...3...=...3...=...3...=...3...=...2...L.....Serialize..count..triggerType..browser..category.UNKNOWN.ToastCheck^.......6...'...B...4...7...6...3...=...6...2...L.....new.ToastCheckCompleted.core.json.require...//A273A5315B579A40BFA7EE0D74F5570524400B254EF12385867A025C61DA7FB260748DBA8F44163460C1217FD698492694E6043D5D0657278CEE5C1A5F03CBE7++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\toastchecktriggered.luc

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.370799319235948
Encrypted:	false
SSDEEP:	12:6DbtRkb6KanBXBiE0LZkUo+tLVe0yrroqwIB4MeUi7tKcVcpOkTgjxfHY17VYUDe:6Hk2DlU9tZywLMeUv9AaIHC7VYse
MD5:	1478AE15609A028A4962A83F51B2F889
SHA1:	76F3B070A2E7A18CEDCE0ABB0015B4AEB41E1D08
SHA-256:	FAE99FC1CCF4CB15D14FD98950A3E87B463146413526EBB6AA54C25B4B44B0B6
SHA-512:	BB1520EA04B9EECD399B46AA06EB640F6FFBCD4A636268196EE96561D7ACBDA2791402E90D6569155CC6C37DCB51B450CEDF56CC8368A3894204C70DBC0DA06C
Malicious:	false
Reputation:	unknown
Preview:	.LJ..............-...L...................-...L...................-...L...................-...L................4...6...-...B...=...6...-...B...=...6...-...B...=...6...-...B...=...'...=...6...9.......9.......B...L............encode.json.core.ToastCheckTriggered._event_name.count.triggerType.browser.tostring.category.........4...'...'...'...'...3...=...3...=...3...=...3...=...3...=...2...L.....Serialize..count..triggerType..browser..category.Started.UNKNOWN.ToastCheck^.......6...'...B...4...7...6...3...=...6...2...L.....new.ToastCheckTriggered.core.json.require...//DB9A0FF7C37F00E3166DD553C062BB88C90602770199F7960B2EEC270EF0A54D3C21FAC405EE0674D56658E9A95C6AD5634B3D339A5446A8EFA3BA814B4DF0DE++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\user_welcome.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	855
Entropy (8bit):	5.09899205467336
Encrypted:	false
SSDEEP:	12:PJH1WJwqwsETwzyAdYETwM6RETwsbMWmQbwRo5AJbwzyAd1oBPbwM62ogFwfwtrU:PbLtRUbUM6OUsfmQcMIc+PcM6cFZkGs7
MD5:	242DE790F10E221CFD4F91D27D9A341D
SHA1:	BE59936901B8EDF61CDA23D30B98BE49F30D6D0D
SHA-256:	067F71BC6D7CC2D2CE85771B0766E8602DB8ADDDC6A187C78019DCCBDA31C1EF
SHA-512:	BBF694E9989738A7C42DC17DBAC2445BD792D107044D81F856B8071D3FF61BF1430C438FE1CC84664B678E9E6FFB84EE2D80B5BD8C668DEFC7AEB30A080D824D
Malicious:	false
Reputation:	unknown
Preview:	var User_Welcome = function(){.. this.elements = {};.. this.elements["name"] = "UNKNOWN";.. this.elements["interaction_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "User_Welcome";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//B640E262078A7FB18EEC4316F5EB7426599E82A0790B148C0B5EA99D7AAAC419040FCF4C9DD7587301323630B217443A70F0EE38D5F064C371250234BA8BCD10++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\webboost_upsell.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	871
Entropy (8bit):	5.0861911425915585
Encrypted:	false
SSDEEP:	24:gTLtTFEL5M6OUsHFCmQcMIc+PcM6cFZTh/enE:gftT+L5iUsHFg+UQnl
MD5:	E4B60E95146066C85BBCA4A9FD4D700E
SHA1:	58F808A79615E2BDCF5EB9040DFCA8D61DD9EE6D
SHA-256:	841A932CBE059B97C9B3F3E2F018E832E4AE37406563706F7CAEA6EA6C7D53B6
SHA-512:	10B355A3F88E2B605DA07D4AB4F44D987ED3A041CE4F603BC0F1009A9C73B2BBB7A92FB4768EAB601BDB8510270C0E3834C215DCF4628F9F6E45184BEC114A87
Malicious:	false
Reputation:	unknown
Preview:	var WebBoost_Upsell = function(){.. this.elements = {};.. this.elements["name"] = "WebBoostUpsell";.. this.elements["interaction_type"] = "Impression";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "WebBoost_Upsell";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//0137FF8C3CC3358809560EE97A79C79C6828DADFA10210F59787270EB75675DFD3C9A52D0BE4BB8E791F2B2F66B769827486DC851278396C41444C46BFACB99A++

C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\wssatpassisttoast.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1867
Entropy (8bit):	4.881326525476856
Encrypted:	false
SSDEEP:	48:pFtdVUiUOU71U0DUmUjrUsTXwUi37mId1j7ny:TtdVUiUOUxU0DUmUjrUaX7i3yId1jzy
MD5:	8C453DFD17366776C451A5198A65EC33
SHA1:	4D1AD60BD8515FFBAEF64D7BF659C857C68EBB62
SHA-256:	48D3A924C6E5A31586764DE7747C4D6098C0F0CF40EAEC3B7EA986B74C807045
SHA-512:	66D7505492D067AE14F944FA20D24E3D18FB466A3ED5645B42B634F698637EE77D0383898CEAE0A0CBB6572553BDE73111BB30F0AB7C57119C5CB2D50F524FEB
Malicious:	false
Reputation:	unknown
Preview:	var WSSATPAssistToast = function(){.. this.elements = {};.. this.elements["category"] = "WSSATPAssistToast";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["counter"] = "UNKNOWN";.. this.elements["threshold"] = "UNKNOWN";.. this.elements["product"] = "UKNOWN";.. this.elements["variation"] = "UNKNOWN";.. this.elements["trigger"] = "UNKNOWN";.. this.elements["url"] = "UNKNOWN";.. this.elements["_event_name"] = "WSSATPAssistToast";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.counter = function(val).. {.. this.elements["counter"] = val.toString();..

C:\Program Files\McAfee\WebAdvisor\uihost.exe

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	858176
Entropy (8bit):	6.486858378721303
Encrypted:	false
SSDEEP:	12288:lMPwwvquKhovuPMoL3Yk5o0Qct+w+1uUpHTxQ3sT+UMcpV/JJcf27ihMZoCI1wVa:lvSFKg2sZMcpV/JKyi0PI1wCVL1
MD5:	D1BEFCFE26C5C2132BDABBF332306004
SHA1:	93BD6C3FA4F87278BE0A41E7EFF3263B362609E7
SHA-256:	C004F670B0A30E68D1FA49061C0014847D19A88CEFDC3A51BDBCF5BB300F11C6
SHA-512:	126D60B502DDAB1039A9457FC3E6B52049019BC8DBFAC0566DB0513BC9A04E142F5CBC6623F3AB121A0D6FF04FE94CBAC18203989390DF63E571538C97E03FC7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..g0..g0..g0...3..g0...5.Ig0...4..g0.Y.4..g0.Y.3..g0.Y.5..g0...5..g0...1..g0..g1..f0...9..g0......g0...2..g0.Rich.g0.........................PE..d.....>f.........."....$.F..........@..........@.....................................A....`.....................................................x....P..p.......t.......@....`..@...<...p.......................(.......@............`...............................text....E.......F.................. ..`.rdata...S...`...T...J..............@..@.data...@........D..................@....pdata..t...........................@..@.didat.......0.......l..............@..._RDATA..\....@.......n..............@..@.rsrc...p....P.......p..............@..@.reloc..@....`.......t..............@..B................................................................................................................................................

C:\Program Files\McAfee\WebAdvisor\uimanager.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5406424
Entropy (8bit):	6.528801066295422
Encrypted:	false
SSDEEP:	98304:3D12ZAweoykRLDXap8Bgh7HMOfx0xpEmQM:zwZXRLDXaWBgh7s2x1M
MD5:	2A9466B91B587E3F6F0EFC307D7A7571
SHA1:	C3D8AA51FD4DFF7A1C66D3384AF18B3CAEEF61E7
SHA-256:	BBFCACBF4203D7A69FB94F46D35B08ED216B5F4C9329F95B69099DE6AEBED49B
SHA-512:	1244B06987D64FF3DF0064DE1A345783E2C1BAA0486B9C8E06A4E6D292A6972E25476DBFD69D3C00ACF72C4D8B279FAC41A09C560AE28592F99F350F3082B019
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$...............................@.......@.......@........................h......#............................... ..........................5...........................Rich............................PE..d...q.>f.........." ...$..<..<........3......................................pT.......R...`A..........................................K.<.... K.......S.P.....P.......P.......S.(...\|UG.p....................VG.(...0.C.@.............<.(... .K......................text.....<.......<................. ..`.rdata...[....<..\....<.............@..@.data....8...PK......>K.............@....pdata........P.......M.............@..@.didat..H.....S......$P.............@..._RDATA..\.....S......&P.............@..@.rsrc...P.....S......(P.............@..@.reloc..(.....S......,P.............@..B................................................................................................

C:\Program Files\McAfee\WebAdvisor\uninstaller.exe

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2772760
Entropy (8bit):	6.529357700123426
Encrypted:	false
SSDEEP:	49152:m8mQnkpPjye5ry5Lj3uqJfnhpM6c37BSBquZba:lnkpLry5LjpnzbcrXuZ
MD5:	19DF152A109B3ADA309DF4D746EFF367
SHA1:	07A64B74CB760F990F1ECFA26BA97C3A54C2DC96
SHA-256:	D7CC8F1D662E0ABAAEEE5B0FC7783C98C726CBFFE6D3175FD7BEACC2DA148BFB
SHA-512:	B20CE372AC1D928D28FAB9CC79728B1B75DFAB09EBCE8C5B961F29ADFDE5E6E456CD4607E72DE5BCF76DC1A9197551A5505D4440738ED2BD684B724B8FB71D2D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......c.;1'bUb'bUb'bUbl.Vc0bUbl.Pc.bUb..Qc4bUb..Vc+bUbl.Qc.bUb..Pc[bUb=.Pc&bUbl.Tc0bUb'bUb&bUb..QctbUb'bTb5`Ub=.\c\bUb=.Uc&bUb=..b&bUb'b.b%bUb=.Wc&bUbRich'bUb........................PE..d....~>f.........."....$.....d......p..........@.......................................`.........................................@1 .(...h@ .......#.@.....".0A...@)......p..,...8..p....................9..(......@....................& .@....................text............................... ..`.rdata...t.......v..................@..@.data........p ......X .............@....pdata..0A...."..B.... .............@..@.didat.......`#......&".............@..._RDATA..\....p#......(".............@..@.rsrc...@.....#......".............@..@.reloc...,...p*.......).............@..B................................................................................................................

C:\Program Files\McAfee\WebAdvisor\updater.exe

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2716008
Entropy (8bit):	6.572287125590082
Encrypted:	false
SSDEEP:	49152:B0b29tvWPbHy9CMjaVp1tb2LEeQBx0UQ8m1spEp5ysfnB:/9YHoCMjaVzg8mKpY
MD5:	D9EF75352B044EB8FBB7DC0EF93E7052
SHA1:	58725605F77B86534B4FA34450C4840DDFAD65FA
SHA-256:	724D118CADD47500AD7752C4E0AB3DF25542458238A7B91D5B4DEB86F2C37FAC
SHA-512:	606DB594D881200A89B7C6030FAD3E07C3920CC7B59B1DDE3112859D26413D427D61E6A5AB5F87BFE8F2631EC27CC9B2F22C021544B0D1503F0013D6428853D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......u%..1D.\1D.\1D.\z<.]&D.\z<.].D.\.:.]"D.\.:.]=D.\.:.]FD.\z<.].D.\z<.]&D.\+;.].D.\1D.\0D.\.1.]bD.\1D.\.E.\+;.]ZD.\+;.]0D.\+;.\0D.\1Dr\0D.\+;.]0D.\Rich1D.\........................PE..d....}>f.........."....$.......................@..............................).....w.)...`...........................................$.$.....$.......'......0&..<...f(.h....`).4)...K".p....................L".(....a .@...............X.....$......................text.............................. ..`.rdata..............................@..@.data...Le....$.......$.............@....pdata...<...0&..>...4%.............@..@.didat.......p'......r&.............@..._RDATA..\.....'......t&.............@..@.rsrc.........'......v&.............@..@.reloc..4)...`)..*...<(.............@..B................................................................................................................

C:\Program Files\McAfee\WebAdvisor\wa-ui-uninstall.js

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10214
Entropy (8bit):	3.9178210410024463
Encrypted:	false
SSDEEP:	192:/QL4RLAq8F9BeGgTcNPRzNPx6RlrC052h3:P1Ii2V
MD5:	DA6B610074FF870DF6BEF5351D7CA8E1
SHA1:	9DAF13E8CD2E82C06F7CFC7EFD6FCE0FAC3932E6
SHA-256:	8437CAF7C143E32A822E22935E3D689DB0AD930E65F5DD06F8946E8063E155BB
SHA-512:	2E8F4FED807E46568808FE718561D9A6E82973065AFA31E99465F3962511829AE58FDC18E268EBD617E984A5936E55E7518A6C02AE1CD518D9B30A9B63D3EEFF
Malicious:	false
Reputation:	unknown
Preview:	/* Uninstaller UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI \|\| {},.. _instrument = wa.Utils.Instrument,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.UNINSTALL).get,.. _core = wa.Core,.. _window = _core.Window,.. _webAdvisor = _core.WebAdvisor,.. _productNameHtml = _webAdvisor.getProductNameHtml(),.. _data = _core.data;.... ui.Uninstaller = function () {.. var checkProgressInterval,.. checkUpdaterInterval,.. checkUpdaterNumRetries ,.. buttonOkId = "wa-uninstaller-button-ok",.. buttonCancelId = "wa-uninstaller-button-cancel",.. buttonCancelCss = "wa-button cancel",.. buttonOkCss = "wa-button ok",.. version = _webAdvisor.getVersion(),.. el = {.. $header: $("#wa-uninstaller-header"),.. $content: $("#wa-uninstaller-content"),.. $footer: $("#wa-uninstaller-footer")..

C:\Program Files\McAfee\WebAdvisor\wa-uninstall.css

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3354
Entropy (8bit):	4.82572822613824
Encrypted:	false
SSDEEP:	96:UKQqFbbgRjujt6whhzIr3EXNkd9ZcRx1+zRMJ9NDG4lzD+v8:FxFb8Rjujt6wr8r3EXNkFcRx1+zRMJ9H
MD5:	8B320241397D098AACB37ACBD8E25B3D
SHA1:	9F2A93A3FEB193DBE14FB43C47BFD40B0408CCD8
SHA-256:	FCF79DA4D417987F10F530E511B015620721E2B2A3799C297595D6AAE8EF51A4
SHA-512:	ECDAE1839B8B520838A141441DDA4ACE1FD3DEF27DB6676EBA5740AA44273DF09231B52BED3F7A790CCC017A06680CB687B1D896B2BAC1CAF7579D5B0CC9587D
Malicious:	false
Reputation:	unknown
Preview:	body {.. background-color: #ffffff;.. overflow: hidden;..}....#wa-uninstaller {.. width: 600px;.. height: 473px;.. border: 1px solid #BAC6EA;..}....#wa-uninstaller-header {.. height: 48px;.. display: table;.. width: 100%;.. background-color: #F5F6FA;.. border-bottom: 1px solid #BBC7E7;..}.... #wa-uninstaller-header > div {.. display: table-cell;.. }.... #wa-uninstaller-header .title {.. vertical-align: middle;.. }....#wa-uninstaller-header-close {.. float: right;.. position: relative;.. top: 12px;.. right: 12px;.. cursor: pointer;..}......#wa-uninstaller-content {.. margin: 24px 30px 0px 30px;.. color: #404040;.. font-size: 12px;.. height: 67%;..}....#wa-uninstaller-start h3 {.. font-size: 16px;.. font-weight: bold;.. color: #53565A;.. margin-bottom: 5px;..}..#wa-uninstaller-start h5 {.. font-size: 14px;.. font-weight: 400;.. color: #53565A;.. margin: 0px;..}....#wa-uninstaller-st

C:\Program Files\McAfee\WebAdvisor\wa-uninstall.html

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	5.270909527295211
Encrypted:	false
SSDEEP:	24:csY0TEL0GNVMz7jVMz7EVMz7VMz/VMzlLVMCdLG7OLG3LGt1LGzQMw8Qb:3XTEL0Sv265iCdLG6LG3LGt1LGzQMZQb
MD5:	82B24C6C9E8BF7C4ABCB6E696062E07A
SHA1:	2ED0BB97030493B7F43DD1370782974976433D97
SHA-256:	7EF680996011424FD257BBBB59FB4242A53DA47F90B3B9701E5BDB54141F68AB
SHA-512:	8CCB6BF59F64F6BA86474D95542D02CA639BC78C24691FE59AAC4B52BEE63174A0FE7E890B406BF03ABAE92CEAD6AB8BD947EF303B8EA832BD4866289AE5C4EE
Malicious:	false
Reputation:	unknown
Preview:	.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-uninstall.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-uninstall-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:wa-ui-uninstall.js"></script>..</head>..<body>.. <div id="wa-uninstaller">.. <div id="wa-uninstaller-header"

C:\Program Files\McAfee\WebAdvisor\wataskmanager.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3588080
Entropy (8bit):	6.554888495920594
Encrypted:	false
SSDEEP:	49152:7YK6qU7x7u0GZhw1HRb7/WZBmdsLdiGjf9oAPq8YHb/2Yh1syMR0/J3Pod:+wZhwv7tVCRY7eq1sy/J
MD5:	D74143B2FD3DB8F9407D36D0C1B5F8BA
SHA1:	93042E422794847FE8338E25A9BEA72BF929E643
SHA-256:	218FD9724A74DD5A9D9A73D04CC990DA7C9E47B23B4D86E267616558B77F7288
SHA-512:	095FE97B1427B9705423BDEE13BDA7FEE22121A1BB2E3FEC5F89C0D15639FBF977184573E08C98489B605846F7E6815660DCC27E730D38C5054D8A6AB4EB04A0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$...........................y.....y..................,.................y.............,.....................................s..........Rich...........................PE..d.....>f.........." ...$..'.........0w".......................................7.......6...`A..........................................1.T...D.1......@7.`....@5.,....z5..E...P7..^...Y/.p....................Z/.(.....,.@.............'.@.....1......................text....'.......'................. ..`.rdata..^L....'..N....'.............@..@.data...,#....2..<....1.............@....pdata..,....@5......83.............@..@.didat....... 7.......5.............@..._RDATA..\....07.......5.............@..@.rsrc...`....@7.......5.............@..@.reloc...^...P7..`....5.............@..B................................................................................................

C:\Program Files\McAfee\WebAdvisor\webadvisor.ico

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	99892
Entropy (8bit):	3.9749743269785345
Encrypted:	false
SSDEEP:	768:JLBqG5eVRjB/jZRj0t4kgU1l50AIDP88+2Y:JLBh5eWgU1B8+2Y
MD5:	236FC5ABB597615A608DAB7BE98D5FBC
SHA1:	18D3D1CF56898B264A24DE24DC13E4B9B7EED768
SHA-256:	06ADAB20CB028B5DC61762691E8C8A6157EB1199526F7C773338B9BF51BD63C6
SHA-512:	155766AA5659BB9E298AEDE4064832168002EEDEE836710C2259446FC35437AD70C04454DEF2D9EB40A83A029351EA1726D65ACBDB8FE8217C016FD4986F7F4E
Malicious:	false
Reputation:	unknown
Preview:	......00......h....... ......................(.......00.............. ......................h...~"........ .n....'........ .(...TC..00.... ..%..\|K.. .... .....$q........ .h......(...0...`...........................................................................................................p......................9Yx...................yyy9Y..................yyY.yy57...............s.....y.yy.............y9Y9Y5..9y.w.............9yyy.....................y.9qy....yy5............yyy.yqy.y.Y9yp...........y.xy....9yyY5....yY9.y.9.......yq....p....9yyqqyp......y.yy5.p...YyY9..p.......yy9Y.Y.........p..............p...Yyy.p...............p...99Yw............y9S.0...................yy..p....yY8............yyS.p...y9y.............y1......y.Y8............yYy.p...................y9yyp...................yyY.p...yyy.............y9yq....9Y.w............yyY9p...................y9yYp...................yyY9p...................y9q.....................yyYyp.......................p.............P.....

C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.chrome.extension.json

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	676
Entropy (8bit):	4.824937383394461
Encrypted:	false
SSDEEP:	12:ShnHvOaKiUlLAjxOw+aJ/0u74odpE5vvi7B4BLpMZhNl/PKqlKuV:ShnPOaKioAjxEaN94MpEJq7SBlMZ79oi
MD5:	D4525EEF75A5ED31DD1463E94E63EE32
SHA1:	9D2B35EF3800BF1CD34F6AFE03EDF1B02F75B7EA
SHA-256:	E8BE10CE45725068D0B6F7B90C1F86C90B0F949B9FB4229CF9EE4A82DF9980E8
SHA-512:	E92548F4F2B49138BEFE5800DD459F0A9DB3062B32661D98BD9E393D2510E9B41822ABCA3FDF179A7EBCA6B8899E0634B668FDDD1D1A1E67D8A5876F11C85D18
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "siteadvisor.mcafee.chrome.extension",.. "description": "Chrome Native Messaging API Host",.. "path": "BrowserHost.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://fheoggkfdfchfphceeifdbepaooicaho/",.. "chrome-extension://klekeajafkkpokaofllcadenjdckhinm/",.. "chrome-extension://enppghjcblldgigemljohkgpcompnjgh/",.. "chrome-extension://mfifoblohohmjoaiclakcbicbeklikgl/",.. "chrome-extension://kanjcmmieblbpbihaafnedamppkhfadn/",.. "chrome-extension://jhnkplodgdopckiblgedcpoidpgcdbfi/",.. "chrome-extension://bgdpakbfhblhpnbhhajplljnioenlpnk/",.. "chrome-extension://hkflippjghmgogabcfmijhamoimhapkh/".. ]..}..

C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.firefox.extension.json

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.199984426997364
Encrypted:	false
SSDEEP:	6:3FHWb4FPe8e/ihvqbRVnRUvFFwF1pl8q96DJqHmAf2U2LhGdFm/dwwuEYOi:1Hi7Gv6iK1re/3dwwBi
MD5:	ED06108D883C1FFED6910F55AC4A5A3D
SHA1:	7974E1658801A128A23C0B2737545F2AB5C5F3F2
SHA-256:	B659E0167E9CEBFB8A031F259D840577B3897ABF3E91C2ABBE3E8F947598FF47
SHA-512:	075F93DE9A8065B939BD947D23F2D3F1EA793AFA492CA030B0B24C4FB223F85846A37DF908ED5DD08987AFFA60AB3ECB6ACA512C777F05E9DD7849976868D6E8
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "siteadvisor.mcafee.chrome.extension",.. "description": "Firefox Native Messaging Host",.. "path": "BrowserHost.exe",.. "type": "stdio",.. "allowed_extensions": [.. "{4ED1F68A-5463-4931-9384-8FFF5ED91D92}",.. "{DFC8025B-FC38-42B1-9E3A-DFA474F33D93}",.. "{C1DB8E20-28BB-4222-8020-FB40187BA1A6}".. ].. }

C:\Program Files\McAfee\WebAdvisor\webadvisor_v2.mcafee.chrome.extension.json

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	675
Entropy (8bit):	4.830153549273225
Encrypted:	false
SSDEEP:	12:JaWhnHvOaKiUlLAjxOw+aJ/0u74odpE5vvi7B4BLpMZhNl/PKqlKuV:JaWhnPOaKioAjxEaN94MpEJq7SBlMZ7R
MD5:	B09DB140B1A6360DC1D7F6BCF9D85B22
SHA1:	09839EFA3B9055D51BFE566E9F5F8B7529B085D2
SHA-256:	395D1298C7E5A9D6A7F45A0A84F89A0652DE890F202812FE3EF0DA830F24A98C
SHA-512:	F1539E728D9F7DB8870CE58D2B4C49431DB288DD4D26D3C3D52374BB1B856001E8BF541650CF77813308060EDC57939E35E0B21D99EE18F0D2681FE052E91145
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "webadvisor.mcafee.chrome.extension",.. "description": "Chrome Native Messaging API Host",.. "path": "BrowserHost.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://fheoggkfdfchfphceeifdbepaooicaho/",.. "chrome-extension://klekeajafkkpokaofllcadenjdckhinm/",.. "chrome-extension://enppghjcblldgigemljohkgpcompnjgh/",.. "chrome-extension://mfifoblohohmjoaiclakcbicbeklikgl/",.. "chrome-extension://kanjcmmieblbpbihaafnedamppkhfadn/",.. "chrome-extension://jhnkplodgdopckiblgedcpoidpgcdbfi/",.. "chrome-extension://bgdpakbfhblhpnbhhajplljnioenlpnk/",.. "chrome-extension://hkflippjghmgogabcfmijhamoimhapkh/".. ]..}..

C:\Program Files\McAfee\WebAdvisor\webadvisor_v2.mcafee.firefox.extension.json

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.221057694206649
Encrypted:	false
SSDEEP:	6:3FHWEas4FPe8e/ihvqbRVnRUvFFwF1pl8q96DJqHmAf2U2LhGdFm/dwwuEYOi:1HZaW7Gv6iK1re/3dwwBi
MD5:	49D8FD2B7CDD52D1CD2F2F3F019A597D
SHA1:	62548306CE140C5336570EB02D4AF566121CFC65
SHA-256:	B114F82CBCB910A1F282E823266801468571F3F2DB9802AFFD3C758F933CE9C2
SHA-512:	3F9FA7C2D56A3BA12690D1D2107FC12D66CC6294D0C1A5003221E4B7A6C6481197BFD05CDEFFDE09F2D2AEF55132CE8CBEB40953AD25A96BF40675907FE68B16
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "webadvisor.mcafee.chrome.extension",.. "description": "Firefox Native Messaging Host",.. "path": "BrowserHost.exe",.. "type": "stdio",.. "allowed_extensions": [.. "{4ED1F68A-5463-4931-9384-8FFF5ED91D92}",.. "{DFC8025B-FC38-42B1-9E3A-DFA474F33D93}",.. "{C1DB8E20-28BB-4222-8020-FB40187BA1A6}".. ].. }

C:\Program Files\McAfee\WebAdvisor\win32\downloadscan.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3060712
Entropy (8bit):	6.7809760106128545
Encrypted:	false
SSDEEP:	49152:UCO7YmPHylVj3myfphYVoY5GOb1yv4nzwrD05xtnew54/3vZnBDKg/F86bBt1TAv:Ut06HI13RfoS+rFxtx+3Xfs
MD5:	DAEB30ACFABE42C4815D04673D167B63
SHA1:	23BA3E0CF2BCA87AB6A984A9D2F846BF5832E1B2
SHA-256:	F6BCA637D5CF3D5EBA4C9B48B6825EBD8A0F324A59B70D756E153B6585666CA7
SHA-512:	5678CE77B1B73EB0FBEB96CA305B411B4AD7B2C4A5FF78370C9F216DBED36386FFE6411328DDBD6476965C7ACD89B4BC7C15DE9354EE98C5B4F88D9968630440
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........8.w.Y.$.Y.$.Y.$.!.%.Y.$.!.%UY.$;'.%.Y.$;'.%.Y.$;'.%.Y.$.&.%.Y.$X,.%.Y.$[,.%.Y.$.!.%.Y.$l.%.Y.$U,.%.Y.$.!.%.Y.$.Y.$FX.$.&.%.Y.$.&.%.Y.$.&S$.Y.$.&.%.Y.$Rich.Y.$................PE..L... .>f...........!...$.."..,................".............................../......./...@A...............................\|........-...............-..!....-.@.....).p...................@.)...... '.@.............".............................text....."......."................. ..`.rdata........".......".............@..@.data.... ...........*.............@....didat..`.....,.......+.............@....rsrc.........-.......+.............@..@.reloc..@.....-.......+.............@..B................................................................................................................................................................................................................

C:\Program Files\McAfee\WebAdvisor\win32\wssdep.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	662504
Entropy (8bit):	6.664375265298234
Encrypted:	false
SSDEEP:	12288:D1btYO+v7ftQNF8XpEB3iePkNEoj+rgSfshPyMjEmjM0ZQ15E:Rb3g4oj+pMjEmw0O3E
MD5:	29D2C8DF586879A81D8B4E21C1916A4D
SHA1:	221EE1EB754113636BDACD00A18F9E59661F4EBC
SHA-256:	CE6D31F4CA28D5EDE624FD724E8A99CFB47776391A4339090B1ABBBF7A0BE4D8
SHA-512:	7CDBC57D37DB1468960F871F55E639FEEE954661E0D159A38ECCEF6C2270606E32AD49779FE409EDE69CAE960FCFBC52E309115D7796A27FFAE914A256377130
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......#..~g.-g.-g.-<..,h.-<..,..-V.}-e.-..}-f.-5..,?.-5..,w.-5..,~.-..,f.-<..,..-<..,w.-s..,e.-..,k.-...,h.-g.-B.-..K-b.-.,f.-.,..-...,j.-...,f.-...-f.-...,f.-Richg.-................PE..L...x1.e...........!......................... ............................................@.........................P.......(........p..@........................^...A..p...................@C......pB..@............ ...............................text............................... ..`.rdata..V.... ......................@..@.data....Y.......@..................@....rsrc...@....p.......8..............@..@.reloc...^.......`...<..............@..B........................................................................................................................................................................................................................

C:\Program Files\McAfee\WebAdvisor\x64\downloadscan.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3484392
Entropy (8bit):	6.545556365357322
Encrypted:	false
SSDEEP:	49152:7IxMdBZq+DEOrOVE3fuJmCRhd+43jN52BA7kAr9S7oilYb4Jud74hy36RO:XEOrO1jNYSpilYndq0
MD5:	86DD7104F29B84681116801719336DEC
SHA1:	28493BC9FD3D0A5C8B2F6311F6D061C8286B612C
SHA-256:	4F98836C41B72B529C5B14E3001F71A1100772BAE5392803176EBCAB8FBD6C7B
SHA-512:	5179913F8AD2CE23276CBCC387A3789F02F824D59FABA1CC8F12780C027A63256FA9A356C0A950B697EF0C2EACCD66F064445FDA4952D092617186FC2E7169DE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........e....eU..eU..eU.\|`T&.eUHzaT..eUHzfT..eUHz`T..eU.\|fT..eU.{`T..eU+qaT..eU(q`T..eU.\|aT..eU..`T..eU&qaT..eU.\|dT..eU..dU6.eU.{lT..eU.{eT..eU.{.U..eU.{gT..eURich..eU........PE..d.....>f.........." ...$..&...........!.......................................6......h5...`A.........................................y0......z0.......5.......3.......3..>....5.dZ..l.-.p.....................-.(.....+.@.............&.8...Hu0......................text.....&.......&................. ..`.rdata........&.......&.............@..@.data.........0.......0.............@....pdata........3.......1.............@..@.didat.......p5......~3.............@..._RDATA..\.....5.......3.............@..@.rsrc.........5.......3.............@..@.reloc..dZ....5..\....3.............@..B........................................................................................................................

C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	822640
Entropy (8bit):	6.402981551979998
Encrypted:	false
SSDEEP:	12288:ESMUeSJFVwoykQGh5YHWSGBjfWeVoNErPgd7hFn:ESbRJFBykQ8YHWvFWeVKErPgf5
MD5:	B2985F3137A70B3F64FEE061CCC5F2FC
SHA1:	6AF2342DDC4ACBF308D519C5857EFE3F3733F55E
SHA-256:	2D7698E65AA98EB6BC73BD387B4FE3730F22096907E9D4EDA206BF217BA0A7AC
SHA-512:	246F33DB73132333EF140CCACB3479F38C72698D1BDE960B698ABC8509600A031FED67554DB7B08328FBA6DA3372E0FCC252B11CFA712448B2B69E0D08F3F660
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.........Wm.9>.9>.9>..:?.9>..<?P.9>...>.9>..<?..9>..=?..9>..:?.9>S.<?.9>..=?..9>..8?..9>..8?.9>V.<?.9>r.<?.9>.8>.9>3].>.9>y.=?.9>y.<?..9>).0?.9>).9?.9>)..>.9>).;?.9>Rich.9>........................PE..d...R1.e.........." .................................................................[....`.................................................x........P..@........x......p....`...... ...p.......................(.......8............0..(............................text............................... ..`.rdata.. ....0......................@..@.data...Tt...@...L..."..............@....pdata...x.......z...n..............@..@_RDATA.......@......................@..@.rsrc...@....P......................@..@.reloc.......`......................@..B........................................................................................................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\LICENSES.chromium.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	8851986
Entropy (8bit):	4.750815293212135
Encrypted:	false
SSDEEP:	24576:fUrV6CV675knWSgRiPyQlrUmf1C6C6y6Z6/678HaBMypuO:sfhaw
MD5:	8E263CC42A54CE9A3562008EADE01062
SHA1:	5053B8D240852729C73282C9D2C2BEB3D749D2E7
SHA-256:	6F95E9FF1F5C55233BCB1520C1296A0C7AFF9CB4D864086DA191ACB77E7A068F
SHA-512:	D25652D9F8CA416219DCFD742AE330319386D499C1C70BC1830A68F6F4EB5CB01072C7986157E26C4298D4587AF06D33D0B8C8FF0CEC6069577C418618FB0E4F
Malicious:	false
Reputation:	unknown
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may use, copy, modify this code for any purpose

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	136004
Entropy (8bit):	7.915638220816395
Encrypted:	false
SSDEEP:	3072:TzwJCGIekwc9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Tzw1IekZ42k3yMK18Gb0OV8ld0GecQ35
MD5:	E4CBB48C438622A4298C7BDD75CC04F6
SHA1:	6F756D31EF95FD745BA0E9C22AADB506F3A78471
SHA-256:	24D92BBEB63D06B01010FE230C1E3A31E667A159BE7E570A8EFE68F83ED9AD40
SHA-512:	8D3EA1B5CA74C20A336EAA29630FD76ECD32F5A56BB66E8CEF2BCE0FA19024EA917562FD31365081F7027DDE9C8464742B833D08C8F41FDDDC5BD1A74B9BC766
Malicious:	false
Reputation:	unknown
Preview:	....................;.........x.........e...................V.....P.............i!...#...).....8...;....@...VC....E....G...>J....L...^N....R.....U.....Y.....Z.....[.....].....^....c_....}e.....k....5m.....n....2o..h. p..i.Aq..j..s..k..u..l..x..m..\|..n.&...o.....p.......`.................L.....?..........................................................H.....X...........=...........w......#.........s,.....1.....4....k>.....A.....I.....M....gW....a....e...mg...8p....x....y....{....\|...........................h........l........~........G....u.........h........h....=..........................................c.....7.....................;...............................................f.....B.......................T...........?.....5... ....#.".........H......................................(.....{.........................................................../...........J.................q...........R...........2.............

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	195949
Entropy (8bit):	7.941377697125107
Encrypted:	false
SSDEEP:	3072:ZDQYaE/N6Mrvy/3JPD9W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ZDQYaSN6svydD42k3yxgx5GMRejnbdZR
MD5:	99B95D59D6817B46E9572E3354C97317
SHA1:	6809DB4CA8E10EDD316261A3490D5FC657372C12
SHA-256:	55D873A9F3AC69BBF6EB6940443DF8331EBD7AA57138681D615F3B89902447E7
SHA-512:	3071CFEB74D5058C4B7C01BFE3C6717D9BB426F3354C4D8A35BD3E16E15CDE2F2C48238CB6382B0703B1CC257D87FCECFB84FBF4F597F58E64463CEEDE4366DD
Malicious:	false
Reputation:	unknown
Preview:	....................B...................................$....).....,...T4...8....@...D...AY....n... s....}.......k.........]........D....h.....q.....+..................................).................Q.........h.M...i.8...j.b...k.V...l.[...m.....n.....o.....p.?...........;.............................9.....OH.....R...._U.....Y....?c....He.....h.....m.....x.....z..............3.................S...............o................................&..............&..............&....;....S....n....;..............9....7....$....E....6"...^%...[,...y/...6....>...A...h...i...n....ns.....t.....v.....w.....x.....z.....{.....}.....~....W...........r.....`.....A.....".....:.....@.................%...........>.....b...........w.....K......... .....#.m....g........"........./.....e.....>.................R...................................(...........M...........~.............................y.................U...........S.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4922000
Entropy (8bit):	6.4005523440244385
Encrypted:	false
SSDEEP:	49152:6CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNh:BG2QCwmHPnog/pzHAo/A6
MD5:	FF94158AAE261FEDA9A4E890687EC159
SHA1:	73E18C24C24BBBE4B9A6610449E107340DD5A1AA
SHA-256:	59BC90CFCB01297C5CF55F3B9B64355ABE9B1E8E1BCC91ED6F6F63613E632F48
SHA-512:	3F195D7F3A5D2183F6E566B4CDFF6D02BF79F31C4D6582EA80FBBEA84E0FE903329D8804E77F54FB9ED42429C7395C2DA4B71DADC6F64C31A94273915DB95ADA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....<.L...`A........................................`%G.x....(G.P.....J.@.....H.......J..:....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\ffmpeg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2896528
Entropy (8bit):	6.71818880996116
Encrypted:	false
SSDEEP:	49152:n0h7iln3U9ZzcZ90CvaQL3nm2+hTf6yfPvJr8PNSt2wLlDZMkSf2F:Hnke90dCnmMyMkSe
MD5:	3D5EC97BDBBA444EE7D32A654000639B
SHA1:	674978EC1A6A0651A8530C5C38773F6425CAFD7A
SHA-256:	303E741ACC90EC72962D9C658BCDA184340338E5C1198900DF3D7A96BB3A8BF1
SHA-512:	CF86144EDD8D03D0BB94740D1FFC6EA173DED4C10AD45C4A20F13DEE1062150FADBA6866C8C00E0B188BA465152718FF9DC36A61EB72F18C4AF6B375605EFF9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....ce.........." ......#......... ........................................@B......5,...`A..................................................(.............@......+..:....B..3....).......................).(....2#.@...........H..P............................text.....#.......#................. ..`.rdata..L.... #.......#.............@..@.data...........".................@....pdata.......@....................@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	10631872
Entropy (8bit):	6.276946936240822
Encrypted:	false
SSDEEP:	196608:1IPBhORjFQwCliXUxbblHa93Whli6Z86WOH:1kwVAliXUxbblHa93Whli6Z8I
MD5:	62880B7D351A9F547B62B8DA6C97CE25
SHA1:	057F11003013CFB3F1C63E6BDD4F2F9949FF0104
SHA-256:	7C40C811D30D459DBF04A04C141B60EB4247CD58A008FB836605317DF665748F
SHA-512:	0D6F83175A91D90F4CC3EC4D9071B7ACD0CD8EBBCC592322E46FDE2ADB7198E035AF62C45A11A622F2A908E26D4DD8B8D1AF023E634A74D0824D02C791BA3C1A
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .....tE.......E.......E.......E.......E...6...E...6...E...g...E..@h...F...h...F.....$F.. ...7F..@...JF......]F......pF.......F.......F..p....F......F.......F......F.. ....F......G..0....G.......G..P...AG..@...TG.....gG..P...zG.......G.......G.......G..0....G.......G.......G..@....G.......H..P...%H......5H......HH..P...YH......mH......}H..@....H.......H.......H..P....H.......H.......H..@....I.......I......0I..@...AI......UI......lI.. 0..\|I..p0...I...0...I...d...I.. e...I..`h...I...h...I...i...J...J.."J......>J...!'.UJ...-'.lJ..@.'..J..05'..J...5'..J...>'..J...>'..J..PC'..J...F'..K..@G'./K..`.(.FK....(.cK....).\|K..P.)..K..0H..K......K....+..L...o+..L...x+.5L...y+.NL..0\|+.eL...}+.~L..@.+..L....,..L....,..L..p....L...\...M.. ....M..0...:M..@...JM......]M......rM.......M.......M.. ....M..p....M..../..M..../..M..@./..N..../..N..../.$N..@./.8N..

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	495760
Entropy (8bit):	6.409208933540656
Encrypted:	false
SSDEEP:	6144:pg9l96cDNg9883RGYrMkNOCzLEUU2s2LXxvZ:pqlYcq68hvrMi4ULP
MD5:	17B27CA1649A7AC14A26574D6C9E2028
SHA1:	3583DB54838E50DE777D4246EFE49F5A8743770F
SHA-256:	6F763E395FC4650A2A17BAE1CF3A268B1A6B4EB081D19D7868522476E2F91C12
SHA-512:	3620616AA90077ECF89E787ED2D2644D8AF3C0A79FABFD8E89C68941DF3CCBFBD83687B3956F3882EE27E409EBCBE5093A102B49ACFA3C1D10C92027A9EEEC7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....ce.........." ..... ...0......P.....................................................`A.........................................".......0..(.......x........B...V...:......................................(...@1..@............4...............................text............ .................. ..`.rdata.......0.......$..............@..@.data....K....... ..................@....pdata...B.......D..................@..@.00cfg..8....`......................@..@.gxfg...`$...p...&..................@..@.retplne.............<...................tls....!............>..............@..._RDATA..\............@..............@..@.rsrc...x............B..............@..@.reloc...............H..............@..B................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7508112
Entropy (8bit):	6.488303026501504
Encrypted:	false
SSDEEP:	98304:pAgpTkR1Ff1SCUDuVyALwkQyx9StmZe5wXVrjD:q9GPc+kgcXrj
MD5:	6CA5C317701092DDAF7500A55F6B9B42
SHA1:	74532206A38649A56F5AAA4756D3983797BFFA13
SHA-256:	549E1ADD7364EF61573830371528DE024AAA8F2C38DCCAB676C0CB8706788FF5
SHA-512:	6900136D42EF7963D632BBB4BC2C11346011CEF57AB63D6ED87F0BCF8398584B6A0F693FB3FAC0A6A89D5D50E74D128397A7D45B3ED1DB87376EF239B90D70E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....ce.........." .....bW...........J......................................`s.....3.r...`A........................................=.i......j.d....pr.......o..T...Vr..:....r.d...\|\i.....................P[i.(.....W.@............j.....`.i.@....................text....aW......bW................. ..`.rdata........W......fW.............@..@.data...4.....k......lk.............@....pdata...T....o..V....n.............@..@.00cfg..8.....r......Jq.............@..@.gxfg....+....r..,...Lq.............@..@.retplne.....@r......xq..................tls....B....Pr......zq.............@..._RDATA..\....`r......\|q.............@..@.rsrc........pr......~q.............@..@.reloc..d.....r.......q.............@..B................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	435973
Entropy (8bit):	5.420771352473224
Encrypted:	false
SSDEEP:	12288:yL0N/vpzXda2KCh2bM70i2Jyngy86BVCgIxHSt2lyV9V5t/te6AziApNi2:yL0FxzXda2LIbM70i2Jyngy86BVCgIxZ
MD5:	D16EF573959CF5CF0A6EEA20136B9C0B
SHA1:	E3384AE3EE92E1DAE47A48E45589372E940AAB33
SHA-256:	73A8401E6DC17C4DAF86B42C65B81359348F7E6B4D62D8637138E747BB3FF0AE
SHA-512:	064C2912F766F10EC042ADF82709AC9582CB8430E3550690FC17343C380DCBABADC0084E08AA5F3EB6FAF79A652D26E1FE2606625A180B7F47808DF07A566933
Malicious:	false
Reputation:	unknown
Preview:	........."..e.J...h.R...i.Z...j.f...k.u...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}............."..........2.....:.....A.....H.....O.....P.....Q.....V.....c.....r.........................................M......................._.........................................1.............................b.......................V.......................e.......................q.......................m.......................x..................................[.....r.................$.....5.............................B.............................].......................Q.......................-.....U.....^.......................&.....x.......................r........... .....7.............................r.......................P.......................H.......................k.......................>.......................>.......................d...........0.....D.................\.....~...........B.....v.......................=.....K.................$.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	710422
Entropy (8bit):	4.889515373188112
Encrypted:	false
SSDEEP:	12288:xzCqEYtxbGUTZwuMhqNx9TvLB/m/+9zT85J933Vw0upOAPxx30jH8+V:5CqpxSUTZsqNxlLBu/+9zT85J933Vw/o
MD5:	39A396FCE4D93F744B3C786D62D2686C
SHA1:	7EC8176E652B666B6AB9FFFB6CB9B7DCFDD1A2A2
SHA-256:	0B1D326BE9DABCDA8E37740017383F2D8F1BEC7A8FDB1F11EBE538C3632453FD
SHA-512:	798063B51F745FC2C9E7F852F72CE55939ED41305D070D1844C790755F7AB42A6830406BA2485237D37A0C46B804512E7DC37C65B7F03249C28741A4F706017A
Malicious:	false
Reputation:	unknown
Preview:	........."k.e.x...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.4...}.F.....N.....S.....[.....c.....k.....r.....y.................................................................L.....l.....-...........\..........._.....!.......................;.................L.................'........... .....j.....................................................I...........b.............................n...........9................I.....$...........k.................o.................2.......................^.............................n.......................'..............................................7.................$.............................`.............................-.....T...........L.................A.............................M.................\|.................:...........^.................~...........`...........S.............................1.......................J.................8.............................(.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	776660
Entropy (8bit):	4.901282904991353
Encrypted:	false
SSDEEP:	12288:OzoB4gW/B/RbVGQKvvYUNDjwkhb5YNip+olYMgSENX//:Ipg55X+L
MD5:	14B15761CB9D4E1956812DF8B42C2AEA
SHA1:	7C25580D892711B9EFF1A3ACE4E6699EA64E0706
SHA-256:	C8D405127B032587E6AE6426A35CB766139BAE26170CA08D811354486AB667F8
SHA-512:	EC9A6E6E715C817726AD744FADCA4D1AF3015D95421774CCFE54D616225B7A17E862E086FE0AEBB3A903D2EBFB27779CFFCD713D3042ECDF9761C24C5A56CDCF
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....\|.....}...................................................................(.....E.....\|.......................5.....Y...................................g.......................\.................q...........K.....b...........U.................>...........".....g....."...........4.....Z.....9.......................M...........A.....o.................K.....f.....m.....Z...........9...........G.....q...........8...................................A.....a.................;.....Y...........X.................N...........8.....\...........a.................=.............................U.................W................./...........*....._...................................A.................F...................................N.....t...........k.............................n...........M...........+.....b...........p.................-.............................1.................E

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	807254
Entropy (8bit):	4.657332043590551
Encrypted:	false
SSDEEP:	24576:05iZCv/q5ftlYMdAs1axUB4x3aCKGtVDqSmvunp8dIO+5ZJquLRlbQDwN/6ZIQ6Y:0mCv/q5ftlYtUB23a0tVDqSmndIO+5Zk
MD5:	01DFB1A7815613FA0A5411235F45B27B
SHA1:	3BF1EA5597AC77B26BD30CAA1EFEA7CB4F7A1B19
SHA-256:	13D08D2C4972CD18BB8EA8A57587DAD29684C2336F73282DD3284B0649377CF8
SHA-512:	5D8A65E5A17AA163FB679E003E1837EA96E515B105C9977029A5CA4854845289DE5D65C0EDFD473CB74410C5CACDB5B360F25A69776705FB05F48688D92680DA
Malicious:	false
Reputation:	unknown
Preview:	........."z.e.Z...h.b...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.........................................c...........k...................................n................._...........&...........Q.................V.................T.....@...........`.................r...........>.....(...........t...........r.............................].................,...................................T.....{.....".................-...........R.................y...........i...........8.................+...........>.................7.............................L.............................M...........).................'.........../.....q.................G...................................n...................................z........................ .....!....@!....0".....#.....#.....#.....$.....%.....&....Q&.....'.....'.....(....G(.....(....r).....).....).....*.....+....8,

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	1043696
Entropy (8bit):	4.274774940218697
Encrypted:	false
SSDEEP:	3072:qiTj8zSyVwde8yRWFyW2Ge/a/0hfI0PLvCIOvkMBbStDn5JiXlZ0:bTj8mySc8VcE8vBO7Bby5Il2
MD5:	FF4F966849B4107535E41D037D9144C7
SHA1:	3A973857B061914E8905BDA7E8F2BDAFA384588E
SHA-256:	2DC26DEE345271F4606650912B0B7B5DF68F621F2920864E0E36C1D1B22459B1
SHA-512:	98772F266F9553F77F91B11DC4589EC8A0930554E9E0B381BBACD8D23CE794C04F6FE821388A6E87CB14CB59C7522C18C06B1AF11FC177C7E40EF71242ADCBA7
Malicious:	false
Reputation:	unknown
Preview:	........."..e.N...h.V...i.g...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....E.....M.....T.....[.....b.....c.....d.....i.............................E.....O...........G.....<...........................................................J...........F...........s...........`...........e.............................y....._.....6............................._...........[...........m.............................Q.....u.....m...........g.....0.................A...........y.................x...........=.....`.....@...........Y...........U...........Q.....}.....5...........).....O...................................X................................... .................f...........C.................>.................9.....e.....M ....&!.....!....5".....".....#.....#.....$.....$.....%.....%....'&....*'.....'.....(.....(.....)....?+....2,....e,.....-..........C/...../.....0....G1.....1.....1.....2.....3.....3....(4.....5.....6

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	491145
Entropy (8bit):	5.414447286175489
Encrypted:	false
SSDEEP:	12288:k8E42a7G6ELn1R355PAF4N3Mw2juwHzejm0XNlGq8EmsTRvIs3cmlLEY0CJ7MyUw:iiQpDR+Vac/MNI5/EB5HTBaY
MD5:	A0B45B122241CF0C11A081EEFB9CB4C6
SHA1:	91FD660A4688AAA70FEE42E783B8B1863B4D11D7
SHA-256:	7D911CDA51564500DD7A6DE43A1E347869427C035B15FA25CAD0526BE9E055B1
SHA-512:	ABCB3BCB96934189CDFD52528CD7C65EA870C9B997BF6349599B7064FE6F4BEF0D34809F0F958E4D4E46486E7C0A41F86B5ED0A132BBF20743D41F3AF64788B4
Malicious:	false
Reputation:	unknown
Preview:	........."..e.N...h.V...i.^...j.j...k.y...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......!.....&...........6.....>.....E.....L.....S.....T.....U.....W.....q.......................m...........i.................].................R...........6.....U.................P.....m.................O.....b.................F.....W...........A.................6.......................~...........&.....:.................+.....?.................b.....}.......................#....................... .....p.......................N.......................N.......................].......................J.......................#.....n.......................^.................&.......................[.......................V.......................m.................<.................".....\|......................._.......................i.............................?.................L.................".................$.....D.........................................0.....L.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	505998
Entropy (8bit):	5.852692589945994
Encrypted:	false
SSDEEP:	6144:MI6vfxlz7skzhZZD7ZUVNzrAMnz15/8VEgkNOQw3SBbY8Qm:9mbz7sobnZUVtRz15/8VEzNOl3SX
MD5:	1101C784521A550B0561B363722086DE
SHA1:	838F2BFE3432B87B950A2EC5D9862D2F58FDE3E5
SHA-256:	CC6FF937D1C9FEC4634DB4E2F6C0718D2606FE2D5D25ADDF1314E110C5B78772
SHA-512:	ECA3CE2075D3C920116C9E34957631E0617A869467BB76B09873AE96F7803F20032A6DD0A0F785F9E59DCFCE3A4CCECDAB2D445A860BEE20D42E140B45E74089
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.*...h.2...i.:...j.F...k.U...l.`...n.h...o.m...p.z...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....3.....C.....U.....g.....\|.......................).................".....1...........4.........................................?.......................;.......................>...................................U.....w...........^.........................................;...................................I.....c.................2.....I.......................,.....{.......................j.......................~.................(.....y.......................n...................................(.....<...........1.....u.................$.....?.....S.......................4.................'.....=.................^.................;.....V.....j...........M.....}.................l.................8...................................b.................f.......................[.......................n.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	457300
Entropy (8bit):	5.462360584216823
Encrypted:	false
SSDEEP:	6144:CVNYzbxqzVBYO5c0orUrnwlH2oJwREbtEbvvXe5aNrRppd4gTGqfwQ:CV4bVLr2nQJ5SrJTpB
MD5:	5B033C206820ACE5EB4C6F82AED34A5D
SHA1:	28017CFC13259273022059F02564FFC99DCD75A4
SHA-256:	1A51DE04CB205C708520F1B013447F1A89F0B1330DBCE6D1E71CF355319D1108
SHA-512:	E423069F7A895179EA17BE5774284E9E2E27F02C40BAC7D7211CAB77348800622796F04C3E6618905364E189CA5EC772ED7DBD285872777D163D3EBEC08A64D4
Malicious:	false
Reputation:	unknown
Preview:	........."v.e.b...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....q.....r.....t.............................0.......................e.................,...........>.......................q.......................d.......................L.....v.................M.....\|...................................K.......................r.................+...........4.................1................./.............................l.......................E.......................0.......................6......................./.............................n.......................W.........................................H.......................,.............................].....z.................r.................B.......................B.......................Z.......................V.............................-.....c.................^.......................8.....T.....a...........#.....Z.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	488577
Entropy (8bit):	5.513232917056381
Encrypted:	false
SSDEEP:	6144:hHb3YfHLHsf63K7UpTzighla/nxDUBEmw3Am0o268dz5qRwT1MROI+ChF:yzY63K7UpCgvaPhf0p5q9+ChF
MD5:	7CCDC41A3DBDF89058D71629225664AE
SHA1:	E15C35B18685D9573349FF4247733B5F5ADA8717
SHA-256:	163EA4C2CF67EDD0526A8E18D3810872E92A1D4E17B5CF4F04107FDA5967B0C9
SHA-512:	13B20B0DB02A0A7480C56C79304EF594353507E1A30DA0130B73AA8E9EC7636F306315A6F40729B10DC725F936642D2E2B282ED3040A079A6F25A7F9F7F1AE28
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...\|.b...}.t.....\|...............................................................................................z.................g...........'.....<...........4.........................................Q.......................\|...........&.....:...........@.....w...........)...................................H.....Y...........[.................B...........(.....B.............................f.......................w.................#.................".....3...........@.........................................?.......................h.................!.................K.....].............................c.......................].......................[...................................N.................O.....m.................i.................4.......................v...........N.....X...........u.................Q.......................m...................................L.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	885915
Entropy (8bit):	4.739553297972224
Encrypted:	false
SSDEEP:	24576:W1YcXPeGgx1vhxi6o/mqHMeD2fpaEAj0vSKjaEA3H8EuiEc7t2DQ739Qtf2ktKMq:AYcXPeGgx1vhxi6o/mqHnD2fpaEAj0vC
MD5:	2B391B2B35F7E096F696FAF5DC093366
SHA1:	1409134A46FCB84457A0E332EDDE98F7666246BD
SHA-256:	F1FE39AF50F4BFE9EDCEA3AF6C132E87D464D7277FB491ED95D7189B3157D20D
SHA-512:	AA640CA41DC9D4F60392B61BBEAD215345ABD32369B0DE90ED1D7CA2FF7A838D04689D538789A1ADC0324FE4539C34DB26B6C245155E51FB0308AF13B60BFDAE
Malicious:	false
Reputation:	unknown
Preview:	........."w.e.`...h.h...i.p...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....g.......................&.....M.....+.............................n.......................,.....^...................................#.....y...........?.................>.................,.....e.....m.....g...........6.................G.....b.....I...........w.................N.................8.....0...............................................T.................b...........P...........g.....A.......................m...................................,.......................".............................#.....+..............................................S.................e...........S...........m.....-............ ..... ....P!.....!.....!....~"....@#.....#.....#.....$....k%.....%....$&....N'....i(.....)....X)....Y....@+.....+.....+.....-......................s/....=0.....0.....0.....1.....2....N3

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	398638
Entropy (8bit):	5.532075614025896
Encrypted:	false
SSDEEP:	6144:bY/F2I4WPMdRwa/YBNSxMP9eFESofaYvskuN5jVS6B7RuKv:btpswRxMSESau5RSuv
MD5:	745918A5A74C7B6F4818A8BB8813F456
SHA1:	031F50286D003844425DDAC557E13E2EA4554BC2
SHA-256:	91BDBF5F1F6BCBCAF16E47865F72EC97D72C74174FB929F089D14C00989F91F4
SHA-512:	5A1EB0231352705BAB527AB27543612D75CB00C522620828CE2A0FDB0B47BE9DAA2DD7A192F8B4BF299007C5AF1D9515F900B9586BA44DD2BD9F4CD4436AA681
Malicious:	false
Reputation:	unknown
Preview:	........."..e.8...h.@...i.N...j.Z...k.i...l.t...n.\|...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................&...........5.....<.....C.....D.....E.....J.....W.....f.....v.................Z.......................X.......................Y.......................P.......................&.....O.....].............................o.......................R.......................H.......................$.....k.......................:.....f.....q...........:.....\|.......................!.....0.....n.............................Q.....r.....~...........&.....X.....k................./.....;.............................E.............................J.....s.....~...........7.....t.......................9.....O.............................W.......................&.....m.......................D....._.....n.................F.....V.................3.....K.................f.....t...........4.....k.................*.....V.....e....................... .....{.............

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	401341
Entropy (8bit):	5.524682081269705
Encrypted:	false
SSDEEP:	6144:1InAdQi32OqOMWvX3BO4XMP9ehWMIfaYRGrc55FSMnC/M1UwB:1IAdQqOONvXMyWMGv57SoUwB
MD5:	C9C2ABCB04E1AD5F1A20244DA8D595A8
SHA1:	89CA81DA21900074A5CCDCDC852768277B2B620B
SHA-256:	0364C73F320E441B03CB2AFCAACA3FFBFAC51A3559DCD0FF99A1ACCF82C7F762
SHA-512:	96BBF21174F56A111A2FC6EC024AB2F143945306797E77D773367A7FAD42B7828EBB7B08D0DAB76858D9FA340BF3205BE403BC53DF9E5E4E390058C94A751FFD
Malicious:	false
Reputation:	unknown
Preview:	........."..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.#...w.0...y.6...z.E...\|.K...}.].....e.....j.....r.....z.......................................................................K.......................`.......................U.......................X.......................3.....x.......................;.....b.....o.................&.....=.................%.....=.............................m.......................;.......................%.............................O.....j.....y.............................].......................!.....o.......................K.....x.......................;.....F.............................N.......................(.......................#.....b.......................!.....A.....V.............................u.......................\.............................\.......................;.....s.................\.......................o.......................e.......................%.....G.....W.................0.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	484842
Entropy (8bit):	5.3948267356117015
Encrypted:	false
SSDEEP:	3072:IiaVobJnVwgKzEFRy7CkcrMjntvYs1kyagv8pPukXA0HjrW5fl5e+GLF47PRRIHO:gKdED+sYzTpsJ5ELF47PdbSTw
MD5:	C8F488B85C17431360E531AA507BE979
SHA1:	BEA5D66BDCC05869A0389E051A9217FD49E48FCD
SHA-256:	536339D99DEE6E8C01F018D4700DDD92CE063F765766A48073AEB256669680C1
SHA-512:	1D7F9F84A8D7C055BF705C71EFAEA817F1B9DEDD5BA314FEC6CE5324F578D3130B5541BB52FA55DB9F6E46EFA8E152D50199A61C7E2466844A4414DF65D61C22
Malicious:	false
Reputation:	unknown
Preview:	........""h.e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................h...........\.....w...........O.................@.................;...........(.....j.................(.....R.....e...........".....J.....[...........U.................T.................2.................T.....g...........<.....z.................}.................x...........P.....w.................=.....X.................1.....@.................8.....N...........+.....p.................G.......................=.....n.....y...........".....R.....\...........*.....j.....z...........m.................?.......................I.................0.......................X.................P.................%.....?.................5.....N.................g...............................................`.................t.......................e.....................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	484986
Entropy (8bit):	5.367134061997785
Encrypted:	false
SSDEEP:	6144:6kqGWOZ1+zun+V4HgspZpGrUKjs5f2rYDoRRiN6PZGMj:6BbOSSmirpKjjs5ursoRwBA
MD5:	29CBDCC2168F1BB29532122C39E67A1A
SHA1:	F086C79D60DAF2B0A7DF91916387EFA461795DCB
SHA-256:	232F41AB5996C917687276E82C177DE208B36E77AA834BB5D94D6A331F4180FE
SHA-512:	B603EDF2A18F5893AB482B0C34E4126F824FBDD1B669927D7BC30D68E2E5BDF78D7D4B2AABDBE257987E8E19F440D9396A3683340B94C3FD844C70E34E93D8A8
Malicious:	false
Reputation:	unknown
Preview:	........."k.e.x...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.+...\|.1...}.C.....K.....P.....X.....`.....h.....o.....v.....}.....~.........................................g..........._.....z...........\.................H...........8.....R...........5.....q.................G.....v.................H.....p.................{.................o...........(.....F.................a.....r...........B.....~...............................................C.....h.................P.....f.................:.....I.................B.....X...........$.....W.....j.................S....._.................=.....H................. ............................'.................\.....v...........,.....X.....u...........&.....M.....l...........S.....x...................................e.......................Y.......................o............................>.................A.................5.................Y.....m.................8.....K.................\.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	438663
Entropy (8bit):	5.47129533877654
Encrypted:	false
SSDEEP:	6144:Co6kjhAvuvJ1O7RCqDW+jDk+xdt0T5cqvT/F1AiGGZv5/je43S3apLU0xPQQbm:CoTjhouS9DVDNOX9v5/jpC
MD5:	5B169234895D929930140B4869A0B81A
SHA1:	F58BA50D1E19CE191A0F8117F3E70F7F3DCB7362
SHA-256:	C465DA80B14981BDBC687B7C37BF70D2BD4B8E03293C04AE5410F84C91EF980E
SHA-512:	C4297E272B5C04A0EE0956B873D5246591BEE98C3B340E72202F3448381C691096A5BC540FDBCF61FB40D6A69270AFA7198C1F0CCF3B2E84CABC906E23EB022C
Malicious:	false
Reputation:	unknown
Preview:	........*"`.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.............................................................................k...........b.....}...........L.....\|.................q.................!.......................!.............................t.......................s.................%.......................O.......................S.......................c...................................S.....j.........../.....Q.....l.................8.....D.................#.....3.................;.....F.................G.....U.................?.....G.................:.....I.................<.....D...........,.....g.................-.....L.....b........... .....D.....g.................L.....Y...........!.....U.................$.....>.....O.................;.....S.................W.....r...........m.................[...........!.....F...........".....X.....e.................!.....5.................1.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	720855
Entropy (8bit):	5.022549799082519
Encrypted:	false
SSDEEP:	12288:xYtlvU8u313uyqoe+slXcfqvdUzOT4imdAQifaQ2XxFvGq+MXvOthgdpxHsAQi6j:8M8u313uyqoe+seq1UzOT4imdAQifaQz
MD5:	F7DA0D07B54698BF8A213D0CCF1942C0
SHA1:	D64FFF18274EBE71A4AAA4754F9BB99D616FA000
SHA-256:	33BDD6EB52F648D475306F35B6103500B864672CBF39CC0FBD8C4AC84C997DEC
SHA-512:	CE7A7B3DF4C814A26E3FD9FDDAFC01AC1A4B2A87EF2D2893DB5D0EDF8E5B8BFE34AFB6E91FF94306248361D57C6B3BD63D116635FB756AAB74C4AED38F31C88F
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....\|.....}...............................................................................I.....p.....U.....&.................z.....+.................{.....;.......................d.................}.....).....o............................."...........[......................./.....{...........;...........'.....C...................................e...................................0...........9.....m...................................o...........E.....\...................................".....i...................................d...........4.....V...........\|.................\|.....+...............................................J................._...........L.....l..... .................W...........M.....r...........G...........C.....e...........................................................0.................s...........i.......................................... ....l .....

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	449023
Entropy (8bit):	5.435118446970961
Encrypted:	false
SSDEEP:	6144:JzlRT+nYGj1FT19iPzGI6B2Roh2jX7GsPzWvOEHGaSNLD5jYWyHRErWacu5CGWO/:JqYGFT19u5JvRa65jYdHRErWaPl0Yb
MD5:	1CBFA553A5B1DE642EA4C248DFE1EDBA
SHA1:	5DE05B3C11FDD59FF5064A153A6DCBDA33350971
SHA-256:	8F3E8EC0FBB471B45DB65A77DC1013E3363F387D3D0C6A458C90F371907D0085
SHA-512:	EA3B99BE7DA893BE8C3B228D1D3D7B644A1F5425B5380DC3E0AE0BA1BD29CF39DABE73819BCC4FA67F10A488F018E9FA2328995CB78F40AE8FDB66AA514188AA
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....\|.....}...........................................................................................2...........7.......................e.........................................A.......................K.......................).....r.......................N.....t.................q.................+.......................'.......................*.......................J.......................s.......................M.............................].....~.................-.....W.....a.................@.....M....................... .....z.......................^.......................S.................".....p.......................=.......................3.......................1.......................;.....{.......................X.......................P.................).......................w.................$....................... .....b.......................).............

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	507368
Entropy (8bit):	5.207212722895636
Encrypted:	false
SSDEEP:	6144:/a4EFuKhJ6hbb8GmxKGp7xLyBDQZSHJu0FeKznGOZ3jmF5aVmzb8ATf3H:/SXJ69BmBsp7aF58mv
MD5:	8CE446CAC9221F07F912BE59534D86EC
SHA1:	15CD1B902B26ABBE665FED518575748483A9C3E4
SHA-256:	B6CE37B1AEB4CA17A7F78EBC8F97C2807F588DFC4AD3E0639005C626B5C9B939
SHA-512:	20BE2B5C7E8FCA897109B1DC8219931EAAA1C8296B1D26DCC7F9058168FEF371D7955FB0F6C5693399B83FA81D27369EFAC8C3742059EEA2333BD66D20B8D0D8
Malicious:	false
Reputation:	unknown
Preview:	........."..e.L...h.T...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.....s.......................W...........F.....d...........[.................]...........J.....q...........f.................$.......................1.......................t...........%.....T...........j.................Y.................-.................T.....n...........i.................b...........N.....p.........../.....Z.....w...........%.....M.....Z.................8.....G...........$....._.....u...........A.....w.................I.....{.................J.....{.................L.....~...................................^.......................X.......................H.......................q...........*.....a...........(.....R.....l...........J.....}...........&.............................1.................@.................@........... .....V.....n...........&.....N.....d...........Z.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	525519
Entropy (8bit):	5.393542369720876
Encrypted:	false
SSDEEP:	12288:rf94ZLoeeEfW6QuaWV5sKzTeX/Z5MYnYZMBrNWiKe5exMJSWkt40wCA73OF8WqiQ:rfB0V/r5jS
MD5:	A1DE4AD3D9B7AA8F122BA00CB983E49C
SHA1:	323D6E1B4ED75F9406BB8488D7FFC7E12FA96886
SHA-256:	A69F52162F6081A06F835EDE10818218DF6E211F00D0EF24561E6221F4696E61
SHA-512:	542F0818EA4517FDEA929F3D4938F7DE75E2A5E6D872607E548F87DE7E9CD0737FAB3F5E82AB7895F44E809279D81C490999ED055ACBDDAFE84F85E60CE2E23B
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.8...h.@...i.Q...j.]...k.l...l.w...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................!.....).....1.....8.....?.....F.....G.....H.....J.....Z.....h.....z.......................N.....p...........W.................?...........$.....@.................o.................L.....x.................\.................7...................................@.....d...........B.......................k.................0.............................%.......................f.......................`.......................f.......................~................./.......................2.............................}.......................\|.................C...........'.....>.................2.....P.......................&.................,.....H...........S................./.....~................./.......................\|.................N...........L.................:...................................j.................2....._.....s..........._.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	1019985
Entropy (8bit):	4.31663406991556
Encrypted:	false
SSDEEP:	3072:zIMpRrC1YKJvPF0WxrHYCjXCl3HIwjAwREJKVMjNiT7llj63rFWlPvpqi5eQWkYh:8QRu15JvPHxMCjSlLTkh015cVhYYHB
MD5:	02BFA1114FD5B75261C24D6C0E6441F7
SHA1:	D48B80339405CB8C8EC7A19B688E8D544938C4C7
SHA-256:	BBB17268412FB3E13584CA4DC90A94F984177D3C97EE89AF2A57324709F8ED1D
SHA-512:	751B91D381C882A5DC0C0EE6313CF3E7EF51B4D369330A169CF9625DE99E6019233109E815FC474FAE44D79235940BA2CE68AF7033F4C4C994E2774BBD8105BE
Malicious:	false
Reputation:	unknown
Preview:	........."x.e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....\|.......................&.....b....._.....0.....l....._..... ...............................................a.......................G.................r...........\.....\|....._...........z.......................V...........n.....B...................................7.....4...../.......................".......................4.....p...........P...........E.....m.......................................................................'...........}.......................C.................j...........u.......................\...........K...........R.....{...................................b.................'...........t............ ....9!....\|!.....!....."....W#.....#.....#.....$.....%....3&....f&.....'.....(.....).....).....*.....+....<,.....,....\|-....H................../....s0.....0.....0.....2.....2.....3

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	630920
Entropy (8bit):	4.630663820009303
Encrypted:	false
SSDEEP:	12288:6iRfEbxhQ3SxsheRvre4maaW/gNZpl60XA4OX78eQCap4X59U4omhV5ylm7eDnw7:6iReew53ok
MD5:	9FCCB330D8B07CA54661407CF737D847
SHA1:	2C6F52801B66AAC7D08ACB60D9736F9149E48AE5
SHA-256:	BB06D364A91B8641724254822B2EEC5D0675E262A4CBF93B92494F601807DBEF
SHA-512:	0CBF36643CC7B1D85DC7CB7825BC816A8538D0CC50B137DD27D5A9703324AE7FF271D38DC0CD6E4A99C6B391070690B90EB8DDB1CC511BC8D84D49A32D36C34C
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................%.....,.....-...........0.....G.....`.....y...........[.......................E.............................k.................p...........?.....a...........V.................#.......................s.................K...........b.................r...........Q.....p...........g.................O................./.......................#.................4.....a...........K.....}...........'...................................H.....[...........Q................. .......................Q...................................:.....M...........t.................e.........................................@...........7.................E.................=.................&.....?...........".....S.....l..............................................."...........J.................s...........@.....g...........S.................\...........I.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	1072787
Entropy (8bit):	4.2950102192986686
Encrypted:	false
SSDEEP:	3072:TOsoU87801sObZWjUNOBKV/BB0ZV1dsuOlzLZW3XHLeOTByntDPtDlqpZs4J/8Wq:xfElWjuOGy5I5oJJa
MD5:	CD91036827739441E4CC849AA30706D6
SHA1:	CC8E4C53E18DB16876F855C2377F3CF0E2ABF95A
SHA-256:	0936587AA072339F8DC347506E5553159319A686010CA1912BED1D830E107C6E
SHA-512:	553773BDC11BE94F495B88E0587D572455EF68C182D51C9E1AE0E3AA23744F836996A446ED136AFC562EB9A110E435B494D5955D2792A364A619111E7B3550E6
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.....i.....j.....k....l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....\|.....}..............................................................................O.....z...............................................?.....z.........................................^...........`...........n...........V...........Q.....t.....[...........^.............................\.....6...........f...........v...../.............................\.........................................Q.......................:.................K...........%.....>.................:.....k................<.....[.......................'...........z.......................Z.............................d...........P...........H.....t...................................F.............................. ....s ....'!.....!.....!....5"....)#.....$.....$.....$.....%....y&.....'....R'.....(.....)..........+.....,.....,....c-.....-.........../....V0.....0.....1....^2.....2.....3.....4.....4....\5

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	489113
Entropy (8bit):	5.523236785909083
Encrypted:	false
SSDEEP:	3072:L5ntcJhHDvjz84N5dkYjjaBV08IRpy+w4DrRkpNAyFOSGqf3rrHlcIG0uP1aSNZA:/cJhvNcw9PwUGMly5Ur7jdicO
MD5:	EF62A50CC098AFCF3FAB69C7502219E9
SHA1:	DB474CF332C90DE660FC575EF897D5389B65784C
SHA-256:	07EFFA557C8BC822626C05A4D299296F88D3DA0654248C326D796F7C2DE3EC64
SHA-512:	7AE6F40C7BF404532DF0BC2FFA449E0D99DEBC2B9816450ED0D015B1634DD96CD5650AB6AF5A6D44D52D0E3C9C81836EE350210C4F8A13BE6CC0CB796A630350
Malicious:	false
Reputation:	unknown
Preview:	........."\.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.=...y.C...z.R...\|.X...}.j.....r.....w...............................................................................................m.................Z.................+.......................y.................0.......................,...............................................4...........1.......................s.................3.......................U................./...........H.................-.....~.......................X.....z.......................>.....N.................H.....].................:.....I.................L.....a.................4.....D.......................,.................g.................".....D.....a.................'.....G.......................4.................Y.................5.....Z.....p...........=.....o.................i.................a...........<.....N...........6.....t.................[.......................8.....V.....h...........D.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	526055
Entropy (8bit):	5.6492163480603805
Encrypted:	false
SSDEEP:	6144:RG4U0RnIyvDoBrDu9O5gVHPCegBAcnky1FB56wqZfK81YX56xTkXqeJrn5gRSDCO:RG4UMnbguUdAIB56wKk6qjrn57iLW
MD5:	51B14B96D1B9FA99ED849347A8954133
SHA1:	5259B749576A9612E429A665DFC8BF47651C39EA
SHA-256:	70D4A0724A2E0E80EC047E7683EEC7715C0FB5F88795CC97A63E4C2EE2237800
SHA-512:	B68D4BC792F29DF210602A557D0B3333A95E30CD03A0A4CB5F537C9C51DA9937119391F2A359C03FB874C1F540C23F44BEF121E45F048F32B1DB06D67A0BAD1B
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.$...h.,...i.=...j.G...k.V...l.a...n.i...o.n...p.{...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................".....).....0.....1.....2.....7.....G.....].....r...........4...........U.....s...........j.................F...........,.....F...........>.....t.................g.......................u.................[.................>...........e.................S...................................C.....S...........V.................K...........7.....V...........J.....v.................k.........................................Q...........-.....D...........N.........................................i...........7.....L...........R.................#...................................).....E.................<.....e...........,.....k...................................k.......................a...................................C.....d...................................;.................S.................6.................5.....Q...........B.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	431922
Entropy (8bit):	5.389359401295906
Encrypted:	false
SSDEEP:	6144:DT9syVtlTqQWoK3UqC1s/fjeVnjHFm6mPAJc25TVh5vtblSzjsEaeh:D5suavkqHiVnjHFnm4Jd5TVhIh
MD5:	3B5E08406059D1A76566E9A5D4C9B15A
SHA1:	6BF45F2647E959EC1B545763180E8F29961AB3E1
SHA-256:	60409D8B785DD057E3495190B18E6D6D235D8313555341CBA5F64327E3D8C3AA
SHA-512:	6C4150C064EDF6ED0B83B216CE62134BBAB12137E6B45749DAD08D1D1734B3365309414900615137C6ACDD12250ADD5C69A222DAA7984A94EE850AAA55AF1B8F
Malicious:	false
Reputation:	unknown
Preview:	........."..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^.....l.....y.........................................6.......................'.......................C.......................F.......................$.....h......................._.......................j.......................V.......................5.....b.....o...........5.....p.................^.......................;.....V.....g.......................+.....y.......................R.......................9.............................b.......................;.....h.....t...........".....T.....a.................K.....].............................`.......................8.....~.......................b.......................9.....S.....a.................A.....P.................H.....a...........Y................./.......................B.............................Y.....x.................G.....~.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	477964
Entropy (8bit):	5.300124197784544
Encrypted:	false
SSDEEP:	6144:Y+mNNNc5Rqviax9RwYMfjNBYISOqRRRsO1Stk+RT9Tjex5GOt/ELmubPUvbT9fL1:YjTNARqvwO3eZ3A8lhHtRA5hlo6
MD5:	4E7AB6A5D407BF4D3F96671D65E467F9
SHA1:	67F43053CCD167F2CE6D945202F64DF29EE1AC49
SHA-256:	20408C09D9447F44AA920F2529D231072DB8BB9C0C8B8FAFA2DB733561EB6964
SHA-512:	BF493E1A1C0898F7A54F8A5278DC0CA345E9937EFE269B1BD3A3BC90645D767070EC9C117DF001F8C3B51B4A383C30F025DAF79606AC1840FCC5878AD4C53624
Malicious:	false
Reputation:	unknown
Preview:	........."\|.e.V...h.^...i.o...j.{...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.*.....2.....7.....?.....G.....O.....V.....].....d.....e.....f.....h.....{.......................K...........9.....U.................\.....m...........e.................u...........).....R.............................q.......................t.................8...........0.......................}.................;.......................X...................................i.................5.....a.......................C.....Q.............................~.................0.............................f.......................:.............................d.........................................H.............................L.....b.....x...........&.....R.....g...........C.................%.....h.......................>.....i.....\|...........a.................i...........Y.....p...........j.................a................./.....\|.......................^.............

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	584193
Entropy (8bit):	5.694400988777854
Encrypted:	false
SSDEEP:	6144:WzLA//bCXyIrwdzzln44dZns2C4tb85BnDxV5:ALA//OXyqw9RdZns2C4+5BnV
MD5:	74E2430CF18DB7ECAE2A9B1FEEB049B5
SHA1:	362A5F3E4D8A79B9D0B041D62A8A5233E20FB208
SHA-256:	1A726C500B5B3EFDBC7B9E6626765DCB8957005F9C072C09D1F517587D6B673A
SHA-512:	324D0BA770C09CCCAC4C59E0E0605846A4E18F32CC79F14FBD4E5B0172F439EF8DEE538F686458B3A07E5E8B4528EF67AA5D339AE25F7C601C9A302CAA7970F9
Malicious:	false
Reputation:	unknown
Preview:	........^!,.e.....h.....i.....j.....k.#...l.,...m.4...o.I...p.V...q.\...v.h...w.u...y.{...z.....\|.....}...........................................................................................9.....Z.....{.........................................D.....\...................................f.................{...........#.....5.................0.....@................[.....z.............................a................................... ...../.................G.....V.................................................................`.....{...................................0.................,...................................L.....^...........I...............................................6.................6.........................................>................~...........2.................0.........................................^.....y...........N.................F...........N.....c...........\|.............................C.....d...........R.................7...................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	1173741
Entropy (8bit):	4.225519544497436
Encrypted:	false
SSDEEP:	12288:vLwIIKo4A60R0RevnIS7d5EnUj+uF+h0FJ:vMIIKUz5SUz
MD5:	56C5F63F439CC962B815BBC4F3F12C32
SHA1:	C96248CAFD869FEF11BC37AEFB1382D0F60A7855
SHA-256:	14B332541C2CCE0835202372F8CC822AEF30B3575B651C96219A88B8D1381648
SHA-512:	9210759D8E73266381FBF04280AAD0BC5006F315CE3FCA74FE304B3261AF0BA399210F0B84620230D6AA0C667E60C0A6D9E67681FDFAC401338E9331475BB7F6
Malicious:	false
Reputation:	unknown
Preview:	........1"Y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...\|.^...}.p.....x.....}......................................................................._................^....._...................................v...........j.............................g.......................D.....1...........{.......................1.............................9.....?...................................c.................................................................2.....}...........n...........S.....f.........................................7.....q.....E...........z...........Q...........t...........x.....0.......................V.................".....! ..... .....!.....!.....".....#...._#.....#.....$.....$.....$.....%....a&.....&.... '....H(.....).....)....%.....+.....+.....,....^,.....-....Z...........9/.....0....J1.....2....e2.....3....L5....J6.....6.....7.....8.....9....,:....d;....I<.....<....<=.....>.....>.....?....X?.....@....tA.....B

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	492782
Entropy (8bit):	6.069818388014136
Encrypted:	false
SSDEEP:	12288:+nSZ8uRit3zdYBb/XHcit8OQ4EVhrxsRCqR5A7eVt+8ftKq7hUomrOe7nB:USZ8uRDcu5c8TQnB
MD5:	A9B446BB79B0E5D0B4AF4F7243B1F3E2
SHA1:	FCF962506B32B34A6315ED61ACDECE33DF3DBF23
SHA-256:	507FC8D2A468456F2842B65A111FC0C74FE1F56D5F5AC0D6E743AEF186B43B2F
SHA-512:	E7F281206BD481427A75B581F8B2A435EB8A29BD8B5586A8DB78605B1C1BBC20DC1F4B2FF92D04C62FB509DC6E1E062D1D584C195E386C5C2FFDA0F764276AA6
Malicious:	false
Reputation:	unknown
Preview:	........F!D.e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.&...s.7...t.@...y.U...z.d...\|.j...}.\|...........................................................................................................I.....g...........@.......................x.................;.......................Y.......................^.......................m.......................~.................3.......................).........................................#.....3...........6.......................L.....p.................-.....R.....b.................-.....=...........!....._.....{...........?.....s.................J.....~.................M.....}.................K.....\|...................................B.......................2.......................=.......................W.................+.....\|.......................G.......................J.......................]........... .......................8.....O.................F.....Y.................,.....?.................0.....C.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	531495
Entropy (8bit):	5.642978583072715
Encrypted:	false
SSDEEP:	12288:Z8zeZddcMEXRfMAYVeXWjCCM5Gz52uxSog6Sbt:KzudcMERMHO2M5w2wSo+
MD5:	49201FAE17B715A15FA03C4D89DD2176
SHA1:	7C559C174850DE48C4A2837FE32C58F74D8150B3
SHA-256:	4A80792CB9A401EBFA7EC3212182B5024D651CA6A5EAD8FC9809D0D3AD4803CD
SHA-512:	3016F721D77206E13E275E7EEA1ADC95D403FEACCF595EACF933940485031E9AAC0C29B6F47A9FF5F73B08C354B7B82C72193C83E1FF09D84CB5B9B72B708166
Malicious:	false
Reputation:	unknown
Preview:	........."p.e.n...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z....\|.0...}.B.....J.....O.....W....._.....g.....n.....u.....\|.....}.....~...................................V...........D....._...........u.................o...........I.....c...........Z.................$.......................c.................6...........0.....d...................................t...........$.....5...........#.....].....m.............................v...........T.....r...........T.....{.................y.........................................g...........%.....8...........,.....f.....u...........s.................?.......................u...........#.....1...........d.................H...................................S.....{...........m.................M.................=.................6.....I...........p.................c................N.........................................H.....h.............................J.......................j...........:.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	529136
Entropy (8bit):	5.634149006390685
Encrypted:	false
SSDEEP:	6144:oAbYD8by28DerxZMNmtVFItX9a4jXcmZib3z5SyT2otETUswxqEAYRFoDs1r:oAbYcFk5I4owiz5pETKqns1r
MD5:	335158EFE454819A0DC8DE0EDB0F0E90
SHA1:	85871F85F626DB1FC597EF24C79C84115A66C17E
SHA-256:	113073CF60AE3D2BCF8A61DF655762E34BA28E4B35B97DE33C18E13F959D76FF
SHA-512:	F81733BCA3FA65C789630B55C4F414A8541E71C4E1ABA56BDB9D231CE189677B3BFF4DC57C92FBE1CBC88F1F2F7FBF1A7E4319A8918C50409FCBA958D743CCBC
Malicious:	false
Reputation:	unknown
Preview:	........8"R.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~.....................................................................................................p.................]...........(.....;...........p.................\...........-.....L...........+.....g.....r...........g.................#.............................9.........................................m...........3.....F...........j.................X...........N.....o...........:.....`.....v...........C.....l.....~...........Q.....x...................................]................. .................E.....T...........=.....p.................y.................V...........I.....a...........$.....?.....T...........S.......................y.................>.................H.................5.....N...........R...............................................P.................N................./...........*.....d.....t...........F.....a.........................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	1219982
Entropy (8bit):	4.262128412360071
Encrypted:	false
SSDEEP:	12288:enA2cMmsbbAxRnxffi177/zY8Cmn1py1rcC3e2hh5L/7djZ8fI3pI:sSdiZ/C3eI5L/7X8w3e
MD5:	1030C08FFBBE7366CE5B7D55BC8ECC0F
SHA1:	B45B53C1E47A0051560C607874357130C499563D
SHA-256:	E1F97CE3011D9231F23FE033BDBB0905C173921B18402D362BFC35224FF67DB7
SHA-512:	3B9127A0EEC02F75F79C66F5F7845B65C4EBE2E6A33989C7686815FFE0651BE47D42F55C2F32A67A221495A8BEBF043D853DF7B244A68F89390044210E52DD3D
Malicious:	false
Reputation:	unknown
Preview:	........2"X.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...\|.`...}.r.....z.......................................................................0.....p...........".....f.....O.......................c...........1.....~.....m.........................................z..........................................................U.................y.......................x.......................A...................................j.............................v...........................................................6.................b...........z.............................z...........%.................c...........o.....7 ..... ..... .....!.....#.....#.....$.....$.....%....-&....e&....'.....'.....(....`(....<)...............*.....,.....,.....-................./...."0....f0.....1.....2.....3....`3.....4....a5.....6...._6.....7.....8.....9.....9.....:.....;.....<.....=....9>....4?.....?....'@.....A.....A....qB.....B.....C.....E.....E

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	999814
Entropy (8bit):	4.292642596004364
Encrypted:	false
SSDEEP:	3072:FUob5vNBksvu/nTuViFo0vYJGVXUPC9hY7xFEMUCG3GRw3RkR3KtOu1zLAQ4BmHs:Fvb5Du/ni50i0r4Q5gRJp5Rprwg
MD5:	EAFB18D633064D0F02A3EFF3EFF9AADD
SHA1:	A8846E473014BE80125630F1C5B51366220FF018
SHA-256:	FCB7C4AEED28AE4D16FA7B82D9571165AAB0FDD46EB65D3AB29007231630CCEF
SHA-512:	D332A4B7F4CB1583A5BF5CE08FDB46661A5BCCBF0A66F7F5AB6CE04367E9BC589588DCB32F443695A3AB129DC50D2962ED4C138F97858639D4EA37C117E23495
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................#.....$.....%..........L.....n.................1.....i.....'.....c.................V.............................F.....L.....I...................................2.................2.....R.....\.....:.................t...........{...............................................o...................................^...........k.................u...............................................V...................................4.................[...........N...........o...........R...........k...........^.....(........................ ..... .....!.....!.....".....".....".....#....B$....x$.....$....f%....,&.....&.....&.....'.....(.....)..........*.....+.....,....Q,.....-....z....../....L/.....0....[1.....2....A2.....3.....4.....5.....6....Y7....c8.....8....q9....z:....X;.....;.....;.....<.....=.....=.... >....A?....5@.....@

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	453603
Entropy (8bit):	5.263221817977717
Encrypted:	false
SSDEEP:	6144:w7Iw1hcujkKorUX7mxbIFYRl1X7ezIrR5sbZKMMEVdED:wswfcugKwUKxbVl1reg56lMr
MD5:	3D0DC94A638F98D9BF3C0F60F89A0C95
SHA1:	A979B04C65832D908305FB0406CB0653271AD744
SHA-256:	A9F9AE23A3BC2AC919C5B46D16B7E1F3BFF73698D2626260196210E101D119C2
SHA-512:	6D687F1EB9A7FDA3791295487063393B8F0A7409B55461B185AAF106C596229DE6988114230625D6504B869D25D7A624BC3B90D66A0BDF561CB05A57D5B87C15
Malicious:	false
Reputation:	unknown
Preview:	........;"O.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.#...t.,...v.A...w.N...y.T...z.c...\|.i...}.{...........................................................................................................q.................L.......................n.................5.......................O.......................C.......................E.......................k...........$.....<.............................i.......................W.......................t...........A.....S.............................`.......................6...............................................).......................".............................p.......................c.........................................3.............................e.......................H.....q.................1.....f.......................).....5.................'.....6.................D.....]...........T.................&.......................>.............................b.......................B.....o.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	441512
Entropy (8bit):	5.436019023287174
Encrypted:	false
SSDEEP:	12288:Zx93W1+5dOY/k7Op7fszJPMh5br46Iofh:Zx93W+rXePMh5n4PS
MD5:	9C18DFA9E69C1D7810132800D084136C
SHA1:	BBAA9576E1B012DF33D79A5DC7776C00E67295E4
SHA-256:	4F3BABCBEC0D138654EC59FD8AB5FD58DA2273237A587928B9687928C7CA10FF
SHA-512:	A82B1E340A25A3858906DED73624BD0BE4B3CCD1F5728560480B4A4E3A78529F5A178D20CF7D95FD55DED7CA4FA95A5FFF87D89F0520EA08B54E7B99C9057D6B
Malicious:	false
Reputation:	unknown
Preview:	........ "j.e.z...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.'...y.-...z.<...\|.B...}.T.....\.....a.....i.....q.....y.................................................................n...........a.....v...........?.....x...................................k.......................l.......................Z.......................[...................................,.....O...........\.................6.......................r...........7.....Q...........q.................0.....\|.......................Q.....v.................4.....Y.....i...........0.....h.....\|...........<.....j.....z...........B.....t.................7.....`.....p.................\.....j...........T.......................b.......................F.....e.....~...........+.....M....._...........L.......................v.................#.......................8.......................F...................................Y.................J.....v.................%.....B.....P.................I.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	455078
Entropy (8bit):	5.3792948383662385
Encrypted:	false
SSDEEP:	6144:HLTFwwa9TZgO73giDngp97gVvG5hHhpXCFbG559toxeGpbhN+gyPTC:rTF89T6gVvG5l1559toxeGpbhNuPTC
MD5:	5CDE06A63C9DC07FDBB0FDC94E403D00
SHA1:	11BE56054908F1F9CD56AB77692FE3717EE91EE8
SHA-256:	3B9ED5ED0DD07D8FA67412A046AB085137542C156876DBFE6F83376571AF91A3
SHA-512:	2716496DCBF76CC2DECE938103813A8DBC17D4C795B4E3459A572DE4F62F9AC0E1788DE3A21F5FB287AD364DECBD541A5E3BDDD406E130D2A9C72118CCEE5390
Malicious:	false
Reputation:	unknown
Preview:	........."..e.B...h.J...i.[...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T.....`.....p.................!.......................p................. .................L.....b.........../.....e.....\|...........'.....P....._.................3.....A.................P.....q...........I.......................^.......................m.................+.......................t...........3.....L.......................#.....q.......................E.......................4.......................6.............................n.......................M.....y.................B.....v.................a.......................p.......................V.....w.................D.....l.....~...........P.......................U.....s.................K.....}.................`.................F.................-.................].................M.....~.................6.....Z.....j...........,.....Z.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	509320
Entropy (8bit):	5.773091636307711
Encrypted:	false
SSDEEP:	12288:v+GWoOB/ZBjSowU/b+Xgv2iWWbafPfCUdxe3mdU8dmo1Qhwal5cNL4U+8/:GIPb71Qhp5ZM
MD5:	B44FCF9FDC4EC7BB5E72CAE30AA15C01
SHA1:	DAAAE4AA7987BCCE299995FEEA5C54F2D77B61D4
SHA-256:	7F1A8392FE3AFF4E6BB4BACBC1F4B395F08ECAFDA9F81E36B41B77FB4AB0BC76
SHA-512:	52B46D7AFFAC4949FA19841D26D2F4BF877E36CBDA4B75F3FF289A7ABE9A80C2A014B1AE23D3079F4D31ED5FA76C320103733284A2C13D99A451810407325674
Malicious:	false
Reputation:	unknown
Preview:	........."o.e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z....\|.0...}.B.....J.....O.....W....._.....g.....n.....u.....\|.....}.....~...................................f...........a.....}...........K........................................w.................,.......................!................. .....2.................?.....e...........[.................8.......................N.......................z...........>.....Z...........k.................G.............................S.....v.......................:.....H.................J.....^.................L.....^.................D.....T.................+.....;.................+.....<...........&.....s.................%.....B.....Y.................#.....I.................9.....N........... .....o.................9.....W.....n...........!.....G.....c...........@................."...................................5.....`.................G.....X.........................................,.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	479561
Entropy (8bit):	5.4365485252742225
Encrypted:	false
SSDEEP:	6144:Z2goEz6oEyiXNBXBLtmiJWpyCp5c4JkjIsR/kVdw:ZXoHHyv5bJvsRcVu
MD5:	DE8FF9456BA9EA999D0D1BC9B831E7CE
SHA1:	1D67C6DD97FCF221C71137CC8B1946368807ABA8
SHA-256:	B32FE8F602EC9800D59806E097E369FD065D8FBF473DA40FD29289493489930C
SHA-512:	5A3A48DDAD801382EC9065C6160698DD746AAE810374C2B772D521A1764E7E0FD2C28C5DD1CDCCB50834D699EE19441713FE10A91DDDEAD46BA0CFF3EDBD6984
Malicious:	false
Reputation:	unknown
Preview:	........."l.e.v...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................r...........Z.....v...........=.....v.............................".................!.....6.............................l...................................H.....x...........m.................H.......................m...................................Y.....r...........~.................C.......................#.......................!.....\|.................$.......................'.....~.......................].......................7.....e.....o...........,.....d.....u...........p.......................x.......................I.....o........... .....K.....c...........\.................@.....e.....~...........F.....~.................a.................N...........(.....>...........?.......................f.......................>.....d.....y...........Q...................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	480680
Entropy (8bit):	5.413568252819253
Encrypted:	false
SSDEEP:	6144:2MyBFs/8K4/ieJVJJxh0plLGDf0wz5+KKSR+v:2MyBFx1z5+KKSR0
MD5:	002D5B37E68A0725DD7D89FE3FC7EC48
SHA1:	545DE8047D3F89150516B95031965ADC8F17DF68
SHA-256:	1FADFF356A7E89A8FF2AF3DDF84F70FD0CE69525C7787F8ADAE10BEED9D76D4E
SHA-512:	ABAD6CBB30A958BB84A521A66636AF4221A9F63774122D3AC3B552503930AD83D343EC4C8109C8031CAB17C546EF7549AA0F87746E39A80F6758FAD28ECEE129
Malicious:	false
Reputation:	unknown
Preview:	........7"S.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.$...t.-...v.B...w.O...y.U...z.d...\|.j...}.\|...........................................................................................................z.................`.................I...........).....D.........../.....s.................:.....d.....t.................H.....Z...........H.........................................h.................,.................+.....;.................Y.....n...........d.................9.......................$.....~.........................................,.......................4.............................u.......................N.....{.................<.....p................._.......................o.......................4.....N....._...........#.....P.....j...........C.......................Y.......................C.....y.................O.................=.................0........... .....g.................n.......................b.......................j.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	498034
Entropy (8bit):	5.462067165925256
Encrypted:	false
SSDEEP:	6144:vTONXXaMqapFzWovxpllKueGP5fBo0xs2h/bulOa:vCXXaMzFzWoJplQuN5Zo8/na
MD5:	7056FC61DE4A16C7F4F5BF44D2E87F8A
SHA1:	99D16DCB3B1AEFC472601439F630E1244B1AA277
SHA-256:	B7BA9435D82F6BEDD7005B6E868EE86F0BB6C4D7B312FE5F5D4AFBD440AD5B85
SHA-512:	529152DA39F7ADE6713206FA9F767B35B9BF03816387579522EEA78AC7D0E150BAD557FCDBEF51E76D52E39F61A0B4E54FF6A3B592EB7E34FAFDB98AFE460F7C
Malicious:	false
Reputation:	unknown
Preview:	........."u.e.d...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....q.....r.....t.............................A.................9.................3.....G...........N.................?......................._.......................B.......................Q...................................L.....p...........N.......................r.................-.......................~...........N.....\|.................9.....V.......................%.....v.......................[.......................X.......................E.............................k.......................S.........................................M.............................e.......................j.................7.................".....t.......................e................................... .....5...........2.................'.......................t.................$.....x.......................z...........9.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	816954
Entropy (8bit):	4.834266897182259
Encrypted:	false
SSDEEP:	12288:m35b4e7TKfQjRo4YS7yODNKg/z+iIaJqShsNoqcnYHReXN2hsO3j/MvbzvMCsjAF:mlPf+V5l6pz
MD5:	91379A583D22FA9343ED466C261366FF
SHA1:	61E8C39235945C4F38807B14AC74DA7D3257759A
SHA-256:	0D4D0B8052519848ABD182C44DFBF444A77A0C6994965C4A3001F0A3A4D1459E
SHA-512:	DDE26B59A1E5F94D5B245F47399D7A9D3DB8D247037331A471C39B1D7E79E236C5A0732FEA4C53B843D8EAFF1F54CA155A816A193B7BAA870FC458A5AADF76BE
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.:...h.B...i.S...j._...k.n...l.y...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................#.....+.....3.....:.....A.....H.....I.....J.....L.....i.............................F.......................(.......................Y.............................\...........E...........M.....p...........".....f.....}.....1...........#....._.....R.............................".....t...........P...........1.....V.................8.....e.....i.....c...........2...........E.....r...........3.......................t................./...........4.....m...........8.................7...........:.....u...................................W.......................(...........t...........).......................i.............................!.......................C...................................-...........\...............................................7.............................0...............................................;.....T.....,...........I

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	514787
Entropy (8bit):	5.823755040121771
Encrypted:	false
SSDEEP:	12288:MjsFAECOdqsskQcNfytiEmap5DvojL6xuXLPxt9Y:2ydqswgyRp5UjLnlt6
MD5:	78BC785A75EE512391A9CB462A771C09
SHA1:	229D39E017174DC0A8CEFCFCC72B0FECA94D6208
SHA-256:	EC15C82956EBDDB7B246C78045AD414ED34CA97D890A915070E252C8715096B0
SHA-512:	96556F6072E69351E1BBCE06BBF896B1AD53060C7CBAF7928EEBBE0F610F5E8778B2B8B97A5A268B7942A1C8D1ADC6BEA0403383A2A5BB99049437E95D575EA0
Malicious:	false
Reputation:	unknown
Preview:	........."u.e.d...h.l...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....y.............................l..............................................._...........3.....M.................W.....n...........=.....l.................8.....a.....u...........N.................C.................2...........).....d.....}...........`.................3.............................).....z.................K.....k.................A.....g.....y...........:.....a.....s...........S.........................................&.......................7.......................V.............................1.....\|.................4.....O.....c.................4.....I.................K.....[...........X.................-.....{.................1.......................Q.............................S.................N.........................................+.........................................I.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	494964
Entropy (8bit):	5.49413802901098
Encrypted:	false
SSDEEP:	12288:tWAZlfdLptj7B2jJiV95b0cnJHje7i/fzvJqv:tlZDptjrV95b0cui/fzvi
MD5:	E76E473C419C25768B08A95A2822918F
SHA1:	0FA7E2FCABB03A8788F50F1D4B4EB383C833E9BA
SHA-256:	FCD27A9F5CB4B4BE373DA7076A8232006EBE020999FDF90D20745F16CD7EF223
SHA-512:	E39AE0ACBB7D148D6ADE676D92E83FA9FB433230BAE4339C31693A538198BF0679ADEF51883B96F8DFBCC8593A982544C64A2B265897F35A693183B27070EA5B
Malicious:	false
Reputation:	unknown
Preview:	........."..e.F...h.N...i._...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....h.....v.................+.................&.................-.....>...........J.........................................#.............................r.................'.......................g.................3.................K.....a...........5.....l.................z.................k...........<.....b.................(.....@.......................%.........................................<.....P.................J.....[...........A.......................S.......................W.......................s.................*.............................d......................._.................0.......................a.......................Z.......................z.................,...........v.......................6.................5.......................1.......................#.............

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	763089
Entropy (8bit):	4.7513575774952015
Encrypted:	false
SSDEEP:	12288:5cDypz07IT6KvuDeqIdl11i8gFeYTotLA5s2MxMxmobA370JMS/k/M:5ceV3QCA5exBI
MD5:	48ABF758A49E2E8AAB013F2BF56091C0
SHA1:	CA909BC28B03BF959AC32E218A318289E0BADBF0
SHA-256:	B4CF2D19B5E443B57CA9D1189880458A7CACFE1C8B231265557A3FB58F597617
SHA-512:	22D65DF1CD35A8127296420A699F26EDF55813FD6A970050DC9B2B051AAF7DA2CF2FE6314A94977587021C02AA7D8B42541E1D08D5940FB7E1AF127E87268C68
Malicious:	false
Reputation:	unknown
Preview:	........&"d.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v. ...w.-...y.3...z.B...\|.H...}.Z.....b.....g.....o.....w.................................................................?.....,...........m...........e...........r.................[...........#.......................I...........x.................w...........4.....K.......................G.....G.............................-.................v...........o...........z.....1.............................i...........6...................................>.....a...........^.................y...........z...........I.................?...........X.................Z.................>...........m.......................[.............................=.....e...........t.......................&.....s...........`...........S...........F.............................f.......................G.............................K.....i.....W...... ....p ..... ....t!....."....S"....t"....."....o#.....#.....#.....$....=%.....%

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	444074
Entropy (8bit):	5.5541915821924555
Encrypted:	false
SSDEEP:	6144:NoWjWd1DOBvgqLMxTFyxycT4RFcm/8GM4iMjSO9DE/xWcqVj5fY5p6gKb7:NoyWHwvg9FN5w5po
MD5:	06C878C1538813E5938D087770058B44
SHA1:	C8AB9B516B8470BDEE86483151AE76368646BFFC
SHA-256:	90DC45426BC1302AA05261F136881DDF038272E9AC315297AA8E5DAE2B31109B
SHA-512:	6DDF615BCF0A8C62221233687BAE1EEDA5CFD749AA8ACC179D6650987289201B405EDD453FC181A1D250EBA9BBDF61EA28FB7C694539FAE3D320BFDEA56665CC
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h."...i.3...j.?...k.N...l.Y...n.a...o.f...p.s...q.y...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................!.....(.....)..........,.....=.....O.....c.....w...........\|.................C...................................L.....e...........5.....n.................@.....o.................?.....p.................d.................6.......................i.......................s...........".....2.................y............................7.............................d.......................A.......................5.......................B.......................7.......................'...............................................).......................>.............................g.......................8.....Y.....k...........C.......................d.......................U.....}.................K.....................................................3.....Y...........%.....U.....h................. .........................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	466983
Entropy (8bit):	5.347321289295822
Encrypted:	false
SSDEEP:	12288:DYetNRoQ8cizJcrZ5DFCXRdPUNbQGRL8D5o8j2g7C5v3iZVqBce/Bruh2:0wNRoQszG5vX
MD5:	55241312A3AABA14A6B19A9012CA25B8
SHA1:	69FADF0817FAEC3BC6B018F0AF5F63378ADE0939
SHA-256:	722C86BD857A93AE06CA0B7CFE2CC04237A7ED5A52586CAB7246336C802ABE37
SHA-512:	612F815C25E9F593D1F1C4DE8E9016DCE048CFE90F21319C4CDBB5772580CB8C71229E9DDBA60852CD0BEC80A07A783ACE24F873D90DC3323E5FDCC44905F2C7
Malicious:	false
Reputation:	unknown
Preview:	........."p.e.n...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.$...\|.*...}.<.....D.....I.....Q.....Y.....a.....h.....o.....v.....w.....x.....}.............................O.................4.................B.....T...........G.......................`.......................Q.....\|.................6.....e.....s...........@.....t...........".......................o.................".....}.......................~.................+...........:.......................Z.......................+.....N.....W.......................#.................Q....._.................D.....V.................W.....b.................9.....F.................9.....B...........&.....l.................8.....d.................B.....s.................T................. .....\|.................R.......................-.....z.................;.......................z...........O.....c...........E.........................................`...................................5.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	1205916
Entropy (8bit):	4.040140087934281
Encrypted:	false
SSDEEP:	6144:tP3cOQSyU/FnX0m/5HqMh/Y56zxtRqcA25tm1vYpiMyk:5XX/5KWY56zscA25tm1vYpiMyk
MD5:	2C0A9CC4A7C775FF13A6888234265CAB
SHA1:	497BDE42737667FC833BBB9D8A9EDAF014D99957
SHA-256:	1DD55659EF21082B9D58BED50F387C0E1FC0F28D0EDE52251B9ADA25ED2A657F
SHA-512:	B862221CF17D3F2CA0495A8A3E1F630AB915FD9B2A46AC16C71DEFFEE9A6F71264A8550233781474D60CC6001A48C7C658C77D4E0DBD5B543E768928119D2F0F
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.(...h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....=.....k.................:...........5...........$.....v...........`...........(...........Z.................%.............................O...........j.....L.........................................m...........u...................................;.....c...........7.................................................................8...........m.....I...................................9.....d.....n...........L.....C.....4.............................3 ....a ....Z!....J".....".....".....#.....$....Z%.....%.....&....:(.....)....Z)....U*....=+.....+.....+.....,.....-.....-....F....../.....0.....0.....1....E2....S3.....3....[4....35.....5....I6.....6.....7.....8....[9.....9....+;....><.....=....p=....\?....FA.....B.....B....DD....QE.....F....{F.....G.....I.....I....'J....+K.....L.....L.....L.....N....9O.....O

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	1115461
Entropy (8bit):	4.293134907326594
Encrypted:	false
SSDEEP:	12288:0xWx17McKN4Ceht/d49Hwb0orWp0Bi3p1FayNdiTlC2pegqNFOVLrOo54NwQvw9k:0Ge35HMjE
MD5:	5F9B7A945638B88E75A3175A7923119D
SHA1:	6AF614F2CBD72DA2224F48A203A6430A623FC7ED
SHA-256:	3B476D2CE7C72C3A10170808020DC3F1A87309F9F725B08217C4716B28D10888
SHA-512:	3B66C9152EC032D6F2372AE5075CBFE7D0FB398C4BF173A7F8C76D91D9EAA816E6F839B90884533B46A9224E9FB52C4D439B3D1907885B8E9F80C5C55A852B65
Malicious:	false
Reputation:	unknown
Preview:	........1"Y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.!...t....v.?...w.L...y.R...z.a...\|.g...}.y.............................................................................%.....b...........T.......................)...................................p.......................................................................c.............................K.......................8.....n.....b...........9.....u.....l...........?...............................................1.................!.....V...........D.............................4.....u.................@.......................".....i...........Z............ ....1!....."....w".....".....#.....$....,%....p%.....&.....'....\(.....(.....)....Q...............+....S,.....,.....,.....-....:...........3/.....0.....1.....2.....2.....3....l4.....4.....5....T6....27.....7.....8....N9.....:.....:.....:.....<....J>....{?.....?....>A....OB.....C....zC.....D.....E....IF.....F.....G....hH.....H.....I....jJ....eK.....L

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	940464
Entropy (8bit):	4.333123617146776
Encrypted:	false
SSDEEP:	12288:vn0UN9LyZYA1T7z1L/LpftQvsYnDROgv1V5UdZWLRffgstBjj8/qGvdw3lozG2IC:vn03ok5j5x
MD5:	84AD3F888C0EC307BB7B8C278CD36757
SHA1:	948A5F8B43D059280D5374CA6D66E8DFC6A76D49
SHA-256:	56665860FE6577FBE00543A47A15E10ECEAE83458815F2989D179E42AF07F81B
SHA-512:	7001C0607DF927145E40A605E2B97914D02712D11E09CA20339CB1AEFB042A1F853FD06E78B76F6DC6F19B6DF837BCA12946A3470C6C064CA767AF1DB57042E5
Malicious:	false
Reputation:	unknown
Preview:	........O!;.e.....h.....i.....j.....k.....l.....o.....p.....q.#...r./...s.@...t.I...v.^...w.k...y.q...z.....\|.....}.....................................................................................7.............................n...........u...........v.............................Y...........m...........`.........................................T.....m...........K...........4.....+...........<...........[.......................u.......................}.....&...............................................U.......................`.......................J.......................R.......................r...............................................h.......................c...............................................@.................z...........E.....\|.......................1.....Q.............................!.....X...........] ..... ....F!....\|!....{".....".....#.....#.....$.....%....N&....o&.....'.....(....s).....).........~+.....+....,.....,....v-.....-.....-.........../....T0

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	476860
Entropy (8bit):	5.622879660217315
Encrypted:	false
SSDEEP:	6144:FQ9HSLQl2q4qRv75az4lTxJXZvqcf4Sd9Ipksge7545/R+Ei1OCvdhAMTwiBK+66:F4SEl2q4qzaklVBhIpV545/g
MD5:	0AEDF5C2F6F4F49074A2ADEA454DF4C9
SHA1:	A48D9D8461E61170257897766DBD6906E754A0C3
SHA-256:	3F4658B3811B36F5CAD794E48E6507335ABFE78B0BFA0C80D1EF9C5D7BB410D0
SHA-512:	E359E446330FC154C16E34A7335174F372BCE701FAF85DE8A5F4B432CE3E10C69F42C93B7182DEAC89BB4D29750D0DD525B6DCD74A5B7BD724F544D14BA44A79
Malicious:	false
Reputation:	unknown
Preview:	........G"C.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.%...r.1...s.B...t.K...v.`...w.m...y.s...z.....\|.....}...........................................................................................5...........X.................7.......................q...........,.....G.................C.....V.................&.....5.......................*.................,.....N...........A.......................f.......................].........................................].................-.......................3.................!.....2.......................,.......................;.................A.....R.................E.....R.................>.....J.................C.....P...........U.................'.......................(.....u.......................\.......................}.................9....................... .....y.................8.............................6.................N.............................4.....z.................Z.......................x.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	817430
Entropy (8bit):	4.86581943160599
Encrypted:	false
SSDEEP:	12288:LVaMf4WifCrn2RIxnaLIN0ZCViZIJ7I5SB3IjzAJmEIl5ujLNiXElqb1EfC:Ld1i6rxI95bE2
MD5:	64AA9344ABD9A32F10D6C05A58EDA4EB
SHA1:	3286EE43F36E2232677B4573E8B4A3303C7DF048
SHA-256:	CA20AF5982AE706F5029467901D7D66F90B261F03C7D240D0D1AB2FCA2B50A7B
SHA-512:	DD768B314DA50B8BA5A006A4E56D70044C1AF79960834722894D930F5347194AE7F9F5697BC4CD0790A79341635CB1DF8C74FF45F74D1736049161AF5B163EFB
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.....i.....j.....k.....l.....n.....o.$...p.1...q.7...r.C...s.T...t.]...v.r...w.....y.....z.....\|.....}...............................................................................#.....M...........s.....6......................./.......................=.......................X........................................H...........4.....I........................................Y...........G...........A.....g.......................$......................./.................j...........2...................................J.....k...........j.................z...........x...........4.................)...........:.................,.............................$.....n.................R......................./.....s.................k.................g.............................J...........9...........:.....n...........B.................3.......................<...................................m...........7...........v ..... ..... ....w!.....!....3"....P"....$#.....#....@$

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	713246
Entropy (8bit):	5.136901438119978
Encrypted:	false
SSDEEP:	12288:5xU+Nw5U8PoF8xxyWJM5T5BZPEFYWmumwQYrSwadcJKwUzu8co/9NjjFpvTg:5xP955DW3
MD5:	88EEF2798DEE8A361C3EA9BAFAA02A35
SHA1:	6F8D4CE422336CA5048EF35D6ECE360A9B416D8A
SHA-256:	91318006C880E427417A2B2FFF81FD451769A5536FA16D1DC185972137BC2D6A
SHA-512:	DB36B58186F165FF3F746AC483F75B6FED596FAD9B3F335E86B374B359E563407ACF58AC7CDED9420E4FCB91F31EEBC8A91C7777EA59BAFCED8CFF2F1C0E9A53
Malicious:	false
Reputation:	unknown
Preview:	........."z.e.Z...h.b...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.....~.............................p........... .........................................+.....`.......................>...........I.................L.................;...........G.............................}...........^...........N.....m.........................................;.....g.....E.......................@...................................:.....\...........E.................=................./...........N.................P.................3.........../.....{.........................................u.......................,.....r...........".......................k...........+.....L.......................N...........O.................[...........6.....\.................(.....Y.....)...........`...........h.............................5................._.................H...........\| .....

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	564786
Entropy (8bit):	5.797828508773141
Encrypted:	false
SSDEEP:	12288:KwEm5WJNuE+ciwJFrAsUaBScxgsHlZ0JdHqRPzaM508ETCoFAi1PzisTm7oA:TAJoE+ciwJFgaTxgsHf0J4P508uCri1c
MD5:	4C5C09CB7E6EB120C8019FE94E1AC716
SHA1:	F018E7F095605E21DB24944B828CC3580CBA863F
SHA-256:	E7319CA18EBA379772954132493BBABB448D4E97D755B85360ED337216B48800
SHA-512:	D171EE83CF02A8904290A74DF1224556887E41333B8A01FBD95F0CACC88D230195FBFB6F99F9E02573D4864B3C95B570A77C2A0B1E19324D2599925E40684807
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.....h.....i.....j.....k.....l.....n.....o.....p. ...q.&...r.2...s.C...t.L...v.a...w.n...y.t...z.....\|.....}.....................................................................................$.....C.......................5...........I.................c...........W.....}...........~.................>.......................3...................................O...........A...........S...............................................G.....^...................................\.................`.......................z.................%.................A.....R...........P........................................./.......................D.......................W.............................b.................g.................2.................1...........(.....^.....~.....'...........#.....r...........V.................;...................................W.....~.....!...........7.....K.......................H...........1.....f.................R.................7.................@.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	408159
Entropy (8bit):	6.667080735281946
Encrypted:	false
SSDEEP:	6144:iDL1fUjJVNmz7+anG7a5DnyykkFS5C4TNpI3DaNllf:sGJV4zia/5Dny2S5jTNpI3DY
MD5:	07B6C43D87DBF93AC8ABE6837F3C2103
SHA1:	79E033179B445609B3F1756C3F4184D5EFACF1C2
SHA-256:	7F85B35938FADCA91BFD8F92CA53613718E375EF010C340947DD27A4FF66594C
SHA-512:	38EF8F8A8A950B11C18EB7A40DA721B888EF792A49E1371DC8C1EB22058A6791F95BF9B25DF4BA190A7AA6CB62CE38B0BFAEA83C71B62CDE6980D12CF9DA53F9
Malicious:	false
Reputation:	unknown
Preview:	.........!..e.h...h.p...i.x...j.{...k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...................%.....-.....<.....A.....I.....P.....W.....Y.....^.....g.....s.........................................E.......................C.......................N.......................R.......................*.....w.......................X.....~.................s.................%.............................h.......................T.......................j.......................I.....c.....}.................6.....B.............................i.......................q.......................Q.......................6.............................`.......................{.................".....k.......................G.....l.................:.....^.....p.................Q.....q.......................&...............................................1.................b.....t...........@.....x.................=.....c.....r.................#.....3.......................%.......

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	404179
Entropy (8bit):	6.680398224941187
Encrypted:	false
SSDEEP:	6144:SpyK3dSRMig8KJ392h2Du0AhVF5a5nzICFG0yn/9yYTo:k2dgpfAhVF5a5nzjqn/e
MD5:	960E99A171C4ED4B6D787027BA88774D
SHA1:	E3869AFF0C52841C9DF718133E7C4BE2977DE7FB
SHA-256:	E42640F5309ADD2EA7FD5A4DB503B93E479EF14807710A06D7E53A0F261DA8E6
SHA-512:	4E51D787AFF8F425D101882BD70E71B88B253F2CA61ED54DD7FF77C7E3A1D6570B270F4EB91F2D03869EA4537D09E141F3E32EA3A27537295EC698BF26305CBF
Malicious:	false
Reputation:	unknown
Preview:	........t!..e."...h....i.;...j.?...k.N...l.Y...n.a...o.f...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....\|.....}.......................................................".....+.....7.....F.....U...........E.......................=.....f.....r...........2.....d.....v.........../....._.....t.................E.....Q.............................y.......................m.......................e.......................M.......................<.......................R.......................X.............................V.....v.................!.....D.....S.................$.....0.............................f.......................N.......................&.....{.......................x.......................S.....m.......................3.......................)............................p.......................+.....z.......................b.........................................Z.......................l.......................6.....w.......................C.....j.....\|...........5.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	5409591
Entropy (8bit):	7.995554964553005
Encrypted:	true
SSDEEP:	98304:SUUxSt0AoqmWPV95jG1p60RCPNSIh1SUeCQ29GrwrJ9ctYXiQxSlzY7G/bh4sWrr:SUUktgqdd95jghUV/hQUeCN8krJ9YY+A
MD5:	2694D3CA546E9BA8B37201741D1B8FFA
SHA1:	322EE81DB1036EBA84D8991BFCB2E6D829B9D632
SHA-256:	F66BA8D1C1ACD35F244965433D5CFEB1D0FB3B81AFC630F131AD9C9E288D03E0
SHA-512:	4D555C61040D48CC8E2237867885A0651CFB4166FEB0F18E4A442540E1C1123571B1298125507D98B4C833717A9E4D732C8C6B2C487009C639BC3447740CE60A
Malicious:	true
Reputation:	unknown
Preview:	........"...f.....{.X)..\|.,,..~../....;B....aD.....E.....O....q...........5...................................f...........A.....a.....?..........<.....<.....<.....<O....<~....<.....<.....<.....<.....<L1...<B8...<M<...<.<..P=.<..Q=.@..R=.B..Y=BG..Z="K..[=.T..\=ec..c=...d=t...e=....f=...g=#...h=....i=....j=%...k=....m=[...n=.....=.....=....=.....=.....=.....=.....=.....= ....=.....=.....Dl....D.....D;....D.....D.....D.....Dq....D.....D~!...Du-...D58...D.I...D.[..pI.l..qI.y..rI....sI:...tI ...uI...vI...wI....xI=...yIi...zI....VJB...WJ....ZZQ...[Z...\Z....]Z....^Z...._Zs...`Z. ..aZx#..bZ.'..cZ.(..dZ...eZ.,...ZV;...Z.A...Z.F...Z.G...Z.K...Z*_...Z.g...Z.j...Zmm...Z~v...Z.{...Z9....Z1....Z.....[.....[.....[w....[.....[.....[(....[.....[f....[.....[.....[7....[.\|...[A...~.........................<...........<.....-...............................................N.....6......................................... ...........$.....Y................_...........w............................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	1262
Entropy (8bit):	5.412279038895346
Encrypted:	false
SSDEEP:	24:v/WFGWvVB/yvVlx1RnQnkfP4RRg5RuBRGHC:v/WkUVB/QVDQkfgR65RKR7
MD5:	5B34CDA07F9DB2DCD583C98C2A357C9A
SHA1:	75116E9EB0BD4D967E4E1409E8CA321DF74AB658
SHA-256:	E20A734E0B2CA43293B87CFA8F31AB43EAF99A89F90482502492546D7E34141D
SHA-512:	C4E5D699A10219FE649D848CD60547D73089EF007F38BB905947068792C3E76D1A173B274ED69CD43C85A7B6F10B90BBFDD426EC63E24741F799619EE94CA450
Malicious:	false
Reputation:	unknown
Preview:	................{"files":{"main.js":{"size":689,"offset":"0","integrity":{"algorithm":"SHA256","hash":"692b0b0bb4388cc72d7fbebd13608c779fd28ed6792ac38db8fdaae3e55391e9","blockSize":4194304,"blocks":["692b0b0bb4388cc72d7fbebd13608c779fd28ed6792ac38db8fdaae3e55391e9"]}},"package.json":{"size":53,"offset":"689","integrity":{"algorithm":"SHA256","hash":"d3565de5ec307c1dcc57fc9550976e67bac071eab7970673f63b6a6ccca24baf","blockSize":4194304,"blocks":["d3565de5ec307c1dcc57fc9550976e67bac071eab7970673f63b6a6ccca24baf"]}}}}...const path = require('path');..const Module = require('module');..const { app } = require('electron');....// Parse command line options...const argv = process.argv.slice(1);....let file = "";..for (const arg of argv) {.. if (arg.match(/^--app=/)) {.. file = arg.split('=')[1];.. break;.. } else {.. file = arg;.. break;.. }..}....function loadApplicationPackage (packagePath) {.. try {.. // Override app name and version... packagePath = path.resolve(packa

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar.sig

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (684)
Category:	dropped
Size (bytes):	685
Entropy (8bit):	5.947506019169076
Encrypted:	false
SSDEEP:	12:xjRe3mjT7X7ovJZ46imOX6oDdHJ62RgjFklzBLpHUDyY7PdKfFlbln:xjI3mjf76o6imQtDZ+xwR+pKdlRn
MD5:	2F8397E50536FB945500F7242D9EEACF
SHA1:	C18EE272D0ED2269844BE4DF93BF4E26028944DF
SHA-256:	83840B400EF2A00E9CBB6299DEA20DFCC0DFD9689D382169C0301D89B51A8E88
SHA-512:	F6B48EDB8E608837BE9ACB40AB3CC56C5A5668716B960EC31946CFBBC80BB7E4E7F118BC3041AADE76D0F8B2D28D7C1CCA4DE26E48BBCFE86326A124172F262B
Malicious:	false
Reputation:	unknown
Preview:	En79ab3KpCJVSQy9cdi2nTsRH+OuEiF7lzGxoXVPNNIqUu6PWra5wK1BuQM7/8aM1zLhamhr6eeUxeMkzZv1rdXlI5k4ykt3eddiJTFwAQ+J1AkkwquVDaeWMQU9GKkIcAkNzPr7v93z+tMd/hhY5ekNQMczHuaZkjXTezXd/sZ41F5RWNsBnC1Xky7YQ7OLj0GdwKTKpJHeInkHTn/pz/NKuHB7s9q2FCU/WPUb3lgQDuz9d969vJjqscG46iuRLcBxLV6IKgayw+kOzlTR6ZJM3FCM5KGVaDD+4vIF5qO/ZQEqx7//nlcigPTBiMIoC050mRz9rNYl7oVVFB7CP2cna+5dlACsc7s/3jPX971ofpTRV7ZmXwAXE+VAQX+FO3/4p3Esn1GjtQTX+WeE/7v/FMvMCnZ5t/2RbhAUkaPhleVYwhUEfEY0tFT88zh6jmNSjrTtMl3IrLMnIkVdY5s4FMlP6ZB859FdvGhfAazqpQZsbvb5rZf3WVfKd5cZ6fZ2V2X0qW1cL7rSkB1zMVEcvyJirWuUiSx3/IFtcMWTubq8amswGNTRYyVxQoEEof+ekQNysuOoGEpEGkX6oETY88FSOYZxBZGBAgBp8MGY0Gew7CWnQja3QxeuPTpx+9tS9Y0saAcwUS3yToOWCUUPSftY0XOpfoiVPeOjolM=.

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	166021264
Entropy (8bit):	6.737540703169629
Encrypted:	false
SSDEEP:	1572864:I69T1tvks4hW81ZG8M1wDxA2td8ql5kMyIjPmreeatjGqyoWdy9l28+6ChQphDKp:W6Y/U84
MD5:	EECF7A555E3BBE3C95008DADE51C9322
SHA1:	9AF0F383838125D1B50455325CEFEB784F673140
SHA-256:	2AF8C0E0F20B19D2845DD823D0353B338A84EEFDC4E0186131FDDB0680152772
SHA-512:	B5BD8AB13FC9A2AA0EB51148BCC06982C787727ED5F3CA0CD7B288E1AD15E538AD18C12F39E32431DE09389CF620D0E9CB7090A039D018455915F0ED3D46B73C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....ce.........."...................,........@..............................!......I....`.............................................i6..$...T.......\|}.......<B......:...0...v...Ux......................Px.(.......@..............H....8..`....................text...)........................... ..`.rdata..."s......$s.................@..@.data....mD......n.................@....pdata...<B......>B..b..............@..@.00cfg..0...........................@..@.gxfg...@B.......D..................@..@.retplne..... ...........................rodata......0...................... ..`.tls.........P......................@...CPADinfo8....`......................@...LZMADEC......p...................... ..`_RDATA..\...........................@..@malloc_h............................ ..`.rsrc...\|}.......~..................@..@.reloc...v...0...x..................@..B................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	268732
Entropy (8bit):	4.129712207392431
Encrypted:	false
SSDEEP:	3072:rbr3R2ER50fFjzgZ911bECxLyuUR27gLz3jzOXSO2xQJjKbCP:rP3R2E0fFCFbECxe527gvk
MD5:	40A3C2200E4126E8C47A7802532C9236
SHA1:	212A4686DEA5A467B7B6FA54397E42122B235F1E
SHA-256:	94AA518FC892EE9A0F1EB5FE35B60123EE61A5F848864B00519B96D8D5D9786D
SHA-512:	FA1A943822ABE3737587D520654078117CAE86C58FEFE6DD6A09F4A08C09293E9547A0AD79C52F8638DFBB1C496DF3D0E828CE414176C8FBB77113BE41212866
Malicious:	false
Reputation:	unknown
Preview:	.........J\|j11.6.189.22-electron.0...............................................c...z......X...a........a........a........ar.......a........a..............m.D.-.....q....`$.......y.D.1.....e....`$.......D.5.....q....`$.........D.9.....q....`$.........D.=.....q....`$.......Y.D.A.....q....`$.......D.E.....q....`$.......D.I.....q....`$.......}.D.M.....i....`$.......D.Q.....q....`$......ID.U.....q....`$.......D.Y.....q....`$.......D.].....q....`$....(Jb...(L.....@..F^.!..%.`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	595812
Entropy (8bit):	5.22268730962
Encrypted:	false
SSDEEP:	6144:6TY0P3R2EpdCFbECxUg8zifcarDJI2GZaGKtQPd9ZVetBRkPjBgnYAz7E:m5itRHtQfVEP7E
MD5:	264E3B574E4F86B1FC47B2427402E779
SHA1:	4A4F9E7C3DA262713E4CF7AF6AC51822C56B5EF3
SHA-256:	ED559C6E81B6003B2057E5C1B0BDB5B28CA094B895CA86C69FE11C5C9E014F06
SHA-512:	144365D0FB83576AAA02EA6ECEA51D7BA2CACB044EEA568A08F65B98A83D3E7D7E693738E065E22F94BFD1165D0EA93A749DD1325D829257A9BB6607A9A927DB
Malicious:	false
Reputation:	unknown
Preview:	...........11.6.189.22-electron.0..........................................(...tY......................a........a........aT.......ar.......a........a..............m.D.-.....q....`$.......y.D.1.....e....`$.......D.5.....q....`$.........D.9.....q....`$.........D.=.....q....`$.......Y.D.A.....q....`$.......D.E.....q....`$.......D.I.....q....`$.......}.D.M.....i....`$.......D.Q.....q....`$......ID.U.....q....`$.......D.Y.....q....`$.......D.].....q....`$....(Jb...(L.....@..F^.!..%.`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...........................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\version

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	1.9182958340544896
Encrypted:	false
SSDEEP:	3:XTLUn:En
MD5:	AE2106EA876113FD0B975AEDEBAD2F89
SHA1:	ADDBF88EEA9506928B8F4665D8103F4AA9FBD070
SHA-256:	E21F1B660AA2C8675DBC6486B0D9CCB5EC9CBB988098E9905E2B49B8C1DC94F8
SHA-512:	37CD1E08432469D75F4CA939D5B57ED3AFBB4232395D6BE9C6B49652EABA6C4BA8006DA16CE9E988A99E61C7B54BDDE36A375F84A464D9D3D14C105A2385E94A
Malicious:	false
Reputation:	unknown
Preview:	26.6.1

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5142528
Entropy (8bit):	6.355922756005317
Encrypted:	false
SSDEEP:	49152:J6PkZFjyeDTIEvAvlo6coVQxa8sVr06l1Z+MuXy55KfD5KNt7wpr30sN+05uQKYY:JNZFjYgpOz0ueCCA2EmgCvGRKw
MD5:	B7A271574FE36F3134D72FB86DECCA02
SHA1:	9C9B26F2C137D0439B938F6D2ED80F830F7D0F2E
SHA-256:	DA25A529E78CA6068CB84DAD50E43B054357C887DF434A0E083B266279CC16A0
SHA-512:	E45AA72D82883E51CD3C6DFF02C4B2CFEC063B82D53C4620963C80C406302DE8EA5F723DDAF4E084BBCEE2678413150654FA5B979F5035A8870BBF1802CFC14C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....ce.........." ......=.........0P6.......................................O.....+.N...`A..........................................I.~...>.I.P....0O......PM..d...:N..>...@O..}...LI......................KI.(...@.=.@............I.P............................text...O.=.......=................. ..`.rdata..4.....=.......=.............@..@.data...P.....J.......J.............@....pdata...d...PM..f....L.............@..@.00cfg..8.....N.......M.............@..@.gxfg....,....N.......M.............@..@.retplne......O.......M..................tls....Y.....O.......M.............@..._RDATA..\.... O.......M.............@..@.rsrc........0O.......M.............@..@.reloc...}...@O..~....M.............@..B................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Program Files\ReasonLabs\Common\Client\v1.4.2\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	955392
Entropy (8bit):	6.604758673715379
Encrypted:	false
SSDEEP:	24576:QA9nIy2rMjWPvnaFUNUQp466Z5WoDYsHs6g3P0zAk7Rjnl:Nt2Yj0n7NU766Z5WoDYsHs6g3P0zAk7n
MD5:	813EEB7306256D152733E03274364DD4
SHA1:	FE23BE85A45D060F05B5CB4F05D9DD2642AAE1E6
SHA-256:	DC51D2BE2E03AB812A3CBE11824B7B79F627C0D7C4608E91C0D9095AE92BB693
SHA-512:	CCE9CC47ECB51F8F55BFC4F86F849FDAC8A642997C2CFC1F310676C7C1014F7BB814A364630BF528CDB489E0D93654631A908C44181BF22B5BD5A60D5118764C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....ce.........." ................................................................g.....`A........................................0...<!..l...P...............Lq...V...>......T...............................(...@...@............................................text...V........................... ..`.rdata..4...........................@..@.data....M....... ..................@....pdata..Lq.......r..................@..@.00cfg..8....`......................@..@.gxfg...P(...p...*..................@..@.retplne.............>...................tls.................@..............@..._RDATA..\............B..............@..@.rsrc................D..............@..@.reloc..T............H..............@..B................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	814440
Entropy (8bit):	6.475715690608882
Encrypted:	false
SSDEEP:	12288:DkaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1Ok:BJll87GY2q61llaOZBjKt5qqxG
MD5:	3068531529196A5F3C9CB369B8A6A37F
SHA1:	2C2B725964CA47F4D627CF323613538CA1DA94D2
SHA-256:	688533610FACDD062F37FF95B0FD7D75235C76901C543C4F708CFAA1850D6FAC
SHA-512:	7F2D29A46832A9A9634A7F58E2263C9EC74C42CBA60EE12B5BB3654EA9CC5EC8CA28B930BA68F238891CB02CF44F3D7AD600BCA04B5F6389387233601F7276EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lC. ("rs("rs("rscZqr""rscZwr."rscZvr;"rszWvr8"rszWqr""rszWwrv"rscZtr)"rscZsr?"rs("ss."rs.W{r "rs.W.s)"rs(".s)"rs.Wpr)"rsRich("rs........................PE..d...x6.d.........."......\...........(.........@....................................0.....`.................................................T........`..p.......xW..."..hK...p..........p...............................8............p...............................text....Z.......\.................. ..`.rdata...'...p...(...`..............@..@.data....F.......*..................@....pdata..xW.......X..................@..@_RDATA.......P......................@..@.rsrc...p....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Program Files\ReasonLabs\EDR\Dia2Lib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58000
Entropy (8bit):	6.450429603336052
Encrypted:	false
SSDEEP:	768:2QMT4Q3O9ymyKJcy3Xs3y4rV50sds8SzUwHhaHRKrLy2Ip4PPCxf1mlD0O:rQCye14oGs8SNhaHi/9PAfIIO
MD5:	771AE99E62F3F041ABA9014682C931AA
SHA1:	96FF034CC69E3F8A2D2FFF736E62401B53033C54
SHA-256:	DCCD68E5689B31CE6AA58E86040773EF68CCE34A47241664172CBDBB2351C4BC
SHA-512:	6AF6D79729931517E68BBB5EC6FA527B6128A814A89C6B68DE42109064B39FDD33F3155ECCEA3CBD300AD6F270CF6C0C4E063FCEDBD85613131177B37D065F07
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.NZ...........!..................... ........@.. ....................................@.................................P...K........................:........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........ ......................P .........................................E...$....8..5>I....zc.9.]hOy......=.....jz.......cxR.Be.mZ...............8.K......o.(...i...3.%.....PO.F...Jq...DBSJB............v4.0.30319......l....Q..#~..,R..d6..#Strings............#US.........#GUID...........#Blob...........W.........%3...................................q...w...#...........$...'.................{.........).....G.....U.....r.............................................

C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.FastSerialization.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79504
Entropy (8bit):	6.220009040083083
Encrypted:	false
SSDEEP:	1536:lG8N6w60T7kWU8EDk26WxvrkJAsSVQ11XVBuBQkjHi/9LfII:lGY6w60T7kWU8EY26WhAAbQ11XVBlkl
MD5:	DA77DE075A56F5D84FD0097A28650ADD
SHA1:	AF8773B88D44A59088295EDB53E2B11DF1AD448B
SHA-256:	316DF4385DB10D7A426C3054007C99E0AD1446AA6E85455D7E7DEDFB6B5D5B5B
SHA-512:	6F2E124FCB1534C76D44CCDED3785043F68BB6D643B002EC71668730BDB4E3FB60186F55FBB65F339FAF9478DA253424C8AE646E850D358797A49D3073652D53
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....i..........." ..0.................. ... ....... .......................`.......1....`.................................e...O.... ...................:...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........~..P...................8........................................0..(........._,..l(2...i...+...]-....X...1.......0..S........./.r...ps3...z~.......+.......2....X....i2...`.+..(....,...Y.e],....X.. ....2....0..!.........Z.. ....6. .....1. .....(....&.j.n\.jX..0............nZ. d.jX.nZ. dm..b.H.E...%.x...(4............0........................,..-..s5...zZri..p......(6...s7...zBr...p~z...(....z6.......(....z"..s8...^r...p..(9...r...ps:...:.(;.....}<...*:.{

C:\Program Files\ReasonLabs\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072656
Entropy (8bit):	5.981049662169802
Encrypted:	false
SSDEEP:	24576:QGPhcAzmc+AzxpCqu6xX/mazyzDS/B6nEL8Esb2X+ThBtQvxqyfMzrvrBrVJ:pWOmczVpCkvmzzDC6nKsbSMQZqy8
MD5:	90999F7893D251FDBFEA7D5D9A13DCAE
SHA1:	BC2CBFE15456C6C22E8A73964DB6C32F490DCBE8
SHA-256:	F8A01AAACD600867AE37C7CD989155BE6729D65A0940813BA4ED0B1462E502DB
SHA-512:	AE73BC354B3CF627F6643C740562FEC045B61C872E29B21C468C4D68287BCF92EE70DE9BBFADCFDBB7099944008868EBEFD8E423F43624CDA7D727C00A4EE3AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ......................../......./...`.....................................O........................:..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......L...L.............................................................{[.....{\...V.(].....}[.....}\......0..A........u........4.,/(^....{[....{[...o_...,.(`....{\....{\...oa...... ... )UU.Z(^....{[...ob...X )UU.Z(`....{\...oc...X...0..b........r...p......%..{[......%q.........-.&.+.......od....%..{\......%q.........-.&.+.......od....(e.....{f.....{g...V.(].....}f.....}g....0..A........u........4.,/(^....{f....{f...o_...,.(`....{g....{g...oa...... B.8' )UU.

C:\Program Files\ReasonLabs\EDR\Microsoft.Win32.Primitives.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.984207052315847
Encrypted:	false
SSDEEP:	384:nN9VWhX3WrrjP9Z95Xa/rl9qX2Ip4X5wCjdAA1m5wMDBu:NGeHRKrLy2Ip4XCCxf1mlD0
MD5:	492C56C6D03D50225215F0FCCB31A2E5
SHA1:	B5C872D6D6DA4195D495B1AA55F10FF35CE1245F
SHA-256:	64F9B2FB46A353BC5F9AAFB240BD8E6A3B8AB6398B1915563CB6AF7AF256669A
SHA-512:	B6238BB5E095F3016DFDC0A667DFCA0B1EC1949F70C98D9C4FF520D42E1C68FC057285425685D4F203A6CE605981F8F8B6DDC9CA572CBF3C1C64F17D01443210
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@..0................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...\|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files\ReasonLabs\EDR\OSExtensions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.750742199085297
Encrypted:	false
SSDEEP:	768:lap2N4EhmXBk4iHj4o9dY6sHRKrLy2Ip4YTxf1mlA6aZ+:Ep23hmRP4nBsHi/9kfInaI
MD5:	3B62657ADB40EF9C4B26C49615A0173C
SHA1:	7F207570DE8F34EB93641FD60DE18108C487ECB6
SHA-256:	A4C41E535860E92FE2C6DA72D5852868CFD0C1D362C85E293E48AF9ADF1827CC
SHA-512:	408B4E904D982A6EE879A7CD5141A4EA89C36862EB240E9842B970AEE7CF13F7B389BF594C55BB9C438D0B4AEEB43E8EBBFBCEAD1591532735A254D9D5F4288A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i.#..........." ..0..8.........."V... ...`....... ..............................LV....`..................................U..O....`...............@...>..........8U..8............................................ ............... ..H............text...(6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............>..............@..B.................V......H........,...(...................T......................................:........(......0.....................}&......}'..............(............0..A...................}(......})......}..............(......,..(....(....N.-..* ..... ...._`....0...............{7... ..@._,....,[s.......{7...(........(........(.......(.........Y.....1.r...ps....z....(....&.(.....(....(......{7...(....f_}7........(....*....0..........~..... .........(.......\|0... .b)" .a.. .K.. .....%.4.k.

C:\Program Files\ReasonLabs\EDR\SQLite.Interop.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1646728
Entropy (8bit):	6.550293918842392
Encrypted:	false
SSDEEP:	49152:CKBZFqX8TvXzlaPmAA6rKmEOwksSf0WBA:CK3/z0he
MD5:	3EC7CF091E6D6D30EDE3983A7C86756A
SHA1:	4E57D4370C2E7397FDE04E1B5821FDFEFC8A1CD6
SHA-256:	E2B48CE46D04F95DF87D49BEBC7A4A3275225D9AB27F278AFC4FDDF974FD6406
SHA-512:	AD8E1789DB2931FB3C879F62C539CA7DEB9CC9E3D929335CD1171FD164D3AB5C270F2237682E693EFE0F82647012161AD7C0938D2C2BF25928CB5AC20D857FA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..7...d...d...d.i.d...d.i.d...d.i.d(..d0..e...d0..e...d0..e...d..=d...d...d...d...e...d...e...d...d...d...e...dRich...d........PE..d....<.].........." .........J...............................................@............`..........................................V..X1......<.......<................:... ..$.......p............................................................................text............................... ..`.rdata..............................@..@.data....L.......6..................@....pdata..............................@..@.gfids..............................@..@.rsrc...<...........................@..@.reloc..$.... ......................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EDR\System.AppContext.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.978744934396574
Encrypted:	false
SSDEEP:	384:YDNxWQFWWrjP9Z95Xa/rl9qX2Ip4z2yTjdAA1m5wMAvru4LTrZIjQ7yyRs:YDNVTHRKrLy2Ip4LTxf1mlA6OZM8s
MD5:	979925F3CEF9F0B9ACC19D26E339912B
SHA1:	5C04FC85D3BFBDA4ACDEE480F3F9A6F30B25AF5B
SHA-256:	A479D89EFC4744AB6B3A91F24F2C63C8A7332786A6B65F87FD7046A101F62C40
SHA-512:	29A23B0A669FA20F880F1FB414F49C5A3D80682EBE3D88FED80B6168C61B7EDCDE3DEE17290967E3A34809D3EDD1E555199438FC4C7C53F4DB295BF08A63B729
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ....................................@..................................(..O....@...................>...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files\ReasonLabs\EDR\System.Collections.Concurrent.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.042295947879012
Encrypted:	false
SSDEEP:	384:Am2igOWnW8rWlrjP9Z95Xa/rl9qX2Ip4+/nTjdAA1m5wMAvru4LTeZIje:gtsHRKrLy2Ip4knTxf1mlA67Zd
MD5:	792D0C83FED25753C1DF8F08AD5A5E99
SHA1:	027A17662AB34D248388D6E7587BF3F125CAF0EA
SHA-256:	87E227E9F7AE7CAEE32625109F4C6D7DC2A7F73FABB07B8FB8C3E04FE549D79E
SHA-512:	26CCEE818AFDE2CEA0D6457DA34235D3535806727CBB4F1EF7A58BCBD7B46BF953F3D9211250AA955079CE6D55D0E6107EE4796621D7E4A5F201A3D7A0131550
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@.................................t)..O....@..D................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EDR\System.Collections.NonGeneric.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.027720924382012
Encrypted:	false
SSDEEP:	384:3napn1iwwPWcGW8rjP9Z95Xa/rl9qX2Ip4QoyCjdAA1m5wMzsPue/:qDusHRKrLy2Ip4QPCxf1mlzze
MD5:	EE10259864E9701525FEB46AF8A2D668
SHA1:	EC412F80EDF85C5A0D72DE5C5943BCFEE8BC27BE
SHA-256:	3757611D8618E2DD166B23793E3D2FD42DE3C717153D265A83783AA70B832960
SHA-512:	74FDE33BFBD9F19120AB321325408314232FC6EAAE12DEC915811BE3AF0DD56CF14C896A6CE27AC259B0D21431FEBB75443A115C46047642114FA559E7E0741E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................<.....@.................................p)..O....@..@................:...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EDR\System.Collections.Specialized.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.0308593662962195
Encrypted:	false
SSDEEP:	384:HHLaEav5aaUa6arWVLWnrjP9Z95Xa/rl9qX2Ip4HXCjdAA1m5wMDBuYQ:mPv5t/NO2HRKrLy2Ip43Cxf1mlD0YQ
MD5:	16D2C673AA6AD02E71C5D96C778E7994
SHA1:	54A6628F49B0A68B8F7F44C0822F8E072F3888EE
SHA-256:	81D9E455790D1093214BCE4058D879616CEF04C2EFF5410E930E496B4126559C
SHA-512:	FE5FCFA1E366C3B801C286CF940A75D9486F33DE03FF0CF516028E973F2FE47A7669571D74BA620685E679F4723F68F9FF688731D2562A7E65DBD70623BE0EC9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ...............................b....@..................................)..O....@..P................:...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EDR\System.Collections.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.921371620507193
Encrypted:	false
SSDEEP:	384:J6iIJq56dOuWSKeWErjP9Z95Xa/rl9qX2Ip4K6gYCjdAA1m5wMDBu:XiAMHRKrLy2Ip4K6pCxf1mlD0
MD5:	9D3D19EE2BE4AAE01A0A9B0FB4D9E3E9
SHA1:	6C9DB4C90C9B88CEF86295F963212A38ECFF3CD9
SHA-256:	EA435047D3403FF0E2D6123FF96FD7BFE2021384AD8030AC1D973DB7E916C91F
SHA-512:	1AF379AB9452E809E48FA637218B7C64C4988B62A414B0DF2C74C5A7C6B49B7ADB003708C00AFEE4F0195A58D6F170702523840FBF6360660EA5E88F3B8D0A5C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0................. ...@....... ....................................@....................................O....@...................:...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\|....................(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k..............0....M...............................#..........x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files\ReasonLabs\EDR\System.ComponentModel.EventBasedAsync.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.974894012448519
Encrypted:	false
SSDEEP:	384:+nzz+MpSaLWW0+WarjP9Z95Xa/rl9qX2Ip4iCUPlTjdAA1m5wMAvru4LTLZIjt:QpuqHRKrLy2Ip4ibTxf1mlA62Zq
MD5:	48F51C415422EC4FE415F81402D73841
SHA1:	C6D3443DEFE15AA08722F6B6EFD63AB500A254B1
SHA-256:	D67F601AD228DF36C199467BD86EE62B47D18AE57B7A08E13B0502B667D3C187
SHA-512:	636EFD35AA0222E30B1C6828C3581A0698F1ACC8D617CF763E0332D75D8EF247686AEB25D73C21B4E42FCF1F5FD576EEC323A480582E244FA3507BD782124B37
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B... ...@....... ....................................@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files\ReasonLabs\EDR\System.ComponentModel.Primitives.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	7.007544012128594
Encrypted:	false
SSDEEP:	384:qGhr+YUfyHxsW/HWJrjP9Z95Xa/rl9qX2Ip4BTjdAA1m5wMAvru4LTIZIjay:ZkmcHRKrLy2Ip4BTxf1mlA6xZ7y
MD5:	A15F6061F42AF97FFDD51061BCA9C58D
SHA1:	A43B2FE6EE0E99DADDBCA6A40AC9B3A02CE3FA6B
SHA-256:	CBD238D92430EB86E08D79619F711B0E9EC11715819EF118721E1B981D980A87
SHA-512:	C0B2781D16DCF790FB9CDB623EC549A6893E26DF9B4DEB1A4606AB7FF12F31BC36AF4885C14B0EEC00B26ABAD23CBF3A55FE9376B198F0B5F9337C1FBAF265A2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ....................................@.................................<+..O....@..`................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EDR\System.ComponentModel.TypeConverter.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21648
Entropy (8bit):	6.936578907474719
Encrypted:	false
SSDEEP:	384:dRE+ruiA5vzWeNWwrjP9Z95Xa/rl9qX2Ip4VgB6CjdAA1m5wM36QNuZL:dS9btHRKrLy2Ip4V+6Cxf1ml36QgZ
MD5:	360D42F24B4E08FA056AB58734A4CD36
SHA1:	DA6E32A298A749ED5C3FA3E05AC2541E1513DB21
SHA-256:	B3527A56EBC1FC120BD9E8F9B0E950A56E2D012DA3AD6976B4B7DBED61D9EC8F
SHA-512:	D83B5F80769842B29D7031A542EE8BDE192EA221BEB42E220DD28093C3808FB6CF361B33304D632D571597CBAD8EF339EF22D97FAB5D864ADA1B1D4D0C52D6D9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ...............................f....@................................../..O....@..p................:...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

C:\Program Files\ReasonLabs\EDR\System.ComponentModel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.008766161447553
Encrypted:	false
SSDEEP:	384:VT+6ywnVvW0LWjrjP9Z95Xa/rl9qX2Ip4IrTjdAA1m5wMAvru4LTOZIjZmt:V99WHRKrLy2Ip4IrTxf1mlA6HZamt
MD5:	FA64C77091FC1B02F46CEB1913B7379D
SHA1:	F24025CABE1A9DC034186392ED24FF0BF3A495ED
SHA-256:	E098965040E3970F28869105CA43DE2E604E2DCA6294339A9D170E0A5DF24D42
SHA-512:	13AE6CBA7EB92DCA72BBBA98188B41CD5D58C525F036E5326F5D45D9257DACD65305503A1736380C6C6975616D767628DDF67B94CACA9CD594FAD17B993B8517
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................+....@..................................(..O....@...................>...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EDR\System.Console.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.004123985634671
Encrypted:	false
SSDEEP:	384:JRbzriaXT+WlEW7rjP9Z95Xa/rl9qX2Ip4NjTjdAA1m5wMAvru4LTMZIjvC63:T7ic7HRKrLy2Ip4lTxf1mlA6ZZ963
MD5:	86089A16F4C80394C5B404309C6026C0
SHA1:	D323D892C114316F838E4ED389BA79F6BD8A3B12
SHA-256:	435AF362523ADEDC9A74887C09FF85B6AF5EA3C2EFE87926C175A425313C4CBD
SHA-512:	EFB2FFA4F1F8892AD6AD9877BEA147A4ECE5889DD5F28FD87FC6F84CC03E05313CD99AFD8920967A85261E6F09BBBCFE995D4F499C568BF07E9212C44F914195
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ..............................<.....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files\ReasonLabs\EDR\System.Data.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154112
Entropy (8bit):	5.52229117256302
Encrypted:	false
SSDEEP:	1536:tHOdYYWg+GImdMEGK61wb5nx03LBblQ6Ndk66byYSI4Zki+BReD4pK/uYxtl+AHB:gdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+zq
MD5:	CD62016404CAC92504889687ABBB13B3
SHA1:	C8CFA6AA9D4EE5F203701BEBB78F598F5FBC4C39
SHA-256:	DE4D28275A972722AAD7B1C5EC4581665CEF87C6132B9F013530BAC92F70C592
SHA-512:	1859D37D46D373C00B1B2DBCE77C8121B47D550AEBE240274F2C29B3870E7F82A18F8AFE1A6A46600DC61F5B6C1D8B8D2158D4EACDD8BDA9CF393159EEAD147D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ....................................@..................................,..O....@...................>...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r;..p.(....2ro..p.(....2r...p.(....2r...p.(....2r...p.(....2rK..p.(....2r...p.(....2r...p.(....2r...p.(....*2rM..

C:\Program Files\ReasonLabs\EDR\System.Data.SQLite.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	370320
Entropy (8bit):	6.097469567826013
Encrypted:	false
SSDEEP:	6144:WruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cmg:VNWx6xz+nRo2GGWHQZMaLyJSJFNFaFeL
MD5:	543B9388781D828B95E0952E62ECFC34
SHA1:	988750B82F4634BC793AA12E05403DEEC049B7DA
SHA-256:	6D1BBFF72AC4163FCA04F27797B1BA1667C37AA45DC3EA7786B0603578DC32A4
SHA-512:	97187D01075FC18C1187C99D629B3375F49ABB7225D25CECC8559F783C8D409592DC3687C65FC29F26FBCC831DE2979299499943C0138AA1B635F8D3BF9E7099
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.].........." ..0..b..........j.... ........... ...............................n....`.....................................O.......$............l...:...........~............................................... ............... ..H............text....a... ...b.................. ..`.rsrc...$............d..............@..@.reloc...............j..............@..B................L.......H...............................`~......................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(......~;...(<...,r.....s....}.......}............{............%......(=....%...:....%...!....%...%.........%....%.........s....(....z.{....,......(=...o>...s?...z..0..'........{....-..(......o........(A.....}.....*..................0..T........{....,K.{....o@....+...(A......(B.....,..o;.....(C...-...........oD.....{..

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Contracts.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.978601082650283
Encrypted:	false
SSDEEP:	384:DRtRWjYWVrjP9Z95Xa/rl9qX2Ip4RaTjdAA1m5wMAvru4LTLZIj7:LiRHRKrLy2Ip4QTxf1mlA62Z8
MD5:	1A56767E8BAB0FA215068240A5C0C251
SHA1:	68AAD233EAA3659696120C2A13B7B3A148C52EA2
SHA-256:	12E6C5EB0047D97EDA672A6DB5DEB0888174B98974E78FAFB240351090DE4A2A
SHA-512:	FCB191A3A416932D5E9A0F549EA5238329369C6514E7E9C9C714154366347518864FDF3CAA3070437C0C715E07F016DEDA6C88FE8E360587F1A5896699AD408F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ..............................ga....@.................................x..O....@..@................>...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.......................H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Debug.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.036011842379594
Encrypted:	false
SSDEEP:	384:seWnoWxrjP9Z95Xa/rl9qX2Ip4CEB98TjdAA1m5wMAvru4LTGZIjm9:sn5HRKrLy2Ip4CEf8Txf1mlA63ZJ9
MD5:	39030D52ECCFAB9462169249022F465D
SHA1:	9DA51C6E644ECFB1F8E7DD559C55D6D014C0588B
SHA-256:	85785A739BDDDB73AB9F2CD23CB5AE6B4A01F739CE736783A4C1AFF7B24E5A85
SHA-512:	55760420F7293D47E77E76201BAF576B4888EFBFF6B2173006A47B3D9E5D99CEA0E41016F9AACCBDA8B4B6B898BC85AEAC827305DB0B431D2774A9D985509B09
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................0....@.................................X)..O....@..$................>...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.FileVersionInfo.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.006824968778004
Encrypted:	false
SSDEEP:	384:Y6oWJjW8rjP9Z95Xa/rl9qX2Ip4ApTjdAA1m5wMBq5ul01vfh+c:Y6vDHRKrLy2Ip4WTxf1mlBqsqvR
MD5:	F9ADBEBACF225106BA1CEA626A0BC5C6
SHA1:	DFD1D956D719095CBC3AFDA71B722903E7EE5369
SHA-256:	D821A7EF1C9DA4F63DC8FD7AE01CE70B1DACEA3BB42BA238C0F15539F2F36D2E
SHA-512:	62DEC309E9F98CF3A3128186E050AF053D4750F34DE9CAF39BAB5F271C150FF21D964422F1C333361DFBF1F10E850F73DC40441A3B744E3CE2891DA8F404D63C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................4`....@.................................H(..O....@..p................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................\|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...\|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Process.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.933759249584018
Encrypted:	false
SSDEEP:	384:mqk53/hW3fZ+zWbbrjP9Z95Xa/rl9qX2Ip46AVZ1CjdAA1m5wMzsPuj:mqk53MPZHRKrLy2Ip46AJCxf1mlzzj
MD5:	763BBEAE9A657ACFB2AAEBDACCCB5784
SHA1:	AD757B57673FFD4368AAB937CCFC04F34DAEF13B
SHA-256:	6E0949D0892F07EA494C2E9F39DE6EA8C1614ED80B3070EA66D6642B9322EE2D
SHA-512:	66CA8C7CDA20C247D361EB8130128B745C970874A7F0BB3B03C505A5DA0CCE87E7661B42883ECC67454BF1EE104CFA5DC6C0ADA6475AE74FB1DE4EB6FD728A7B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*... ...@....... ..............................u.....@..................................)..O....@..0................:...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.StackTrace.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	6.855678676687748
Encrypted:	false
SSDEEP:	384:OFCc4Y4OJWfOWqWWOWirjP9Z95Xa/rl9qX2Ip4CJTjdAA1m5wMBq5ul0Svfh+lWt:eCcyCCHRKrLy2Ip4CJTxf1mlBqsBvOBW
MD5:	ACA4AC5F26F5CECDB95AEAC5689FCC05
SHA1:	7A73787A55A02FF16514E3EC815FFF9091D8E482
SHA-256:	4DF83F6363CF55DCD9B38ED549E0B136FD43AD36111AFAA364E1FAAF89D7C0AC
SHA-512:	629F7ABC7D43EA0AAD81A2E0AFBF8072B8EB2F93539337BE6B9FDCA1E36471A6074320BE0226DAEC44CA10841105C1D54B55D5FA36BB142F4F9E980F4EA82FA9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ....................................@..................................-..O....@...................>...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....6.o.....(....6.o..........*.o........~.....~.....BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.\|.....Z...1.Z.....$.....$.......3.D.......\|...F.\|...c.\|.....\|.....\|.....\|.....\|.....\|.....Z...I.\|...}.Z.....Z.

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.TextWriterTraceListener.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.027393084902794
Encrypted:	false
SSDEEP:	384:yAWxMWKrjP9Z95Xa/rl9qX2Ip43lTjdAA1m5wMAvru4LTXZIjV:yvwHRKrLy2Ip41Txf1mlA6+Zw
MD5:	EF1B2AABBCFEE45969F540DA71CEFF50
SHA1:	7D61CCDF119D7F95CC0A0128A45B945B96738378
SHA-256:	EC7FBA909949B623BA739E00E687B80D79BE9F1C6CC7A36F96004618504F6AAC
SHA-512:	5AB60A2294C04D2191B5B22D42D8CD2898E05AB39B69AD04A185CC6A33C9327CF4472C68C297F905F27CE561555E87B8A6870D0F9AA813459652348544BB0A7B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@...................>...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..\|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Tools.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.00802697135113
Encrypted:	false
SSDEEP:	384:CAlcWHaW9rjP9Z95Xa/rl9qX2Ip470oTjdAA1m5wMBq5ul0svfh+A8pu:b9XHRKrLy2Ip4ooTxf1mlBqs/v20
MD5:	8ABD5EA47E697C477ADE46806C4C4BF3
SHA1:	7AD67F762A6E690CA4454FDB0804A84E4159A741
SHA-256:	A003D90106B3AE1A7D6E04F3BC20AE1DAB7EB342B03F9E3B5D9C5CC507414914
SHA-512:	32AF2A53814190D6329F3D7F9A1A8C829DC771988EF40BFDF2B5E2E3F4421118884713B0C39C94F6E2FD3CA3EF80BFD6F7AD6C6E23E0323D2311E37CFA455E9A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.TraceSource.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.954525389333393
Encrypted:	false
SSDEEP:	384:usIZnWlNWNrjP9Z95Xa/rl9qX2Ip4x+lTjdAA1m5wMAvru4LTNzbZIjdE:1UyiHRKrLy2Ip4GTxf1mlA64Z4E
MD5:	EBFEC60221C240FF2F2B33F112FEA014
SHA1:	9850A8DAFCA426D8FBEE01AFB6AFEC0E2D27ECD1
SHA-256:	D5E521B842062BC825E5DF4EC711718B420E459BA1E8CFD788C615901BF9696B
SHA-512:	48A553B3117CA2911ABD09DB448063F3D4E786F8517A208B653ED1B5CD4F31B10EF46A713C09E137A9D35AE203F79DA973F50550F1CF1E8C046BE8CA9CF0FEAA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2... ...@....... ..............................1.....@..................................)..O....@..P................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EDR\System.Diagnostics.Tracing.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	6.687209756368598
Encrypted:	false
SSDEEP:	768:GQq33333333kX+TBi8FHRKrLy2Ip4ITxf1mlA6f7Zzf:Ju1i8FHi/90fInf7p
MD5:	682312A833402F2D407132E9D2215BD8
SHA1:	139C007DE6EFBA5D673211A5D82616D64BE6E7F2
SHA-256:	299C1FDCBBABF523761CF7591A567DAA6F116DE4775D684A664F30D31AD08911
SHA-512:	316C7B28940F8D223666CED22085477949F17D3C6609363DBBF0821E959F12FDAAFF0CFD562DE945F18F1640B700A87DF8C30687BB6E276205FAFFEE9484625B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ...................................@..................................L..O....`..x............<...>..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o...."..(........0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....&...{.....0..4.................}......+....{.....".......X.....{.....i2..0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

C:\Program Files\ReasonLabs\EDR\System.Drawing.Primitives.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.008740634214412
Encrypted:	false
SSDEEP:	384:u28YFlXulWY/W1rjP9Z95Xa/rl9qX2Ip4oe2NTjdAA1m5wMAvru4LTiMZIjTH7:u0q8HRKrLy2Ip4oLNTxf1mlA6mZ8H7
MD5:	A6DB195ADB646F05AA767594380DFC1D
SHA1:	006689DDCABDD879D70447A34EA1334B33ADFC0F
SHA-256:	8D160AF3A6D933B56F705875E2D7B2CDCF4B121B78C1DD8E11B897AF7A4979C2
SHA-512:	9C05631B74878EAAE4C986567308F9963AFCED6220D918C34DA27A79BD25D8CDE3C8492C6BA275563E3277B6E15E5524FDB157D62FC5B26B57670869083B4C59
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................f.....@..................................(..O....@.. ................>...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EDR\System.Dynamic.Runtime.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.9176080347073805
Encrypted:	false
SSDEEP:	384:UuMLcdQ5MW9MWcrjP9Z95Xa/rl9qX2Ip4IDmTjdAA1m5wMAvru4LTEZIj0s:ZOcSpmHRKrLy2Ip43Txf1mlA6VZ3s
MD5:	6D52E868AB8D5D896D2B34F2324D3912
SHA1:	9AE22458D2EB81022174C3A16D94FFA9161A641F
SHA-256:	60361634D7F67DE07A9073598671D202E9EFD829429666BFA4C936563187777E
SHA-512:	83DA81F4BAC14E1643508765CBF7CB222F37FBA36526D60A972358F187E90F4962CAB5F1A83F6FF49F742140B16C5E4236B1B2A0334208A613842D32A0CA6AA9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ...............................E....@..................................+..O....@...................>...`...................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .............................................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EDR\System.Globalization.Calendars.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.979331656555997
Encrypted:	false
SSDEEP:	384:KZ7RqXWDRqlRqj0RqFW9rjP9Z95Xa/rl9qX2Ip4CSuTjdAA1m5wMAvru4LTAZIjP:K9qKqjqjuqCHRKrLy2Ip4CSuTxf1mlAV
MD5:	3398DE072478B410EDC1AD3E328F6561
SHA1:	BF6C0ED75D46381DB214957B974E8226EFF57D2D
SHA-256:	2DED1A05A4B4E289A19187FC96B90C3987EF86CC10B590376462D492131FC490
SHA-512:	07EE3479DFAD2683207A1DCF00BDA5EF43D4545ED22FF7F80A2A6644AD332B4C5DE81C976F5CB2111BB26996BFFF30BD9EFE33F77FDA3CF9A4CBDE871959C750
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................X..O....@..P................>...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EDR\System.Globalization.Extensions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24720
Entropy (8bit):	6.791971497516804
Encrypted:	false
SSDEEP:	768:8vMhF2SzNzwu/Nlju6HRKrLy2Ip4OCxf1mlzzE6:8vMhaKTHi/9rfIPE
MD5:	48510914EF8C8C8A20DFCD2AA769B164
SHA1:	72629A00729E1F9546C13F4362C66AAF8C841AF9
SHA-256:	81FD0E624E822B0C95DF603325EEB7A7ACE7E04D10D575667F3C44F4EB456E7A
SHA-512:	029B9747486CF3C624CB2179A211EB7914C2AAA00359220652869B6848DEADE94894DC3446DF3C5C1FEEE93E894CAB6BD92CF42A8597D1E9BA2D587FCE8D9785
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ....................................@.................................a6..O....@...............&...:...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o...."..o......o...."..o....j~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(.......0..K........-.r1..ps....z. ...@3.(..... ....3.(....*. ...._,.(....rI..ps..

C:\Program Files\ReasonLabs\EDR\System.Globalization.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.039009488547633
Encrypted:	false
SSDEEP:	384:oZ4RLWdRfRJ0RZWdrjP9Z95Xa/rl9qX2Ip40TjdAA1m5wMAvru4LTfNIZIj8h:oZK0pJuOHRKrLy2Ip40Txf1mlA6cNIZr
MD5:	1DE0EFFEA5081B9745DFA8418FCC934E
SHA1:	5C12AA1392C44103DA9266137E1A602894AD4B32
SHA-256:	E2149ACDF31CCD396730D2FD232F103A944307C9348119EF7D18D5B2BBD3499D
SHA-512:	4BA943B48A884DFB500EC6ED09844F9067BF110189754EB50A6260CF1630F363CB5DAE7A3404B53D487F80C0960E2E80F8E5449B53B4D3F2B91C3C2F253DE3AB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................h....@..................................)..O....@...................>...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EDR\System.IO.Compression.ZipFile.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.967890189655318
Encrypted:	false
SSDEEP:	384:kYWsmWYrjP9Z95Xa/rl9qX2Ip4JTjdAA1m5wMAvru4LTmZIjh0:k2gHRKrLy2Ip4JTxf1mlA6LZM0
MD5:	23F56878BDDC8C8CEEC3AD07D0C89FB9
SHA1:	932B93203E6936067293CE48154D99DDF0A05BFD
SHA-256:	52216915A70BBA9DF457552E46ADDCF4EDFD5489929210EC8B01552A2EE384C2
SHA-512:	95571DD03388126C04428A911DA5B1081398A20F84CCFAC78B159C6F17DC6832EC3E9298DAEC25D1674CEC2C16DDEDB03E219AF984DAB498A8973580F07C7B87
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ....................................@..................................'..O....@..@................>...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

C:\Program Files\ReasonLabs\EDR\System.IO.Compression.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109712
Entropy (8bit):	6.440388342659836
Encrypted:	false
SSDEEP:	1536:ovc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXbHi/9HfIP:wgk1tiLMYiDFvxqrWDWNoJX5
MD5:	9AA1E845DA38257FF1C418A41E7674BC
SHA1:	5C27458B364343CC78658E19D552947DA2ED6007
SHA-256:	556B30116823FD919415156137F4A7AB04AC317E599ED5647FFF9C8D892596FB
SHA-512:	19631E0736DAD754C19480F99BB7823E25602AD2ED576B62063822CE88A29050504AD28BFA61FA39B4ECC763CBCD68FE64F6E8AB993BCF736361ABF0C144E2B6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ..............................=.....@.................................5W..O....................r...:...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r7..p.(....2rs..p.(....2r...p.(....2r...p.(....2r...p.(....2r=..p.(....2r_..p.(....2r...p.(....2r...p.(....*2r...

C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.DriveInfo.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.012269943025893
Encrypted:	false
SSDEEP:	384:BKcuz1W1cWFrjP9Z95Xa/rl9qX2Ip4uowTjdAA1m5wMAvru4LT7ZIjiDNt:bu8NHRKrLy2Ip4CTxf1mlA6OZn7
MD5:	6C03876D161F9CAD9BAD77F7247585DD
SHA1:	820121DCB6CC3CC05E14511796AA07E3352EDD45
SHA-256:	446E7BDCE29E103FC2D3C227F07FCEBB51F521EC928E38D63F949A3B92EB199C
SHA-512:	DAFD08673968493BC0A5371BA87466BD7512F782B1774C6139F82B9ACC376BA7EC46E376686B18021E27DD57CB90A6AD0EA7287CC86B98BDB0EADCD62C4353F3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.Primitives.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.015596217362603
Encrypted:	false
SSDEEP:	384:tJ+SWikW2rjP9Z95Xa/rl9qX2Ip4TTjdAA1m5wMAvru4LT8ZIjSO:r+eoHRKrLy2Ip4TTxf1mlA61ZjO
MD5:	B586826CED650BC66C94F93A323D8E8F
SHA1:	36F2F3A82790685AA95B6B11A612C2CD62EA9D5F
SHA-256:	4880A7167BBFE901C3583091B974CB226783B20AB8727DAC51EAB935314B692E
SHA-512:	B2D0CA5EF973DE567419F750C547CFF7C4FC5CF69DE24CBE4545D2F7965331212EECD85BE0CF73F3E8F46B6B4B4AAC8E8DC5F0ADA114C49A9C2753E03DD6C207
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................}.....@..................................(..O....@..P................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.Watcher.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.045009892938906
Encrypted:	false
SSDEEP:	384:3AWzgWsxrjP9Z95Xa/rl9qX2Ip4ub+TjdAA1m5wMBq5ul0Ivfh+pS:3tuHRKrLy2Ip4uKTxf1mlBqsrv9
MD5:	974FE1E400F46AD556BF2CB96A0B3B39
SHA1:	E542A749C0ADAF80DB25D9ABE7C0DD2DF20A8817
SHA-256:	C0FE74081933567A56395F344E2333FF7BCAABD1DBA41DA6CC6A4A16373D7906
SHA-512:	28374864F465631D12264D40078CB7C88A3B4832CE33E008490188DF8102E715D1833FB444520C50759C646A074383F95FCD59F629847D1612D530CC5D1426D5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................#.....@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EDR\System.IO.FileSystem.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.018571772835123
Encrypted:	false
SSDEEP:	384:GBLRWbYWmrjP9Z95Xa/rl9qX2Ip4mTjdAA1m5wMAvru4LTEZIjd:GB2EHRKrLy2Ip4mTxf1mlA69ZW
MD5:	C4BF31F3F089FB4CFF61848A7E368E40
SHA1:	ABC6D15FDF0BAF685CB46AEE067E4B84065450B6
SHA-256:	2862B8B12EA41602C4F5FDC4E74B3534DF35D13154F4E4BFD25C2F1ADE5F44E4
SHA-512:	42C2EE70270999423895E66FF0C0736B8004FD9C820D2801C4B7D462F06C274C2DDC919ED68DDFFD23B0B89D541DF9CBCE088D5564249A8C9D2B8F51F2E28A82
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ..............................].....@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EDR\System.IO.IsolatedStorage.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.005836250911921
Encrypted:	false
SSDEEP:	384:KHW4/WG+rjP9Z95Xa/rl9qX2Ip4lUlTjdAA1m5wMBq5ul0Hvfh+kq:KrrWHRKrLy2Ip4ClTxf1mlBqssvjq
MD5:	371578A79C29BB383005971BA4644675
SHA1:	C5E6EBBA9A3464C023FBF836474DEA05157D9EC8
SHA-256:	6DC48CC35F8BACB18039C37C39B1C379DFD6FA5BCC77B9575C9DE8187ED4A3F1
SHA-512:	0D589AF9490FA5D1DB519956AE3E2DD6C55B65C138A83366C679197BA270ADCB1D463ACAB680069AD9289680EC74650DC28E8C173CDC6536897E1587524FD41F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... .............................../....@..................................(..O....@.. ................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EDR\System.IO.MemoryMappedFiles.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.041976655197995
Encrypted:	false
SSDEEP:	384:bvk7hWmCWJrjP9Z95Xa/rl9qX2Ip4bTjdAA1m5wMBq5ul0Pmvfh+a0a:bs7/7HRKrLy2Ip4bTxf1mlBqs5vn
MD5:	7D2951DCB6B1172FA1EB015C208701D9
SHA1:	D55575258E967E28EB81BA5154BFFADF8FA4163A
SHA-256:	5DC1FDADF06103A5F26F43A4F1F39012A22E3CA38E1001ACBF2AEE4E80F0BE3B
SHA-512:	C0483B359E4239D50BE2CC8FEBAEB54E426F57A15F69F9A2DDC062BA92CC1E5973B04FEBBD4167C87312B2714441F42A5CD1FFADCC5058B8FE2EF5F626A82AFF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................)Y....@.................................h)..O....@..0................>...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files\ReasonLabs\EDR\System.IO.Pipes.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.022018859408551
Encrypted:	false
SSDEEP:	384:SGMWCUWfrjP9Z95Xa/rl9qX2Ip4ZTjdAA1m5wMAvru4LTYDZIjk:S3rHRKrLy2Ip4ZTxf1mlA6nDZz
MD5:	CD03BB46CE2E0A96102B3D2FAA92CFBC
SHA1:	66497E909BA7F72E1A4C2B7CC8C7AF7A6558E5CE
SHA-256:	498302110BFC203FAF1670D5EF04FD79D2EDEBFE907AD1E6674A6A85EE56989C
SHA-512:	077C25BD1D1C49ECF9890A87E4D150A269CAD53759D53BF7E3023B08CE1E75770EE4BF09EC5041D17230D33AD346A424E345A37D48DB7F73738F9E138D75A0C0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................&9....@.................................@)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files\ReasonLabs\EDR\System.IO.UnmanagedMemoryStream.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.994997816444603
Encrypted:	false
SSDEEP:	384:OBhwI7WSQWxrjP9Z95Xa/rl9qX2Ip4wgC6CjdAA1m5wM36QNuZL5c:ODwIBJHRKrLy2Ip4w6Cxf1ml36QgZFc
MD5:	567B31ABAA1476CDA6FB631FCBCA7EA8
SHA1:	A78FF09D358000BE3EC04EC6EF504A90C3A726B5
SHA-256:	F71CC788961A41E5E6B15D1400E064AAA9C3DD4D7EAA032758215388ADF57756
SHA-512:	A50EDB73A3732729C479087E1681AC882A64E081E9936D09387F239F2FA9E2DCBFF77610F8123B5E07CF173E24770CFC011F048BBA7A4A8DE549E656C21D4CCD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................l(..O....@..P................:...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EDR\System.IO.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.018735616462396
Encrypted:	false
SSDEEP:	384:SyvPRW4lWfrjP9Z95Xa/rl9qX2Ip4qTjdAA1m5wMAvru4LTLZIjJ:339cHRKrLy2Ip4qTxf1mlA66Zi
MD5:	5058626C8519E190CFF67C918AFE0A4E
SHA1:	87D2F203F86AC99022334AC0244D1DD47D400A09
SHA-256:	486B5A0E6E47E92F89BE6F694B2B0F285B1C0367BC4CF8CB27FF821F3AC0EBCB
SHA-512:	EB4E8AACFDBA139C80C3A20582089495A4AA82E00483A91E7F1F82D80ABE694C3CE0B352945E4DE341838017746FA83BD41C2BAEE28575DD701F83D71B1D4CA4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................3.....@..................................)..O....@...................>...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

C:\Program Files\ReasonLabs\EDR\System.Linq.Expressions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.975680937062165
Encrypted:	false
SSDEEP:	384:S6RW6eWSrjP9Z95Xa/rl9qX2Ip4h8TjdAA1m5wMBq5ul0Wvfh+2a6P0:S67iHRKrLy2Ip4eTxf1mlBqslv3a1
MD5:	D239BA595AAADB0EA18B5987221AE091
SHA1:	44564DDC01DD0D8E4FEBB12B3232F646D3C06A7A
SHA-256:	CDDF808A755A9DCE7C9622C9EFC7A5C4E218CB191CBCF0FCF1B1FF5618AF0917
SHA-512:	27F9229021832CE386B795C8A438A4057E29AB90D1817012A192D6FBFFB75A3C882508E40711DECF9F6C7C1D54D57A42D522A31BD81C9E9D85E6B3BFB1077305
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ..............................?Z....@..................................-..O....@...................>...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EDR\System.Linq.Parallel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.014555464183901
Encrypted:	false
SSDEEP:	384:eSUP9W70W1rjP9Z95Xa/rl9qX2Ip4zRFTjdAA1m5wMBq5ul0Ivfh+hm7:3UeNHRKrLy2Ip4XTxf1mlBqsHvZ
MD5:	A8460A5894B72975C63FB6D32F9D0C8D
SHA1:	0DD34691B7482E5EA6EC4A0087EDE169A0212B24
SHA-256:	14638F6195F5D6A617AC5C3B37C172FD1CD0E028D4F80160DCE2BC25E265CB50
SHA-512:	BFC9CF48649335AAE291B14C8FD8E8FCF971937C849651429B84B1042C16A646FB805BFECE101215AF612DC3B8926BD93DEC1F22D1A258F05147C6614F447BD6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EDR\System.Linq.Queryable.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.992849598041938
Encrypted:	false
SSDEEP:	384:X8yg07W0/WhrjP9Z95Xa/rl9qX2Ip4Ob6CjdAA1m5wM36QNuZLU:XBHcHRKrLy2Ip4e6Cxf1ml36QgZY
MD5:	9B2AFCE22829448E52919ADC97FA0F75
SHA1:	4378B914393E30DCD67BCCB9F28FD956EF56DEB4
SHA-256:	306C43B5F695726D63BC347417F5189F7392719C788B953E4D9576925DAE4CDB
SHA-512:	40C27A9B0836BC74851890C3D633C4D1EE588F99DD19580A71C5FC6DB4A535F06FE5D4BD57C8E499E65982668C929C245A9D17C009F405AB347589375D4E8EC6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................T.....@..................................(..O....@...................:...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EDR\System.Linq.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.984362208373399
Encrypted:	false
SSDEEP:	384:fe1WmRW6rjP9Z95Xa/rl9qX2Ip406TjdAA1m5wMAvru4LTwZIjjy:fejLHRKrLy2Ip47Txf1mlA6RZSy
MD5:	75197142BEB82E4E45074F809B4AC1ED
SHA1:	D359EC1D8084898FB77CDEE07031E952648D3285
SHA-256:	70B9D7B943C5BBB511A3943368411EC0969E55913FDB7639E35100EB0B993A49
SHA-512:	B4064F5E9A06F754748F28826F4F71D0484FFBBBC3D9D1FF2864C1DF4BCB2C317F874853C68985992FE83D2273A3553C4A1DAF4AF507976E8F5702706617A79D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................1....@.................................p(..O....@...................>...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

C:\Program Files\ReasonLabs\EDR\System.Net.Http.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	198144
Entropy (8bit):	6.164369117328881
Encrypted:	false
SSDEEP:	3072:JeruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgtH:cW60VcTvakcXcApOu
MD5:	8DC59D67663004627D8B2D0746533249
SHA1:	27F2D020233099882332945AA1E706DD412805EC
SHA-256:	62FB650E6211E74DF8D9EFAF2F5F36BCBECA0E8551C3CC3AF757FB4103725993
SHA-512:	8ED5FB6F9103A572C5CA22CFCC39CDD1017DAE827091EA7A4D2E5C406DC43D281DD2DE76C13B5FFF588C749BD82961FBFDA0A6001F5C8205A27D2E086C9BAF89
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ...........@.....................................O.......h................>........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1....0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2..J.Xo3.....J.Xo3...(...... ........J.XT....J...XT.o3.....o2....Y./....o3....%3 ...Xo3......Xo3...(.... ..........0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._......0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

C:\Program Files\ReasonLabs\EDR\System.Net.NameResolution.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.980312715919581
Encrypted:	false
SSDEEP:	384:M6ZWYLW6rjP9Z95Xa/rl9qX2Ip4q31vy86CjdAA1m5wM36QNuZL5d8tY:M6l1HRKrLy2Ip4q3Jy86Cxf1ml36QgZf
MD5:	C19A4B2BEF8202293066556D39DDAF88
SHA1:	2CA6DCC8CC585FB282EBA89BC38B8B901181C9CD
SHA-256:	68628C824A222943C2BDDE8D7089E3F41FB9673CB711510297F2A8A78493BF58
SHA-512:	46D8FF9B0D1EDAAE45F32671A5961310ECEF445EEFAF08D153C10F5F417D5260269D95BFDD928C419661A146D92FBCFF7C4A4750BE3369D37D2E70891A1F6216
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................-.....@.................................T(..O....@.. ................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EDR\System.Net.NetworkInformation.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.954621838798846
Encrypted:	false
SSDEEP:	384:k1W1WMQWArjP9Z95Xa/rl9qX2Ip4/CTjdAA1m5wMBq5ul0yvfh+l0O:H1yHRKrLy2Ip4/CTxf1mlBqsdvC
MD5:	E45BECF9266A273DF70331171A822EF9
SHA1:	4BC48FD9BFC184691F15EDC47EB412D13895B7BB
SHA-256:	4632590F6231C37250549C2BDB5D8C8FD1A7881E12AA7777BA07A9B443F1793E
SHA-512:	35269AECA1663F3DC4EFDA33BD713888FC7AB86C35D8E14D1C870E60F93A7B2EC104E1085FB27330450981F966201EE9FE7010C1F9A3510F76DFB0E8BB16B92A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ....................................@..................................,..O....@..@................>...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EDR\System.Net.Ping.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.992639582476022
Encrypted:	false
SSDEEP:	384:BdSWSKWprjP9Z95Xa/rl9qX2Ip4wgTjdAA1m5wMAvru4LTCZIjtmUu:zOTHRKrLy2Ip4wgTxf1mlA6zZYpu
MD5:	11E4FE99627FCB3B157FB92D8D931F6C
SHA1:	214512E4FE71666C1C10D52969B89BA341F7C66C
SHA-256:	22D17B01651A7047AA52C7A6202299305F523E4394790CF058B87D7AB8A173DE
SHA-512:	FDBEFFBC5E9C4752AD1D8BC93B06521BD44AE14A235D31514A92426D874E7BB770B4BD4BAEBE4D8BCBC21696AEA1243DA7C381820C91A700CBA1FE3E409FF7C8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................=.....@..................................(..O....@...................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files\ReasonLabs\EDR\System.Net.Primitives.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.926380492711681
Encrypted:	false
SSDEEP:	384:PJEYA2WkIWVrjP9Z95Xa/rl9qX2Ip4VTjdAA1m5wMBq5ul0Avfh+r:PyYA8dHRKrLy2Ip4VTxf1mlBqsvvO
MD5:	B5E82B2D3167150A283BAEDF6635585C
SHA1:	A0B8D612E07D3D5357F2BC253E2394CA7CC62EF8
SHA-256:	1C4D07DF98A1C096B4F3B64F4C06A545A0099CCACB0CFC615AE78FD213327632
SHA-512:	A45E6D6DB25C9A52BE27FAEBB7D6FFDC0B3B6BE3F782696345F2F05830447F5251481B306BF98CFE3B6DB8C18E4F7A67F4EAE678DDDE52F68F7D42A2AE85920D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................:.....@................................. ,..O....@...................>...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l.......#~..\|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EDR\System.Net.Requests.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.011172629188287
Encrypted:	false
SSDEEP:	384:RJGWe4WdrjP9Z95Xa/rl9qX2Ip4tCCjdAA1m5wMzsPuK:Pm9HRKrLy2Ip4ECxf1mlzzK
MD5:	6784F9869E44E7B12ACF609B6EC7D9F0
SHA1:	121D7AC450832A5FF2161CEB4C1C053047AF61A5
SHA-256:	FBC98FBC3C67210115F69C8EA7685FC4DF6090499EFD4F26B2C3D8A359515026
SHA-512:	1DE77CE14B71655031DC158DCA06E798F17B8CE094C9245E2AF92B05A01F771D0A359317BC8518A241F2CF0AEC0BC712167B66EF5C0F5DE7C266808E6188DE7E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................0)..O....@...................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files\ReasonLabs\EDR\System.Net.Security.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.956721913718706
Encrypted:	false
SSDEEP:	384:VdW1w3WesWRrjP9Z95Xa/rl9qX2Ip48jBMTjdAA1m5wMBq5ul05vfh+y:C1wxZHRKrLy2Ip48aTxf1mlBqsCvj
MD5:	11ECCC72C540BFB8569C41480DAEA7C5
SHA1:	3A1647D47975E818E71744A715682A836A7565C3
SHA-256:	16C9F88A141863D12DCBF5F7DE604DEE8852ED026E23956EED4D9758828DCADB
SHA-512:	008DA3D459D3F0BE8BD2D967BDC19BF03311712CF1F4A6636F28A84DA08D3EA2894024FAEF411932237E30AB4438CD695855A5BEB7567B8B1E898407CF646EC3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~... ...@....... ..............................T.....@.................................,..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files\ReasonLabs\EDR\System.Net.Sockets.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	6.767850843576942
Encrypted:	false
SSDEEP:	768:Cyp12Bhkg3qnV/spMHRKrLy2Ip4mTxf1mlA6kZC:p12zkg3qV/spMHi/9GfInkE
MD5:	6C96760E10DD343BE96551945F9E8BAB
SHA1:	4A9EDD9D9DA52158CA3792D01DA3B2FE8FB4B918
SHA-256:	894929F99C214FA1748D163F8349D2A8D16901890C1DB7407D447E0A9E954CC6
SHA-512:	6084D7D66F1AB858C1910917455F3CC3486C773EB31BEAA309A9E1DF78BF1AA0120C5B50F005DEB2A4142F27DFDD0EC47C407105833EE95A0311FA888CB170CC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............I... ...`....... ...............................c....@.................................gI..O....`...............8...>...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o.......0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..L.......(....~....%-.&~..........s....%.....~....%-.

C:\Program Files\ReasonLabs\EDR\System.Net.WebHeaderCollection.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.013405463565456
Encrypted:	false
SSDEEP:	384:FHPAW1bWjrjP9Z95Xa/rl9qX2Ip4INETjdAA1m5wMAvru4LTYZIjVC7ggg:xrWHRKrLy2Ip4IKTxf1mlA6pZY4G
MD5:	7231EED833F6496EB34442B4AB87904C
SHA1:	BAD09DCA990E86CABDC82869639A7574501CA148
SHA-256:	9B0071C13569C3982F0A5CA91EC511D97DDCFAF807D2383E8EDDDC259FA44D07
SHA-512:	7FDFFE9FEFDCFF90279A004302408C245A620C13F812209F14BFFF07F5835AD496B8A1773A9048D4FA41A8D57381CF5D37021760B01B809848188027D797D88C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................v....@..................................(..O....@..P................>...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EDR\System.Net.WebSockets.Client.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.994636032353121
Encrypted:	false
SSDEEP:	384:ZNoqWD7WPrjP9Z95Xa/rl9qX2Ip4TeCjdAA1m5wMzsPu0or:ZNofOHRKrLy2Ip4iCxf1mlzzhr
MD5:	D6CC536E7AAD5F67830F0AD3B761A503
SHA1:	0D6F5D6DBCBB20BE3C94094DE5C93ED7752F1595
SHA-256:	CC6D8CDB7C37C39EBDEC1D494A0BC88B468BBB8B4F82B755052E816E553C5A2E
SHA-512:	EB3C327C22C1E8DA8838D37DE4D740D2BB4248ECCCDF63CEFB87CBBC8C69385F77758220BDEFF484C48F72C663E44525CB75A7B7D0C53B6D45B1D7C4488A8C39
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................\|(..O....@..@................:...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EDR\System.Net.WebSockets.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20856
Entropy (8bit):	7.009270974622172
Encrypted:	false
SSDEEP:	384:FGETSAWUEWarjP9Z95Xa/rl9qX2Ip4RtoCjdAA1m5wMt+uKz2MDug2O:pT1QHRKrLy2Ip4noCxf1mltdKzNp
MD5:	D75F5F80E910C80B204717F9B95E745B
SHA1:	C597C5807DB40BB50FDBB93FEE780A5AE7C2426C
SHA-256:	627B337EBE82028FA425063807AACBECA00A3457EC1DE1FBD7667663B7048DF6
SHA-512:	347A0E007343B106509CE7469E0E724FD6B2B0CCACE90432971BD5119B98EE65B8640F9CB134330D3D6ADDAC3F6AE4D0D4154B456293BC6CF3FDD59500350DB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@..................x=...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EDR\System.ObjectModel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.9987016230024715
Encrypted:	false
SSDEEP:	384:zcDagtDApWSKJW4rjP9Z95Xa/rl9qX2Ip4GTjdAA1m5wMT9YMWuuwSmNA5DO9:zPKBtHRKrLy2Ip4GTxf1mlTAwRN+o
MD5:	A603D98CF998417CE64C4539CDCA24AE
SHA1:	11A696FED63167B0B315EA77573BBFD65E01DFB6
SHA-256:	B919535D20819F90BD2C6A03BC9E962E56025F9C921A2266FF415E91D12723B6
SHA-512:	4190C9B267A5726D5E84D3EFFDD2B15A06794B1DB707B1C9619DED057880B9DE77C67F300E198E5B82A4D2EABBAAF14DA8CE020235D708777F465D8DA1082990
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ....................................@.................................0+..O....@...................>...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files\ReasonLabs\EDR\System.Reflection.Extensions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.011374618700231
Encrypted:	false
SSDEEP:	384:sIWD4WWrjP9Z95Xa/rl9qX2Ip4zTjdAA1m5wMBq5ul0lvfh+0e:s18HRKrLy2Ip4zTxf1mlBqsWv2
MD5:	DD82DBBC223607A8AED7BA3516860A85
SHA1:	AEA2F102D1A003138742C9671BED3161922B8DD7
SHA-256:	FA8B5C160F798C9151F2A8DC2E4DB8FCF8EDF156EEE30B14197C11116E4D7917
SHA-512:	B0CDE160BF04A33A053C13E2DFB316C1D4C7E8B280F47646C3B60B3113A4A5BE7404F56BB4740FADEBA2401332E86C59DC314E9028C734FCBA44B42800002F06
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..@................>...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EDR\System.Reflection.Primitives.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.940990584600268
Encrypted:	false
SSDEEP:	384:JMWzQWQrjP9Z95Xa/rl9qX2Ip4oooeCjdAA1m5wMzsPu:J5aHRKrLy2Ip4o+Cxf1mlzz
MD5:	7546D722FF86F3FABE21891C4912153D
SHA1:	B32377E75979E2FA1990590E9106CA99B9C552FF
SHA-256:	D2B775EFDC8BC0B9766A151B1AF1A6DCB9951D9123CB119ECE2E8C835897A4EA
SHA-512:	F337C1A2FD5AE062F686E7B0580F539B1F5B8F4E1F94B857CD3E0E07B14FCBAE0A64B39494D7D8E1544C7407AF66D3DFD879B49DEEF77DCFE30C6500F94421F0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N... ...@....... ..............................!.....@..................................)..O....@..@................:...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EDR\System.Reflection.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21888
Entropy (8bit):	6.900382977940602
Encrypted:	false
SSDEEP:	384:VxDHKWAMW6rjP9Z95Xa/rl9qX2Ip4eACjdAA1m5wMt+uKEK2MDug2:bD8UHRKrLy2Ip4eACxf1mltdKEKN
MD5:	B0E03F24261F0A5911BAEBF2DAC4F261
SHA1:	9E8DD1297F73F7537E4585317BAD2BBAE66CCBA9
SHA-256:	77D7DF7E179AB2780D0DB5C25DACF1998AD1A30DAD779DBE46CCDEE1072BF1A1
SHA-512:	B30C5881C22D90FACF29C855D92CB40EF5DC283A40C57556F27B5CA3AF4613E576E3F668DAE6C5D7DE646ADB8AE4508EF6B247C343DB37E29E7BBE23FFD473A3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................&....@................................. ,..O....@...................=...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files\ReasonLabs\EDR\System.Resources.Reader.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	6.988188886324482
Encrypted:	false
SSDEEP:	384:BLNBEW6pWTrjP9Z95Xa/rl9qX2Ip45CjdAA1m5wMt+uK562MDug2Eq:BbMMHRKrLy2Ip45Cxf1mltdK56NP
MD5:	4056B9B941A27EA3DB441088E2B73108
SHA1:	373CF0B09BD1FBF716C7BE234DFA99A341AB4626
SHA-256:	E180BDF8C805A85F86BEDED3A9FA37E7CF7D2E281A0FF87E2143604BCA1D82A7
SHA-512:	3FAD3AAEA333A0301B3F88FB7E667CA24CFE8BAA23B40F2076794F268ECDD8E92301CCC3717CB1D1E154BCA60BF0199D1F0832EF6FDA06AA799C904524EAB0D7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ............................../.....@.................................D(..O....@...................=...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EDR\System.Resources.ResourceManager.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.010082222669093
Encrypted:	false
SSDEEP:	384:TKkHKW/tWmrjP9Z95Xa/rl9qX2Ip4VlKCjdAA1m5wMzsPuy8:2ujHRKrLy2Ip4rKCxf1mlzzy8
MD5:	95CAB5C70CA547404FC228753B5248F5
SHA1:	CA80094BE3458609EC72EE53A77883EB3CBEDA74
SHA-256:	10BAC8F44ED75AC497BC392EE2CB7457455C59C3BC7064C101B346BB6F8CE095
SHA-512:	86826B4B7EFD21ACCD5C052621A3D3C13444CEEFC603125F808C6626ECBCCEFF2085364A788742D0643D358ED7DC5D9D9D0830F29789D658EA0E9EBDD514FF18
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................4.....@..................................(..O....@..`................:...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EDR\System.Resources.Writer.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.977617239092562
Encrypted:	false
SSDEEP:	384:ALnfIWqrWXrjP9Z95Xa/rl9qX2Ip4tyCjdAA1m5wMzsPukwZjNtY:ADf4GHRKrLy2Ip4oCxf1mlzzxj
MD5:	2280ED9104EB833B7EF3B5F96C322AEE
SHA1:	5E542572BDC4005660462968E4B50D3695DF58F7
SHA-256:	2B3E85B40E98C93C58A9E0C6EAD47EB8C1A2A59CBE62D85220D0D94D517E4C5A
SHA-512:	8CC31D50F5C35706706D8E372CC4D46CE6C673E16B15DB1BC1B4A5D870333800582C0BD854792C05EB7AB468B6AA943EE475C6ABCE5971786C0635C0CF22C63C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@...................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EDR\System.Runtime.CompilerServices.Unsafe.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22672
Entropy (8bit):	6.814455866031959
Encrypted:	false
SSDEEP:	384:6qTO1PdhW1YWxvfrjP9Z95Xa/rl9qX2Ip4tACjdAA1m5wMzsPuz/4o0:6q6PSztHRKrLy2Ip4aCxf1mlzzzQo0
MD5:	FD44D69516412D1AC6D32F47F5C4BF3D
SHA1:	08A77249796ABF70C8DC3C8B11AC490577EF6B28
SHA-256:	2945E07168DD5856D36BA869BF12F91D0C2B7B5E9F4ED88E5163216FAE594C42
SHA-512:	06B15C163A8AD8A68A4DF40A8B9B75D9CDDF39E92EDFA61ACD5A33C43197D9DBEAA2B2D0B9E5120F09D0CBA708537E21D53A276A7E4653FF8AEBC92D45805B2D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..[...........!.................1... ...@....@.. ..............................X.....@..................................1..K....@...................:...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H........#......................P ........................................\|......<...rp....O..Ih.VvI..a,...%...(..@...7.v..v..N..x.6.._.....H^c~s_...]..Q@.,n.H(..CN..Q..<...%N`H..MV}%'x;.A.1..E..^.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..................0..................0..................0..........

C:\Program Files\ReasonLabs\EDR\System.Runtime.CompilerServices.VisualC.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.969946391198759
Encrypted:	false
SSDEEP:	384:Fna8WK1WbrjP9Z95Xa/rl9qX2Ip4FlCjdAA1m5wMt+uKb2MDug2E:Fna0gHRKrLy2Ip4DCxf1mltdKbNL
MD5:	130792957623ABA4B9A6699398314AA9
SHA1:	75D44C66FDF0D887553F788F1175666D03CA9950
SHA-256:	0AADE7D9F0C7E98884466AC2AF829227DC14BA469B2C7E55D9C2190B0578E34B
SHA-512:	4A8ADEFA5495B6DA1A451881FE089EF781C98E99A239378772FACE4D6A17CDB31E517557C6D6A731A35B3FA83E2DD89C12A08E645B6B3F20620978657FD30F38
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j... ...@....... ....................................@....................................O....@...................=...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EDR\System.Runtime.Extensions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.939048706998203
Encrypted:	false
SSDEEP:	384:kBSWITWPrjP9Z95Xa/rl9qX2Ip4qCjdAA1m5wMt+uKE2MDug2:k6OHRKrLy2Ip4qCxf1mltdKEN
MD5:	007612D7CD9AB2F476488862FEE6DDF7
SHA1:	7A0EFA45E52FFA944876E9AFE7BBACC7A84FE8D8
SHA-256:	F24229E4F09D602B6681D51C30EB7A75FC01FAA83225885903B65A6114E359CB
SHA-512:	1B22132423E81EB15685D3BEACDBCDEFED6F6DAF12825F70E85FC07D51044B295B0BB3B32CB5903CF60704689BABC325EF368DBA42424AEB408FF54C241E7C44
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0................. ...@....... ....................................@..................................)..O....@.. ................=...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................\|.....\|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EDR\System.Runtime.Handles.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20104
Entropy (8bit):	7.011676585489165
Encrypted:	false
SSDEEP:	384:188cIIWNoW4rjP9Z95Xa/rl9qX2Ip4X/4CjdAA1m5wMDBuvX:19cUmHRKrLy2Ip4wCxf1mlD0vX
MD5:	CFB008C51A954851C991442F9672BDCE
SHA1:	3200F25CB1CBEA3D0DA2DBD2F80324B6438E8FBF
SHA-256:	E79A0DAAB8BF70A360213FB3F3272BFA980B56EC40EBE0E66A7D06E2986FDB37
SHA-512:	3666CD8B94CCF6FB0CCD2C2A299415229E253278D2AF8FB90D7334B3E80003766C5AA7EAB450B845348B4993DA4FCCA4EECE0F8F8A49BFBCF4B5B206DBB8C4F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ..............................'.....@..................................)..O....@...................:...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..........................................................c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EDR\System.Runtime.InteropServices.RuntimeInformation.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27280
Entropy (8bit):	6.771047348828758
Encrypted:	false
SSDEEP:	768:ErmoFmWdOpHRKrLy2Ip4wyNCxf1mlD0L:EaEFdOpHi/9L6fIIL
MD5:	9776D5F2CC7EB70D9F884683D7EEF5CC
SHA1:	598977D0FF922A1DF4794E89052E95FDF841EF0D
SHA-256:	71E20EA248C9E4BA3969EF99475978B93CACB3902BAD0AE856197D6C5B5805B9
SHA-512:	86887EAE9BB93E1332FD94BCF98FBA2BB18C5C3BB671F87C3746ED97DEACCF58C2109DB0B3C9141563F33AADB482300A6534ACD6FDEB562E1EEB409418A45C10
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ..............................7.....@.................................PE..O....`..x............0...:...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r/..p.(..........(....2(.....(....^~....-.(.........~.....0..........~..........(.........(....-Y..(!....{/......5..,

C:\Program Files\ReasonLabs\EDR\System.Runtime.InteropServices.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23184
Entropy (8bit):	6.842912642172639
Encrypted:	false
SSDEEP:	384:k09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsP:FOAghbsDCyVnVc3p/i2fBVlAO/BRU+pX
MD5:	16737B9D9DBA4E2D85B9C98379E3D04A
SHA1:	4BF9E51BFE7BA6993A2D4A590B4A7872EA650DF1
SHA-256:	25DC1EDED1EB569B6A423896506C13474E2732118B3F3BEE1D1DCE4A76EA5A4F
SHA-512:	2446915FEA03CC008EEB996735403CAE9ACA12DA23211EFE802F882115F60C3FA68D46690E40FF83B092F758800E2800D5F47A2A8B523DC53286E29B863EC6BF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................g....@................................. 5..O....@..P............ ...:...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EDR\System.Runtime.Numerics.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.996432897343726
Encrypted:	false
SSDEEP:	384:u7W6RWhrjP9Z95Xa/rl9qX2Ip4XTjdAA1m5wMT9YMWuuwcNA5DCUCT:u5CHRKrLy2Ip4XTxf1mlTAwcN+GUA
MD5:	686EED1A62C5D0790DF8E4BB44FC7F7B
SHA1:	4DC98B4B3B3215ACF736737C74931BF97B9F3586
SHA-256:	8E9A766F5C6B7F67562E33AE7E8EF753049C09DD669E8CC40EB94887FDB23B94
SHA-512:	7270831B80389F0ED6D4F7F0A865106DE83B94018CB20FC84EBF56CACC37C0A1B023D9A90BADE1F9A8000A00316AE5236AE0FEAB901C2313613A1C33207F9411
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................\|.....@.................................T(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Formatters.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.042668418966383
Encrypted:	false
SSDEEP:	384:7I5HeWFwTBsWerjP9Z95Xa/rl9qX2Ip4VLZCjdAA1m5wMzsPuI:7I5HFwTBUHRKrLy2Ip4XCxf1mlzz
MD5:	90D3BEE58A0AA90CEFDEF09FE7D98576
SHA1:	34C517B1CB91281CBAB1253624BB9EE23984E96C
SHA-256:	CE53C0656DE14AB215AEAF436CF85CB056A89E8CFA5D3EE727444C80ED6DE8F7
SHA-512:	6E432D68B80AA461077617EA093A817C9A4412C3E81E77307C96BD1122DA2759899F2D9C649F502A1CD0EA3CE7F0B1E2974370077F2DA3C0F3C9CEDD61F4C6B7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................\....@.................................\|)..O....@...................:...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Json.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.017159903856617
Encrypted:	false
SSDEEP:	384:2AJpVWbfkBnWprjP9Z95Xa/rl9qX2Ip4wO6CjdAA1m5wMDBu/:2AJpWfkBUHRKrLy2Ip4wlCxf1mlD0
MD5:	36D959C16C2B02B04D2EA24CCE6752D2
SHA1:	039F9E9DD22BC55A3CB941E8BF0C1A9BF7A07B2C
SHA-256:	FA4B7BB60E6F8113FB04E7B14632ABCF302C8D2A356F290BE1014BAAE61E4408
SHA-512:	DCBC4F4F0097EE52CC3933B70907AD7297C897B1AE2958624001D62A647B24FE9DF6D3BD6432A87737F74D13DF8A0AF3D1DDE7D75CE06EB9720593F63B891540
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ....................................@..................................(..O....@..`................:...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Primitives.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25744
Entropy (8bit):	6.721365603948899
Encrypted:	false
SSDEEP:	768:v1dyAqgQBfqyTBxHRKrLy2Ip4AzCxf1mlzzlZ:NdK1LHi/9AsfIPl
MD5:	8D2D51E700D8F12730189C49EB521595
SHA1:	B10D09CB5DC37F189151EE9294FF1A0B227117CA
SHA-256:	73555D3D6F3A7C735ECBE7B5B2C71CAE7E67B9D3020DCB1E3FBAC976E6310763
SHA-512:	9BF1FEF67B08F9331A976DD9DC0CC453333208AEA20EA213BDF50309B246CD587EABCBA10B39905FFA00CA2A3EC092914BAB4E9105AE293320A52802AE60478C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ..............................W.....@..................................8..O....@..8...............:...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......\|!..l............1..p...X7......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

C:\Program Files\ReasonLabs\EDR\System.Runtime.Serialization.Xml.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.8634763704059285
Encrypted:	false
SSDEEP:	384:OpsBljcZQIVI8CNwbcyMWs4oBOW9MWG4tBOWIrjP9Z95Xa/rl9qX2Ip4qLTjdAAV:csPMQMI8COYyi4oBNw4tB4HRKrLy2IpR
MD5:	0FDA1C1123E1440735B8CBF796A0FF90
SHA1:	A41A480D7ACF146E1E772090A097BF84F8A37D4B
SHA-256:	568AE987E24F0494BB782F24BA19E43391A835877C48B6E6DF32B7F9D46AA465
SHA-512:	F8AED32FFBCC9C43F08DBBE1B89D2E14FF5443E0A4BC340E8A846AF6C19ADFC468CB99D301520FFD8BE6FAE1B37943265955E4109BD788C8D8DF008F5E1E3B37
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ...............................M....@..................................3..O....@..............."...>...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s......s......0...........o....u......,..o......0..%........s..........(....r...p.$o......o....:.(......}......{.....(....z.(....z6.{.....o....:.{......o.....(....z:.{......o.....(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

C:\Program Files\ReasonLabs\EDR\System.Runtime.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28296
Entropy (8bit):	6.535649241097432
Encrypted:	false
SSDEEP:	384:4bhigwLAuZtM66g/Id7WVXW8rjP9Z95Xa/rl9qX2Ip4hCjdAA1m5wMDBu96:4bhzkKsHHRKrLy2Ip4hCxf1mlD096
MD5:	4358C0FB7A3830CB3C0F65734D54E5F3
SHA1:	FE56EEA28B06C67B6532923978BE76A6C9E937BC
SHA-256:	CE5AB73A3EE94E0D0A4A1F894885A5D7822386615A2E0DB08D4E09688C0CE306
SHA-512:	61BA825633E6319B6C13FB449607156DDEABC9D9627356999752D2E0966D0383581A707A75BA081DDEECA146FEEAC2AC448B9E8A25C5C9410FE09D74ADAE637D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0............"H... ...`....... ....................................@..................................G..O....`...............4...:...........F............................................... ............... ..H............text...((... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8....8.....8.....8.....8.....8.....8..........8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files\ReasonLabs\EDR\System.Security.Claims.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.01018265988071
Encrypted:	false
SSDEEP:	384:bUcX6W9aWGrjP9Z95Xa/rl9qX2Ip43KvCjdAA1m5wMt+uKW2MDug2uS:bUchqHRKrLy2Ip43KvCxf1mltdKWNq
MD5:	B5CD3546FB5660E318C478AE5702BF40
SHA1:	DB237901029B10313A378683FFDDCB2984295A1D
SHA-256:	C867C08AF648A1D7978CFEC4D19FF22A939BE213684B3E688A2C6B1945533092
SHA-512:	46351689E7B16788DD331FAB0FA22DF47FC781BED8FEE89798B0DA27DCB27959F536B2A7D2F11F281D85AC63B9D63251E03C8E39C34B83F1E87F6C2EBFCD983A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................=...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Algorithms.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46464
Entropy (8bit):	6.164766431431803
Encrypted:	false
SSDEEP:	768:aoBj7kS+8mjvHTeaWKs0Sd4eeaHRKrLy2Ip48TCxf1mltdK3N0:5Pmb9WKs0PeeaHi/9/fI/K3i
MD5:	66281C77E5AB5C7F86A5F917B88E30F7
SHA1:	3DCE110B186BBF31D7BF1C64C94F7D979027206D
SHA-256:	1D209584D163008919CD0BA26146C9591BB91592FA1EBA51B54A3B6213C9FABF
SHA-512:	0624C0A44F2D076FF772F8ED47C559C7AD55D0BCD909CC195819220E1E4549EB93D741C098173BDB0187B69F317AF693855C63E28910616E23450F46FBF3FBC1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ....................................@.................................u...O.......8............x...=........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rI..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r9..p.(....2rm..p.(....2r...p.(....2r...p.(....*2r=..

C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Csp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.028815476254108
Encrypted:	false
SSDEEP:	384:yTI2pWPzW9rjP9Z95Xa/rl9qX2Ip4KTPCjdAA1m5wMt+uKb2MDug246:yE3cHRKrLy2Ip4uPCxf1mltdKbNo
MD5:	DF4B7A795571B55CE86F74A1C08249BC
SHA1:	9C8A478BE482094EB3AD4543E0239635A5F5A581
SHA-256:	496BE8AD65B5EEA31BDEDDC4284990D14988A9DA7CC9B19EEBDEBD034FF53022
SHA-512:	5910A7AEA09BDB2F3D6AFFEE9134ECEDAAEAC182F16E715FDC1FE9E890448DD938DDC9065AD36C7E6D852662FB62A5ACF83834BD125F6AB22F8D944A901AC6F4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ..............................nz....@..................................)..O....@..`................=...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Encoding.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.043203018042703
Encrypted:	false
SSDEEP:	384:ucezoy4W04WoFrjP9Z95Xa/rl9qX2Ip4sQ8TjdAA1m5wMT9YMWuuwCNA5DFpk:uBzoy+KHRKrLy2Ip4sQ8Txf1mlTAwCNP
MD5:	1E2909FF20B8D95495308530A1A13676
SHA1:	3B72EEEE7D42BE66AC3BB7C1E4622A0DE2EE86B6
SHA-256:	C2714DFE9E5C9ABF062FF2F74E4671A7104962BCC707668537927F6290E6D00F
SHA-512:	96C5617BCCA5F39E92174337C3D03637FE56F2572DCDD7BA945CCA441AC5377C1CA87597524D0E52050EAF647BF1AA4ED26EACF1B06B1321C5C89E31DB5EF706
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ..............................p.....@.................................,)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.Primitives.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.961404899955368
Encrypted:	false
SSDEEP:	384:JH/JWKpWFrjP9Z95Xa/rl9qX2Ip4xsxTjdAA1m5wMT9YMWuuwUNA5DQITB:JH/jOHRKrLy2Ip4exTxf1mlTAwUN+0M
MD5:	BC8A91C10FD4A5429AC54A015921A4C4
SHA1:	A85B915FFB5104CEBDE7D1D26FD646F09629CC44
SHA-256:	CDDA0D36EEC0BB62393ED72FA43D1BD5C241B2222E052AFDD070007B4B04ABF9
SHA-512:	270D7AD50775FA2FE50DF06C204562E61D323011828B534887F0EB83ED7BA20768B9964205C4121A9EC97F1A4F97C42B9E3BB6222202A308D1CC1BAF0613FB26
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."... ...@....... ....................................@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EDR\System.Security.Cryptography.X509Certificates.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21648
Entropy (8bit):	6.900106811884281
Encrypted:	false
SSDEEP:	384:sTjbocNsWMhWbrjP9Z95Xa/rl9qX2Ip4uux6CjdAA1m5wM36QNuZLL5:AboYyAHRKrLy2Ip4u46Cxf1ml36QgZH5
MD5:	A471FF1F9125DE39B50573F7803AF769
SHA1:	75F39916F239075C34470A2BB730FFE9DE14438A
SHA-256:	9647FE75BB47364CEA56B78828840E8752482A7D83BB369771681B5E3810387C
SHA-512:	8209F8FFC6DE5830092876360F6A4DC0107EC8748808ABB49FC09DE73B78B5D028A0A26CACF921D85349532160643F0907CFABC8967DF12F55DB861CF75E310F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................k.....@..................................-..O....@...................:...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....x.......#US.\|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

C:\Program Files\ReasonLabs\EDR\System.Security.Principal.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.9886717572167285
Encrypted:	false
SSDEEP:	384:ISKiWIhW5rjP9Z95Xa/rl9qX2Ip40Z+566CjdAA1m5wM36QNuZLX3:ISK8iHRKrLy2Ip40ZA66Cxf1ml36QgZ7
MD5:	540D04AA9B9CA639DFA78EB6BC11E195
SHA1:	78530FA7D8A68F67145DC2B98604E871AD411228
SHA-256:	C882A29AAB3E323719D129D9E75FB878DB909A3F2AB76D65C5696459B01FE90B
SHA-512:	18DAF10638A899552B80AFEC035EA0BDC03CA65963336896002AC415826C5C1004D5C7617599338DE50F9266D6AC75117C1B8A2606E88A28B3B488C878F176DF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................t(..O....@.. ................:...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EDR\System.Security.SecureString.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.952579369169005
Encrypted:	false
SSDEEP:	384:M0KbZWApWmWTpWNrjP9Z95Xa/rl9qX2Ip4DTnTjdAA1m5wMT9YMWuuwVNA5DyOI4:DKRyiHRKrLy2Ip4DTnTxf1mlTAwVN+uQ
MD5:	C22EFC2F987821406E7F39E6432DBDF5
SHA1:	BC2CD24C4578EE3E7BDBE524D7703583F1D4B70E
SHA-256:	11C03D5D29516D82FCFC512777AE49D9B5594FC48F399CC5198D21C251F8B9D3
SHA-512:	2AAD2733729E58BF4D7A7EFA8B8B5B97ACA49C453C9272CAF7E85474731CB0EA29E8BE04DE47F22CCD3458AAF25FE70D7504C8DE916682941CF14AFB600C056B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ....................................@.................................>)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(......(......(......(....BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

C:\Program Files\ReasonLabs\EDR\System.Text.Encoding.Extensions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20104
Entropy (8bit):	7.01078174815367
Encrypted:	false
SSDEEP:	384:xb1nWCXWzrjP9Z95Xa/rl9qX2Ip4yCjdAA1m5wMDBupe:17yHRKrLy2Ip4yCxf1mlD0pe
MD5:	5177EDC078028D8E88FA55A3960328F2
SHA1:	19D84FDFF5B3D1164A7AF7CD53B1DD7A285A3224
SHA-256:	320A063AA8FF50E6684BAEA892F023AF5DD7B4B33B1E3ACEBD5E47DD1F778D97
SHA-512:	F83871D0BE1F5A598A2E9A88DD4FCB648FBA2997DDA981150827F02331929D50BC067F4543A9FD476384919AD3302E0A7858BC2C93181B27CF2D4E73D9B94A2D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................Ky....@..................................(..O....@..T................:...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EDR\System.Text.Encoding.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.933857173145757
Encrypted:	false
SSDEEP:	384:YxyW7TW4rjP9Z95Xa/rl9qX2Ip4HjCjdAA1m5wMDBuS4:+fHHRKrLy2Ip4DCxf1mlD0S4
MD5:	E92883D9D3772678F18EBCACF8DE60C1
SHA1:	E12BB87179A5F5C3E78C8A883C430C9E53A5B464
SHA-256:	7ED94887C9F14C1032147C9EAF993EDF9B5F40532A888A889E1E6A1AF353B842
SHA-512:	8AC6D6D20D2F2CE74E1AF5CA157E381CD4507605C5D0DB92829654CC07A5BB37684609212EF3D7CA7B5D77FDBCD085E0E9E873EFFFE497726B5FB41E94F25910
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2... ...@....... ...................................@..................................)..O....@...................:...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EDR\System.Text.RegularExpressions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.043584942077097
Encrypted:	false
SSDEEP:	384:fd6Rb32WVzW5rjP9Z95Xa/rl9qX2Ip43chTjdAA1m5wMT9YMWuuwmNA5Dk:fERb3dkHRKrLy2Ip43chTxf1mlTAwmNp
MD5:	A9822B47A1E850BF593CB61B4B0DA6A5
SHA1:	443308B64C9BD1B24DEF286F5D118B5D4D46A59F
SHA-256:	0E276865A2877403DD7C8DF94F9AA7CA15A5EE49A3FC7A9A866B9CAB7E1198F8
SHA-512:	930D3CC22411665E36A789000A5F45679E1E9CD5D9BC07863DFE777C7A7A9CF36932AF79D8FFFDB2A01C2EC3B2F609EDA6D3AD96EEEF0684B3C1AA399638BB42
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................t)..O....@..P................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EDR\System.Threading.Overlapped.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36496
Entropy (8bit):	6.692065690331391
Encrypted:	false
SSDEEP:	768:ou5I+sqOylryry8qqIfUc7a5AHRKrLy2Ip4d6Cxf1ml36QgZx:oYIVBpry8qqIfUcm5AHi/9xfI5g
MD5:	928FFE2B02C8C07B69B235D52C179EB1
SHA1:	766DDE57768588CCAA43602E57B0F46E1608AB82
SHA-256:	71C1DD3E2683D124B65237376FB4DF2D6FFD85079038FAAB827C281DA69A6D69
SHA-512:	2E2EAA3AD7F167E6E412DC9AC04B49409FA4F297710DC4A1CF9BAC152C7561CCC31D99E0DDFF5CA423298F0A69F0D59F55B6AF34251D7279F910BC179DDF99F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ...................................@..................................c..O.......x............T...:...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rK..p.(....2ry..p.(....2r...p.(....2r...p.(....2rc..p.(..........(......0..;........\|....(......./......(....o....s

C:\Program Files\ReasonLabs\EDR\System.Threading.Tasks.Parallel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20880
Entropy (8bit):	7.0167424902341216
Encrypted:	false
SSDEEP:	384:xvn4HREpWiQWdrjP9Z95Xa/rl9qX2Ip4TFqjdAA1m5wMcJcouCPiK0z:uShHRKrLy2Ip4xqxf1mlcJqCPm
MD5:	0F8E8070A4B0B55480AB85A85EB22B9D
SHA1:	B60E58FD0ECED6BFDB7CF2441EAE88EE6A6FAEAB
SHA-256:	E72C6D3A7E9E23C0D6332AA4CDB8140E127A7913484E8FFB6CCD384491BC51D9
SHA-512:	903731D067496952B5582A5839491B36C90A9BB21E50BB70130288D4AFB50628A1A0D4AB9DAE7F0121E9A14C923A4D98B4B02E31E0985BA85A0042983853F879
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..P................=...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EDR\System.Threading.Tasks.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21136
Entropy (8bit):	6.925388301948598
Encrypted:	false
SSDEEP:	384:M8MjKb47T3UCcqFMkJ59WdtWhrjP9Z95Xa/rl9qX2Ip4PJCDCjdAA1m5wMDBu/:9MjKb4vcGdOmHRKrLy2Ip4PyCxf1mlD+
MD5:	B09E7D715D06FEBF8F0731AF593B2151
SHA1:	16966B4503352D387EECDBD358CB77ABF55960B9
SHA-256:	767041162E62EB43DEAAB00F6D4E79890C15D7D3B2150CABD48948B51D0D37EF
SHA-512:	CC60BA9571F1BC3EF4604C15864A6A27EC87DA519E0F636CF9B21F1200E0D06D84A76331196EAABBC5BFCCBC43E8BFCA8FCC31105639C0E849CD94C0AD9C38F4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ...................................@.................................`,..O....@...................:...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EDR\System.Threading.Thread.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.001945686038119
Encrypted:	false
SSDEEP:	384:fzyNXd4+BW6FWbrjP9Z95Xa/rl9qX2Ip4j93MCjdAA1m5wMDBuh:ezMHRKrLy2Ip4qCxf1mlD0
MD5:	209FFB98068B9A091F03DE3EA4A02A83
SHA1:	CB7DD764550163D9F8D156CF9565CC1071CF05DA
SHA-256:	5961BFBC94256103198F867E0F0A22A2EA2039B572F81FE8B75168DD7225EBBD
SHA-512:	4FBB9DF6CA43D582B18E28F8F0C10C1189E59FDFB18F87FEE24E49E8BA446AFEDE56F409F9A49B09A7C127CE54051384F8335217E2844B3A9108AAD9CF20C472
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................I....@..................................(..O....@...................:...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EDR\System.Threading.ThreadPool.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.012131761847572
Encrypted:	false
SSDEEP:	384:pvs2Q3HKJNrWWRWErjP9Z95Xa/rl9qX2Ip4Jy714TjdAA1m5wMBq5ul09vfh+JVI:puMRHRKrLy2Ip4JI4Txf1mlBqsqv5
MD5:	A32EADC37E0A1ED37FEC41FC2E045CFD
SHA1:	4BA3FFE3A6FA3DA342CE83F5AEF5CBAC86D2311E
SHA-256:	2039B9EC93FA1251E5DA3E1A2B96B8F3450B01C44413EEFBDD4BC455274FE354
SHA-512:	5F158EE1C682E0670CCAF2A7FC44693492A9D2A46A73E5BADCA3B2999F19B08F89C8CD210E3C0665FFFDB1527ECF2D125FB4CC07F9B6BA34BDC9CD1EACA50B51
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................p.....@..................................(..O....@..4................>...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files\ReasonLabs\EDR\System.Threading.Timer.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.9924618472479105
Encrypted:	false
SSDEEP:	384:xFz0Q6gcqRhcsMWdMWDrjP9Z95Xa/rl9qX2Ip4/bVTjdAA1m5wMT9YMWuuwmNA5k:xFz1c6THRKrLy2Ip4DVTxf1mlTAwmN+k
MD5:	3A428C73A353ED7509FBFB4942604D72
SHA1:	D807D591C8257C0FC1EC8F4FAFD403447A164C22
SHA-256:	74CF34024678952427D238FBF286E1D3A53C81E4ED3F8FBB6651356A3D1A8D01
SHA-512:	4D0E9F3E7C11727260AD2628CC42274698474E45EF2AD63FF98938E90230F4ABBD3BF4A95A647443A24CFB63377FB6EB69F1A06F7E832FD36EDDB49079AE2845
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................L(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EDR\System.Threading.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.912168734049125
Encrypted:	false
SSDEEP:	384:z6xWA3W4aW/NWUrjP9Z95Xa/rl9qX2Ip4bTjdAA1m5wMQhKuVd4m5vZqIcNOE:zaBJHRKrLy2Ip4bTxf1mlQh5Vd4m5ExT
MD5:	DA0A017A7B27E4E070FC451B78509F12
SHA1:	770C7BBDD3579F4C0C4A7E0747A2CCC0C3F5F740
SHA-256:	7DC2B072A5431B0CBF5F7DF8B19E0A4CAFC43ACDDD3EBA0F8E77D3B87161FC6A
SHA-512:	49AE7C5849A2ED81A32FDD06DCCC78556AA2F695BDD4062F9C090330C49B0698178B68B5DF1268280A3C5D7DC158E3FCABB3C2F7A7D64B4EAE0747B217BADAB0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ....................................@..................................+..O....@...................>...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .............................................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files\ReasonLabs\EDR\System.ValueTuple.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	6.068451904343695
Encrypted:	false
SSDEEP:	1536:QIumja0tbe16pSc45EfL+4vD4SuJbhjXuE3FMqF1KAy4kHo05ureseh79xHi/96m:QIuAaGbeGq5rKASI0ICh9fG/
MD5:	497DBE1C655A103B64BF60DD1B9742DA
SHA1:	739CAA4AA085FE23B4CFD24CCFF12D9578EDEB5A
SHA-256:	C80225BBCF11FBF421DE9169191C2316C96B9E5858C0B2749C53EEEA8993148E
SHA-512:	093C06FB355BC5CD8148332689C183F80732960D88647D0A75E3CEE234A2B83C55235F100D23748B8BA6748736DEC5D8A465593642EB92EDE4EC1F214EC84A84
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............~.... ... ....... .......................`......Ja....@.................................,...O.... ..x................>...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...x.... ......................@..@.reloc.......@......................@..B................`.......H.......................d.......t.......................................6..o.........f..o...........o............o...........o...........o............o...........o...........o ...........o!...........o"..........o#..........o$...........o%...........o&............0..L.........o'..........o(..........o)...........o...........o+...........o,.........0..Y.........o-..........o...........o/...........o0...........o1...........o2...........o3.... .......0..k.........o4....

C:\Program Files\ReasonLabs\EDR\System.Xml.ReaderWriter.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21400
Entropy (8bit):	6.994018550233344
Encrypted:	false
SSDEEP:	384:2r97WquWzrjP9Z95Xa/rl9qX2Ip4o9mqjdAA1m5wMRv3cquhqjlLBd:2RJBHRKrLy2Ip4Hqxf1mlRv3cZhqj
MD5:	E2143D1AA04BCC81A1079CC3D502C85F
SHA1:	60D8889978337C74D9CDB209EC50DFFC79796C68
SHA-256:	AB28A9025F8537F3ADC4673F5D9DA769C688AD14DBBFF9C2022B99264C360A05
SHA-512:	0FAC48EA0651D638416019540EAE37C349C4DB25BB2075C13C855B60A4524DC51E001B23A0559ED56CCC81FED9141E4FB6D8E5AEFD1D00DEB9EBA29AC3567FDC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... .............................../....@.................................\+..O....@...................=...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EDR\System.Xml.XDocument.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.966463595778793
Encrypted:	false
SSDEEP:	384:J16eWLDWxrjP9Z95Xa/rl9qX2Ip4XTjdAA1m5wMBq5ul04vfh+Yg2:L6LgHRKrLy2Ip4XTxf1mlBqs3v7L
MD5:	6A2A6B51A7FA9D5D06FA735E70E40BF0
SHA1:	C5BE68952FE78208F1A8E306A556E96C4B190C93
SHA-256:	A08770C6344602101FC611FED68F71579FD06CB7823ED8FEEBC511B1D1AE4150
SHA-512:	C341134693BCAF3F13979AA5DE59508ED64E1AA3674572FEAD41E20320BCA8FFFC27BED3EA1874AB898E540B5CFCE016DDD1A3B520A55D3E16A7EBCAE65F1AF6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0................. ...@....... ....................................@.................................\|..O....@...................>...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EDR\System.Xml.XPath.XDocument.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.952372708304721
Encrypted:	false
SSDEEP:	384:D8G4YC2W+wW8WpwWJrjP9Z95Xa/rl9qX2Ip43dTjdAA1m5wMBq5ul01vfh+Z92:gGZ5JHRKrLy2Ip43dTxf1mlBqsOv8Q
MD5:	CD4894F1E77B8A9EDEDF5CD9775001CD
SHA1:	B3CE1EA8BD191F5CC34512D832A3A2D9EDB51811
SHA-256:	E9BC548E0052F85BD3D2E640987905404E2FE27F8A31D90648192937A4E9E4D1
SHA-512:	A5D8B5E9B66F3967C2192180938658B44CAA29B4D83E84D39B104A8DE8951B922A545712BAD0265E607E5EBBEDDD09A7FA837E13A893592FC370C25FEE604189
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ..............................k.....@.................................z+..O....@..x................>...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P........................................s....:.(......}....2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

C:\Program Files\ReasonLabs\EDR\System.Xml.XPath.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.0376762989157
Encrypted:	false
SSDEEP:	384:D6ziqTEkGWvRWZrjP9Z95Xa/rl9qX2Ip48JETjdAA1m5wMQhKuVdAm5vZczsoJ:DYT1eHRKrLy2Ip48WTxf1mlQh5VdAm5E
MD5:	00BBE6D832B673963EE8BC6404CBB1DB
SHA1:	05E1CBBF4D9774EF62A61BAB601F2EDA1E72DA0F
SHA-256:	3BF178AA6FDC46926C574D3F307B30EBE87D4481C7400EF527E1BD0D4DF7DF91
SHA-512:	4C20639B211264009A83BE85D28CDF21A553DB3E2BFDE04EB716C9C1C082D37E23E95E197BFF0C0019429A44C22997CC6AAC44A72D4371D2E82BD6A56B1FE176
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................TJ....@..................................)..O....@...................>...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files\ReasonLabs\EDR\System.Xml.XmlDocument.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.975166502138063
Encrypted:	false
SSDEEP:	384:0Uv7c7iWNCWjrjP9Z95Xa/rl9qX2Ip4TTjdAA1m5wMAvru4LTXZIjNJ:0M7c1tHRKrLy2Ip4TTxf1mlA6KZ8
MD5:	2F66F0F5AD5EF1F67F0D6096BF10A553
SHA1:	8AE3D7E780EC9177073D618F28D5DE7A1211CFE0
SHA-256:	FD46E5FA1C263C127BF8386A53D457A2E1619AD15A79EC0DB6CC956D5925CDD0
SHA-512:	26E0788910E6417919306F47C3A1590177A3F0403EE28EC869280D94B8839A2EE1401C41EEBA33555405C99ECE686785337BBB3EDC73F8D34E703F5F9D079806
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0................. ...@....... ....................................@....................................O....@...................>...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EDR\System.Xml.XmlSerializer.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21392
Entropy (8bit):	6.998832177906868
Encrypted:	false
SSDEEP:	384:iSWnRWLrjP9Z95Xa/rl9qX2Ip4EeqjdAA1m5wMRv3cquhWjlLo:izcHRKrLy2Ip4xqxf1mlRv3cZhWjW
MD5:	BEC0755730B206089B82B42109DC0A6A
SHA1:	57FB2797D73991F48A5ED1211BED5B7AECE85803
SHA-256:	071AC56D8E9A64A1C1E32DCD0880C5E328BE47050DE776323BEF6F70FA0AC487
SHA-512:	936F3DDA594D4421A61B12C58C4A0AAF4FAC3A9EF8DA7131FBF763461D5C74C991DEED5A2F21063B40A6978CDF72D470604D95D421EF1AF38185C80FEB74633C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ..............................%.....@.................................L+..O....@..$................=...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EDR\TraceReloggerLib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	6.947773246140973
Encrypted:	false
SSDEEP:	384:aoMeAKyr1jSC6rrjP9Z95Xa/rl9qX2Ip4STjdAA1m5wMBq5ul0Rvfh+q:aoMbKK1OBpHRKrLy2Ip4STxf1mlBqs+f
MD5:	4CD2BE5105CD5E9AF7D4BFFF40F99B6F
SHA1:	B0B83308D8007A7B1FD9EFB4D28373B532C713A2
SHA-256:	2A9D8653F09B4FBA3A39E03FECB6C2D1747813D8051C0F9060EE81B62C082DAF
SHA-512:	329CB6AEBA3DFAB79806075D0C1255CD53EA8A2D8566F2E3A16ECC3C04D3301702485D292DE30E3D262A282E64B00CE56950A13AEBB3CDB7AFC8F906E4881F88
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.NZ...........!.................2... ...@....@.. ...............................~....@..................................1..S....@...................>...`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H........ ......................P .......................................t..Ar..(9...8.7.Y*(...x.R.[#.e..3.A.8]...a?..o...W..%...,U.8Rn...^..?N ...0....f..X...G.P..Z.X.....ih.Du.UPxSh.............BSJB............v4.0.30319......l...h...#~......d...#Strings....8.......#US.@.......#GUID...P.......#Blob...........W.........%3................)..."...'.........................................p.........).....L.....d.....r............................................... .....5...

C:\Program Files\ReasonLabs\EDR\Uninstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	96000
Entropy (8bit):	6.9811464858641346
Encrypted:	false
SSDEEP:	1536:OsuNLvSFVVeozLpPu0jgbWjjWcJorX/wC/wPqaWVxEdHi/9NfIc30fP:O1NjcVVnLpPun8jvqPw5fXPH
MD5:	5D58234A8024444C73B39CEBB62BD3BD
SHA1:	0667616E58B31F72FE95EA59B6092D68B747B014
SHA-256:	400C678A095C17DE027DD6A878267A23CD14BF7428FA9CEF106B9E846FFCA346
SHA-512:	2DBEEB5628EDAA3C7BC2D0104B07CE16E39FE27027E823C4F645A603C447C4D67CCC4EF43DE4CA28D946BEAF18B9FC96666464F58694E17CD6969AF7D91498C4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L....Oa.................f...*.......4............@..........................p............@..............................................m...........9...>...........................................................................................text....e.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...P...............................rsrc....m.......n..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EDR\amd64\KernelTraceControl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	234496
Entropy (8bit):	6.308803769130203
Encrypted:	false
SSDEEP:	3072:+X5gE72vcK8s7pTxEl7Onygi9wDO4z4WSYB0JuPrOAjT//P2jVFU10xNA:+XX20y7HNz14RU0J/AL2bUqA
MD5:	BF3E4DEEBA78482CF19018DD55751642
SHA1:	9166B4449953624995004544326CBDACDE285E77
SHA-256:	E172168748E0A2E7B2582F3E941E7262A366D8B292B6C2FDA3B6ABDA3DF1A455
SHA-512:	D012A20926A6EE5DD54227CEA9EA0E51CF2A40DFCDC4146E99482A8747E18BAFD615C4CCC72373A47D050062CAF5EC7744BC174EF0DEE104E329AF631F3702D2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>..jz..9z..9z..9.$b9y..9.$a9w..9z..9...9.$\|9i..9.$}9{..9.$d9l..9.$`9\|..9.$~9{..9.$c9{..9Richz..9........................PE..d....S.V.........." .....l...........H....................................................`A........................................ %.......%...............P.......V...>..........p...8........................... ........................$..@....................text...5k.......l.................. ..`.rdata...............p..............@..@.data........@.......*..............@....pdata.......P.......,..............@..@.didat.......p.......J..............@....rsrc................L..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EDR\amd64\msdia140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1692048
Entropy (8bit):	6.326801866800496
Encrypted:	false
SSDEEP:	24576:x+8Gg7kWyJnk8kvXfX+WquRLvbKG5pkKMV2Dzbcn3P88/UTlXe:x+bWE+TvTRLv/y2DzbcnU8/UTw
MD5:	B0B902CF5B6F147211370A7BC97765B4
SHA1:	1993129A785CB3C99F80A948D2FA75DA454D4E85
SHA-256:	9418B43B8F26DEF716E15EC9138C49AE4DF08306F9D1FF4C65455F2A729715EF
SHA-512:	E556BFD25A6B6AB9E1FFEA82CB5D4813B4BFE8CF90C77EC154D6295AD257625FE431A303185F3CAC5271583881F500869478CD6AD6268D938C9F35ACEE7B4E69
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..si..si..si.3.i..siS.rh..si..wh..si..ph..si..vh..siS.wh..siS.ph..siS.vh.si.3.i..si..ri".siS.{h..siS.sh..siS.i..siS.qh..siRich..si........PE..d....8.^.........." .................b.......................................0......}.....`A....................................................<.......x................=.......H......8...............................0...............p............................text...~........................... ..`.rdata..\...........................@..@.data...(........b..................@....pdata...............,..............@..@.didat...............8..............@..._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc...H.......J...J..............@..B................................................................................................................................................

C:\Program Files\ReasonLabs\EDR\amd64\msvcp140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	589824
Entropy (8bit):	6.46320033169136
Encrypted:	false
SSDEEP:	12288:ut8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3HC:uCMm9pyp35bQEKZm+jWodEExi
MD5:	6BA8C51379494D612E4EF69550A6CE8C
SHA1:	2D642A9FA5C9435E43D009C8734E0FDE44327C29
SHA-256:	F832E41CC246B1037289D731804D2207837E8B8D0385F357B1A7592E94308932
SHA-512:	2426DD48264F6C0189C5A840B6F11DC877C9096472A50C267EF52125A39011DA8D4D755572CCC71B77D6701359A7364C95BB3473E2BE49C2FA32EA861E81A389
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..............w.(...#...<........../.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;.......>......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EDR\amd64\vcruntime140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	99984
Entropy (8bit):	6.5538732748545305
Encrypted:	false
SSDEEP:	1536:Xy6+2mUD0uBFRXqYue/o+18iBH5T7heunxr98nZXR9xecbSQ2bnHi/9vfII:XlXfRXqQw+PHLrCZh9xecbStV
MD5:	6430909108F315614AB8C02265ECF041
SHA1:	7BD0CF29CB2D17E730170F8264CCAF90ECB662D4
SHA-256:	27DD79BD367559A0DE592D33B015F7204A9C4483192BFAACDEC9DE07BF460FF2
SHA-512:	A1313FB85EC019AADF1BB449FA333B998D1813D54A037CAC06F9CC37A50F6C70D8F41B434AFCD51A7B97BAC43C7F291DE5111C2D787352207A6160D4FF9234BF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!/.NeNl.eNl.eNl....gNl.l6..nNl.eNm.INl..>o.hNl..>h.uNl..>i.zNl..>l.dNl..>..dNl..>n.dNl.RicheNl.................PE..d...M8.^.........." .........^...... ................................................P....`A........................................`1..4....9.......p.......P.......L...:..........H...T...............................0............................................text...b........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EDR\amd64\vcruntime140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	6.64690620367382
Encrypted:	false
SSDEEP:	768:8JnUUV7xPg4RdPvv1DHkhh+JHRKrLy2Ip4eTxf1mlA6qZe:8aY7XN7I+JHi/9+fInqM
MD5:	3382104CEE2BE75491991D2631EC056A
SHA1:	8DC3AF340121BBFDC69CA2E04388CBD1E37DB5EC
SHA-256:	40147F671339275AAF711388EEEB5F8F313864DEE717E099116085A57286CAA4
SHA-512:	EE613917FF5CD539E4B1526BE1CF48A6C478F0D72291865CC1167AA508DCAF017EE22226C1494D69CCD3513E9F4761C345BE8C5DAAE6B40B1C79CDC71D450C64
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..j...j...j....l.h....y..h...cq..a...j...[....y..o....y..m....y..p....y..k....y\|.k....y..k...Richj...................PE..d...Q8.^.........." .....:...4......pA....................................................`A........................................Pk.......k..x....................l...>......8...(b..T............................b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EDR\netstandard.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97424
Entropy (8bit):	5.617357157968208
Encrypted:	false
SSDEEP:	1536:x2Ec05j4eAH64rh5fSt5T9nFcI94W0Hi/9efII:glK4eA7mDmWJ
MD5:	D316F297D51844DB28FC96A847ACC05B
SHA1:	2A046FC6DEFE22033A76F2F6B18112738CBDD5C4
SHA-256:	057FF7A5BBDAA0BDD437D68FC9E0534CD0DFB42EB70DFE87AB864DC8EDB086A9
SHA-512:	C1DAC8920B7DB1B6AA13639DB223C4AA02594F7EB57810891C615B850A3C8CA4ADD9C5BF64B8AA8C28EE1528B3018945C72F850305BA8223577EAB498AF5E1ED
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ...............................u....@..................................U..O....`..,............B...:........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Program Files\ReasonLabs\EDR\rsAtom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	177152
Entropy (8bit):	6.55862728173861
Encrypted:	false
SSDEEP:	3072:oSHreWE0uOeOyqN8ROsKQsN3gVTAg3mZtrOYDf1gwBvDO:fLeWEPOyqNnys+K1trOOSx
MD5:	27C1AC30C9AE3BD7665FB4648AC2648E
SHA1:	B07C7A939CA2ED27F3491835CEC2B5F4BAC9B25E
SHA-256:	86D05E66E4AC5DBC46BA6270E8A57B5D12E2E31D58A4ECE1BA95F3F381F6CCBF
SHA-512:	BD21AFE8BD5243934DF9CF0B04310DBFAB100F76AD17EEF7CA39D2D3C6FDCD9D071BEDBC947C52FD58457F1460715BE65E44B5D441864E2C82BBCF3B84D2C5CD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#.............!..0..l..........>.... ........@.. ....................................`.....................................K.......T............v...>........................................................... ............... ..H............text...Dj... ...l.................. ..`.rsrc...T............n..............@..@.reloc...............t..............@..B................ .......H.......Hi..l................~..&........................................(....(....:+.(Ar.[.(..................................0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................HP.z.....0.............B(....(....(..............................................................................0..............0.............Ad......G.......Y...

C:\Program Files\ReasonLabs\EDR\rsEDRLib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1648784
Entropy (8bit):	7.665089270086584
Encrypted:	false
SSDEEP:	24576:YHRJ4hTCfcsbCQUVu1B/NwOBsG/F7vL6E7wFGk3OwdKZa1zBwSUnn3KNEIq5ZXta:E+TbsbGVWvBB/ROEA3FIUninM1q5
MD5:	3E7DD0248ABCB1B24AB54ED6E09E15FE
SHA1:	3513AE79BADEE569D8C6E0B459851C60FEA08F27
SHA-256:	765F56F16FA3E15069DD882A59BFD755CA14B123A287E0841596D3EC371AFFC5
SHA-512:	07816CAA3E2E62F10D40462B373D06567F8C012999D145BC0815A0DB3FE460F023EBBAC5254EE71073FDE5680BF721EDC75A9343B1105C00F4B31B3C991D0253
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...j.............. ..0.................. ....@...... .......................@............`...@......@............... ............................... ...................:..........^................................................................ ..H............text........ ...................... ..`.rsrc........ ......................@..@........................................H.......................B...............................................(....(....:+.(...P.(......0.............AL..........K.......@...........8...t.......;...............T.......................0.............AL..........I.......;...............z...4...;...........f.../................0.............AL......p...F.......^...................I...;...............Y.......................0.............AL......l...D.......;.......................;...........2...9...k............0..

C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	163328
Entropy (8bit):	6.264821948719024
Encrypted:	false
SSDEEP:	3072:qeD9b8uzpNi8br556FpwsdxcNfBBFaS8o92WnTbEZBtQ3rvXeX:qeD184NijpTsNfBBF392WcBQC
MD5:	6B03DAEF1CAA676A0BC6E13B4BC8F89B
SHA1:	3985879BA05C56C0FA1839B569EA4643731A052C
SHA-256:	DF2B1F19DBCF4E1787AD625AE73D844B129D126661861971F8E13E794646906A
SHA-512:	741517162EC051D199CD69ED768D6FFE48C75ADBE1CCC06BE1272FE4C6A2C45B64414E84673B036B2BB85CF7B49175107AA03627ED216CDD2E79D47027A73166
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...a.\|...............0..6............... ....@...... ....................................`...@......@............... ...............................`...............@...>...........U............................................................... ..H............text....5... ...6.................. ..`.rsrc........`.......8..............@..@........................................H.......................(....:..+U.......................................(....(....:+.(vlpI.(......0.....................GU.J.....0.....................LZ.E.....0...................K..f.............J.....0..............................0..............(....(..............................................................................*....0..........+.(X...8........E........8....(....8.....(...........s....o.... 3...8........E6......."...................3.............

C:\Program Files\ReasonLabs\EDR\rsEngine.Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	334336
Entropy (8bit):	7.162095871589973
Encrypted:	false
SSDEEP:	6144:UUkuU/9vnxhTmdaXlumDgLhhgV+AhV30ZwI+3U:tg9vn+dSBDahgEADu/
MD5:	C2538DD971AA2D4F2E863695FB4C585E
SHA1:	46B1814C5155DD5148DE7EB06D58B7AE2E5CD6AD
SHA-256:	D1781B732CDE702764A8007F76EE8CA0B464C4F4EA30A6E0C67AB562C9F509DC
SHA-512:	8587B2141F8A14235B9058EEA876A4202152AC79505B68C5CCEDF21265EC86CF732E769365F4CAE95E9C8B31C49DBCD48D302A8D2D1928E69B78D9B07866DA1C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...npA............!..0.............N.... ........@.. .......................@......p.....`.....................................K.......h................>... ....................................................... ............... ..H............text...T.... ...................... ..`.rsrc...h...........................@..@.reloc....... ......................@..B................0.......H............/..............'...4........................................(....(.....0.............AL..........K..._...;...................,...;...........]...V.......................0.............AL..........I.../...;...............j.......@...........8.......W............0.............AL..........K...g...;...............p...%...Y...........;...b.......................0.............*AL......Y...D.......c...................f...@...........d...L................0..........

C:\Program Files\ReasonLabs\EDR\rsEngine.JSON.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	6.18944717645377
Encrypted:	false
SSDEEP:	1536:f2DD4JcSb+rfzHr+fWPu0yHHFx9EqJvhSYNBcFFlngCTltxeR8LmsvDiHi/9nfIt:QP++X9W0gFx9B9N+FFhgCThLms7knt
MD5:	747A3CBD0A2B77BE3CF507BCD4DF1BDA
SHA1:	565EC03E0DC06B00C09E3890ADACA584871EB180
SHA-256:	263BC382848CBAE80BD641AA0654A23971E2887E07BC1D6F4182DAFF84C501C0
SHA-512:	661C6CD0CD4290C2D27669291A9CCD746C6E57A90CC753BE06DD9D55012F16119CEBE0E7D24352400FC21E5626D41AF79ABBC92A72245EA1AB5E6F3C368C31FA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....2............!..0.................. ........@.. .......................@............`.................................@...K.......h................>... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...h...........................@..@.reloc....... ......................@..B................p.......H........_...o..........d....%..q........................................(g...(....:+.(8L`@.(]......................................................0............................0..............................0...................................................0.....................0.....................1E.......0...................&.Sy......B(g...( ...(!................................................................................*...B(g...(]

C:\Program Files\ReasonLabs\EDR\rsEngine.Loggers.Application.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	146432
Entropy (8bit):	6.2745753496402985
Encrypted:	false
SSDEEP:	3072:qmFLQiVm1Ie2cDQHOhsK21h8iFT9Z6avH6SCZlmm:zQwm1IeSHOeKmmOC5
MD5:	2487994259AE9E8166F22FE39790C671
SHA1:	09E1D13605AACCFC0F6EF3858AA53AE0135746B6
SHA-256:	4AD77036EEFF9E015C1E6FE1886A465845ADDBDB56AAF5ADAC238AD1CCB91AD3
SHA-512:	9A1C3D6A94C954C093547134F621ED69C897C08E3305409FDF3FB17ADC960A17EC03066005AAB16ECDA7F89A55B31FD1006EFA54E5C8C59375BEF05639937F59
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.I............!..0.................. ... ....@.. .......................`...........`.................................`...K.... ...................>...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pc...w..........$...q5...........................................(q...(....:+.(..d>.(g.....0..............0.....................g..;.....0..............................0..............................0..............................0.....................*.......0..............................0............................0..............................0............................0..............................0.............*........ff.......0..........

C:\Program Files\ReasonLabs\EDR\rsEngine.Utilities.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2261504
Entropy (8bit):	7.596639757213537
Encrypted:	false
SSDEEP:	49152:wdm0hCMOJwV1isz+0DxhCHPpdiiobYCI8:w45HWgszsKQ8
MD5:	0E5519F6202594F1990CC0F623B43DEC
SHA1:	7845F116F5AA74F89A2AB1A9C0AE746E54250FAA
SHA-256:	6793F731558A2123E8031E511E9FCF680FB391604383E78C6FB29F132E0E75A0
SHA-512:	09139A5EE60309483219EEFA0C7C18659ACF7002B27993B5172BE19AABD7CE51013348AAEC2971F42C84517312A5BD3E318D94784C069AFDAFDFB19ABA088200
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..:"..........X".. ...`"...@.. ........................"......."...`..................................X".K....`"..............D"..>...."....._X".............................................. ............... ..H............text....9".. ...:"................. ..`.rsrc........`"......<".............@..@.reloc........"......B".............@..B.................X".....H........L...h..............Jg...W"......................................(....(.....0.............AL......_...K.......@................... ...@...........]...V.......................0.............AL..........D...-...;...............j.......;...........8.......W............0.............AL..........K...Z...;...............p.......@...........[...P.......................0.............*AL..........D...X...Y.......................;...........h...m................0..........

C:\Program Files\ReasonLabs\EDR\rsJSON.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	222208
Entropy (8bit):	6.786565578522807
Encrypted:	false
SSDEEP:	3072:qT4Ahf0UCXbEb89D4KT+/vi+55uHr3Yv+rDi8TV5l1mVb3OFZj:qTfLsbEKDY/3K3YkzTV5lkK/
MD5:	C6F7D6A83C38E3BA04C8CEA017B5BF56
SHA1:	4447ED64AD603FC438B9D2C67DC9DA6D33D01E3A
SHA-256:	69F0E9B57759CB06D79F6121311E768A87BEA1972344D7FBB6852B48D9FBCFE4
SHA-512:	3CA8067CA1E1F969B389E0EAC6D88CB1E8489E32CDBDCD778D8415DA58EBC15961D5A2878C4E8CC4F0BD84B7D2692CBD0D794D37FE6CFE8CE8BDFD0F7C7C31C2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...uM.............!..0.............N;... ...@....@.. ....................................`..................................;..K....@..D............&...>...`.......:............................................... ............... ..H............text...T.... ...................... ..`.rsrc...D....@......................@..@.reloc.......`.......$..............@..B................0;......H........~...............S......7:.......................................(....(.....0.............A...........)...1...:........0.............B(....(....(................................................................................................................................................................................0.....................0............................0..............................0.............*....................

C:\Program Files\ReasonLabs\EDR\x64\SQLite.Interop.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1647616
Entropy (8bit):	6.5512299586037255
Encrypted:	false
SSDEEP:	49152:IKBZFqX8TvXzlaPmAA6rKmEOwksSf0WB2:IK3/z0hY
MD5:	221FB15A1D7C97DE76335176E6E44203
SHA1:	D73D7308497BC30471BD3ACA93868C7BAB9FF9DC
SHA-256:	BD91F6FD71B802815D563065AC0B43527D4CDF726E9BCCF98C52338A8067E181
SHA-512:	0B0AFF2B0B1D03C9006C8E2C06BB0F46F4CFE9FD003BE1744CA1ADFE8FB0357BA86A2E3D17476166BE31C5BD9B70CF975CC31A2745956A8D50D8D083516FAE7C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..7...d...d...d.i.d...d.i.d...d.i.d(..d0..e...d0..e...d0..e...d..=d...d...d...d...e...d...e...d...d...d...e...dRich...d........PE..d....<.].........." .........J...............................................@............`..........................................V..X1......<.......<................>... ..$.......p............................................................................text............................... ..`.rdata..............................@..@.data....L.......6..................@....pdata..............................@..@.gfids..............................@..@.rsrc...<...........................@..@.reloc..$.... ......................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\133617854419739262\ARM64\KernelTraceControl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	6.227072664660365
Encrypted:	false
SSDEEP:	3072:DJxCYKhMXJw5eSpmpi4F1Lvvt+S/77gQQgfUFOlkBsTdUM3J/qyPUQrmqMlw2aFG:DJxJK/dpOfr37g1QOe5qWlr0lwbG
MD5:	51117CE7C1A4BC9A60F614A7EE35FA6A
SHA1:	8B2582DDC2F4D70014C5012A811352C31A054B05
SHA-256:	45F09D1BFBDC7D513D371E0DE290097F2142CBA513F77EF11CD4BAA9A2797FE4
SHA-512:	B3FB5047036FA03359F8ABB9CCA6C228D87D0C8F560CC9A294D13ABBC61B84019F6E1FFA35AAC44A243AA6D5965C84CF8D5DEFBC521F3544479B0BFA38D377E2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.lO.......................H...................................................................Rich............................PE..d...Bz^..........." ......................................................... .......V....`A........................................@...................x................>...........(..T...............................8....................}..@....................text............................... ..`.rdata..............................@..@.data...`'..........................@....pdata..............................@..@.didat..@...........................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\133617854419739262\SecurityProductInformation.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.9372191821953795
Encrypted:	false
SSDEEP:	3:LBQBIGqr2igRUGLsW7/ZA783dEcsAVCXoA0Ayn:1U2rwRUGZA783dAAVCXoA7y
MD5:	AA76741FF18EEF8DADD607315B86815D
SHA1:	F71E92F4ABDC7DC7FBEAF8583A8415A83948F2DA
SHA-256:	3F8B58A5E9F78367AC1F366488004B409BC1526439D1C3FAA344A95BCA445D32
SHA-512:	7FBE625D421AD9A6DFB1AF1956CC4B65320385E05B1013054922E17AFCF990857B8996EED02E2497F978CFAF07460D7EC9487B070BB1287074DD3DA4A5055164
Malicious:	false
Reputation:	unknown
Preview:	[Products] ..Name=Reason Cybersecurity ..Version=3.5.0 ..Company=Reason Software Company, Inc ..Upgrade=FALSE ..

C:\Program Files\ReasonLabs\EPP\133617854419739262\Signatures.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2022592
Entropy (8bit):	5.999974579136952
Encrypted:	false
SSDEEP:	24576:+dK+qRAhQZWnHFRGGbk0kLHYCFOEx3BMHAE4d/R0l7lRmRj5/Kz3PYez2OQJBmx0:eKYdRxknOEx352P57PFj1xVYNcXsn
MD5:	FB84325FD7362B5634C4DE62B3A2C001
SHA1:	EBB54EC78A071CE47A1C86F47903D56D77B34CF7
SHA-256:	23BDCCB16E5900857C621B67C779B2A49179ACA564EEAF1E74FD10C4EB1651EF
SHA-512:	D59933302521C9B3EEAD330A38577FAF1DF0378AA926690C6001186D495ABE4FC470BF578BC9DEABD82E26D7B1F8ED446957494122BD65047456C657DC9BADE2
Malicious:	false
Reputation:	unknown
Preview:	LtAADqVO7UZPm5M2i6U0Ut+519EhIs7fDC28Wl1pQ3a5caHSrw+Gx5gPpgKjm6512l6HKUBJcXQoHbNGYOCA49Q3BTXE41yS8brQXEozdrMJ/QdDxGcC56TGJwEI91lQyrkOtRfocRkRscRbJGGAiyLm3qgIwtTxwz1Jjb4Pecxp6sC2gikNX1FsfN9m6z1LyQNZnfcuQ/6nD0PPsgLRx3rKTfu8eICM9LWsz2LcMcH5EgncDPPlUBccIAOoNxcwirnig5V7fYkq5PCmIeJV/foKrhkvtj2sNYOZMBtbUvSWsEGn6a6TOU/Piv2Sl43XCYBaSV+MbZD2Fa7N4XNtgSjNH8CbppSZk5+xCm2MtTAwzdHIONHn1L8zBeGZwdAbocx7Qon0DNvHkJmVNpIMiH03GwfpOb7+a7jO6UjzphzFDZTTetf0odM6bxJE5mmTkX8tHVeJZDsSRtH/kxPrlWwaJ/GDcy18HIbQYhCSoTZ7U2D0D6O+3vJNh/gXcd1/hA9EWe8sZr9+92Z7fQPHW0W1X9gXdbysOmQ53nZiTGa2LVaen84GWnaQmiNuAr8KeAYqKQLpTCHHt8HnwIB+EKPHbi5fTgHNK+5QnHZnexdkrlNEG8iJhoHPW5yMNGtxKY2j6SHQVMPeRC7IyRSSfHZjarSYlrbAwmLjM9omyK9uScT2ZUWhDXLAB5t1g/C+YFWFKgCi/fZM9BZZd6gBosg+t/ajXVDxgq4JXCDTGuarqflQgnAhx9f4UizVRedmiupelpZ7OYPPKxRHxRUXxFaijSPvFqUNjwVHEiq1D2CWLAiq1EmGZBvW5DXozhpi/Ibsj9v1rVkmO365wPql2zKxSwA41CV/ezqtyB2v9YoEFEhD5ovN6/RgP/chRBlu617VTprMUa0OiPA6jkDPVwo+H1iSLxJVFAUW7SgkDPwAmu5aL88lIJz74HBh6gEKsS/qYtzEJHt34OdPBAf+FcrmWK4rQ9vzpdNjNDmX

C:\Program Files\ReasonLabs\EPP\133617854419739262\WhiteList.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	modified
Size (bytes):	377176
Entropy (8bit):	5.999945871691186
Encrypted:	false
SSDEEP:	6144:1BDotCsX0mytklk/i2PziH5XiX2huoW9h7dp9Q5FG85I2YYCQLk6j:jWCsDytkxMzUhYhFH/i/eLkA6j
MD5:	F2C339446D80393CF12236A064FA5182
SHA1:	4274F6487AC9249FD4B49DD5D22EB7CF60A67046
SHA-256:	863A22F58523D47B94E1273ECF9E2F280D0715FFC20A46D704993A32F54829BE
SHA-512:	E65CF3BBD78AB8DE244E47AEA6BFFE1CCD3B22B32A2260C9BA761D2C1F00A03AED17E6144E271435DC44C1F139AD74743F4F52A6140253B77842DEEDEA4DCF00
Malicious:	false
Reputation:	unknown
Preview:	ECc+ipJzcwkbZhHH6D1ciQjLEdRYh2hxwL6t/gI/aKzFhP0JZ+o5RIJUuC6/SkyIcfEFK5ngKBkQ1fvVMN//LTvf565Sl+AVaap/4k4EptyHPj7I4OILB+ncy7swuiZtl3+1Wp6PX+vCWTGe4GqB4ngQZT9u8DhbT1rCWvkw2WT3Y9DEfpISoufMWf3NoVOzqCIojN21hORpmAQGvoajCOuhLkVo1t05PggD8+Et608IkI7f5XwJOlxQc5UQRikZNMOmJvi1LncghPiSSeM+a5bjR3DuO1jhUPDTVnQODj2RvNHwNZwYBCr64Av8cQT2gKS+Hs5Lui/gpf5xf5fGZuVAm56ioEBqOO9DZGQ/SQahAU1yudisgt5XB0z9efK+b6/EAPVLrUgZ3wHKwOZZtpECfmVrXRxUm5k5pgLlyMRBN2b8I9Wmqf9X+rfv0OhkLYM/yw3xSIo3ge3BOI+h1vmtfYHahQZWoEKC3rTcFRu19M8ii/gCiD7NiTuu1F2z1l/oxXz4XLr2r4QBGSBM19jsFpaaqITyTIEqwRCde7v6PSekbGgg6ZkklM2dC0HKq35eHdDQZni4kMhyqGlFWYudbMpxARQFtI0yEyKCgiF2VALSsHpckoW+JBC77U81je2vYYd1HjbeFBHdjPxYuiL5tVGWfPXvyKbMMPCMhOJCvrQTLusJs8Wxkl4KLJ0whNNdHJrPCTYREEf0K1PhYTJhIoCJcgEcD9FiK4LLBVGwgtFwLNQbFAC1dVI8EaT7c4ajDWdBB6ZwdFyiOsgaVSJIiykb0icL5G8I2mt7KkzCZed+2VY4AS8X5IiERwRolxc946p7jXl5YLwQXCPFJBAqI+z2mC+DK8bMF1/d8mymt0zXXmFuvnusX9R+/VUB27QIHT6iAj66SwD++dVDnut2Dhf9LSuNQTOD6QXDUY+VqquajycJ0iodaqasTCKzYXubGVjq1mOfsPKubp5P5IPqmCQoU/idhouWq58V

C:\Program Files\ReasonLabs\EPP\133617854419739262\amd64\KernelTraceControl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	273920
Entropy (8bit):	6.063893530470953
Encrypted:	false
SSDEEP:	6144:jlPLikZqxz9Prt9e1bd6JcAMaLD0qjR0FC4YPHnG:jFmX9e1bd6JcAMq+FpGG
MD5:	5F3DD6D4469C25B3100035493E84B287
SHA1:	375784997D26D0F30D5BCDB9B37E1C481F0C3D60
SHA-256:	04BAAF4E558FC18828E65002CEB130CE0CF79AAED507FB1C5A2ACA5B4A37182F
SHA-512:	27C61ECBA96DC53945A0881C29AF457C7DC9EB174D2FE1C854DC26143A80906023D9FFA4504014DA7CFF924F0ED05325158AEAB352F6D63208C1F1D38D822B3F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................y................`..y......y......y......y......y......y.@....y.B....y......Rich...................PE..d....5............" .........P......................................................z-....`A.........................................X.......Y..........x................>......$.......p...........................p...8...................pW..@....................text...;........................... ..`.rdata..............................@..@.data... (....... ..................@....pdata........... ..................@..@.didat..@...........................@....rsrc...x...........................@..@.reloc..$...........................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\133617854419739262\amd64\msdia140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804288
Entropy (8bit):	6.342131904971123
Encrypted:	false
SSDEEP:	24576:frPHIDLY5h/Ud23lAy7ldZyzjIK3Y9bni0QwURlG3xA44jqfBlMoTVe:fUo/Ud2V17liz29utwURluxN4B
MD5:	0D12B6457B990E150388E5906F61C6BB
SHA1:	28B8087E023783DDA50C6BAEC351416F68BD5628
SHA-256:	214DC7E1C6E93CF7CC902E824E36F091FCF54A90754247F6A221299978AD2E9C
SHA-512:	718F162C96D896FFEA6AA3A3AB2FCF6E2054C8D1DBE1FD138B273A86D80A39869041FCAF1B17B6AB5F212A10D55F54F8B10485385B53FA66F7C6F7A5ED6E2A90
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]............K.......K...5...K.......<.......<.......<......K.........../...<.......<.......<.4.....<.......Rich............................PE..d....)?t.........." ...$.....z......`....................................................`A...................................................(....p..X....0.......J...>.......H... ..T.................... ..(....m..@............0......t........................text...L........................... ..`.rdata..zm...0...n..................@..@.data...@........:..................@....pdata.......0......................@..@.didat.......P......................@..._RDATA..\....`......................@..@.rsrc...X....p......................@..@.reloc...H.......J..................@..B................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\evntdrv.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	4.908284940509403
Encrypted:	false
SSDEEP:	48:o55s8iPgzK7W96MhM5IVkZJElInU/9ysI1qNA:o550ozK7WFhM5I6eo89ysI1qNA
MD5:	2AF5B11A9B5F5B7C2BFEA7A3D7186B85
SHA1:	E1F32261FD6D3D4679740B69E923CB053B30CE5F
SHA-256:	6953F1DB3172307E77B65295FDE86915E77A0589B6669EB80ADFCDB8056802A6
SHA-512:	4BD531D81FE46B1ABE933258C945683D98209E3C83BA3B3A0AB136F6D1A3D22D8731131FD6D11B58D8FD7B642E324C3DB1942BA22E9033CB76302E110E8D01DF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='utf-8' standalone='yes'?>....<instrumentationManifest.. xmlns="http://schemas.microsoft.com/win/2004/08/events".. xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events".. xmlns:xs="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd">.. <instrumentation>.. <events>.. <provider.. guid="{b5a0bda9-50fe-4d0e-a83d-bae3f58c94d6}".. messageFileName="%SystemRoot%\System32\drivers\rsElam.sys".. name="Reason ELAM Driver".. resourceFileName="%SystemRoot%\System32\drivers\rsElam.sys".. symbol="DriverControlGuid">.. <channels>.. <importChannel.. chid="SYSTEM".. name="System" />.. </channels>.. <templates>.. <template tid="AllEventsTemplate">.. <data name="message" inType="win:UnicodeString" outType="xs:string">..

C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\rsElam.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	5.230162000430176
Encrypted:	false
SSDEEP:	48:FhHP8wMlKnfM2nnwrIP5yHvb2/oyzvTB+X:zkDlE0ow2yHvb2XzLB2
MD5:	EC813E1F8F193DCE5B07ADA4FEE1D43A
SHA1:	9464FB33B041B54E20BC71D4BD67185B255A3809
SHA-256:	FDACE7F8EBF8CD4A8CA18A172A604132CC2BCF000083DF69A4B9D54A10DC1BE6
SHA-512:	9EE51D25D5F7679C3038F0B77AECF0AC29DE57E4065BCE3105AD21A9D37CF9818F67B2AF32823E781E5D38E360BC249E46979F674BDF1DCE85072ADA4795CC5E
Malicious:	false
Reputation:	unknown
Preview:	[Version]..Signature = "$Windows NT$"..Class=System..ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}..Provider = %ManufacturerName%..DriverVer = 04/12/2022,0.0.0.6..CatalogFile = rsElam.cat......[DestinationDirs]..DefaultDestDir = 12....[DefaultInstall.NTamd64]..OptionDesc = %rsElamDescription%..CopyFiles = rsElam.DriverFiles....[DefaultInstall.NTamd64.Services]..AddService = %ServiceName%,,rsElam_Service....[DefaultUninstall.NTamd64]..DelReg = ElamDelReg..DelFiles = rsElam.RemoveDriverFiles..LegacyUninstall=1....[DefaultInstall.NTx86]..OptionDesc = %rsElamDescription%..CopyFiles = rsElam.DriverFiles....[DefaultInstall.NTx86.Services]..AddService = %ServiceName%,,rsElam_Service....[DefaultUninstall.NTx86]..DelReg = ElamDelReg..DelFiles = rsElam.RemoveDriverFiles..LegacyUninstall=1....[ElamDelReg]..HKLM, "SYSTEM\ControlSet001\Services\rsElam"....[rsElam_Service]..DisplayName = %rsElamDisplayName%..Description = %rsElamDescription%..ServiceType

C:\Program Files\ReasonLabs\EPP\133617854419739262\elam\rselam.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	11062
Entropy (8bit):	7.302964587285633
Encrypted:	false
SSDEEP:	192:TohIuPyyJCx0jnyKQvAIFWQFljudcCFaqDu0K9X01k9z3APi5t:000ivAIFR78cCFYj9R9zqSt
MD5:	DF4EAED5CF816C9F03DBC95AB74BC8A8
SHA1:	CA40FF3D91D3D3D75286EFD1C320CD1DCCB6C3DC
SHA-256:	34C442AA2B53F2256108FC54CAD61C820884C8195193CECDA2BCBBE33D05359E
SHA-512:	E53F25823A9B875EB67C16888E61566357853CCECDBB287AFCE8637FE08674EFF5EAB825CA687F66838AC6F01A1B0A1CC561F4BA12BCFB756DD20CB8B102BF50
Malicious:	false
Reputation:	unknown
Preview:	0.+2...H........+#0.+....1.0...`.H.e......0.....+.....7......0...0...+.....7.....).#...\J.@.RL.<...220412160200Z0...+.....7.....0..G0.... ....zg.X?w .!.{...`.Mp..~^..n..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........r.s.e.l.a.m...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ....zg.X?w .!.{...`.Mp..~^..n..0... VG..k..V..P.xg.'......,.......G1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........r.s.e.l.a.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... VG..k..V..P.xg.'......,.......G0........k.+t...1.U4J9.h1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........r.s.e.l.a.m...s.y.s...0......J.c..t.!?..\|.a...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...1*0(...F.i.l.e........r.s.e.l.a.m...i.n.f......10..-0J..+.....7....<0:.&

C:\Program Files\ReasonLabs\EPP\133617854419739262\manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.005190565270453
Encrypted:	false
SSDEEP:	3:3H9ifFQtJdVQWNtNg/IBF+WVlIvDn:3HW2trVfNgKYWyD
MD5:	B887FD9A0E3798FD3482667E21561155
SHA1:	87188CDC055C857561333942FB24E7F209C51178
SHA-256:	F698ED945129085C527E4E79C0475D989DB367EF223F0A6E833AD151E31ED5DA
SHA-512:	533AEF3F4E4CB4619881B391388FE465608936A525B18EC6B9A5B0B5F80802CEEE6717B390C178CA71B6D121B5D77B3988C4C695C04047BD4F51DD865E9A1214
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "epp",.. "dependencies": {.. "epp-ui": "5.30.4".. }..}..

C:\Program Files\ReasonLabs\EPP\133617854419739262\rsClient.Protection.Microphone.dll.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	5.010777093927904
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOodBQV7VKXRAmIRMNHjFHr0lUfEyhTRyAEDDQIMOov:TMVBd1InV7VQ7VJdfEyFRyAqDQIm
MD5:	DDC25AEFCAE9826CCE1754C2C89E959D
SHA1:	36899490B8B0CF36AE8A1477468F3884C0CC9664
SHA-256:	F8AD17C37D444521B3905CCBD75EA6CB6E3D2763B16EB56B2E1AA4274173E614
SHA-512:	4C52E02E4E6A17FD36714E3769D34BC14675D47BE0322B14F4BBB13268C34DFE647A37DB7DF0DE7D8C31494BF878B597EDF85913E7FB648CB0D993E89FB5D611
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>..<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/></startup></configuration>..

C:\Program Files\ReasonLabs\EPP\133617854419739262\rsEngine.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (5824), with no line terminators
Category:	dropped
Size (bytes):	5824
Entropy (8bit):	5.99179572850437
Encrypted:	false
SSDEEP:	96:Rw99zAT1M+bHIEwrgiYlBk9x/rcohy9Q/GDFSf1Ru/M7j0C0wXfAXBT5A:RwLzAZxrIt0Bk7+QZz7jh0wI5K
MD5:	0195B6F2D3E0F5A4947F353E48E15D8C
SHA1:	F29FB502B68A486FFEE0C55ED343C15E5110E6F9
SHA-256:	52B9FF10C412162CE0AC5ECE6CD56B1164C209AF1AD8B3B8E334149ED6E4EA56
SHA-512:	65BA63D1645A1C507C2A8C4728DF0F1F660F3574333925386F1B5B07F11E4E894D8404767A478A384D6A5910915FF040698C6C761047A4CE53A9FABD2D788BEF
Malicious:	false
Reputation:	unknown
Preview:	SeNHHAozzDzx8xafGs52O02M3LrbDRSLIJ5xixluCuxOz2RE7hbtSEc4h5uwlDrbNRkIuc4wJhx4cXXt/BOt9Z+36zGIYFX8XISHgLWcpFjCNyTrdgn2YOwLq7Y7bAKO5yDJj86mhhScMYzZBlyORgFRJ147EDfwm0fcGGR0sjv0p2Gn/ZV4AgD66Ocu+Msv8hkX9Iv4Ny94mQ/t8HdSZcpl3Vs1/Y2/w1eWrsjffIJRQPTst3kD+6PkJ6wESCkalyNysMY7Xym7/aS1fSZWmUxP0m0VZihGj6AV+J3d8we9Z3Jd/GK2Eyq8xg+d0D03kWzKYSSWH6IurX1f0MJ/RdIqVoXOToOeW8FXmrL/mVu1P0Sk9q5GCosFlPYAQdEkM+k9JNb0YPcOmlrbVVF+CU2PekpKhwWF/u6kFjbT3EZbXcfjB4XPqNremlWvMtCo2mOnMIs9Omm9ROlhD28LolaA9zpxsgDoqLGVSb56MA8Z2ho9DdUQHixQWphsJ7efUATXjTeoitUN7qTrigGJXAeGYCeHtHISIi8LkQB6uba4L8w6imPsL/ak8FtVyW2OYkpELVVcBdg5NTDT7hhkgBYjSRz4udHNJAwrHJtQkDcZRu81LGNQBmeEER99cN71j06CjH6xiw5y6Q/bgmQ8OvH0WTMXXcCc3fkVWDHgSDKvj6owxB9+Z3KGjnEbmpOzfxDkI8h4JF2ALQbKSxhTEaLUDm7zsJuljmB7VBsCEAw0yStGo/aTERF+U4Hlh6RrC6jTRnB6hMMY3NJf7nqG7jlAcyoi6/btEFUz0MmFZ6PF7rOuPsIuD3QHWgZdFQIH/TZskLj1YAEXDsU/HSQR/ukB/If5hjj5Lk4ZkZ621Upjc2OVvyFMrSEC8chhTVfauV72ZEIvueY5TFjx+AxdEvShXzTTJJjlss3nI8Qsy2+k/bUAuaJO9qlH6KuWoYT5keJ7IZxJQP0DE1Lfzb6ZWNMcwZLxYXCpR4lLNHDb

C:\Program Files\ReasonLabs\EPP\133617854419739262\rsEngineSvc.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18070
Entropy (8bit):	4.992549577385435
Encrypted:	false
SSDEEP:	96:hrkUwfx0GReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhubUfSJeZedUaw:hrU5PUDRTHffIz
MD5:	5EF4DC031D352D4CDCEFAF5B37A4843B
SHA1:	128285EC63297232B5109587DC97B7C3EBD500A6
SHA-256:	4B094B7BD38E5BF01900E468DDD545B42369AE510EC2366427804A57DA5013A7
SHA-512:	38B0444E4F07AD0B50891E2B0DA6374B0033CB9656A4918E9EAAE34E381D95671978D19ABBCF2B8FDB079921B85E20DBE2C4392B15984CE6051B48B4A05A172F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.InteropServices.RuntimeInformation" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.2.0" newVersion="4.0.2.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Collectio

C:\Program Files\ReasonLabs\EPP\133617854419739262\rsExtensionHost.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18070
Entropy (8bit):	4.992549577385435
Encrypted:	false
SSDEEP:	96:hrkUwfx0GReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhubUfSJeZedUaw:hrU5PUDRTHffIz
MD5:	5EF4DC031D352D4CDCEFAF5B37A4843B
SHA1:	128285EC63297232B5109587DC97B7C3EBD500A6
SHA-256:	4B094B7BD38E5BF01900E468DDD545B42369AE510EC2366427804A57DA5013A7
SHA-512:	38B0444E4F07AD0B50891E2B0DA6374B0033CB9656A4918E9EAAE34E381D95671978D19ABBCF2B8FDB079921B85E20DBE2C4392B15984CE6051B48B4A05A172F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.InteropServices.RuntimeInformation" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.2.0" newVersion="4.0.2.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Collectio

C:\Program Files\ReasonLabs\EPP\133617854419739262\rsHelper.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18070
Entropy (8bit):	4.992549577385435
Encrypted:	false
SSDEEP:	96:hrkUwfx0GReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhubUfSJeZedUaw:hrU5PUDRTHffIz
MD5:	5EF4DC031D352D4CDCEFAF5B37A4843B
SHA1:	128285EC63297232B5109587DC97B7C3EBD500A6
SHA-256:	4B094B7BD38E5BF01900E468DDD545B42369AE510EC2366427804A57DA5013A7
SHA-512:	38B0444E4F07AD0B50891E2B0DA6374B0033CB9656A4918E9EAAE34E381D95671978D19ABBCF2B8FDB079921B85E20DBE2C4392B15984CE6051B48B4A05A172F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.InteropServices.RuntimeInformation" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.2.0" newVersion="4.0.2.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Collectio

C:\Program Files\ReasonLabs\EPP\133617854419739262\rsRemediation.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	532
Entropy (8bit):	5.071669869884946
Encrypted:	false
SSDEEP:	12:TMHdG3VOcrL59LNFF7ap+5EPf/2/+ZS9FicYo4xT:2dErvPF7NEPH2/+w39y
MD5:	801C6F8CE1CA9EAC249D7CD896E49649
SHA1:	6C39302A125ED0D5B4E7FAB0F04231264B5E59FE
SHA-256:	30F7E43D8512DE6CD64FAA58F6AD86046DA331E979AB4AF38F57BE57F7469EBD
SHA-512:	CC310126D9FE3857ED7F335400C11749911611EE782C172426F31ED7B6B7B3921C53BBFA5FEAB3BF1B0637A53581ACA231A7ED144D77F7B0237C77E4096F4D76
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	19517294
Entropy (8bit):	6.694656838901371
Encrypted:	false
SSDEEP:	98304:d+ST74motPO6kP2yKFZ18eBEUuvO2iVTmkPF6F5iyNbQ0/ynL:4STsdhB2UUiVBP0IIsL
MD5:	5B3C96E8253407BB4D731B00F64F42C3
SHA1:	F6F1C01CCA4DEBF091A8A6A76CF65D8FE47E9881
SHA-256:	8EE98FEC98550BFB5404406191838972977EFBE8B38B043D91BE2D2A5DF80C4D
SHA-512:	F257F5BAE982DE279D29475CBAD159C79B3BF7834434F944FF92CC34B6190C84489B755BAF513203578F105A106405428E84A58A6A3978D8A666765523CDFC42
Malicious:	false
Reputation:	unknown
Preview:	................{"files":{"asset-manifest.json":{"size":22307,"offset":"0","integrity":{"algorithm":"SHA256","hash":"1c397dbeb5572ee886bf7ad240ec1d6a49fdc39467eef0435c0bc2ec078d1b28","blockSize":4194304,"blocks":["1c397dbeb5572ee886bf7ad240ec1d6a49fdc39467eef0435c0bc2ec078d1b28"]}},"electron":{"files":{"assets":{"files":{"icon.ico":{"size":2127654,"offset":"22307","integrity":{"algorithm":"SHA256","hash":"b79838b15a988ea1aaaead3ba1353d54085cc76008489fb42f614e96f8b46aab","blockSize":4194304,"blocks":["b79838b15a988ea1aaaead3ba1353d54085cc76008489fb42f614e96f8b46aab"]}},"tray_icon_notification.ico":{"size":16836,"offset":"2149961","integrity":{"algorithm":"SHA256","hash":"195607d97318343d29f77215740adce9a8029f7944db37f912a4b1b2290f115e","blockSize":4194304,"blocks":["195607d97318343d29f77215740adce9a8029f7944db37f912a4b1b2290f115e"]}},"tray_icon_rtp.ico":{"size":28078,"offset":"2166797","integrity":{"algorithm":"SHA256","hash":"ac1878c446d7434ad43262739b23085830a9bd4c67864ea0fc57228ea218

C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.sig

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (684)
Category:	dropped
Size (bytes):	685
Entropy (8bit):	5.950928481801507
Encrypted:	false
SSDEEP:	12:ctCb0Vz+/Zq+hQrXSx2zIAtw3LAvljajTo25nmEOAIKb2d+MQRs0Cv8Q3Tz2On1+:4809+/fm7Se23LmzcncAxW+MQe0Cv/ut
MD5:	39990FB3FBE164F5CCA526FFF6678787
SHA1:	7037190DC2C2D10C9220B30A6AC3E5186215CC8C
SHA-256:	513EEC3066E2C6ABAA5654D14157DAC092B8546A22F88F64F17A3B0FA31FDFB5
SHA-512:	FD2F93C033B1A35BCEDF459573E12DF9529ACAF919AEBAB0F0296E90230E0A2D1C758FCD5DC1EB6533DEC4EF11077D832C245F284FCF38E4B1188FDAF8749C3B
Malicious:	false
Reputation:	unknown
Preview:	NNWiHoYKUNP4wim/xps0pIZW91JrzgVqVKdk6/6p/0VFB+U6s116mOKSdx+CEtHEJQa5FpngO7YuDx5amohtSnS9F5vpFqIAFTpczGGYHkDJ7J0+RvDIrR6IxDEJB/8M5yEw4Df8NV2dvKjHoYEVgKgpDIASXxDufeJW4syXz3+UCdWaS2rSz03vmSmBlsQNIwMTBD/PVpSEqLvT49UiP9b+Dy5zopLHWd/F5zo+DUJnX98OZCQ1DYAwwqHyXIvPBDamJraD4ja3C7ARVl0ALRif5Ju/ONOqPsVBQRvhM43X7zwZfnpWJZ+8FwWu+3UnRXZfbP3FX1D71/tCLUb44bykmgaKEkH0kMA8TAkEWlSmYZTr+Zt+n8l2HzB/5gX1mfcqDAJxWGlyAQu/6mzzmnWaJgdWR7HmsIPZ3LrR/aGHuJp9RVpj5xmkkiWPSkt+Kh79kKit44CzavGzx+5VLTuGghqBbfTKRzklFAAEMKRNEfj9Y5FD+ort4NwD0HKmehYcrv5G6dN33P11BWIe0CYAme6aJjqJ3CkxG7+2g3CAJM1I7dbRysLWD6gunrkYvjvVJKd+ew2ol9Af5Y0ROYYTupmTFRGoV6ZSx6E7mLL7/Mu+hNPdual3xBaLYR8Ac7Yjb4QEkFGziaFPRZz8qp0ywLbjqgHKqcHFEzL69yQ=.

C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	6.408978814111418
Encrypted:	false
SSDEEP:	3072:Bxa137c+Jw+7mlU6UFyAIJXw9AlbLI+aYroEWOV4iDh:Bo37c+JwGIApIJA9AlbuJEfbN
MD5:	9504727B1D15A8BDF74F28F40C85D1F3
SHA1:	DBDFCB492A583EE82C86013FD03C3F9FA1288D59
SHA-256:	F5DD2E25F142BFC75060DD1000B858349998497196C2509D508368131A89FDD5
SHA-512:	4EF87E1507C95C4B012F03D7E9D1664D3CA73FED8960D48D1E791C9C16A2A57855EE299526DEE0BE89ADE9B98A0E76B7CD6065B312DB1D559267FB8381FF2DD6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... .. .. ..@P.. ..@P.." ..@P.. ...U.. ...U.. ...U.. ..@P.. .. ..+ ...U.. ...U.. ...U1. ...U.. ..Rich. ..........................PE..d...*..b.........." .........................................................@............`.........................................P...D.......<.... ..........(........>...0.......~..p............................v..8......................@....................text............................... ..`.rdata..............................@..@.data.... ..........................@....pdata..(...........................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	6.408619361294289
Encrypted:	false
SSDEEP:	3072:6xa137c+Jw+7mlU6UFyAIJXw9AlbLI+aYroEWOV4iCY:6o37c+JwGIApIJA9AlbuJEfbz
MD5:	CEDCC6CEAFF8EB1C4BE2A5E6E2B012C3
SHA1:	D53FAB8D1FA4A2AFF8E490C8F7F13F5B1C691C8E
SHA-256:	282519F369B7D642BE6B1AEBDCF83B113101B812896C379E53D99A859A39B8DA
SHA-512:	D3F4A6C01EEC58418DA43BCCE2BB74C8FCB4B75CCF6140CEB402CFEEB05997324F7E583249F905CB31750E2C00703E3A04F7823681AEEDE84C07E0018C635AA1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... .. .. ..@P.. ..@P.." ..@P.. ...U.. ...U.. ...U.. ..@P.. .. ..+ ...U.. ...U.. ...U1. ...U.. ..Rich. ..........................PE..d...*..b.........." .........................................................@............`.........................................P...D.......<.... ..........(........>...0.......~..p............................v..8......................@....................text............................... ..`.rdata..............................@..@.data.... ..........................@....pdata..(...........................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124560
Entropy (8bit):	6.262453461799155
Encrypted:	false
SSDEEP:	1536:N+rSugvaDzJGezUUSBxlezTESfWwjbE42qyGHzdHKcQsWydp9dlscxHi/9afI5g:N+rSu15XslsTEMPs42qyqKaB+cs5
MD5:	04BFFD5DEC81CBD4A75C00D36A1E0510
SHA1:	48B7E059157AECF0CEE08F7C5273929572499704
SHA-256:	F17416F61D9DDAEF528CC1121205E6526AAA0600114A61535D6C1D7CB76DEB00
SHA-512:	67CA87F152D7B63030BD24F2DE1E60F8C9ACC6A2B401350AF168CC03A1A7C8FBCCB81D097F6E4AA6608FF4E8FB119A426F1397BB0DFAAA02D86B99FBF84D76D5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............N..N..N...O..N...Ol.N...O..N...O..N...O..N...O..N...O..N..N..NS..O..NS..O..NS.eN..NS..O..NRich..N................PE..d.....a.........." ................................................................P.....`.............................................h.......<........................:......d...P{..p...........................0x..8...................T...@....................text...@........................... ..`.rdata..z...........................@..@.data...............................@....pdata..............................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\133617854419739262\ui\manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.19896048699559
Encrypted:	false
SSDEEP:	3:mifFQiXvF9+GNHfFQ3TRpvF/FHEYd7QWNwFiOv8KAfFHURXPFMY:v2KdgGjYVC4OFAt0RSY
MD5:	E250CCE095CCDBA7CF7B0399DC8D8970
SHA1:	49A4AA2D4240C6E68BC2E4A17C1006ACA156EF6B
SHA-256:	8188F879E93D568204BCD78E8F1B43F120A6F0917DCA9B045EAB946D84907A3F
SHA-512:	248832E5358BA06338C061AB675CC1CF6F01B17CAE5BD62FE1A65E8A9BD46BEBCEE76EC187628C27B67AB919040558F636698DB9A08335AE431CEE4964715373
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "epp-ui",. "arch": [. "x64",. "arm64". ],. "dependencies": {. "electron-shell": "1.4.2". }.}

C:\Program Files\ReasonLabs\EPP\133617854419739262\x64\rsKernelEngine.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	3063
Entropy (8bit):	5.014088126389475
Encrypted:	false
SSDEEP:	48:utXfcDLNthOyA9Bd8WMv/EhtF/qi/Oaucosld2dVBBiBklmP55I4kYlIRF7osFrr:uNfcDLNPOyALd81v+tVR/qlPsBklA5IL
MD5:	E8EF8570898C8ED883B4F9354D8207AE
SHA1:	5CC645EF9926FD6A3E85DBC87D62E7D62AB8246D
SHA-256:	EDC8579DEA9FAF89275F0A0BABEA442ED1C6DCC7B4F436424E6E495C6805D988
SHA-512:	971DD20773288C7D68FB19B39F9F5ED4AF15868BA564814199D149C32F6E16F1FD3DA05DE0F3C2ADA02C0F3D1FF665B1B7D13CE91D2164E01B77CE1A125DE397
Malicious:	false
Reputation:	unknown
Preview:	;;;..;;; rsKernelEngine..;;;..;;;..;;; Copyright (c) Microsoft Corporation..;;;....[Version]..Signature = "$Windows NT$"..Class = "ContentScreener" ;This is determined by the work this filter driver does..ClassGuid = {3e3f0674-c83c-4558-bb26-9820e1eba5c5} ;This value is determined by the Class..Provider = %ProviderString%..DriverVer = 03/25/2021,1.0.0.2..CatalogFile = rsKernelEngine.cat......[DestinationDirs]..DefaultDestDir = 12..rsKernelEngine.DriverFiles = 12 ;%windir%\system32\drivers..rsKernelEngine.UserFiles = 10,FltMgr ;%windir%\FltMgr....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..;CopyFiles = rsKernelEngine.DriverFiles..;, rsKernelEngine.UserFiles....[DefaultInstall.Services]..AddService = %ServiceName%,,rsKernelEngine.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..;DelFiles = rsKernelEngine.DriverF

C:\Program Files\ReasonLabs\EPP\ARM64\KernelTraceControl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	6.227072664660365
Encrypted:	false
SSDEEP:	3072:DJxCYKhMXJw5eSpmpi4F1Lvvt+S/77gQQgfUFOlkBsTdUM3J/qyPUQrmqMlw2aFG:DJxJK/dpOfr37g1QOe5qWlr0lwbG
MD5:	51117CE7C1A4BC9A60F614A7EE35FA6A
SHA1:	8B2582DDC2F4D70014C5012A811352C31A054B05
SHA-256:	45F09D1BFBDC7D513D371E0DE290097F2142CBA513F77EF11CD4BAA9A2797FE4
SHA-512:	B3FB5047036FA03359F8ABB9CCA6C228D87D0C8F560CC9A294D13ABBC61B84019F6E1FFA35AAC44A243AA6D5965C84CF8D5DEFBC521F3544479B0BFA38D377E2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.lO.......................H...................................................................Rich............................PE..d...Bz^..........." ......................................................... .......V....`A........................................@...................x................>...........(..T...............................8....................}..@....................text............................... ..`.rdata..............................@..@.data...`'..........................@....pdata..............................@..@.didat..@...........................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\ARM64\msdia140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	3490816
Entropy (8bit):	6.326124434789562
Encrypted:	false
SSDEEP:	24576:jF+5PLDsbg5+e9VvR/hzH01zzEbMx+5vqDLBOmUAmPNb63oJmoJS9MeK3XqRZ:GDPfpz24ME5nbqogp9h
MD5:	37A7A31A4A28C4FB13878C67FF114C08
SHA1:	9726DD9EBDB5203581FFBC67AE21814172E72D7F
SHA-256:	8E5EED1FB13D790F061F45125D9F13135C46F7E4614874B4A2A23ED7FB6F2851
SHA-512:	55FAF413A434406A91E6313AFDBCBB48A50DB0CC85687B90DA38A76D14008F655FF63AD72DCB1FC5DFB755CD3400418E99A7886C86E429117812BF5BAF6209A5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ^..N...N...N...M...N...J...N...K...N...J...N...M...N...K...N...O...N...O...N...F...N...N...N......N...L...N.Rich..N.........PE..d...@TA..........." ...$...........P.........................................6.....eL5...`A........................................@.1.....<.1.(....@4.X....03.0.....5..>...`5.....()0.T....................0.(....,.@....................1......................hexpthkp........................... ..`.text....... ..................... ..`.rdata...c......d....*.............@..@.data...$.... 2..r....1.............@....pdata..l....03......`2.............@..@.didat..`.... 4......N3.............@....a64xrm.@....04......P3.............@..@.rsrc...X....@4......R3.............@..@.reloc.......`5......n4.............@..B........................................................................................................................

C:\Program Files\ReasonLabs\EPP\ARM64\rsYara-ARM64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	1768448
Entropy (8bit):	6.608015764873274
Encrypted:	false
SSDEEP:	24576:NFh+6066jUNguhPGJQAJQfxilwTebiPcFvX:vgEaUNguhPGJQAJQUldbiPcF/
MD5:	4845895C33EF465D7E87C299F777E108
SHA1:	90E7917C79733E469C34B59275DB667A78AB0AD9
SHA-256:	E8D15C16D106660E7B100B8F2CF471E80407422A91A22A1D04F88103559E7AD9
SHA-512:	96EA20296791696234BFA2AA2D53D1CDB79A2EA5460F3F0CF7AFF94AB99C037D30F6258F609A62689BF14977823C427448D0342483FD46B47A720490F7BE1338
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......,%._hD..hD..hD..#<..jD..#<...D..#<..~D..hD..iD..n.h.iD..n..wD..n..\|D..n..fD..hD...D..#<..cD.....lF.....ID.....iD.....iD....j.iD..hD..iD.....iD..RichhD..........................PE..d.....e.........." ...&.t..........h........................................P............`......................................... ...t.......x.......X....`..0x.......>.......R......................................@...............h............................text....r.......t.................. ..`.rdata..~C.......D...x..............@..@.data....r..........................@....pdata..0x...`...z..................@..@.rsrc...X............d..............@..@.reloc...R.......T...j..............@..B........................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\BouncyCastle.Crypto.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2624144
Entropy (8bit):	5.839297070317323
Encrypted:	false
SSDEEP:	49152:TSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:rxodumo6Lr
MD5:	B18CA30F651CFFF347CBEB8BAB938014
SHA1:	238373F463B31BA04F5C42A0B4926E1E199E7E36
SHA-256:	D21186E6BA5DD62BD873F544215E78EEBF7536ADBF787BD103E694A10D07E1E8
SHA-512:	990EFD9AA0AC93E612193CC8E653E0B614003099C3DBF5B8971406D090D0FFBD4D73CC537633DC3BF115F662DDD9B496992356FB19A588B7BAE830170131BEFA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,.._...........!......'.. ........'.. ....'...@.. ........................(.......(.....................................d.'.W.....'.`.............'..:....'...................................................... ............... ..H............text....'.. ....'................. ..`.rsrc...`.....'.......'.............@..@.reloc........'.......'.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\Dia2Lib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	6.4695031247599255
Encrypted:	false
SSDEEP:	768:iQMT4Q3O9ymyKJcy3Xs3y4rV50sds8SzUwHhTHRKrLy2Ip4ruTxf1mlA6hZ68:HQCye14oGs8SNhTHi/9rufInhc8
MD5:	50BA6B3FDBCEDF339C9E7097B8714294
SHA1:	012D4E83B2B698903EEC0C1D608033389797A225
SHA-256:	E2940DDCCB2427DAA5996BAF3FAC1A50B01D59DD42D49A7D2889F12773B87384
SHA-512:	C930FF79972D927F332CF3C3E7641176883211854253102C92FE96BB3D909A5ABBCF2A89B5FC1324C4E262F9E6BA49B4D83BD73DF4DB2BD37D615073FA1B1F0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.NZ...........!..................... ........@.. ...............................k....@.................................P...K........................>........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........ ......................P .........................................E...$....8..5>I....zc.9.]hOy......=.....jz.......cxR.Be.mZ...............8.K......o.(...i...3.%.....PO.F...Jq...DBSJB............v4.0.30319......l....Q..#~..,R..d6..#Strings............#US.........#GUID...........#Blob...........W.........%3...................................q...w...#...........$...'.................{.........).....G.....U.....r.............................................

C:\Program Files\ReasonLabs\EPP\EDR\Dia2Lib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58000
Entropy (8bit):	6.450429603336052
Encrypted:	false
SSDEEP:	768:2QMT4Q3O9ymyKJcy3Xs3y4rV50sds8SzUwHhaHRKrLy2Ip4PPCxf1mlD0O:rQCye14oGs8SNhaHi/9PAfIIO
MD5:	771AE99E62F3F041ABA9014682C931AA
SHA1:	96FF034CC69E3F8A2D2FFF736E62401B53033C54
SHA-256:	DCCD68E5689B31CE6AA58E86040773EF68CCE34A47241664172CBDBB2351C4BC
SHA-512:	6AF6D79729931517E68BBB5EC6FA527B6128A814A89C6B68DE42109064B39FDD33F3155ECCEA3CBD300AD6F270CF6C0C4E063FCEDBD85613131177B37D065F07
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.NZ...........!..................... ........@.. ....................................@.................................P...K........................:........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........ ......................P .........................................E...$....8..5>I....zc.9.]hOy......=.....jz.......cxR.Be.mZ...............8.K......o.(...i...3.%.....PO.F...Jq...DBSJB............v4.0.30319......l....Q..#~..,R..d6..#Strings............#US.........#GUID...........#Blob...........W.........%3...................................q...w...#...........$...'.................{.........).....G.....U.....r.............................................

C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.FastSerialization.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79504
Entropy (8bit):	6.220009040083083
Encrypted:	false
SSDEEP:	1536:lG8N6w60T7kWU8EDk26WxvrkJAsSVQ11XVBuBQkjHi/9LfII:lGY6w60T7kWU8EY26WhAAbQ11XVBlkl
MD5:	DA77DE075A56F5D84FD0097A28650ADD
SHA1:	AF8773B88D44A59088295EDB53E2B11DF1AD448B
SHA-256:	316DF4385DB10D7A426C3054007C99E0AD1446AA6E85455D7E7DEDFB6B5D5B5B
SHA-512:	6F2E124FCB1534C76D44CCDED3785043F68BB6D643B002EC71668730BDB4E3FB60186F55FBB65F339FAF9478DA253424C8AE646E850D358797A49D3073652D53
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....i..........." ..0.................. ... ....... .......................`.......1....`.................................e...O.... ...................:...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........~..P...................8........................................0..(........._,..l(2...i...+...]-....X...1.......0..S........./.r...ps3...z~.......+.......2....X....i2...`.+..(....,...Y.e],....X.. ....2....0..!.........Z.. ....6. .....1. .....(....&.j.n\.jX..0............nZ. d.jX.nZ. dm..b.H.E...%.x...(4............0........................,..-..s5...zZri..p......(6...s7...zBr...p~z...(....z6.......(....z"..s8...^r...p..(9...r...ps:...:.(;.....}<...*:.{

C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.Tracing.TraceEvent.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072656
Entropy (8bit):	5.981049662169802
Encrypted:	false
SSDEEP:	24576:QGPhcAzmc+AzxpCqu6xX/mazyzDS/B6nEL8Esb2X+ThBtQvxqyfMzrvrBrVJ:pWOmczVpCkvmzzDC6nKsbSMQZqy8
MD5:	90999F7893D251FDBFEA7D5D9A13DCAE
SHA1:	BC2CBFE15456C6C22E8A73964DB6C32F490DCBE8
SHA-256:	F8A01AAACD600867AE37C7CD989155BE6729D65A0940813BA4ED0B1462E502DB
SHA-512:	AE73BC354B3CF627F6643C740562FEC045B61C872E29B21C468C4D68287BCF92EE70DE9BBFADCFDBB7099944008868EBEFD8E423F43624CDA7D727C00A4EE3AA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ......................../......./...`.....................................O........................:..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......L...L.............................................................{[.....{\...V.(].....}[.....}\......0..A........u........4.,/(^....{[....{[...o_...,.(`....{\....{\...oa...... ... )UU.Z(^....{[...ob...X )UU.Z(`....{\...oc...X...0..b........r...p......%..{[......%q.........-.&.+.......od....%..{\......%q.........-.&.+.......od....(e.....{f.....{g...V.(].....}f.....}g....0..A........u........4.,/(^....{f....{f...o_...,.(`....{g....{g...oa...... B.8' )UU.

C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Win32.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.984207052315847
Encrypted:	false
SSDEEP:	384:nN9VWhX3WrrjP9Z95Xa/rl9qX2Ip4X5wCjdAA1m5wMDBu:NGeHRKrLy2Ip4XCCxf1mlD0
MD5:	492C56C6D03D50225215F0FCCB31A2E5
SHA1:	B5C872D6D6DA4195D495B1AA55F10FF35CE1245F
SHA-256:	64F9B2FB46A353BC5F9AAFB240BD8E6A3B8AB6398B1915563CB6AF7AF256669A
SHA-512:	B6238BB5E095F3016DFDC0A667DFCA0B1EC1949F70C98D9C4FF520D42E1C68FC057285425685D4F203A6CE605981F8F8B6DDC9CA572CBF3C1C64F17D01443210
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@..0................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...\|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files\ReasonLabs\EPP\EDR\OSExtensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.750742199085297
Encrypted:	false
SSDEEP:	768:lap2N4EhmXBk4iHj4o9dY6sHRKrLy2Ip4YTxf1mlA6aZ+:Ep23hmRP4nBsHi/9kfInaI
MD5:	3B62657ADB40EF9C4B26C49615A0173C
SHA1:	7F207570DE8F34EB93641FD60DE18108C487ECB6
SHA-256:	A4C41E535860E92FE2C6DA72D5852868CFD0C1D362C85E293E48AF9ADF1827CC
SHA-512:	408B4E904D982A6EE879A7CD5141A4EA89C36862EB240E9842B970AEE7CF13F7B389BF594C55BB9C438D0B4AEEB43E8EBBFBCEAD1591532735A254D9D5F4288A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i.#..........." ..0..8.........."V... ...`....... ..............................LV....`..................................U..O....`...............@...>..........8U..8............................................ ............... ..H............text...(6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............>..............@..B.................V......H........,...(...................T......................................:........(......0.....................}&......}'..............(............0..A...................}(......})......}..............(......,..(....(....N.-..* ..... ...._`....0...............{7... ..@._,....,[s.......{7...(........(........(.......(.........Y.....1.r...ps....z....(....&.(.....(....(......{7...(....f_}7........(....*....0..........~..... .........(.......\|0... .b)" .a.. .K.. .....%.4.k.

C:\Program Files\ReasonLabs\EPP\EDR\SQLite.Interop.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1646728
Entropy (8bit):	6.550293918842392
Encrypted:	false
SSDEEP:	49152:CKBZFqX8TvXzlaPmAA6rKmEOwksSf0WBA:CK3/z0he
MD5:	3EC7CF091E6D6D30EDE3983A7C86756A
SHA1:	4E57D4370C2E7397FDE04E1B5821FDFEFC8A1CD6
SHA-256:	E2B48CE46D04F95DF87D49BEBC7A4A3275225D9AB27F278AFC4FDDF974FD6406
SHA-512:	AD8E1789DB2931FB3C879F62C539CA7DEB9CC9E3D929335CD1171FD164D3AB5C270F2237682E693EFE0F82647012161AD7C0938D2C2BF25928CB5AC20D857FA7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..7...d...d...d.i.d...d.i.d...d.i.d(..d0..e...d0..e...d0..e...d..=d...d...d...d...e...d...e...d...d...d...e...dRich...d........PE..d....<.].........." .........J...............................................@............`..........................................V..X1......<.......<................:... ..$.......p............................................................................text............................... ..`.rdata..............................@..@.data....L.......6..................@....pdata..............................@..@.gfids..............................@..@.rsrc...<...........................@..@.reloc..$.... ......................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\EDR\System.AppContext.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.978744934396574
Encrypted:	false
SSDEEP:	384:YDNxWQFWWrjP9Z95Xa/rl9qX2Ip4z2yTjdAA1m5wMAvru4LTrZIjQ7yyRs:YDNVTHRKrLy2Ip4LTxf1mlA6OZM8s
MD5:	979925F3CEF9F0B9ACC19D26E339912B
SHA1:	5C04FC85D3BFBDA4ACDEE480F3F9A6F30B25AF5B
SHA-256:	A479D89EFC4744AB6B3A91F24F2C63C8A7332786A6B65F87FD7046A101F62C40
SHA-512:	29A23B0A669FA20F880F1FB414F49C5A3D80682EBE3D88FED80B6168C61B7EDCDE3DEE17290967E3A34809D3EDD1E555199438FC4C7C53F4DB295BF08A63B729
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ....................................@..................................(..O....@...................>...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Concurrent.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.042295947879012
Encrypted:	false
SSDEEP:	384:Am2igOWnW8rWlrjP9Z95Xa/rl9qX2Ip4+/nTjdAA1m5wMAvru4LTeZIje:gtsHRKrLy2Ip4knTxf1mlA67Zd
MD5:	792D0C83FED25753C1DF8F08AD5A5E99
SHA1:	027A17662AB34D248388D6E7587BF3F125CAF0EA
SHA-256:	87E227E9F7AE7CAEE32625109F4C6D7DC2A7F73FABB07B8FB8C3E04FE549D79E
SHA-512:	26CCEE818AFDE2CEA0D6457DA34235D3535806727CBB4F1EF7A58BCBD7B46BF953F3D9211250AA955079CE6D55D0E6107EE4796621D7E4A5F201A3D7A0131550
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@.................................t)..O....@..D................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.NonGeneric.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.027720924382012
Encrypted:	false
SSDEEP:	384:3napn1iwwPWcGW8rjP9Z95Xa/rl9qX2Ip4QoyCjdAA1m5wMzsPue/:qDusHRKrLy2Ip4QPCxf1mlzze
MD5:	EE10259864E9701525FEB46AF8A2D668
SHA1:	EC412F80EDF85C5A0D72DE5C5943BCFEE8BC27BE
SHA-256:	3757611D8618E2DD166B23793E3D2FD42DE3C717153D265A83783AA70B832960
SHA-512:	74FDE33BFBD9F19120AB321325408314232FC6EAAE12DEC915811BE3AF0DD56CF14C896A6CE27AC259B0D21431FEBB75443A115C46047642114FA559E7E0741E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................<.....@.................................p)..O....@..@................:...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.Specialized.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.0308593662962195
Encrypted:	false
SSDEEP:	384:HHLaEav5aaUa6arWVLWnrjP9Z95Xa/rl9qX2Ip4HXCjdAA1m5wMDBuYQ:mPv5t/NO2HRKrLy2Ip43Cxf1mlD0YQ
MD5:	16D2C673AA6AD02E71C5D96C778E7994
SHA1:	54A6628F49B0A68B8F7F44C0822F8E072F3888EE
SHA-256:	81D9E455790D1093214BCE4058D879616CEF04C2EFF5410E930E496B4126559C
SHA-512:	FE5FCFA1E366C3B801C286CF940A75D9486F33DE03FF0CF516028E973F2FE47A7669571D74BA620685E679F4723F68F9FF688731D2562A7E65DBD70623BE0EC9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ...............................b....@..................................)..O....@..P................:...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.921371620507193
Encrypted:	false
SSDEEP:	384:J6iIJq56dOuWSKeWErjP9Z95Xa/rl9qX2Ip4K6gYCjdAA1m5wMDBu:XiAMHRKrLy2Ip4K6pCxf1mlD0
MD5:	9D3D19EE2BE4AAE01A0A9B0FB4D9E3E9
SHA1:	6C9DB4C90C9B88CEF86295F963212A38ECFF3CD9
SHA-256:	EA435047D3403FF0E2D6123FF96FD7BFE2021384AD8030AC1D973DB7E916C91F
SHA-512:	1AF379AB9452E809E48FA637218B7C64C4988B62A414B0DF2C74C5A7C6B49B7ADB003708C00AFEE4F0195A58D6F170702523840FBF6360660EA5E88F3B8D0A5C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0................. ...@....... ....................................@....................................O....@...................:...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\|....................(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k..............0....M...............................#..........x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.EventBasedAsync.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.974894012448519
Encrypted:	false
SSDEEP:	384:+nzz+MpSaLWW0+WarjP9Z95Xa/rl9qX2Ip4iCUPlTjdAA1m5wMAvru4LTLZIjt:QpuqHRKrLy2Ip4ibTxf1mlA62Zq
MD5:	48F51C415422EC4FE415F81402D73841
SHA1:	C6D3443DEFE15AA08722F6B6EFD63AB500A254B1
SHA-256:	D67F601AD228DF36C199467BD86EE62B47D18AE57B7A08E13B0502B667D3C187
SHA-512:	636EFD35AA0222E30B1C6828C3581A0698F1ACC8D617CF763E0332D75D8EF247686AEB25D73C21B4E42FCF1F5FD576EEC323A480582E244FA3507BD782124B37
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B... ...@....... ....................................@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	7.007544012128594
Encrypted:	false
SSDEEP:	384:qGhr+YUfyHxsW/HWJrjP9Z95Xa/rl9qX2Ip4BTjdAA1m5wMAvru4LTIZIjay:ZkmcHRKrLy2Ip4BTxf1mlA6xZ7y
MD5:	A15F6061F42AF97FFDD51061BCA9C58D
SHA1:	A43B2FE6EE0E99DADDBCA6A40AC9B3A02CE3FA6B
SHA-256:	CBD238D92430EB86E08D79619F711B0E9EC11715819EF118721E1B981D980A87
SHA-512:	C0B2781D16DCF790FB9CDB623EC549A6893E26DF9B4DEB1A4606AB7FF12F31BC36AF4885C14B0EEC00B26ABAD23CBF3A55FE9376B198F0B5F9337C1FBAF265A2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ....................................@.................................<+..O....@..`................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.TypeConverter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21648
Entropy (8bit):	6.936578907474719
Encrypted:	false
SSDEEP:	384:dRE+ruiA5vzWeNWwrjP9Z95Xa/rl9qX2Ip4VgB6CjdAA1m5wM36QNuZL:dS9btHRKrLy2Ip4V+6Cxf1ml36QgZ
MD5:	360D42F24B4E08FA056AB58734A4CD36
SHA1:	DA6E32A298A749ED5C3FA3E05AC2541E1513DB21
SHA-256:	B3527A56EBC1FC120BD9E8F9B0E950A56E2D012DA3AD6976B4B7DBED61D9EC8F
SHA-512:	D83B5F80769842B29D7031A542EE8BDE192EA221BEB42E220DD28093C3808FB6CF361B33304D632D571597CBAD8EF339EF22D97FAB5D864ADA1B1D4D0C52D6D9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ...............................f....@................................../..O....@..p................:...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.ComponentModel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.008766161447553
Encrypted:	false
SSDEEP:	384:VT+6ywnVvW0LWjrjP9Z95Xa/rl9qX2Ip4IrTjdAA1m5wMAvru4LTOZIjZmt:V99WHRKrLy2Ip4IrTxf1mlA6HZamt
MD5:	FA64C77091FC1B02F46CEB1913B7379D
SHA1:	F24025CABE1A9DC034186392ED24FF0BF3A495ED
SHA-256:	E098965040E3970F28869105CA43DE2E604E2DCA6294339A9D170E0A5DF24D42
SHA-512:	13AE6CBA7EB92DCA72BBBA98188B41CD5D58C525F036E5326F5D45D9257DACD65305503A1736380C6C6975616D767628DDF67B94CACA9CD594FAD17B993B8517
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................+....@..................................(..O....@...................>...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Console.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.004123985634671
Encrypted:	false
SSDEEP:	384:JRbzriaXT+WlEW7rjP9Z95Xa/rl9qX2Ip4NjTjdAA1m5wMAvru4LTMZIjvC63:T7ic7HRKrLy2Ip4lTxf1mlA6ZZ963
MD5:	86089A16F4C80394C5B404309C6026C0
SHA1:	D323D892C114316F838E4ED389BA79F6BD8A3B12
SHA-256:	435AF362523ADEDC9A74887C09FF85B6AF5EA3C2EFE87926C175A425313C4CBD
SHA-512:	EFB2FFA4F1F8892AD6AD9877BEA147A4ECE5889DD5F28FD87FC6F84CC03E05313CD99AFD8920967A85261E6F09BBBCFE995D4F499C568BF07E9212C44F914195
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ..............................<.....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Data.Common.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154112
Entropy (8bit):	5.52229117256302
Encrypted:	false
SSDEEP:	1536:tHOdYYWg+GImdMEGK61wb5nx03LBblQ6Ndk66byYSI4Zki+BReD4pK/uYxtl+AHB:gdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+zq
MD5:	CD62016404CAC92504889687ABBB13B3
SHA1:	C8CFA6AA9D4EE5F203701BEBB78F598F5FBC4C39
SHA-256:	DE4D28275A972722AAD7B1C5EC4581665CEF87C6132B9F013530BAC92F70C592
SHA-512:	1859D37D46D373C00B1B2DBCE77C8121B47D550AEBE240274F2C29B3870E7F82A18F8AFE1A6A46600DC61F5B6C1D8B8D2158D4EACDD8BDA9CF393159EEAD147D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ....................................@..................................,..O....@...................>...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r;..p.(....2ro..p.(....2r...p.(....2r...p.(....2r...p.(....2rK..p.(....2r...p.(....2r...p.(....2r...p.(....*2rM..

C:\Program Files\ReasonLabs\EPP\EDR\System.Data.SQLite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	370320
Entropy (8bit):	6.097469567826013
Encrypted:	false
SSDEEP:	6144:WruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cmg:VNWx6xz+nRo2GGWHQZMaLyJSJFNFaFeL
MD5:	543B9388781D828B95E0952E62ECFC34
SHA1:	988750B82F4634BC793AA12E05403DEEC049B7DA
SHA-256:	6D1BBFF72AC4163FCA04F27797B1BA1667C37AA45DC3EA7786B0603578DC32A4
SHA-512:	97187D01075FC18C1187C99D629B3375F49ABB7225D25CECC8559F783C8D409592DC3687C65FC29F26FBCC831DE2979299499943C0138AA1B635F8D3BF9E7099
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.].........." ..0..b..........j.... ........... ...............................n....`.....................................O.......$............l...:...........~............................................... ............... ..H............text....a... ...b.................. ..`.rsrc...$............d..............@..@.reloc...............j..............@..B................L.......H...............................`~......................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(......~;...(<...,r.....s....}.......}............{............%......(=....%...:....%...!....%...%.........%....%.........s....(....z.{....,......(=...o>...s?...z..0..'........{....-..(......o........(A.....}.....*..................0..T........{....,K.{....o@....+...(A......(B.....,..o;.....(C...-...........oD.....{..

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Contracts.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.978601082650283
Encrypted:	false
SSDEEP:	384:DRtRWjYWVrjP9Z95Xa/rl9qX2Ip4RaTjdAA1m5wMAvru4LTLZIj7:LiRHRKrLy2Ip4QTxf1mlA62Z8
MD5:	1A56767E8BAB0FA215068240A5C0C251
SHA1:	68AAD233EAA3659696120C2A13B7B3A148C52EA2
SHA-256:	12E6C5EB0047D97EDA672A6DB5DEB0888174B98974E78FAFB240351090DE4A2A
SHA-512:	FCB191A3A416932D5E9A0F549EA5238329369C6514E7E9C9C714154366347518864FDF3CAA3070437C0C715E07F016DEDA6C88FE8E360587F1A5896699AD408F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ..............................ga....@.................................x..O....@..@................>...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.......................H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Debug.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.036011842379594
Encrypted:	false
SSDEEP:	384:seWnoWxrjP9Z95Xa/rl9qX2Ip4CEB98TjdAA1m5wMAvru4LTGZIjm9:sn5HRKrLy2Ip4CEf8Txf1mlA63ZJ9
MD5:	39030D52ECCFAB9462169249022F465D
SHA1:	9DA51C6E644ECFB1F8E7DD559C55D6D014C0588B
SHA-256:	85785A739BDDDB73AB9F2CD23CB5AE6B4A01F739CE736783A4C1AFF7B24E5A85
SHA-512:	55760420F7293D47E77E76201BAF576B4888EFBFF6B2173006A47B3D9E5D99CEA0E41016F9AACCBDA8B4B6B898BC85AEAC827305DB0B431D2774A9D985509B09
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................0....@.................................X)..O....@..$................>...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.FileVersionInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.006824968778004
Encrypted:	false
SSDEEP:	384:Y6oWJjW8rjP9Z95Xa/rl9qX2Ip4ApTjdAA1m5wMBq5ul01vfh+c:Y6vDHRKrLy2Ip4WTxf1mlBqsqvR
MD5:	F9ADBEBACF225106BA1CEA626A0BC5C6
SHA1:	DFD1D956D719095CBC3AFDA71B722903E7EE5369
SHA-256:	D821A7EF1C9DA4F63DC8FD7AE01CE70B1DACEA3BB42BA238C0F15539F2F36D2E
SHA-512:	62DEC309E9F98CF3A3128186E050AF053D4750F34DE9CAF39BAB5F271C150FF21D964422F1C333361DFBF1F10E850F73DC40441A3B744E3CE2891DA8F404D63C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................4`....@.................................H(..O....@..p................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................\|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...\|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Process.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.933759249584018
Encrypted:	false
SSDEEP:	384:mqk53/hW3fZ+zWbbrjP9Z95Xa/rl9qX2Ip46AVZ1CjdAA1m5wMzsPuj:mqk53MPZHRKrLy2Ip46AJCxf1mlzzj
MD5:	763BBEAE9A657ACFB2AAEBDACCCB5784
SHA1:	AD757B57673FFD4368AAB937CCFC04F34DAEF13B
SHA-256:	6E0949D0892F07EA494C2E9F39DE6EA8C1614ED80B3070EA66D6642B9322EE2D
SHA-512:	66CA8C7CDA20C247D361EB8130128B745C970874A7F0BB3B03C505A5DA0CCE87E7661B42883ECC67454BF1EE104CFA5DC6C0ADA6475AE74FB1DE4EB6FD728A7B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*... ...@....... ..............................u.....@..................................)..O....@..0................:...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.StackTrace.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	6.855678676687748
Encrypted:	false
SSDEEP:	384:OFCc4Y4OJWfOWqWWOWirjP9Z95Xa/rl9qX2Ip4CJTjdAA1m5wMBq5ul0Svfh+lWt:eCcyCCHRKrLy2Ip4CJTxf1mlBqsBvOBW
MD5:	ACA4AC5F26F5CECDB95AEAC5689FCC05
SHA1:	7A73787A55A02FF16514E3EC815FFF9091D8E482
SHA-256:	4DF83F6363CF55DCD9B38ED549E0B136FD43AD36111AFAA364E1FAAF89D7C0AC
SHA-512:	629F7ABC7D43EA0AAD81A2E0AFBF8072B8EB2F93539337BE6B9FDCA1E36471A6074320BE0226DAEC44CA10841105C1D54B55D5FA36BB142F4F9E980F4EA82FA9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ....................................@..................................-..O....@...................>...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....6.o.....(....6.o..........*.o........~.....~.....BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.\|.....Z...1.Z.....$.....$.......3.D.......\|...F.\|...c.\|.....\|.....\|.....\|.....\|.....\|.....Z...I.\|...}.Z.....Z.

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.027393084902794
Encrypted:	false
SSDEEP:	384:yAWxMWKrjP9Z95Xa/rl9qX2Ip43lTjdAA1m5wMAvru4LTXZIjV:yvwHRKrLy2Ip41Txf1mlA6+Zw
MD5:	EF1B2AABBCFEE45969F540DA71CEFF50
SHA1:	7D61CCDF119D7F95CC0A0128A45B945B96738378
SHA-256:	EC7FBA909949B623BA739E00E687B80D79BE9F1C6CC7A36F96004618504F6AAC
SHA-512:	5AB60A2294C04D2191B5B22D42D8CD2898E05AB39B69AD04A185CC6A33C9327CF4472C68C297F905F27CE561555E87B8A6870D0F9AA813459652348544BB0A7B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@...................>...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..\|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tools.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.00802697135113
Encrypted:	false
SSDEEP:	384:CAlcWHaW9rjP9Z95Xa/rl9qX2Ip470oTjdAA1m5wMBq5ul0svfh+A8pu:b9XHRKrLy2Ip4ooTxf1mlBqs/v20
MD5:	8ABD5EA47E697C477ADE46806C4C4BF3
SHA1:	7AD67F762A6E690CA4454FDB0804A84E4159A741
SHA-256:	A003D90106B3AE1A7D6E04F3BC20AE1DAB7EB342B03F9E3B5D9C5CC507414914
SHA-512:	32AF2A53814190D6329F3D7F9A1A8C829DC771988EF40BFDF2B5E2E3F4421118884713B0C39C94F6E2FD3CA3EF80BFD6F7AD6C6E23E0323D2311E37CFA455E9A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.TraceSource.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.954525389333393
Encrypted:	false
SSDEEP:	384:usIZnWlNWNrjP9Z95Xa/rl9qX2Ip4x+lTjdAA1m5wMAvru4LTNzbZIjdE:1UyiHRKrLy2Ip4GTxf1mlA64Z4E
MD5:	EBFEC60221C240FF2F2B33F112FEA014
SHA1:	9850A8DAFCA426D8FBEE01AFB6AFEC0E2D27ECD1
SHA-256:	D5E521B842062BC825E5DF4EC711718B420E459BA1E8CFD788C615901BF9696B
SHA-512:	48A553B3117CA2911ABD09DB448063F3D4E786F8517A208B653ED1B5CD4F31B10EF46A713C09E137A9D35AE203F79DA973F50550F1CF1E8C046BE8CA9CF0FEAA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2... ...@....... ..............................1.....@..................................)..O....@..P................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tracing.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	6.687209756368598
Encrypted:	false
SSDEEP:	768:GQq33333333kX+TBi8FHRKrLy2Ip4ITxf1mlA6f7Zzf:Ju1i8FHi/90fInf7p
MD5:	682312A833402F2D407132E9D2215BD8
SHA1:	139C007DE6EFBA5D673211A5D82616D64BE6E7F2
SHA-256:	299C1FDCBBABF523761CF7591A567DAA6F116DE4775D684A664F30D31AD08911
SHA-512:	316C7B28940F8D223666CED22085477949F17D3C6609363DBBF0821E959F12FDAAFF0CFD562DE945F18F1640B700A87DF8C30687BB6E276205FAFFEE9484625B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ...................................@..................................L..O....`..x............<...>..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o...."..(........0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....&...{.....0..4.................}......+....{.....".......X.....{.....i2..0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

C:\Program Files\ReasonLabs\EPP\EDR\System.Drawing.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.008740634214412
Encrypted:	false
SSDEEP:	384:u28YFlXulWY/W1rjP9Z95Xa/rl9qX2Ip4oe2NTjdAA1m5wMAvru4LTiMZIjTH7:u0q8HRKrLy2Ip4oLNTxf1mlA6mZ8H7
MD5:	A6DB195ADB646F05AA767594380DFC1D
SHA1:	006689DDCABDD879D70447A34EA1334B33ADFC0F
SHA-256:	8D160AF3A6D933B56F705875E2D7B2CDCF4B121B78C1DD8E11B897AF7A4979C2
SHA-512:	9C05631B74878EAAE4C986567308F9963AFCED6220D918C34DA27A79BD25D8CDE3C8492C6BA275563E3277B6E15E5524FDB157D62FC5B26B57670869083B4C59
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................f.....@..................................(..O....@.. ................>...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Dynamic.Runtime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.9176080347073805
Encrypted:	false
SSDEEP:	384:UuMLcdQ5MW9MWcrjP9Z95Xa/rl9qX2Ip4IDmTjdAA1m5wMAvru4LTEZIj0s:ZOcSpmHRKrLy2Ip43Txf1mlA6VZ3s
MD5:	6D52E868AB8D5D896D2B34F2324D3912
SHA1:	9AE22458D2EB81022174C3A16D94FFA9161A641F
SHA-256:	60361634D7F67DE07A9073598671D202E9EFD829429666BFA4C936563187777E
SHA-512:	83DA81F4BAC14E1643508765CBF7CB222F37FBA36526D60A972358F187E90F4962CAB5F1A83F6FF49F742140B16C5E4236B1B2A0334208A613842D32A0CA6AA9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ...............................E....@..................................+..O....@...................>...`...................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .............................................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Calendars.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.979331656555997
Encrypted:	false
SSDEEP:	384:KZ7RqXWDRqlRqj0RqFW9rjP9Z95Xa/rl9qX2Ip4CSuTjdAA1m5wMAvru4LTAZIjP:K9qKqjqjuqCHRKrLy2Ip4CSuTxf1mlAV
MD5:	3398DE072478B410EDC1AD3E328F6561
SHA1:	BF6C0ED75D46381DB214957B974E8226EFF57D2D
SHA-256:	2DED1A05A4B4E289A19187FC96B90C3987EF86CC10B590376462D492131FC490
SHA-512:	07EE3479DFAD2683207A1DCF00BDA5EF43D4545ED22FF7F80A2A6644AD332B4C5DE81C976F5CB2111BB26996BFFF30BD9EFE33F77FDA3CF9A4CBDE871959C750
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................X..O....@..P................>...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Extensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24720
Entropy (8bit):	6.791971497516804
Encrypted:	false
SSDEEP:	768:8vMhF2SzNzwu/Nlju6HRKrLy2Ip4OCxf1mlzzE6:8vMhaKTHi/9rfIPE
MD5:	48510914EF8C8C8A20DFCD2AA769B164
SHA1:	72629A00729E1F9546C13F4362C66AAF8C841AF9
SHA-256:	81FD0E624E822B0C95DF603325EEB7A7ACE7E04D10D575667F3C44F4EB456E7A
SHA-512:	029B9747486CF3C624CB2179A211EB7914C2AAA00359220652869B6848DEADE94894DC3446DF3C5C1FEEE93E894CAB6BD92CF42A8597D1E9BA2D587FCE8D9785
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ....................................@.................................a6..O....@...............&...:...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o...."..o......o...."..o....j~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(.......0..K........-.r1..ps....z. ...@3.(..... ....3.(....*. ...._,.(....rI..ps..

C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.039009488547633
Encrypted:	false
SSDEEP:	384:oZ4RLWdRfRJ0RZWdrjP9Z95Xa/rl9qX2Ip40TjdAA1m5wMAvru4LTfNIZIj8h:oZK0pJuOHRKrLy2Ip40Txf1mlA6cNIZr
MD5:	1DE0EFFEA5081B9745DFA8418FCC934E
SHA1:	5C12AA1392C44103DA9266137E1A602894AD4B32
SHA-256:	E2149ACDF31CCD396730D2FD232F103A944307C9348119EF7D18D5B2BBD3499D
SHA-512:	4BA943B48A884DFB500EC6ED09844F9067BF110189754EB50A6260CF1630F363CB5DAE7A3404B53D487F80C0960E2E80F8E5449B53B4D3F2B91C3C2F253DE3AB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................h....@..................................)..O....@...................>...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.ZipFile.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.967890189655318
Encrypted:	false
SSDEEP:	384:kYWsmWYrjP9Z95Xa/rl9qX2Ip4JTjdAA1m5wMAvru4LTmZIjh0:k2gHRKrLy2Ip4JTxf1mlA6LZM0
MD5:	23F56878BDDC8C8CEEC3AD07D0C89FB9
SHA1:	932B93203E6936067293CE48154D99DDF0A05BFD
SHA-256:	52216915A70BBA9DF457552E46ADDCF4EDFD5489929210EC8B01552A2EE384C2
SHA-512:	95571DD03388126C04428A911DA5B1081398A20F84CCFAC78B159C6F17DC6832EC3E9298DAEC25D1674CEC2C16DDEDB03E219AF984DAB498A8973580F07C7B87
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ....................................@..................................'..O....@..@................>...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Compression.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109712
Entropy (8bit):	6.440388342659836
Encrypted:	false
SSDEEP:	1536:ovc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXbHi/9HfIP:wgk1tiLMYiDFvxqrWDWNoJX5
MD5:	9AA1E845DA38257FF1C418A41E7674BC
SHA1:	5C27458B364343CC78658E19D552947DA2ED6007
SHA-256:	556B30116823FD919415156137F4A7AB04AC317E599ED5647FFF9C8D892596FB
SHA-512:	19631E0736DAD754C19480F99BB7823E25602AD2ED576B62063822CE88A29050504AD28BFA61FA39B4ECC763CBCD68FE64F6E8AB993BCF736361ABF0C144E2B6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ..............................=.....@.................................5W..O....................r...:...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r7..p.(....2rs..p.(....2r...p.(....2r...p.(....2r...p.(....2r=..p.(....2r_..p.(....2r...p.(....2r...p.(....*2r...

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.DriveInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.012269943025893
Encrypted:	false
SSDEEP:	384:BKcuz1W1cWFrjP9Z95Xa/rl9qX2Ip4uowTjdAA1m5wMAvru4LT7ZIjiDNt:bu8NHRKrLy2Ip4CTxf1mlA6OZn7
MD5:	6C03876D161F9CAD9BAD77F7247585DD
SHA1:	820121DCB6CC3CC05E14511796AA07E3352EDD45
SHA-256:	446E7BDCE29E103FC2D3C227F07FCEBB51F521EC928E38D63F949A3B92EB199C
SHA-512:	DAFD08673968493BC0A5371BA87466BD7512F782B1774C6139F82B9ACC376BA7EC46E376686B18021E27DD57CB90A6AD0EA7287CC86B98BDB0EADCD62C4353F3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.015596217362603
Encrypted:	false
SSDEEP:	384:tJ+SWikW2rjP9Z95Xa/rl9qX2Ip4TTjdAA1m5wMAvru4LT8ZIjSO:r+eoHRKrLy2Ip4TTxf1mlA61ZjO
MD5:	B586826CED650BC66C94F93A323D8E8F
SHA1:	36F2F3A82790685AA95B6B11A612C2CD62EA9D5F
SHA-256:	4880A7167BBFE901C3583091B974CB226783B20AB8727DAC51EAB935314B692E
SHA-512:	B2D0CA5EF973DE567419F750C547CFF7C4FC5CF69DE24CBE4545D2F7965331212EECD85BE0CF73F3E8F46B6B4B4AAC8E8DC5F0ADA114C49A9C2753E03DD6C207
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................}.....@..................................(..O....@..P................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.Watcher.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.045009892938906
Encrypted:	false
SSDEEP:	384:3AWzgWsxrjP9Z95Xa/rl9qX2Ip4ub+TjdAA1m5wMBq5ul0Ivfh+pS:3tuHRKrLy2Ip4uKTxf1mlBqsrv9
MD5:	974FE1E400F46AD556BF2CB96A0B3B39
SHA1:	E542A749C0ADAF80DB25D9ABE7C0DD2DF20A8817
SHA-256:	C0FE74081933567A56395F344E2333FF7BCAABD1DBA41DA6CC6A4A16373D7906
SHA-512:	28374864F465631D12264D40078CB7C88A3B4832CE33E008490188DF8102E715D1833FB444520C50759C646A074383F95FCD59F629847D1612D530CC5D1426D5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................#.....@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.018571772835123
Encrypted:	false
SSDEEP:	384:GBLRWbYWmrjP9Z95Xa/rl9qX2Ip4mTjdAA1m5wMAvru4LTEZIjd:GB2EHRKrLy2Ip4mTxf1mlA69ZW
MD5:	C4BF31F3F089FB4CFF61848A7E368E40
SHA1:	ABC6D15FDF0BAF685CB46AEE067E4B84065450B6
SHA-256:	2862B8B12EA41602C4F5FDC4E74B3534DF35D13154F4E4BFD25C2F1ADE5F44E4
SHA-512:	42C2EE70270999423895E66FF0C0736B8004FD9C820D2801C4B7D462F06C274C2DDC919ED68DDFFD23B0B89D541DF9CBCE088D5564249A8C9D2B8F51F2E28A82
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ..............................].....@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.IsolatedStorage.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.005836250911921
Encrypted:	false
SSDEEP:	384:KHW4/WG+rjP9Z95Xa/rl9qX2Ip4lUlTjdAA1m5wMBq5ul0Hvfh+kq:KrrWHRKrLy2Ip4ClTxf1mlBqssvjq
MD5:	371578A79C29BB383005971BA4644675
SHA1:	C5E6EBBA9A3464C023FBF836474DEA05157D9EC8
SHA-256:	6DC48CC35F8BACB18039C37C39B1C379DFD6FA5BCC77B9575C9DE8187ED4A3F1
SHA-512:	0D589AF9490FA5D1DB519956AE3E2DD6C55B65C138A83366C679197BA270ADCB1D463ACAB680069AD9289680EC74650DC28E8C173CDC6536897E1587524FD41F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... .............................../....@..................................(..O....@.. ................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.MemoryMappedFiles.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.041976655197995
Encrypted:	false
SSDEEP:	384:bvk7hWmCWJrjP9Z95Xa/rl9qX2Ip4bTjdAA1m5wMBq5ul0Pmvfh+a0a:bs7/7HRKrLy2Ip4bTxf1mlBqs5vn
MD5:	7D2951DCB6B1172FA1EB015C208701D9
SHA1:	D55575258E967E28EB81BA5154BFFADF8FA4163A
SHA-256:	5DC1FDADF06103A5F26F43A4F1F39012A22E3CA38E1001ACBF2AEE4E80F0BE3B
SHA-512:	C0483B359E4239D50BE2CC8FEBAEB54E426F57A15F69F9A2DDC062BA92CC1E5973B04FEBBD4167C87312B2714441F42A5CD1FFADCC5058B8FE2EF5F626A82AFF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................)Y....@.................................h)..O....@..0................>...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.Pipes.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.022018859408551
Encrypted:	false
SSDEEP:	384:SGMWCUWfrjP9Z95Xa/rl9qX2Ip4ZTjdAA1m5wMAvru4LTYDZIjk:S3rHRKrLy2Ip4ZTxf1mlA6nDZz
MD5:	CD03BB46CE2E0A96102B3D2FAA92CFBC
SHA1:	66497E909BA7F72E1A4C2B7CC8C7AF7A6558E5CE
SHA-256:	498302110BFC203FAF1670D5EF04FD79D2EDEBFE907AD1E6674A6A85EE56989C
SHA-512:	077C25BD1D1C49ECF9890A87E4D150A269CAD53759D53BF7E3023B08CE1E75770EE4BF09EC5041D17230D33AD346A424E345A37D48DB7F73738F9E138D75A0C0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................&9....@.................................@)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.UnmanagedMemoryStream.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.994997816444603
Encrypted:	false
SSDEEP:	384:OBhwI7WSQWxrjP9Z95Xa/rl9qX2Ip4wgC6CjdAA1m5wM36QNuZL5c:ODwIBJHRKrLy2Ip4w6Cxf1ml36QgZFc
MD5:	567B31ABAA1476CDA6FB631FCBCA7EA8
SHA1:	A78FF09D358000BE3EC04EC6EF504A90C3A726B5
SHA-256:	F71CC788961A41E5E6B15D1400E064AAA9C3DD4D7EAA032758215388ADF57756
SHA-512:	A50EDB73A3732729C479087E1681AC882A64E081E9936D09387F239F2FA9E2DCBFF77610F8123B5E07CF173E24770CFC011F048BBA7A4A8DE549E656C21D4CCD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................l(..O....@..P................:...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.IO.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.018735616462396
Encrypted:	false
SSDEEP:	384:SyvPRW4lWfrjP9Z95Xa/rl9qX2Ip4qTjdAA1m5wMAvru4LTLZIjJ:339cHRKrLy2Ip4qTxf1mlA66Zi
MD5:	5058626C8519E190CFF67C918AFE0A4E
SHA1:	87D2F203F86AC99022334AC0244D1DD47D400A09
SHA-256:	486B5A0E6E47E92F89BE6F694B2B0F285B1C0367BC4CF8CB27FF821F3AC0EBCB
SHA-512:	EB4E8AACFDBA139C80C3A20582089495A4AA82E00483A91E7F1F82D80ABE694C3CE0B352945E4DE341838017746FA83BD41C2BAEE28575DD701F83D71B1D4CA4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................3.....@..................................)..O....@...................>...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Expressions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.975680937062165
Encrypted:	false
SSDEEP:	384:S6RW6eWSrjP9Z95Xa/rl9qX2Ip4h8TjdAA1m5wMBq5ul0Wvfh+2a6P0:S67iHRKrLy2Ip4eTxf1mlBqslv3a1
MD5:	D239BA595AAADB0EA18B5987221AE091
SHA1:	44564DDC01DD0D8E4FEBB12B3232F646D3C06A7A
SHA-256:	CDDF808A755A9DCE7C9622C9EFC7A5C4E218CB191CBCF0FCF1B1FF5618AF0917
SHA-512:	27F9229021832CE386B795C8A438A4057E29AB90D1817012A192D6FBFFB75A3C882508E40711DECF9F6C7C1D54D57A42D522A31BD81C9E9D85E6B3BFB1077305
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ..............................?Z....@..................................-..O....@...................>...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Parallel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.014555464183901
Encrypted:	false
SSDEEP:	384:eSUP9W70W1rjP9Z95Xa/rl9qX2Ip4zRFTjdAA1m5wMBq5ul0Ivfh+hm7:3UeNHRKrLy2Ip4XTxf1mlBqsHvZ
MD5:	A8460A5894B72975C63FB6D32F9D0C8D
SHA1:	0DD34691B7482E5EA6EC4A0087EDE169A0212B24
SHA-256:	14638F6195F5D6A617AC5C3B37C172FD1CD0E028D4F80160DCE2BC25E265CB50
SHA-512:	BFC9CF48649335AAE291B14C8FD8E8FCF971937C849651429B84B1042C16A646FB805BFECE101215AF612DC3B8926BD93DEC1F22D1A258F05147C6614F447BD6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.Queryable.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.992849598041938
Encrypted:	false
SSDEEP:	384:X8yg07W0/WhrjP9Z95Xa/rl9qX2Ip4Ob6CjdAA1m5wM36QNuZLU:XBHcHRKrLy2Ip4e6Cxf1ml36QgZY
MD5:	9B2AFCE22829448E52919ADC97FA0F75
SHA1:	4378B914393E30DCD67BCCB9F28FD956EF56DEB4
SHA-256:	306C43B5F695726D63BC347417F5189F7392719C788B953E4D9576925DAE4CDB
SHA-512:	40C27A9B0836BC74851890C3D633C4D1EE588F99DD19580A71C5FC6DB4A535F06FE5D4BD57C8E499E65982668C929C245A9D17C009F405AB347589375D4E8EC6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................T.....@..................................(..O....@...................:...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Linq.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.984362208373399
Encrypted:	false
SSDEEP:	384:fe1WmRW6rjP9Z95Xa/rl9qX2Ip406TjdAA1m5wMAvru4LTwZIjjy:fejLHRKrLy2Ip47Txf1mlA6RZSy
MD5:	75197142BEB82E4E45074F809B4AC1ED
SHA1:	D359EC1D8084898FB77CDEE07031E952648D3285
SHA-256:	70B9D7B943C5BBB511A3943368411EC0969E55913FDB7639E35100EB0B993A49
SHA-512:	B4064F5E9A06F754748F28826F4F71D0484FFBBBC3D9D1FF2864C1DF4BCB2C317F874853C68985992FE83D2273A3553C4A1DAF4AF507976E8F5702706617A79D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................1....@.................................p(..O....@...................>...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Http.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	198144
Entropy (8bit):	6.164369117328881
Encrypted:	false
SSDEEP:	3072:JeruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgtH:cW60VcTvakcXcApOu
MD5:	8DC59D67663004627D8B2D0746533249
SHA1:	27F2D020233099882332945AA1E706DD412805EC
SHA-256:	62FB650E6211E74DF8D9EFAF2F5F36BCBECA0E8551C3CC3AF757FB4103725993
SHA-512:	8ED5FB6F9103A572C5CA22CFCC39CDD1017DAE827091EA7A4D2E5C406DC43D281DD2DE76C13B5FFF588C749BD82961FBFDA0A6001F5C8205A27D2E086C9BAF89
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ...........@.....................................O.......h................>........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1....0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2..J.Xo3.....J.Xo3...(...... ........J.XT....J...XT.o3.....o2....Y./....o3....%3 ...Xo3......Xo3...(.... ..........0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._......0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NameResolution.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.980312715919581
Encrypted:	false
SSDEEP:	384:M6ZWYLW6rjP9Z95Xa/rl9qX2Ip4q31vy86CjdAA1m5wM36QNuZL5d8tY:M6l1HRKrLy2Ip4q3Jy86Cxf1ml36QgZf
MD5:	C19A4B2BEF8202293066556D39DDAF88
SHA1:	2CA6DCC8CC585FB282EBA89BC38B8B901181C9CD
SHA-256:	68628C824A222943C2BDDE8D7089E3F41FB9673CB711510297F2A8A78493BF58
SHA-512:	46D8FF9B0D1EDAAE45F32671A5961310ECEF445EEFAF08D153C10F5F417D5260269D95BFDD928C419661A146D92FBCFF7C4A4750BE3369D37D2E70891A1F6216
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................-.....@.................................T(..O....@.. ................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NetworkInformation.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.954621838798846
Encrypted:	false
SSDEEP:	384:k1W1WMQWArjP9Z95Xa/rl9qX2Ip4/CTjdAA1m5wMBq5ul0yvfh+l0O:H1yHRKrLy2Ip4/CTxf1mlBqsdvC
MD5:	E45BECF9266A273DF70331171A822EF9
SHA1:	4BC48FD9BFC184691F15EDC47EB412D13895B7BB
SHA-256:	4632590F6231C37250549C2BDB5D8C8FD1A7881E12AA7777BA07A9B443F1793E
SHA-512:	35269AECA1663F3DC4EFDA33BD713888FC7AB86C35D8E14D1C870E60F93A7B2EC104E1085FB27330450981F966201EE9FE7010C1F9A3510F76DFB0E8BB16B92A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ....................................@..................................,..O....@..@................>...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Ping.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.992639582476022
Encrypted:	false
SSDEEP:	384:BdSWSKWprjP9Z95Xa/rl9qX2Ip4wgTjdAA1m5wMAvru4LTCZIjtmUu:zOTHRKrLy2Ip4wgTxf1mlA6zZYpu
MD5:	11E4FE99627FCB3B157FB92D8D931F6C
SHA1:	214512E4FE71666C1C10D52969B89BA341F7C66C
SHA-256:	22D17B01651A7047AA52C7A6202299305F523E4394790CF058B87D7AB8A173DE
SHA-512:	FDBEFFBC5E9C4752AD1D8BC93B06521BD44AE14A235D31514A92426D874E7BB770B4BD4BAEBE4D8BCBC21696AEA1243DA7C381820C91A700CBA1FE3E409FF7C8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................=.....@..................................(..O....@...................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.926380492711681
Encrypted:	false
SSDEEP:	384:PJEYA2WkIWVrjP9Z95Xa/rl9qX2Ip4VTjdAA1m5wMBq5ul0Avfh+r:PyYA8dHRKrLy2Ip4VTxf1mlBqsvvO
MD5:	B5E82B2D3167150A283BAEDF6635585C
SHA1:	A0B8D612E07D3D5357F2BC253E2394CA7CC62EF8
SHA-256:	1C4D07DF98A1C096B4F3B64F4C06A545A0099CCACB0CFC615AE78FD213327632
SHA-512:	A45E6D6DB25C9A52BE27FAEBB7D6FFDC0B3B6BE3F782696345F2F05830447F5251481B306BF98CFE3B6DB8C18E4F7A67F4EAE678DDDE52F68F7D42A2AE85920D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................:.....@................................. ,..O....@...................>...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l.......#~..\|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Requests.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.011172629188287
Encrypted:	false
SSDEEP:	384:RJGWe4WdrjP9Z95Xa/rl9qX2Ip4tCCjdAA1m5wMzsPuK:Pm9HRKrLy2Ip4ECxf1mlzzK
MD5:	6784F9869E44E7B12ACF609B6EC7D9F0
SHA1:	121D7AC450832A5FF2161CEB4C1C053047AF61A5
SHA-256:	FBC98FBC3C67210115F69C8EA7685FC4DF6090499EFD4F26B2C3D8A359515026
SHA-512:	1DE77CE14B71655031DC158DCA06E798F17B8CE094C9245E2AF92B05A01F771D0A359317BC8518A241F2CF0AEC0BC712167B66EF5C0F5DE7C266808E6188DE7E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................0)..O....@...................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Security.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.956721913718706
Encrypted:	false
SSDEEP:	384:VdW1w3WesWRrjP9Z95Xa/rl9qX2Ip48jBMTjdAA1m5wMBq5ul05vfh+y:C1wxZHRKrLy2Ip48aTxf1mlBqsCvj
MD5:	11ECCC72C540BFB8569C41480DAEA7C5
SHA1:	3A1647D47975E818E71744A715682A836A7565C3
SHA-256:	16C9F88A141863D12DCBF5F7DE604DEE8852ED026E23956EED4D9758828DCADB
SHA-512:	008DA3D459D3F0BE8BD2D967BDC19BF03311712CF1F4A6636F28A84DA08D3EA2894024FAEF411932237E30AB4438CD695855A5BEB7567B8B1E898407CF646EC3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~... ...@....... ..............................T.....@.................................,..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.Sockets.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	6.767850843576942
Encrypted:	false
SSDEEP:	768:Cyp12Bhkg3qnV/spMHRKrLy2Ip4mTxf1mlA6kZC:p12zkg3qV/spMHi/9GfInkE
MD5:	6C96760E10DD343BE96551945F9E8BAB
SHA1:	4A9EDD9D9DA52158CA3792D01DA3B2FE8FB4B918
SHA-256:	894929F99C214FA1748D163F8349D2A8D16901890C1DB7407D447E0A9E954CC6
SHA-512:	6084D7D66F1AB858C1910917455F3CC3486C773EB31BEAA309A9E1DF78BF1AA0120C5B50F005DEB2A4142F27DFDD0EC47C407105833EE95A0311FA888CB170CC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............I... ...`....... ...............................c....@.................................gI..O....`...............8...>...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o.......0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..L.......(....~....%-.&~..........s....%.....~....%-.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebHeaderCollection.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.013405463565456
Encrypted:	false
SSDEEP:	384:FHPAW1bWjrjP9Z95Xa/rl9qX2Ip4INETjdAA1m5wMAvru4LTYZIjVC7ggg:xrWHRKrLy2Ip4IKTxf1mlA6pZY4G
MD5:	7231EED833F6496EB34442B4AB87904C
SHA1:	BAD09DCA990E86CABDC82869639A7574501CA148
SHA-256:	9B0071C13569C3982F0A5CA91EC511D97DDCFAF807D2383E8EDDDC259FA44D07
SHA-512:	7FDFFE9FEFDCFF90279A004302408C245A620C13F812209F14BFFF07F5835AD496B8A1773A9048D4FA41A8D57381CF5D37021760B01B809848188027D797D88C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................v....@..................................(..O....@..P................>...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.Client.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.994636032353121
Encrypted:	false
SSDEEP:	384:ZNoqWD7WPrjP9Z95Xa/rl9qX2Ip4TeCjdAA1m5wMzsPu0or:ZNofOHRKrLy2Ip4iCxf1mlzzhr
MD5:	D6CC536E7AAD5F67830F0AD3B761A503
SHA1:	0D6F5D6DBCBB20BE3C94094DE5C93ED7752F1595
SHA-256:	CC6D8CDB7C37C39EBDEC1D494A0BC88B468BBB8B4F82B755052E816E553C5A2E
SHA-512:	EB3C327C22C1E8DA8838D37DE4D740D2BB4248ECCCDF63CEFB87CBBC8C69385F77758220BDEFF484C48F72C663E44525CB75A7B7D0C53B6D45B1D7C4488A8C39
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................\|(..O....@..@................:...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Net.WebSockets.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20856
Entropy (8bit):	7.009270974622172
Encrypted:	false
SSDEEP:	384:FGETSAWUEWarjP9Z95Xa/rl9qX2Ip4RtoCjdAA1m5wMt+uKz2MDug2O:pT1QHRKrLy2Ip4noCxf1mltdKzNp
MD5:	D75F5F80E910C80B204717F9B95E745B
SHA1:	C597C5807DB40BB50FDBB93FEE780A5AE7C2426C
SHA-256:	627B337EBE82028FA425063807AACBECA00A3457EC1DE1FBD7667663B7048DF6
SHA-512:	347A0E007343B106509CE7469E0E724FD6B2B0CCACE90432971BD5119B98EE65B8640F9CB134330D3D6ADDAC3F6AE4D0D4154B456293BC6CF3FDD59500350DB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@..................x=...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.ObjectModel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.9987016230024715
Encrypted:	false
SSDEEP:	384:zcDagtDApWSKJW4rjP9Z95Xa/rl9qX2Ip4GTjdAA1m5wMT9YMWuuwSmNA5DO9:zPKBtHRKrLy2Ip4GTxf1mlTAwRN+o
MD5:	A603D98CF998417CE64C4539CDCA24AE
SHA1:	11A696FED63167B0B315EA77573BBFD65E01DFB6
SHA-256:	B919535D20819F90BD2C6A03BC9E962E56025F9C921A2266FF415E91D12723B6
SHA-512:	4190C9B267A5726D5E84D3EFFDD2B15A06794B1DB707B1C9619DED057880B9DE77C67F300E198E5B82A4D2EABBAAF14DA8CE020235D708777F465D8DA1082990
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ....................................@.................................0+..O....@...................>...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Extensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.011374618700231
Encrypted:	false
SSDEEP:	384:sIWD4WWrjP9Z95Xa/rl9qX2Ip4zTjdAA1m5wMBq5ul0lvfh+0e:s18HRKrLy2Ip4zTxf1mlBqsWv2
MD5:	DD82DBBC223607A8AED7BA3516860A85
SHA1:	AEA2F102D1A003138742C9671BED3161922B8DD7
SHA-256:	FA8B5C160F798C9151F2A8DC2E4DB8FCF8EDF156EEE30B14197C11116E4D7917
SHA-512:	B0CDE160BF04A33A053C13E2DFB316C1D4C7E8B280F47646C3B60B3113A4A5BE7404F56BB4740FADEBA2401332E86C59DC314E9028C734FCBA44B42800002F06
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..@................>...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.940990584600268
Encrypted:	false
SSDEEP:	384:JMWzQWQrjP9Z95Xa/rl9qX2Ip4oooeCjdAA1m5wMzsPu:J5aHRKrLy2Ip4o+Cxf1mlzz
MD5:	7546D722FF86F3FABE21891C4912153D
SHA1:	B32377E75979E2FA1990590E9106CA99B9C552FF
SHA-256:	D2B775EFDC8BC0B9766A151B1AF1A6DCB9951D9123CB119ECE2E8C835897A4EA
SHA-512:	F337C1A2FD5AE062F686E7B0580F539B1F5B8F4E1F94B857CD3E0E07B14FCBAE0A64B39494D7D8E1544C7407AF66D3DFD879B49DEEF77DCFE30C6500F94421F0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N... ...@....... ..............................!.....@..................................)..O....@..@................:...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Reflection.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21888
Entropy (8bit):	6.900382977940602
Encrypted:	false
SSDEEP:	384:VxDHKWAMW6rjP9Z95Xa/rl9qX2Ip4eACjdAA1m5wMt+uKEK2MDug2:bD8UHRKrLy2Ip4eACxf1mltdKEKN
MD5:	B0E03F24261F0A5911BAEBF2DAC4F261
SHA1:	9E8DD1297F73F7537E4585317BAD2BBAE66CCBA9
SHA-256:	77D7DF7E179AB2780D0DB5C25DACF1998AD1A30DAD779DBE46CCDEE1072BF1A1
SHA-512:	B30C5881C22D90FACF29C855D92CB40EF5DC283A40C57556F27B5CA3AF4613E576E3F668DAE6C5D7DE646ADB8AE4508EF6B247C343DB37E29E7BBE23FFD473A3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................&....@................................. ,..O....@...................=...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Reader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	6.988188886324482
Encrypted:	false
SSDEEP:	384:BLNBEW6pWTrjP9Z95Xa/rl9qX2Ip45CjdAA1m5wMt+uK562MDug2Eq:BbMMHRKrLy2Ip45Cxf1mltdK56NP
MD5:	4056B9B941A27EA3DB441088E2B73108
SHA1:	373CF0B09BD1FBF716C7BE234DFA99A341AB4626
SHA-256:	E180BDF8C805A85F86BEDED3A9FA37E7CF7D2E281A0FF87E2143604BCA1D82A7
SHA-512:	3FAD3AAEA333A0301B3F88FB7E667CA24CFE8BAA23B40F2076794F268ECDD8E92301CCC3717CB1D1E154BCA60BF0199D1F0832EF6FDA06AA799C904524EAB0D7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ............................../.....@.................................D(..O....@...................=...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.ResourceManager.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.010082222669093
Encrypted:	false
SSDEEP:	384:TKkHKW/tWmrjP9Z95Xa/rl9qX2Ip4VlKCjdAA1m5wMzsPuy8:2ujHRKrLy2Ip4rKCxf1mlzzy8
MD5:	95CAB5C70CA547404FC228753B5248F5
SHA1:	CA80094BE3458609EC72EE53A77883EB3CBEDA74
SHA-256:	10BAC8F44ED75AC497BC392EE2CB7457455C59C3BC7064C101B346BB6F8CE095
SHA-512:	86826B4B7EFD21ACCD5C052621A3D3C13444CEEFC603125F808C6626ECBCCEFF2085364A788742D0643D358ED7DC5D9D9D0830F29789D658EA0E9EBDD514FF18
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................4.....@..................................(..O....@..`................:...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Resources.Writer.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.977617239092562
Encrypted:	false
SSDEEP:	384:ALnfIWqrWXrjP9Z95Xa/rl9qX2Ip4tyCjdAA1m5wMzsPukwZjNtY:ADf4GHRKrLy2Ip4oCxf1mlzzxj
MD5:	2280ED9104EB833B7EF3B5F96C322AEE
SHA1:	5E542572BDC4005660462968E4B50D3695DF58F7
SHA-256:	2B3E85B40E98C93C58A9E0C6EAD47EB8C1A2A59CBE62D85220D0D94D517E4C5A
SHA-512:	8CC31D50F5C35706706D8E372CC4D46CE6C673E16B15DB1BC1B4A5D870333800582C0BD854792C05EB7AB468B6AA943EE475C6ABCE5971786C0635C0CF22C63C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@...................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22672
Entropy (8bit):	6.814455866031959
Encrypted:	false
SSDEEP:	384:6qTO1PdhW1YWxvfrjP9Z95Xa/rl9qX2Ip4tACjdAA1m5wMzsPuz/4o0:6q6PSztHRKrLy2Ip4aCxf1mlzzzQo0
MD5:	FD44D69516412D1AC6D32F47F5C4BF3D
SHA1:	08A77249796ABF70C8DC3C8B11AC490577EF6B28
SHA-256:	2945E07168DD5856D36BA869BF12F91D0C2B7B5E9F4ED88E5163216FAE594C42
SHA-512:	06B15C163A8AD8A68A4DF40A8B9B75D9CDDF39E92EDFA61ACD5A33C43197D9DBEAA2B2D0B9E5120F09D0CBA708537E21D53A276A7E4653FF8AEBC92D45805B2D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..[...........!.................1... ...@....@.. ..............................X.....@..................................1..K....@...................:...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H........#......................P ........................................\|......<...rp....O..Ih.VvI..a,...%...(..@...7.v..v..N..x.6.._.....H^c~s_...]..Q@.,n.H(..CN..Q..<...%N`H..MV}%'x;.A.1..E..^.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..................0..................0..................0..........

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.969946391198759
Encrypted:	false
SSDEEP:	384:Fna8WK1WbrjP9Z95Xa/rl9qX2Ip4FlCjdAA1m5wMt+uKb2MDug2E:Fna0gHRKrLy2Ip4DCxf1mltdKbNL
MD5:	130792957623ABA4B9A6699398314AA9
SHA1:	75D44C66FDF0D887553F788F1175666D03CA9950
SHA-256:	0AADE7D9F0C7E98884466AC2AF829227DC14BA469B2C7E55D9C2190B0578E34B
SHA-512:	4A8ADEFA5495B6DA1A451881FE089EF781C98E99A239378772FACE4D6A17CDB31E517557C6D6A731A35B3FA83E2DD89C12A08E645B6B3F20620978657FD30F38
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j... ...@....... ....................................@....................................O....@...................=...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Extensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.939048706998203
Encrypted:	false
SSDEEP:	384:kBSWITWPrjP9Z95Xa/rl9qX2Ip4qCjdAA1m5wMt+uKE2MDug2:k6OHRKrLy2Ip4qCxf1mltdKEN
MD5:	007612D7CD9AB2F476488862FEE6DDF7
SHA1:	7A0EFA45E52FFA944876E9AFE7BBACC7A84FE8D8
SHA-256:	F24229E4F09D602B6681D51C30EB7A75FC01FAA83225885903B65A6114E359CB
SHA-512:	1B22132423E81EB15685D3BEACDBCDEFED6F6DAF12825F70E85FC07D51044B295B0BB3B32CB5903CF60704689BABC325EF368DBA42424AEB408FF54C241E7C44
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0................. ...@....... ....................................@..................................)..O....@.. ................=...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................\|.....\|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Handles.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20104
Entropy (8bit):	7.011676585489165
Encrypted:	false
SSDEEP:	384:188cIIWNoW4rjP9Z95Xa/rl9qX2Ip4X/4CjdAA1m5wMDBuvX:19cUmHRKrLy2Ip4wCxf1mlD0vX
MD5:	CFB008C51A954851C991442F9672BDCE
SHA1:	3200F25CB1CBEA3D0DA2DBD2F80324B6438E8FBF
SHA-256:	E79A0DAAB8BF70A360213FB3F3272BFA980B56EC40EBE0E66A7D06E2986FDB37
SHA-512:	3666CD8B94CCF6FB0CCD2C2A299415229E253278D2AF8FB90D7334B3E80003766C5AA7EAB450B845348B4993DA4FCCA4EECE0F8F8A49BFBCF4B5B206DBB8C4F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ..............................'.....@..................................)..O....@...................:...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..........................................................c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27280
Entropy (8bit):	6.771047348828758
Encrypted:	false
SSDEEP:	768:ErmoFmWdOpHRKrLy2Ip4wyNCxf1mlD0L:EaEFdOpHi/9L6fIIL
MD5:	9776D5F2CC7EB70D9F884683D7EEF5CC
SHA1:	598977D0FF922A1DF4794E89052E95FDF841EF0D
SHA-256:	71E20EA248C9E4BA3969EF99475978B93CACB3902BAD0AE856197D6C5B5805B9
SHA-512:	86887EAE9BB93E1332FD94BCF98FBA2BB18C5C3BB671F87C3746ED97DEACCF58C2109DB0B3C9141563F33AADB482300A6534ACD6FDEB562E1EEB409418A45C10
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ..............................7.....@.................................PE..O....`..x............0...:...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r/..p.(..........(....2(.....(....^~....-.(.........~.....0..........~..........(.........(....-Y..(!....{/......5..,

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.InteropServices.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23184
Entropy (8bit):	6.842912642172639
Encrypted:	false
SSDEEP:	384:k09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsP:FOAghbsDCyVnVc3p/i2fBVlAO/BRU+pX
MD5:	16737B9D9DBA4E2D85B9C98379E3D04A
SHA1:	4BF9E51BFE7BA6993A2D4A590B4A7872EA650DF1
SHA-256:	25DC1EDED1EB569B6A423896506C13474E2732118B3F3BEE1D1DCE4A76EA5A4F
SHA-512:	2446915FEA03CC008EEB996735403CAE9ACA12DA23211EFE802F882115F60C3FA68D46690E40FF83B092F758800E2800D5F47A2A8B523DC53286E29B863EC6BF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................g....@................................. 5..O....@..P............ ...:...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Numerics.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.996432897343726
Encrypted:	false
SSDEEP:	384:u7W6RWhrjP9Z95Xa/rl9qX2Ip4XTjdAA1m5wMT9YMWuuwcNA5DCUCT:u5CHRKrLy2Ip4XTxf1mlTAwcN+GUA
MD5:	686EED1A62C5D0790DF8E4BB44FC7F7B
SHA1:	4DC98B4B3B3215ACF736737C74931BF97B9F3586
SHA-256:	8E9A766F5C6B7F67562E33AE7E8EF753049C09DD669E8CC40EB94887FDB23B94
SHA-512:	7270831B80389F0ED6D4F7F0A865106DE83B94018CB20FC84EBF56CACC37C0A1B023D9A90BADE1F9A8000A00316AE5236AE0FEAB901C2313613A1C33207F9411
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................\|.....@.................................T(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Formatters.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.042668418966383
Encrypted:	false
SSDEEP:	384:7I5HeWFwTBsWerjP9Z95Xa/rl9qX2Ip4VLZCjdAA1m5wMzsPuI:7I5HFwTBUHRKrLy2Ip4XCxf1mlzz
MD5:	90D3BEE58A0AA90CEFDEF09FE7D98576
SHA1:	34C517B1CB91281CBAB1253624BB9EE23984E96C
SHA-256:	CE53C0656DE14AB215AEAF436CF85CB056A89E8CFA5D3EE727444C80ED6DE8F7
SHA-512:	6E432D68B80AA461077617EA093A817C9A4412C3E81E77307C96BD1122DA2759899F2D9C649F502A1CD0EA3CE7F0B1E2974370077F2DA3C0F3C9CEDD61F4C6B7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................\....@.................................\|)..O....@...................:...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.017159903856617
Encrypted:	false
SSDEEP:	384:2AJpVWbfkBnWprjP9Z95Xa/rl9qX2Ip4wO6CjdAA1m5wMDBu/:2AJpWfkBUHRKrLy2Ip4wlCxf1mlD0
MD5:	36D959C16C2B02B04D2EA24CCE6752D2
SHA1:	039F9E9DD22BC55A3CB941E8BF0C1A9BF7A07B2C
SHA-256:	FA4B7BB60E6F8113FB04E7B14632ABCF302C8D2A356F290BE1014BAAE61E4408
SHA-512:	DCBC4F4F0097EE52CC3933B70907AD7297C897B1AE2958624001D62A647B24FE9DF6D3BD6432A87737F74D13DF8A0AF3D1DDE7D75CE06EB9720593F63B891540
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ....................................@..................................(..O....@..`................:...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25744
Entropy (8bit):	6.721365603948899
Encrypted:	false
SSDEEP:	768:v1dyAqgQBfqyTBxHRKrLy2Ip4AzCxf1mlzzlZ:NdK1LHi/9AsfIPl
MD5:	8D2D51E700D8F12730189C49EB521595
SHA1:	B10D09CB5DC37F189151EE9294FF1A0B227117CA
SHA-256:	73555D3D6F3A7C735ECBE7B5B2C71CAE7E67B9D3020DCB1E3FBAC976E6310763
SHA-512:	9BF1FEF67B08F9331A976DD9DC0CC453333208AEA20EA213BDF50309B246CD587EABCBA10B39905FFA00CA2A3EC092914BAB4E9105AE293320A52802AE60478C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ..............................W.....@..................................8..O....@..8...............:...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......\|!..l............1..p...X7......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.Serialization.Xml.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.8634763704059285
Encrypted:	false
SSDEEP:	384:OpsBljcZQIVI8CNwbcyMWs4oBOW9MWG4tBOWIrjP9Z95Xa/rl9qX2Ip4qLTjdAAV:csPMQMI8COYyi4oBNw4tB4HRKrLy2IpR
MD5:	0FDA1C1123E1440735B8CBF796A0FF90
SHA1:	A41A480D7ACF146E1E772090A097BF84F8A37D4B
SHA-256:	568AE987E24F0494BB782F24BA19E43391A835877C48B6E6DF32B7F9D46AA465
SHA-512:	F8AED32FFBCC9C43F08DBBE1B89D2E14FF5443E0A4BC340E8A846AF6C19ADFC468CB99D301520FFD8BE6FAE1B37943265955E4109BD788C8D8DF008F5E1E3B37
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ...............................M....@..................................3..O....@..............."...>...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s......s......0...........o....u......,..o......0..%........s..........(....r...p.$o......o....:.(......}......{.....(....z.(....z6.{.....o....:.{......o.....(....z:.{......o.....(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28296
Entropy (8bit):	6.535649241097432
Encrypted:	false
SSDEEP:	384:4bhigwLAuZtM66g/Id7WVXW8rjP9Z95Xa/rl9qX2Ip4hCjdAA1m5wMDBu96:4bhzkKsHHRKrLy2Ip4hCxf1mlD096
MD5:	4358C0FB7A3830CB3C0F65734D54E5F3
SHA1:	FE56EEA28B06C67B6532923978BE76A6C9E937BC
SHA-256:	CE5AB73A3EE94E0D0A4A1F894885A5D7822386615A2E0DB08D4E09688C0CE306
SHA-512:	61BA825633E6319B6C13FB449607156DDEABC9D9627356999752D2E0966D0383581A707A75BA081DDEECA146FEEAC2AC448B9E8A25C5C9410FE09D74ADAE637D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0............"H... ...`....... ....................................@..................................G..O....`...............4...:...........F............................................... ............... ..H............text...((... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8....8.....8.....8.....8.....8.....8..........8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Claims.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.01018265988071
Encrypted:	false
SSDEEP:	384:bUcX6W9aWGrjP9Z95Xa/rl9qX2Ip43KvCjdAA1m5wMt+uKW2MDug2uS:bUchqHRKrLy2Ip43KvCxf1mltdKWNq
MD5:	B5CD3546FB5660E318C478AE5702BF40
SHA1:	DB237901029B10313A378683FFDDCB2984295A1D
SHA-256:	C867C08AF648A1D7978CFEC4D19FF22A939BE213684B3E688A2C6B1945533092
SHA-512:	46351689E7B16788DD331FAB0FA22DF47FC781BED8FEE89798B0DA27DCB27959F536B2A7D2F11F281D85AC63B9D63251E03C8E39C34B83F1E87F6C2EBFCD983A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................=...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Algorithms.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46464
Entropy (8bit):	6.164766431431803
Encrypted:	false
SSDEEP:	768:aoBj7kS+8mjvHTeaWKs0Sd4eeaHRKrLy2Ip48TCxf1mltdK3N0:5Pmb9WKs0PeeaHi/9/fI/K3i
MD5:	66281C77E5AB5C7F86A5F917B88E30F7
SHA1:	3DCE110B186BBF31D7BF1C64C94F7D979027206D
SHA-256:	1D209584D163008919CD0BA26146C9591BB91592FA1EBA51B54A3B6213C9FABF
SHA-512:	0624C0A44F2D076FF772F8ED47C559C7AD55D0BCD909CC195819220E1E4549EB93D741C098173BDB0187B69F317AF693855C63E28910616E23450F46FBF3FBC1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ....................................@.................................u...O.......8............x...=........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rI..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r9..p.(....2rm..p.(....2r...p.(....2r...p.(....*2r=..

C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Csp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.028815476254108
Encrypted:	false
SSDEEP:	384:yTI2pWPzW9rjP9Z95Xa/rl9qX2Ip4KTPCjdAA1m5wMt+uKb2MDug246:yE3cHRKrLy2Ip4uPCxf1mltdKbNo
MD5:	DF4B7A795571B55CE86F74A1C08249BC
SHA1:	9C8A478BE482094EB3AD4543E0239635A5F5A581
SHA-256:	496BE8AD65B5EEA31BDEDDC4284990D14988A9DA7CC9B19EEBDEBD034FF53022
SHA-512:	5910A7AEA09BDB2F3D6AFFEE9134ECEDAAEAC182F16E715FDC1FE9E890448DD938DDC9065AD36C7E6D852662FB62A5ACF83834BD125F6AB22F8D944A901AC6F4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ..............................nz....@..................................)..O....@..`................=...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Encoding.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.043203018042703
Encrypted:	false
SSDEEP:	384:ucezoy4W04WoFrjP9Z95Xa/rl9qX2Ip4sQ8TjdAA1m5wMT9YMWuuwCNA5DFpk:uBzoy+KHRKrLy2Ip4sQ8Txf1mlTAwCNP
MD5:	1E2909FF20B8D95495308530A1A13676
SHA1:	3B72EEEE7D42BE66AC3BB7C1E4622A0DE2EE86B6
SHA-256:	C2714DFE9E5C9ABF062FF2F74E4671A7104962BCC707668537927F6290E6D00F
SHA-512:	96C5617BCCA5F39E92174337C3D03637FE56F2572DCDD7BA945CCA441AC5377C1CA87597524D0E52050EAF647BF1AA4ED26EACF1B06B1321C5C89E31DB5EF706
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ..............................p.....@.................................,)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.961404899955368
Encrypted:	false
SSDEEP:	384:JH/JWKpWFrjP9Z95Xa/rl9qX2Ip4xsxTjdAA1m5wMT9YMWuuwUNA5DQITB:JH/jOHRKrLy2Ip4exTxf1mlTAwUN+0M
MD5:	BC8A91C10FD4A5429AC54A015921A4C4
SHA1:	A85B915FFB5104CEBDE7D1D26FD646F09629CC44
SHA-256:	CDDA0D36EEC0BB62393ED72FA43D1BD5C241B2222E052AFDD070007B4B04ABF9
SHA-512:	270D7AD50775FA2FE50DF06C204562E61D323011828B534887F0EB83ED7BA20768B9964205C4121A9EC97F1A4F97C42B9E3BB6222202A308D1CC1BAF0613FB26
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."... ...@....... ....................................@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21648
Entropy (8bit):	6.900106811884281
Encrypted:	false
SSDEEP:	384:sTjbocNsWMhWbrjP9Z95Xa/rl9qX2Ip4uux6CjdAA1m5wM36QNuZLL5:AboYyAHRKrLy2Ip4u46Cxf1ml36QgZH5
MD5:	A471FF1F9125DE39B50573F7803AF769
SHA1:	75F39916F239075C34470A2BB730FFE9DE14438A
SHA-256:	9647FE75BB47364CEA56B78828840E8752482A7D83BB369771681B5E3810387C
SHA-512:	8209F8FFC6DE5830092876360F6A4DC0107EC8748808ABB49FC09DE73B78B5D028A0A26CACF921D85349532160643F0907CFABC8967DF12F55DB861CF75E310F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................k.....@..................................-..O....@...................:...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....x.......#US.\|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Principal.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.9886717572167285
Encrypted:	false
SSDEEP:	384:ISKiWIhW5rjP9Z95Xa/rl9qX2Ip40Z+566CjdAA1m5wM36QNuZLX3:ISK8iHRKrLy2Ip40ZA66Cxf1ml36QgZ7
MD5:	540D04AA9B9CA639DFA78EB6BC11E195
SHA1:	78530FA7D8A68F67145DC2B98604E871AD411228
SHA-256:	C882A29AAB3E323719D129D9E75FB878DB909A3F2AB76D65C5696459B01FE90B
SHA-512:	18DAF10638A899552B80AFEC035EA0BDC03CA65963336896002AC415826C5C1004D5C7617599338DE50F9266D6AC75117C1B8A2606E88A28B3B488C878F176DF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................t(..O....@.. ................:...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Security.SecureString.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.952579369169005
Encrypted:	false
SSDEEP:	384:M0KbZWApWmWTpWNrjP9Z95Xa/rl9qX2Ip4DTnTjdAA1m5wMT9YMWuuwVNA5DyOI4:DKRyiHRKrLy2Ip4DTnTxf1mlTAwVN+uQ
MD5:	C22EFC2F987821406E7F39E6432DBDF5
SHA1:	BC2CD24C4578EE3E7BDBE524D7703583F1D4B70E
SHA-256:	11C03D5D29516D82FCFC512777AE49D9B5594FC48F399CC5198D21C251F8B9D3
SHA-512:	2AAD2733729E58BF4D7A7EFA8B8B5B97ACA49C453C9272CAF7E85474731CB0EA29E8BE04DE47F22CCD3458AAF25FE70D7504C8DE916682941CF14AFB600C056B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ....................................@.................................>)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(......(......(......(....BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.Extensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20104
Entropy (8bit):	7.01078174815367
Encrypted:	false
SSDEEP:	384:xb1nWCXWzrjP9Z95Xa/rl9qX2Ip4yCjdAA1m5wMDBupe:17yHRKrLy2Ip4yCxf1mlD0pe
MD5:	5177EDC078028D8E88FA55A3960328F2
SHA1:	19D84FDFF5B3D1164A7AF7CD53B1DD7A285A3224
SHA-256:	320A063AA8FF50E6684BAEA892F023AF5DD7B4B33B1E3ACEBD5E47DD1F778D97
SHA-512:	F83871D0BE1F5A598A2E9A88DD4FCB648FBA2997DDA981150827F02331929D50BC067F4543A9FD476384919AD3302E0A7858BC2C93181B27CF2D4E73D9B94A2D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................Ky....@..................................(..O....@..T................:...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.933857173145757
Encrypted:	false
SSDEEP:	384:YxyW7TW4rjP9Z95Xa/rl9qX2Ip4HjCjdAA1m5wMDBuS4:+fHHRKrLy2Ip4DCxf1mlD0S4
MD5:	E92883D9D3772678F18EBCACF8DE60C1
SHA1:	E12BB87179A5F5C3E78C8A883C430C9E53A5B464
SHA-256:	7ED94887C9F14C1032147C9EAF993EDF9B5F40532A888A889E1E6A1AF353B842
SHA-512:	8AC6D6D20D2F2CE74E1AF5CA157E381CD4507605C5D0DB92829654CC07A5BB37684609212EF3D7CA7B5D77FDBCD085E0E9E873EFFFE497726B5FB41E94F25910
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2... ...@....... ...................................@..................................)..O....@...................:...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Text.RegularExpressions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.043584942077097
Encrypted:	false
SSDEEP:	384:fd6Rb32WVzW5rjP9Z95Xa/rl9qX2Ip43chTjdAA1m5wMT9YMWuuwmNA5Dk:fERb3dkHRKrLy2Ip43chTxf1mlTAwmNp
MD5:	A9822B47A1E850BF593CB61B4B0DA6A5
SHA1:	443308B64C9BD1B24DEF286F5D118B5D4D46A59F
SHA-256:	0E276865A2877403DD7C8DF94F9AA7CA15A5EE49A3FC7A9A866B9CAB7E1198F8
SHA-512:	930D3CC22411665E36A789000A5F45679E1E9CD5D9BC07863DFE777C7A7A9CF36932AF79D8FFFDB2A01C2EC3B2F609EDA6D3AD96EEEF0684B3C1AA399638BB42
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................t)..O....@..P................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Overlapped.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36496
Entropy (8bit):	6.692065690331391
Encrypted:	false
SSDEEP:	768:ou5I+sqOylryry8qqIfUc7a5AHRKrLy2Ip4d6Cxf1ml36QgZx:oYIVBpry8qqIfUcm5AHi/9xfI5g
MD5:	928FFE2B02C8C07B69B235D52C179EB1
SHA1:	766DDE57768588CCAA43602E57B0F46E1608AB82
SHA-256:	71C1DD3E2683D124B65237376FB4DF2D6FFD85079038FAAB827C281DA69A6D69
SHA-512:	2E2EAA3AD7F167E6E412DC9AC04B49409FA4F297710DC4A1CF9BAC152C7561CCC31D99E0DDFF5CA423298F0A69F0D59F55B6AF34251D7279F910BC179DDF99F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ...................................@..................................c..O.......x............T...:...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rK..p.(....2ry..p.(....2r...p.(....2r...p.(....2rc..p.(..........(......0..;........\|....(......./......(....o....s

C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.Parallel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20880
Entropy (8bit):	7.0167424902341216
Encrypted:	false
SSDEEP:	384:xvn4HREpWiQWdrjP9Z95Xa/rl9qX2Ip4TFqjdAA1m5wMcJcouCPiK0z:uShHRKrLy2Ip4xqxf1mlcJqCPm
MD5:	0F8E8070A4B0B55480AB85A85EB22B9D
SHA1:	B60E58FD0ECED6BFDB7CF2441EAE88EE6A6FAEAB
SHA-256:	E72C6D3A7E9E23C0D6332AA4CDB8140E127A7913484E8FFB6CCD384491BC51D9
SHA-512:	903731D067496952B5582A5839491B36C90A9BB21E50BB70130288D4AFB50628A1A0D4AB9DAE7F0121E9A14C923A4D98B4B02E31E0985BA85A0042983853F879
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..P................=...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Tasks.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21136
Entropy (8bit):	6.925388301948598
Encrypted:	false
SSDEEP:	384:M8MjKb47T3UCcqFMkJ59WdtWhrjP9Z95Xa/rl9qX2Ip4PJCDCjdAA1m5wMDBu/:9MjKb4vcGdOmHRKrLy2Ip4PyCxf1mlD+
MD5:	B09E7D715D06FEBF8F0731AF593B2151
SHA1:	16966B4503352D387EECDBD358CB77ABF55960B9
SHA-256:	767041162E62EB43DEAAB00F6D4E79890C15D7D3B2150CABD48948B51D0D37EF
SHA-512:	CC60BA9571F1BC3EF4604C15864A6A27EC87DA519E0F636CF9B21F1200E0D06D84A76331196EAABBC5BFCCBC43E8BFCA8FCC31105639C0E849CD94C0AD9C38F4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ...................................@.................................`,..O....@...................:...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Thread.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.001945686038119
Encrypted:	false
SSDEEP:	384:fzyNXd4+BW6FWbrjP9Z95Xa/rl9qX2Ip4j93MCjdAA1m5wMDBuh:ezMHRKrLy2Ip4qCxf1mlD0
MD5:	209FFB98068B9A091F03DE3EA4A02A83
SHA1:	CB7DD764550163D9F8D156CF9565CC1071CF05DA
SHA-256:	5961BFBC94256103198F867E0F0A22A2EA2039B572F81FE8B75168DD7225EBBD
SHA-512:	4FBB9DF6CA43D582B18E28F8F0C10C1189E59FDFB18F87FEE24E49E8BA446AFEDE56F409F9A49B09A7C127CE54051384F8335217E2844B3A9108AAD9CF20C472
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................I....@..................................(..O....@...................:...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.ThreadPool.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.012131761847572
Encrypted:	false
SSDEEP:	384:pvs2Q3HKJNrWWRWErjP9Z95Xa/rl9qX2Ip4Jy714TjdAA1m5wMBq5ul09vfh+JVI:puMRHRKrLy2Ip4JI4Txf1mlBqsqv5
MD5:	A32EADC37E0A1ED37FEC41FC2E045CFD
SHA1:	4BA3FFE3A6FA3DA342CE83F5AEF5CBAC86D2311E
SHA-256:	2039B9EC93FA1251E5DA3E1A2B96B8F3450B01C44413EEFBDD4BC455274FE354
SHA-512:	5F158EE1C682E0670CCAF2A7FC44693492A9D2A46A73E5BADCA3B2999F19B08F89C8CD210E3C0665FFFDB1527ECF2D125FB4CC07F9B6BA34BDC9CD1EACA50B51
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................p.....@..................................(..O....@..4................>...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.Timer.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.9924618472479105
Encrypted:	false
SSDEEP:	384:xFz0Q6gcqRhcsMWdMWDrjP9Z95Xa/rl9qX2Ip4/bVTjdAA1m5wMT9YMWuuwmNA5k:xFz1c6THRKrLy2Ip4DVTxf1mlTAwmN+k
MD5:	3A428C73A353ED7509FBFB4942604D72
SHA1:	D807D591C8257C0FC1EC8F4FAFD403447A164C22
SHA-256:	74CF34024678952427D238FBF286E1D3A53C81E4ED3F8FBB6651356A3D1A8D01
SHA-512:	4D0E9F3E7C11727260AD2628CC42274698474E45EF2AD63FF98938E90230F4ABBD3BF4A95A647443A24CFB63377FB6EB69F1A06F7E832FD36EDDB49079AE2845
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................L(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Threading.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.912168734049125
Encrypted:	false
SSDEEP:	384:z6xWA3W4aW/NWUrjP9Z95Xa/rl9qX2Ip4bTjdAA1m5wMQhKuVd4m5vZqIcNOE:zaBJHRKrLy2Ip4bTxf1mlQh5Vd4m5ExT
MD5:	DA0A017A7B27E4E070FC451B78509F12
SHA1:	770C7BBDD3579F4C0C4A7E0747A2CCC0C3F5F740
SHA-256:	7DC2B072A5431B0CBF5F7DF8B19E0A4CAFC43ACDDD3EBA0F8E77D3B87161FC6A
SHA-512:	49AE7C5849A2ED81A32FDD06DCCC78556AA2F695BDD4062F9C090330C49B0698178B68B5DF1268280A3C5D7DC158E3FCABB3C2F7A7D64B4EAE0747B217BADAB0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ....................................@..................................+..O....@...................>...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .............................................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.ValueTuple.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	6.068451904343695
Encrypted:	false
SSDEEP:	1536:QIumja0tbe16pSc45EfL+4vD4SuJbhjXuE3FMqF1KAy4kHo05ureseh79xHi/96m:QIuAaGbeGq5rKASI0ICh9fG/
MD5:	497DBE1C655A103B64BF60DD1B9742DA
SHA1:	739CAA4AA085FE23B4CFD24CCFF12D9578EDEB5A
SHA-256:	C80225BBCF11FBF421DE9169191C2316C96B9E5858C0B2749C53EEEA8993148E
SHA-512:	093C06FB355BC5CD8148332689C183F80732960D88647D0A75E3CEE234A2B83C55235F100D23748B8BA6748736DEC5D8A465593642EB92EDE4EC1F214EC84A84
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............~.... ... ....... .......................`......Ja....@.................................,...O.... ..x................>...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...x.... ......................@..@.reloc.......@......................@..B................`.......H.......................d.......t.......................................6..o.........f..o...........o............o...........o...........o............o...........o...........o ...........o!...........o"..........o#..........o$...........o%...........o&............0..L.........o'..........o(..........o)...........o...........o+...........o,.........0..Y.........o-..........o...........o/...........o0...........o1...........o2...........o3.... .......0..k.........o4....

C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.ReaderWriter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21400
Entropy (8bit):	6.994018550233344
Encrypted:	false
SSDEEP:	384:2r97WquWzrjP9Z95Xa/rl9qX2Ip4o9mqjdAA1m5wMRv3cquhqjlLBd:2RJBHRKrLy2Ip4Hqxf1mlRv3cZhqj
MD5:	E2143D1AA04BCC81A1079CC3D502C85F
SHA1:	60D8889978337C74D9CDB209EC50DFFC79796C68
SHA-256:	AB28A9025F8537F3ADC4673F5D9DA769C688AD14DBBFF9C2022B99264C360A05
SHA-512:	0FAC48EA0651D638416019540EAE37C349C4DB25BB2075C13C855B60A4524DC51E001B23A0559ED56CCC81FED9141E4FB6D8E5AEFD1D00DEB9EBA29AC3567FDC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... .............................../....@.................................\+..O....@...................=...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XDocument.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.966463595778793
Encrypted:	false
SSDEEP:	384:J16eWLDWxrjP9Z95Xa/rl9qX2Ip4XTjdAA1m5wMBq5ul04vfh+Yg2:L6LgHRKrLy2Ip4XTxf1mlBqs3v7L
MD5:	6A2A6B51A7FA9D5D06FA735E70E40BF0
SHA1:	C5BE68952FE78208F1A8E306A556E96C4B190C93
SHA-256:	A08770C6344602101FC611FED68F71579FD06CB7823ED8FEEBC511B1D1AE4150
SHA-512:	C341134693BCAF3F13979AA5DE59508ED64E1AA3674572FEAD41E20320BCA8FFFC27BED3EA1874AB898E540B5CFCE016DDD1A3B520A55D3E16A7EBCAE65F1AF6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0................. ...@....... ....................................@.................................\|..O....@...................>...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.XDocument.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.952372708304721
Encrypted:	false
SSDEEP:	384:D8G4YC2W+wW8WpwWJrjP9Z95Xa/rl9qX2Ip43dTjdAA1m5wMBq5ul01vfh+Z92:gGZ5JHRKrLy2Ip43dTxf1mlBqsOv8Q
MD5:	CD4894F1E77B8A9EDEDF5CD9775001CD
SHA1:	B3CE1EA8BD191F5CC34512D832A3A2D9EDB51811
SHA-256:	E9BC548E0052F85BD3D2E640987905404E2FE27F8A31D90648192937A4E9E4D1
SHA-512:	A5D8B5E9B66F3967C2192180938658B44CAA29B4D83E84D39B104A8DE8951B922A545712BAD0265E607E5EBBEDDD09A7FA837E13A893592FC370C25FEE604189
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ..............................k.....@.................................z+..O....@..x................>...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P........................................s....:.(......}....2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XPath.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.0376762989157
Encrypted:	false
SSDEEP:	384:D6ziqTEkGWvRWZrjP9Z95Xa/rl9qX2Ip48JETjdAA1m5wMQhKuVdAm5vZczsoJ:DYT1eHRKrLy2Ip48WTxf1mlQh5VdAm5E
MD5:	00BBE6D832B673963EE8BC6404CBB1DB
SHA1:	05E1CBBF4D9774EF62A61BAB601F2EDA1E72DA0F
SHA-256:	3BF178AA6FDC46926C574D3F307B30EBE87D4481C7400EF527E1BD0D4DF7DF91
SHA-512:	4C20639B211264009A83BE85D28CDF21A553DB3E2BFDE04EB716C9C1C082D37E23E95E197BFF0C0019429A44C22997CC6AAC44A72D4371D2E82BD6A56B1FE176
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................TJ....@..................................)..O....@...................>...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlDocument.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.975166502138063
Encrypted:	false
SSDEEP:	384:0Uv7c7iWNCWjrjP9Z95Xa/rl9qX2Ip4TTjdAA1m5wMAvru4LTXZIjNJ:0M7c1tHRKrLy2Ip4TTxf1mlA6KZ8
MD5:	2F66F0F5AD5EF1F67F0D6096BF10A553
SHA1:	8AE3D7E780EC9177073D618F28D5DE7A1211CFE0
SHA-256:	FD46E5FA1C263C127BF8386A53D457A2E1619AD15A79EC0DB6CC956D5925CDD0
SHA-512:	26E0788910E6417919306F47C3A1590177A3F0403EE28EC869280D94B8839A2EE1401C41EEBA33555405C99ECE686785337BBB3EDC73F8D34E703F5F9D079806
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0................. ...@....... ....................................@....................................O....@...................>...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\EDR\System.Xml.XmlSerializer.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21392
Entropy (8bit):	6.998832177906868
Encrypted:	false
SSDEEP:	384:iSWnRWLrjP9Z95Xa/rl9qX2Ip4EeqjdAA1m5wMRv3cquhWjlLo:izcHRKrLy2Ip4xqxf1mlRv3cZhWjW
MD5:	BEC0755730B206089B82B42109DC0A6A
SHA1:	57FB2797D73991F48A5ED1211BED5B7AECE85803
SHA-256:	071AC56D8E9A64A1C1E32DCD0880C5E328BE47050DE776323BEF6F70FA0AC487
SHA-512:	936F3DDA594D4421A61B12C58C4A0AAF4FAC3A9EF8DA7131FBF763461D5C74C991DEED5A2F21063B40A6978CDF72D470604D95D421EF1AF38185C80FEB74633C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ..............................%.....@.................................L+..O....@..$................=...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EPP\EDR\TraceReloggerLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	6.947773246140973
Encrypted:	false
SSDEEP:	384:aoMeAKyr1jSC6rrjP9Z95Xa/rl9qX2Ip4STjdAA1m5wMBq5ul0Rvfh+q:aoMbKK1OBpHRKrLy2Ip4STxf1mlBqs+f
MD5:	4CD2BE5105CD5E9AF7D4BFFF40F99B6F
SHA1:	B0B83308D8007A7B1FD9EFB4D28373B532C713A2
SHA-256:	2A9D8653F09B4FBA3A39E03FECB6C2D1747813D8051C0F9060EE81B62C082DAF
SHA-512:	329CB6AEBA3DFAB79806075D0C1255CD53EA8A2D8566F2E3A16ECC3C04D3301702485D292DE30E3D262A282E64B00CE56950A13AEBB3CDB7AFC8F906E4881F88
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.NZ...........!.................2... ...@....@.. ...............................~....@..................................1..S....@...................>...`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H........ ......................P .......................................t..Ar..(9...8.7.Y*(...x.R.[#.e..3.A.8]...a?..o...W..%...,U.8Rn...^..?N ...0....f..X...G.P..Z.X.....ih.Du.UPxSh.............BSJB............v4.0.30319......l...h...#~......d...#Strings....8.......#US.@.......#GUID...P.......#Blob...........W.........%3................)..."...'.........................................p.........).....L.....d.....r............................................... .....5...

C:\Program Files\ReasonLabs\EPP\EDR\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	96000
Entropy (8bit):	6.9811464858641346
Encrypted:	false
SSDEEP:	1536:OsuNLvSFVVeozLpPu0jgbWjjWcJorX/wC/wPqaWVxEdHi/9NfIc30fP:O1NjcVVnLpPun8jvqPw5fXPH
MD5:	5D58234A8024444C73B39CEBB62BD3BD
SHA1:	0667616E58B31F72FE95EA59B6092D68B747B014
SHA-256:	400C678A095C17DE027DD6A878267A23CD14BF7428FA9CEF106B9E846FFCA346
SHA-512:	2DBEEB5628EDAA3C7BC2D0104B07CE16E39FE27027E823C4F645A603C447C4D67CCC4EF43DE4CA28D946BEAF18B9FC96666464F58694E17CD6969AF7D91498C4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L....Oa.................f...*.......4............@..........................p............@..............................................m...........9...>...........................................................................................text....e.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...P...............................rsrc....m.......n..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\EDR\amd64\KernelTraceControl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	234496
Entropy (8bit):	6.308803769130203
Encrypted:	false
SSDEEP:	3072:+X5gE72vcK8s7pTxEl7Onygi9wDO4z4WSYB0JuPrOAjT//P2jVFU10xNA:+XX20y7HNz14RU0J/AL2bUqA
MD5:	BF3E4DEEBA78482CF19018DD55751642
SHA1:	9166B4449953624995004544326CBDACDE285E77
SHA-256:	E172168748E0A2E7B2582F3E941E7262A366D8B292B6C2FDA3B6ABDA3DF1A455
SHA-512:	D012A20926A6EE5DD54227CEA9EA0E51CF2A40DFCDC4146E99482A8747E18BAFD615C4CCC72373A47D050062CAF5EC7744BC174EF0DEE104E329AF631F3702D2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>..jz..9z..9z..9.$b9y..9.$a9w..9z..9...9.$\|9i..9.$}9{..9.$d9l..9.$`9\|..9.$~9{..9.$c9{..9Richz..9........................PE..d....S.V.........." .....l...........H....................................................`A........................................ %.......%...............P.......V...>..........p...8........................... ........................$..@....................text...5k.......l.................. ..`.rdata...............p..............@..@.data........@.......*..............@....pdata.......P.......,..............@..@.didat.......p.......J..............@....rsrc................L..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\EDR\amd64\msdia140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1692048
Entropy (8bit):	6.326801866800496
Encrypted:	false
SSDEEP:	24576:x+8Gg7kWyJnk8kvXfX+WquRLvbKG5pkKMV2Dzbcn3P88/UTlXe:x+bWE+TvTRLv/y2DzbcnU8/UTw
MD5:	B0B902CF5B6F147211370A7BC97765B4
SHA1:	1993129A785CB3C99F80A948D2FA75DA454D4E85
SHA-256:	9418B43B8F26DEF716E15EC9138C49AE4DF08306F9D1FF4C65455F2A729715EF
SHA-512:	E556BFD25A6B6AB9E1FFEA82CB5D4813B4BFE8CF90C77EC154D6295AD257625FE431A303185F3CAC5271583881F500869478CD6AD6268D938C9F35ACEE7B4E69
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..si..si..si.3.i..siS.rh..si..wh..si..ph..si..vh..siS.wh..siS.ph..siS.vh.si.3.i..si..ri".siS.{h..siS.sh..siS.i..siS.qh..siRich..si........PE..d....8.^.........." .................b.......................................0......}.....`A....................................................<.......x................=.......H......8...............................0...............p............................text...~........................... ..`.rdata..\...........................@..@.data...(........b..................@....pdata...............,..............@..@.didat...............8..............@..._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc...H.......J...J..............@..B................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\EDR\amd64\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	589824
Entropy (8bit):	6.46320033169136
Encrypted:	false
SSDEEP:	12288:ut8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3HC:uCMm9pyp35bQEKZm+jWodEExi
MD5:	6BA8C51379494D612E4EF69550A6CE8C
SHA1:	2D642A9FA5C9435E43D009C8734E0FDE44327C29
SHA-256:	F832E41CC246B1037289D731804D2207837E8B8D0385F357B1A7592E94308932
SHA-512:	2426DD48264F6C0189C5A840B6F11DC877C9096472A50C267EF52125A39011DA8D4D755572CCC71B77D6701359A7364C95BB3473E2BE49C2FA32EA861E81A389
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..............w.(...#...<........../.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;.......>......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	99984
Entropy (8bit):	6.5538732748545305
Encrypted:	false
SSDEEP:	1536:Xy6+2mUD0uBFRXqYue/o+18iBH5T7heunxr98nZXR9xecbSQ2bnHi/9vfII:XlXfRXqQw+PHLrCZh9xecbStV
MD5:	6430909108F315614AB8C02265ECF041
SHA1:	7BD0CF29CB2D17E730170F8264CCAF90ECB662D4
SHA-256:	27DD79BD367559A0DE592D33B015F7204A9C4483192BFAACDEC9DE07BF460FF2
SHA-512:	A1313FB85EC019AADF1BB449FA333B998D1813D54A037CAC06F9CC37A50F6C70D8F41B434AFCD51A7B97BAC43C7F291DE5111C2D787352207A6160D4FF9234BF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!/.NeNl.eNl.eNl....gNl.l6..nNl.eNm.INl..>o.hNl..>h.uNl..>i.zNl..>l.dNl..>..dNl..>n.dNl.RicheNl.................PE..d...M8.^.........." .........^...... ................................................P....`A........................................`1..4....9.......p.......P.......L...:..........H...T...............................0............................................text...b........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\EDR\amd64\vcruntime140_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	6.64690620367382
Encrypted:	false
SSDEEP:	768:8JnUUV7xPg4RdPvv1DHkhh+JHRKrLy2Ip4eTxf1mlA6qZe:8aY7XN7I+JHi/9+fInqM
MD5:	3382104CEE2BE75491991D2631EC056A
SHA1:	8DC3AF340121BBFDC69CA2E04388CBD1E37DB5EC
SHA-256:	40147F671339275AAF711388EEEB5F8F313864DEE717E099116085A57286CAA4
SHA-512:	EE613917FF5CD539E4B1526BE1CF48A6C478F0D72291865CC1167AA508DCAF017EE22226C1494D69CCD3513E9F4761C345BE8C5DAAE6B40B1C79CDC71D450C64
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..j...j...j....l.h....y..h...cq..a...j...[....y..o....y..m....y..p....y..k....y\|.k....y..k...Richj...................PE..d...Q8.^.........." .....:...4......pA....................................................`A........................................Pk.......k..x....................l...>......8...(b..T............................b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97424
Entropy (8bit):	5.617357157968208
Encrypted:	false
SSDEEP:	1536:x2Ec05j4eAH64rh5fSt5T9nFcI94W0Hi/9efII:glK4eA7mDmWJ
MD5:	D316F297D51844DB28FC96A847ACC05B
SHA1:	2A046FC6DEFE22033A76F2F6B18112738CBDD5C4
SHA-256:	057FF7A5BBDAA0BDD437D68FC9E0534CD0DFB42EB70DFE87AB864DC8EDB086A9
SHA-512:	C1DAC8920B7DB1B6AA13639DB223C4AA02594F7EB57810891C615B850A3C8CA4ADD9C5BF64B8AA8C28EE1528B3018945C72F850305BA8223577EAB498AF5E1ED
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\ReasonLabs\EPP\EDR\netstandard.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ...............................u....@..................................U..O....`..,............B...:........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	177152
Entropy (8bit):	6.55862728173861
Encrypted:	false
SSDEEP:	3072:oSHreWE0uOeOyqN8ROsKQsN3gVTAg3mZtrOYDf1gwBvDO:fLeWEPOyqNnys+K1trOOSx
MD5:	27C1AC30C9AE3BD7665FB4648AC2648E
SHA1:	B07C7A939CA2ED27F3491835CEC2B5F4BAC9B25E
SHA-256:	86D05E66E4AC5DBC46BA6270E8A57B5D12E2E31D58A4ECE1BA95F3F381F6CCBF
SHA-512:	BD21AFE8BD5243934DF9CF0B04310DBFAB100F76AD17EEF7CA39D2D3C6FDCD9D071BEDBC947C52FD58457F1460715BE65E44B5D441864E2C82BBCF3B84D2C5CD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsAtom.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#.............!..0..l..........>.... ........@.. ....................................`.....................................K.......T............v...>........................................................... ............... ..H............text...Dj... ...l.................. ..`.rsrc...T............n..............@..@.reloc...............t..............@..B................ .......H.......Hi..l................~..&........................................(....(....:+.(Ar.[.(..................................0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................HP.z.....0.............B(....(....(..............................................................................0..............0.............Ad......G.......Y...

C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1648784
Entropy (8bit):	7.665089270086584
Encrypted:	false
SSDEEP:	24576:YHRJ4hTCfcsbCQUVu1B/NwOBsG/F7vL6E7wFGk3OwdKZa1zBwSUnn3KNEIq5ZXta:E+TbsbGVWvBB/ROEA3FIUninM1q5
MD5:	3E7DD0248ABCB1B24AB54ED6E09E15FE
SHA1:	3513AE79BADEE569D8C6E0B459851C60FEA08F27
SHA-256:	765F56F16FA3E15069DD882A59BFD755CA14B123A287E0841596D3EC371AFFC5
SHA-512:	07816CAA3E2E62F10D40462B373D06567F8C012999D145BC0815A0DB3FE460F023EBBAC5254EE71073FDE5680BF721EDC75A9343B1105C00F4B31B3C991D0253
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEDRLib.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...j.............. ..0.................. ....@...... .......................@............`...@......@............... ............................... ...................:..........^................................................................ ..H............text........ ...................... ..`.rsrc........ ......................@..@........................................H.......................B...............................................(....(....:+.(...P.(......0.............AL..........K.......@...........8...t.......;...............T.......................0.............AL..........I.......;...............z...4...;...........f.../................0.............AL......p...F.......^...................I...;...............Y.......................0.............AL......l...D.......;.......................;...........2...9...k............0..

C:\Program Files\ReasonLabs\EPP\EDR\rsEDRSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	163328
Entropy (8bit):	6.264821948719024
Encrypted:	false
SSDEEP:	3072:qeD9b8uzpNi8br556FpwsdxcNfBBFaS8o92WnTbEZBtQ3rvXeX:qeD184NijpTsNfBBF392WcBQC
MD5:	6B03DAEF1CAA676A0BC6E13B4BC8F89B
SHA1:	3985879BA05C56C0FA1839B569EA4643731A052C
SHA-256:	DF2B1F19DBCF4E1787AD625AE73D844B129D126661861971F8E13E794646906A
SHA-512:	741517162EC051D199CD69ED768D6FFE48C75ADBE1CCC06BE1272FE4C6A2C45B64414E84673B036B2BB85CF7B49175107AA03627ED216CDD2E79D47027A73166
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...a.\|...............0..6............... ....@...... ....................................`...@......@............... ...............................`...............@...>...........U............................................................... ..H............text....5... ...6.................. ..`.rsrc........`.......8..............@..@........................................H.......................(....:..+U.......................................(....(....:+.(vlpI.(......0.....................GU.J.....0.....................LZ.E.....0...................K..f.............J.....0..............................0..............(....(..............................................................................*....0..........+.(X...8........E........8....(....8.....(...........s....o.... 3...8........E6......."...................3.............

C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	334336
Entropy (8bit):	7.162095871589973
Encrypted:	false
SSDEEP:	6144:UUkuU/9vnxhTmdaXlumDgLhhgV+AhV30ZwI+3U:tg9vn+dSBDahgEADu/
MD5:	C2538DD971AA2D4F2E863695FB4C585E
SHA1:	46B1814C5155DD5148DE7EB06D58B7AE2E5CD6AD
SHA-256:	D1781B732CDE702764A8007F76EE8CA0B464C4F4EA30A6E0C67AB562C9F509DC
SHA-512:	8587B2141F8A14235B9058EEA876A4202152AC79505B68C5CCEDF21265EC86CF732E769365F4CAE95E9C8B31C49DBCD48D302A8D2D1928E69B78D9B07866DA1C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Core.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...npA............!..0.............N.... ........@.. .......................@......p.....`.....................................K.......h................>... ....................................................... ............... ..H............text...T.... ...................... ..`.rsrc...h...........................@..@.reloc....... ......................@..B................0.......H............/..............'...4........................................(....(.....0.............AL..........K..._...;...................,...;...........]...V.......................0.............AL..........I.../...;...............j.......@...........8.......W............0.............AL..........K...g...;...............p...%...Y...........;...b.......................0.............*AL......Y...D.......c...................f...@...........d...L................0..........

C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.JSON.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	6.18944717645377
Encrypted:	false
SSDEEP:	1536:f2DD4JcSb+rfzHr+fWPu0yHHFx9EqJvhSYNBcFFlngCTltxeR8LmsvDiHi/9nfIt:QP++X9W0gFx9B9N+FFhgCThLms7knt
MD5:	747A3CBD0A2B77BE3CF507BCD4DF1BDA
SHA1:	565EC03E0DC06B00C09E3890ADACA584871EB180
SHA-256:	263BC382848CBAE80BD641AA0654A23971E2887E07BC1D6F4182DAFF84C501C0
SHA-512:	661C6CD0CD4290C2D27669291A9CCD746C6E57A90CC753BE06DD9D55012F16119CEBE0E7D24352400FC21E5626D41AF79ABBC92A72245EA1AB5E6F3C368C31FA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.JSON.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....2............!..0.................. ........@.. .......................@............`.................................@...K.......h................>... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...h...........................@..@.reloc....... ......................@..B................p.......H........_...o..........d....%..q........................................(g...(....:+.(8L`@.(]......................................................0............................0..............................0...................................................0.....................0.....................1E.......0...................&.Sy......B(g...( ...(!................................................................................*...B(g...(]

C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	146432
Entropy (8bit):	6.2745753496402985
Encrypted:	false
SSDEEP:	3072:qmFLQiVm1Ie2cDQHOhsK21h8iFT9Z6avH6SCZlmm:zQwm1IeSHOeKmmOC5
MD5:	2487994259AE9E8166F22FE39790C671
SHA1:	09E1D13605AACCFC0F6EF3858AA53AE0135746B6
SHA-256:	4AD77036EEFF9E015C1E6FE1886A465845ADDBDB56AAF5ADAC238AD1CCB91AD3
SHA-512:	9A1C3D6A94C954C093547134F621ED69C897C08E3305409FDF3FB17ADC960A17EC03066005AAB16ECDA7F89A55B31FD1006EFA54E5C8C59375BEF05639937F59
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Loggers.Application.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.I............!..0.................. ... ....@.. .......................`...........`.................................`...K.... ...................>...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pc...w..........$...q5...........................................(q...(....:+.(..d>.(g.....0..............0.....................g..;.....0..............................0..............................0..............................0.....................*.......0..............................0............................0..............................0............................0..............................0.............*........ff.......0..........

C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2261504
Entropy (8bit):	7.596639757213537
Encrypted:	false
SSDEEP:	49152:wdm0hCMOJwV1isz+0DxhCHPpdiiobYCI8:w45HWgszsKQ8
MD5:	0E5519F6202594F1990CC0F623B43DEC
SHA1:	7845F116F5AA74F89A2AB1A9C0AE746E54250FAA
SHA-256:	6793F731558A2123E8031E511E9FCF680FB391604383E78C6FB29F132E0E75A0
SHA-512:	09139A5EE60309483219EEFA0C7C18659ACF7002B27993B5172BE19AABD7CE51013348AAEC2971F42C84517312A5BD3E318D94784C069AFDAFDFB19ABA088200
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..:"..........X".. ...`"...@.. ........................"......."...`..................................X".K....`"..............D"..>...."....._X".............................................. ............... ..H............text....9".. ...:"................. ..`.rsrc........`"......<".............@..@.reloc........"......B".............@..B.................X".....H........L...h..............Jg...W"......................................(....(.....0.............AL......_...K.......@................... ...@...........]...V.......................0.............AL..........D...-...;...............j.......;...........8.......W............0.............AL..........K...Z...;...............p.......@...........[...P.......................0.............*AL..........D...X...Y.......................;...........h...m................0..........

C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	222208
Entropy (8bit):	6.786565578522807
Encrypted:	false
SSDEEP:	3072:qT4Ahf0UCXbEb89D4KT+/vi+55uHr3Yv+rDi8TV5l1mVb3OFZj:qTfLsbEKDY/3K3YkzTV5lkK/
MD5:	C6F7D6A83C38E3BA04C8CEA017B5BF56
SHA1:	4447ED64AD603FC438B9D2C67DC9DA6D33D01E3A
SHA-256:	69F0E9B57759CB06D79F6121311E768A87BEA1972344D7FBB6852B48D9FBCFE4
SHA-512:	3CA8067CA1E1F969B389E0EAC6D88CB1E8489E32CDBDCD778D8415DA58EBC15961D5A2878C4E8CC4F0BD84B7D2692CBD0D794D37FE6CFE8CE8BDFD0F7C7C31C2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\EDR\rsJSON.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...uM.............!..0.............N;... ...@....@.. ....................................`..................................;..K....@..D............&...>...`.......:............................................... ............... ..H............text...T.... ...................... ..`.rsrc...D....@......................@..@.reloc.......`.......$..............@..B................0;......H........~...............S......7:.......................................(....(.....0.............A...........)...1...:........0.............B(....(....(................................................................................................................................................................................0.....................0............................0..............................0.............*....................

C:\Program Files\ReasonLabs\EPP\EDR\x64\SQLite.Interop.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1647616
Entropy (8bit):	6.5512299586037255
Encrypted:	false
SSDEEP:	49152:IKBZFqX8TvXzlaPmAA6rKmEOwksSf0WB2:IK3/z0hY
MD5:	221FB15A1D7C97DE76335176E6E44203
SHA1:	D73D7308497BC30471BD3ACA93868C7BAB9FF9DC
SHA-256:	BD91F6FD71B802815D563065AC0B43527D4CDF726E9BCCF98C52338A8067E181
SHA-512:	0B0AFF2B0B1D03C9006C8E2C06BB0F46F4CFE9FD003BE1744CA1ADFE8FB0357BA86A2E3D17476166BE31C5BD9B70CF975CC31A2745956A8D50D8D083516FAE7C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..7...d...d...d.i.d...d.i.d...d.i.d(..d0..e...d0..e...d0..e...d..=d...d...d...d...e...d...e...d...d...d...e...dRich...d........PE..d....<.].........." .........J...............................................@............`..........................................V..X1......<.......<................>... ..$.......p............................................................................text............................... ..`.rdata..............................@..@.data....L.......6..................@....pdata..............................@..@.gfids..............................@..@.rsrc...<...........................@..@.reloc..$.... ......................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\InstallUtil.InstallLog

Download File

Process:	C:\Program Files\ReasonLabs\EPP\rsWSC.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1253
Entropy (8bit):	4.713861705385405
Encrypted:	false
SSDEEP:	24:Us43XVolmMY3ipNVeolmMYYNXpsgOhPs43XVo8mMYsipNVeo8mMYLNXpsgOhn:unV/t6e/85qnVgW6egT5c
MD5:	EC71480B0C9D97299779B9E2C9DF9EA4
SHA1:	0F751CE93B81D37C8C1E4685C603BCDF861CE95C
SHA-256:	B0F6C6CDECFEF54CFE75AF1EC9D1EBA67571B60350D3584301F9CE6523B55212
SHA-512:	FBA232399801551EB289849FD34C3D0C5970B37E3D2E346E8B7E179A522A37B08B96374DED76CDB563A93AA6B3862D56922D4534F6E0DFE5E580F6EA9245084D
Malicious:	false
Reputation:	unknown
Preview:	...Running a transacted installation.....Beginning the Install phase of the installation...See the contents of the log file for the C:\Program Files\ReasonLabs\EPP\rsWSC.exe assembly's progress...The file is located at C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog.....The Install phase completed successfully, and the Commit phase is beginning...See the contents of the log file for the C:\Program Files\ReasonLabs\EPP\rsWSC.exe assembly's progress...The file is located at C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog.....The Commit phase completed successfully.....The transacted install has completed.....Running a transacted installation.....Beginning the Install phase of the installation...See the contents of the log file for the C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe assembly's progress...The file is located at C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog.....The Install phase completed successfully, and the Commit phase is beginning...See the contents of the

C:\Program Files\ReasonLabs\EPP\InstallerLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.319695730516836
Encrypted:	false
SSDEEP:	6144:Bc4hrbRETiqEVVtrSiitN4J4RVk87Uo0zEWEpnSAJVGN937taTVD7zsih7Kn9s0T:uMnqEVtmLtRRVB7UoQI80zsihmn9dZ
MD5:	135353974CBEBF94B8BC48D682F8F5D8
SHA1:	0D8911EFA7759516FC80961EC42ED6E15764CEB8
SHA-256:	3DA6DB19E909805066BB41B1674B76B9B1946E99AEFDEE3EF96A0EE73B9914C1
SHA-512:	1896E77B05162F9624ECC2139866186260B1ADFB6A1918F04F9696DDE2E7B5B4C2FB64533C20ABC44EA0BC42AFED692381CFF956A458B1FB420E5B490F26F998
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\InstallerLib.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....yY............!..0.............N.... ... ....@.. .......................`......Fm....`.....................................K.... ..\|................>...@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc...\|.... ......................@....reloc.......@......................@..B................0.......H........,.. 4...........`..Z...3..........................................B(w...(....(.........(l.....(........*..................{J...9......(.... .H.. ....a~D...{#...a(q...(....~....%:....&~......B...s....%.....(...+....(....9).....(.... 4K.V ..54a~D...{-...a(q...(....... .... ..va .U8Ca~D...{<...a(q.....(......r...p..s....o......(.... .M_. .t_.a~D...{7...a(q...(.......(.... .. i..VY 9..Aa~D...{....a(q...(.......(.... .q{.e ...^a~D...{c...a(q...(...... ...ze ...a~D

C:\Program Files\ReasonLabs\EPP\Microsoft.Bcl.HashCode.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	6.760851730168963
Encrypted:	false
SSDEEP:	768:4v6lknrJ93rkPKCHRKrLy2Ip4ZxTxf1mlA6AZr:9m33lCHi/9ZjfInAh
MD5:	ACB3B8B030A178D204A6C32414CB16F0
SHA1:	C7D1703BE7C2B6F0F327A4353C08285E3171567C
SHA-256:	19A884B8D348DBE3D90816052193A24D83B01FB1BD5D6540FC25EF1CC6993A8E
SHA-512:	6F7C05555319F3EC1C97DD4A7BDE0F6A42B992386BD8B717CEEA2A911F816DF70E5FC4B8873AB93D74A1D1D38AC7708B3D067D37BEE40F5AEA4C29A44E65A97E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...E.&..........." ..0..............M... ...`....... ...............................+....`.................................jM..O....`...............8...>...........L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................M......H........,..\|...........0J......HL........................................(....^.(.......!...%...}....:.(......}....:.(......}....:.(......}........0..6.......(....-.(.......!......o.......(.....(.......,..o................+........(.....0..............(.......0..4.............-..+.........o.....(.......X...(......(.......0..U.............-..+.........o...........-..+.........o.....(.......X...(.......(......(..........0..w.............-..+.........o...........-..+.

C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.FastSerialization.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.2332467019367135
Encrypted:	false
SSDEEP:	1536:uGQVC/QSnsZIHMkJAsSQQ11pJXWmWHi/9wfInX2:uGkC/QXI/A6Q11pJXXpm
MD5:	CF1EDCCF60725C2F4BA3C1B87D8ED683
SHA1:	C1EB3691E4058A0FCFB2D5F27C515DD1D4199E4A
SHA-256:	5503DD2AB5C36751E2752FA790E73CC60A273872FA30FC6D2680C7D7377A8902
SHA-512:	13B7035AE83B4075150C41B8ABEF9463EE74F0C022AF1536C50CD990695C86768B93362E61D27981D9804D78B1D7AD8D0D075411FC54AA54B6028A03A9D940F1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3A..........." ..0.................. ... ....... .......................`......\R....`.................................W...O.... ...................>...@......X...T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......................................................................0..(........._,..l(2...i...+...]-....X...1.......0..S........./.r...ps3...z~.......+.......2....X....i2...`.+..(....,...Y.e],....X.. ....2....0..!.........Z.. ....6. .....1. .....(....&.j.n\.jX..0............nZ. d.jX.nZ. dm..b.H.F...%.\|...(4............0........................,..-..s5...zZri..p......(6...s7...zBr...p~~...(....z6.......(....z"..s8...^r...p..(9...r...ps:...:.(;.....}<...*:.{

C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.Tracing.TraceEvent.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3168256
Entropy (8bit):	5.997335561761779
Encrypted:	false
SSDEEP:	24576:82D77md4XviutkNNnh9k/kCC0Ps6MrwMvAcZU28MHAmXyFlDH3n9:3D7y4qutkNlICUTMHlXyv9
MD5:	6E70D569E1A4A1D8DFE4884286643C95
SHA1:	A90A5BF9D736FA595FEA49CDD5B4A644E1ED8A7D
SHA-256:	4DD85290401BD1F59BDF9157A74D0DEFF03755D1A0DBCC6E1DF214B618E64287
SHA-512:	7ED8E219DC80507300131CA0808BE5EA3EDD5E4966FB67DB3860A9CD48792AF15EAD9BE50C730A73B3323EBDD43832C0B033F546BAFD8CCAAD46D1401DFFCF39
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\..........." ..0...0........./0.. ...@0...... ........................0......\0...`...................................0.O....@0...............0..>...`0......-0.T............................................ ............... ..H............text...0.0.. ....0................. ..`.rsrc........@0.......0.............@..@.reloc.......`0.......0.............@..B................./0.....H........j......................\-0.......................................{_.....{`...V.(a.....}_.....}`......0..A........u........4.,/(b....{_....{_...oc...,.(d....{`....{`...oe...... ... )UU.Z(b....{_...of...X )UU.Z(d....{`...og...X...0..b........r...p......%..{_......%q.........-.&.+.......oh....%..{`......%q.........-.&.+.......oh....(i.....{j.....{k...V.(a.....}j.....}k....0..A........u........4.,/(b....{j....{j...oc...,.(d....{k....{k...oe.....*. B.8' )UU.

C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.999968626712184
Encrypted:	false
SSDEEP:	384:UN9VWhX3WwrjP9Z95Xa/rl9qX2Ip4jcTjdAA1m5wMT9YMWuuwsNA5DuQ/f:4GrHRKrLy2Ip4jcTxf1mlTAwsN+iQH
MD5:	9BF3077927261B22D370B5B3CA57D038
SHA1:	B17769BE1674A4E2714E739B2563D300144C904D
SHA-256:	3FD59AA9EB5F647528F1E6B44320CA7DF4A29C45C3632A3D568BBA6BA6518E55
SHA-512:	414AC4A704EE5E776F5F35361A497FD43B564B0FA8E8D38462BE8AA159B9588DF63F2005C8C62B51D871DB6550BFB6B42E1E806C58785CEB0A7560382CDC3151
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ..............................CD....@.................................T(..O....@..0................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...\|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Registry.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	6.545145822499441
Encrypted:	false
SSDEEP:	768:biE9HCViR9ymljiqHRKrLy2Ip4WjTxf1mlA6mRZmV:G0CViR9ymljiqHi/9IfInmRA
MD5:	B8BC5CFB09FC20C3AAC34B61F938FDA8
SHA1:	4317695A609106D4BCCDA3413ADE56871079CB7E
SHA-256:	6EFB32D2EB38B0226CB930BBCA3C6D421D1A425EECD843D2F72DE85610C09E26
SHA-512:	D2169F1280C45C6389285D9D8D17C4AA61C202C512EEC27BC7E105DD11C7231099407B7F6EF9F94C55F9D4330C1F79D10032289DCA05A07BF82EC41D228C00FA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..,..........6K... ...`....... ....................................@..................................J..O....`..(............<...>..........8J............................................... ............... ..H............text...<+... ...,.................. ..`.rsrc...(....`......................@..@.reloc...............:..............@..B.................K......H........"..x...........8<.......I......................................j~....%-.&("...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r?..p.(....2rg..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r7..p.(....2r_..p.(....2r...p.(....*2r...

C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.TaskScheduler.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	349696
Entropy (8bit):	6.202386229973413
Encrypted:	false
SSDEEP:	3072:81sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5DfD:81sSmRIt/xhtsOju1DH5NXnIKAcW
MD5:	312DDE0440242AC225AADF3C1F72DA30
SHA1:	DF1F5B38F76A1661380EAF660936FF8721A16E34
SHA-256:	1908B436373C8813C21D777124E715363D0AB7EDBE8238AE71C6FD6F24C95B69
SHA-512:	21A7C48004313A254BA928B4CD238C2C5AB33B70C4016E82BF29561A882AD2F3D8067E2CF014E0EC815736594ACB7F10DE40C7CF7B38B284DBC11D2D235C1F34
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ..............................{.....`.................................0-..O....@...................>...`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{......{....V.(......}......}.......0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....... ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(......{......{......{....r.(......}......}......}......0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

C:\Program Files\ReasonLabs\EPP\NAudio.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	529408
Entropy (8bit):	6.092519311604388
Encrypted:	false
SSDEEP:	12288:hnfnRe200wJT4WQ+NOStYVlJHMGwH7fug:1DIrQ+NOS2HMGwHT/
MD5:	C7EB00862B2ACF71D32CB1CDF6E02581
SHA1:	3C6E5B0AE8EBA473FE0E5DB17ADC98AC2B5F276C
SHA-256:	AA4BAFD2B0D064BAA00996DCECFBCB4C0C118F7534CECE4AF9B137ECB42B3268
SHA-512:	A753137140B6CBC9040BE95F07C5DC3681747FD82FDA48535E09E10F2ADCACD64932E2F635B6A78A89E7C199DF26039A11A8186165BE6D657B2E0F9D35EE2F77
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q............" ..0.................. ........... .......................@...........@.................................1...O........................>... ......d...T............................................ ............... ..H............text...\.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................e.......H........i...[............................................................{<.....{=...V.(>.....}<.....}=......0..;........u(.....,/(?....{<....{<...o@...,.(A....{=....{=...oB..... ... )UU.Z(?....{<...oC...X )UU.Z(A....{=...oD...X.0..X........r...p......%..{<........+...-.&.+...+...oE....%..{=........,...-.&.+...,...oE....(F...r...(....(G.....}......}....JrG..p.......(H...2.,...s....z..{....N.,...i./...s......N.,...i./...l..........0..............+....,....X....

C:\Program Files\ReasonLabs\EPP\ReasonLabs-EPP.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	26330316
Entropy (8bit):	7.999983860384319
Encrypted:	true
SSDEEP:	786432:HezmrWVYcTY2IQnlfHBDy255kAfgO11YqBLPmHd9q:HeDDgQnVEIIq1Rm9Q
MD5:	44DE10A0C7BFAD8466A5FB454B47517F
SHA1:	D2FAA11E23616DECDE7D3893B8306D7F802AEC7A
SHA-256:	3ADDD6F2758FAF11DE2332E8E14374221142D53661C7E348474BB8B75E12B34E
SHA-512:	A7BC6D414F7D997969A527880881DFE9DC1CA2B0FFF6D233402636D89880F8A0306077E1375BE70A9B8B4DB8C39833B40CF6B60C1569252C0372B8117E4578D8
Malicious:	true
Reputation:	unknown
Preview:	7z..'.....fx.......&........{......].......f......{4.Y.!..h.A...z...v..h.G.y.G.bg(6.<C...C....Q.{..U...e.X.-1...6.gQ..(....&../-.."0NT.z=.U..].....w..:. .b.Vr..5@\~.....p...,.d...o.\|jGrBC_..I..X...d<...{...t...v...GP...X.`4k0...J>Ps..+..1.4.JZ...+.`Ka.7.....f......t0...p.i...@..............+...>0.......4-.....!C.>..]I$.....?.3.u... ..%3.$..fZ..P..)L...?.1.b.o"<.j.<......W....!..e..........N......h......`..X.B..'WQt.J....Fc.{...#.u{.x6...Mm....fy'z6.{A.0...W.. Z}..v..N....(...>e...4D Wo..S.....n.G..1A......Qj.4.....{pG0.f...hW...........&._K.&..XA7.Cs#...8.x..0.BB.j....B..&..bs..?.%@.'....9.h..Ms..2....c.R8.Z. 8.x5 ...7,..b.'..uJu.]N.D...H.I..z...s^am..@....^...c.w.?.I...x....9..xsl..=.....\E0......9.}.1..Y..?.).X/.....`..f#,.!.........#.t....f.?.......o...ti..g.....O"XPO..d4....?.9(F.x.}...%.!.=.cri..d...3xx2.$..u...D....w.......u&.@.?..l+3.}.^.....a.t.q..v......(?....G.Njk.M.T..9.........C.7.e.....^.V.....n....c..l..Kx

C:\Program Files\ReasonLabs\EPP\SQLite.Interop.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1647616
Entropy (8bit):	6.551177299884059
Encrypted:	false
SSDEEP:	49152:HKBZFqX8TvXzlaPmAA6rKmEOwksSf0WB/:HK3/z0hZ
MD5:	D208CAB80627C09A9E7E69FF31FE95F7
SHA1:	A36E96E21AD21638046BC9820E07724E8A202CCE
SHA-256:	29842A886DC678A7CAFF5F741FFF20E9825E064144BA09CA3BBD47E09EA7CFCE
SHA-512:	1CAF5E430AD5E295C5BD4EEF698E44025F826FE1E70079C1AE214885A8962D3170E3465494AB24B36365CC1CF25AF9C6F6EF5A3409BF6B4C8CFA1C8A1877F154
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..7...d...d...d.i.d...d.i.d...d.i.d(..d0..e...d0..e...d0..e...d..=d...d...d...d...e...d...e...d...d...d...e...dRich...d........PE..d....<.].........." .........J...............................................@............`..........................................V..X1......<.......<................>... ..$.......p............................................................................text............................... ..`.rdata..............................@..@.data....L.......6..................@....pdata..............................@..@.gfids..............................@..@.rsrc...<...........................@..@.reloc..$.... ......................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\SecurityProductInformation.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.9372191821953795
Encrypted:	false
SSDEEP:	3:LBQBIGqr2igRUGLsW7/ZA783dEcsAVCXoA0Ayn:1U2rwRUGZA783dAAVCXoA7y
MD5:	AA76741FF18EEF8DADD607315B86815D
SHA1:	F71E92F4ABDC7DC7FBEAF8583A8415A83948F2DA
SHA-256:	3F8B58A5E9F78367AC1F366488004B409BC1526439D1C3FAA344A95BCA445D32
SHA-512:	7FBE625D421AD9A6DFB1AF1956CC4B65320385E05B1013054922E17AFCF990857B8996EED02E2497F978CFAF07460D7EC9487B070BB1287074DD3DA4A5055164
Malicious:	false
Reputation:	unknown
Preview:	[Products] ..Name=Reason Cybersecurity ..Version=3.5.0 ..Company=Reason Software Company, Inc ..Upgrade=FALSE ..

C:\Program Files\ReasonLabs\EPP\Signatures.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2022592
Entropy (8bit):	5.999974579136952
Encrypted:	false
SSDEEP:	24576:+dK+qRAhQZWnHFRGGbk0kLHYCFOEx3BMHAE4d/R0l7lRmRj5/Kz3PYez2OQJBmx0:eKYdRxknOEx352P57PFj1xVYNcXsn
MD5:	FB84325FD7362B5634C4DE62B3A2C001
SHA1:	EBB54EC78A071CE47A1C86F47903D56D77B34CF7
SHA-256:	23BDCCB16E5900857C621B67C779B2A49179ACA564EEAF1E74FD10C4EB1651EF
SHA-512:	D59933302521C9B3EEAD330A38577FAF1DF0378AA926690C6001186D495ABE4FC470BF578BC9DEABD82E26D7B1F8ED446957494122BD65047456C657DC9BADE2
Malicious:	false
Reputation:	unknown
Preview:	LtAADqVO7UZPm5M2i6U0Ut+519EhIs7fDC28Wl1pQ3a5caHSrw+Gx5gPpgKjm6512l6HKUBJcXQoHbNGYOCA49Q3BTXE41yS8brQXEozdrMJ/QdDxGcC56TGJwEI91lQyrkOtRfocRkRscRbJGGAiyLm3qgIwtTxwz1Jjb4Pecxp6sC2gikNX1FsfN9m6z1LyQNZnfcuQ/6nD0PPsgLRx3rKTfu8eICM9LWsz2LcMcH5EgncDPPlUBccIAOoNxcwirnig5V7fYkq5PCmIeJV/foKrhkvtj2sNYOZMBtbUvSWsEGn6a6TOU/Piv2Sl43XCYBaSV+MbZD2Fa7N4XNtgSjNH8CbppSZk5+xCm2MtTAwzdHIONHn1L8zBeGZwdAbocx7Qon0DNvHkJmVNpIMiH03GwfpOb7+a7jO6UjzphzFDZTTetf0odM6bxJE5mmTkX8tHVeJZDsSRtH/kxPrlWwaJ/GDcy18HIbQYhCSoTZ7U2D0D6O+3vJNh/gXcd1/hA9EWe8sZr9+92Z7fQPHW0W1X9gXdbysOmQ53nZiTGa2LVaen84GWnaQmiNuAr8KeAYqKQLpTCHHt8HnwIB+EKPHbi5fTgHNK+5QnHZnexdkrlNEG8iJhoHPW5yMNGtxKY2j6SHQVMPeRC7IyRSSfHZjarSYlrbAwmLjM9omyK9uScT2ZUWhDXLAB5t1g/C+YFWFKgCi/fZM9BZZd6gBosg+t/ajXVDxgq4JXCDTGuarqflQgnAhx9f4UizVRedmiupelpZ7OYPPKxRHxRUXxFaijSPvFqUNjwVHEiq1D2CWLAiq1EmGZBvW5DXozhpi/Ibsj9v1rVkmO365wPql2zKxSwA41CV/ezqtyB2v9YoEFEhD5ovN6/RgP/chRBlu617VTprMUa0OiPA6jkDPVwo+H1iSLxJVFAUW7SgkDPwAmu5aL88lIJz74HBh6gEKsS/qYtzEJHt34OdPBAf+FcrmWK4rQ9vzpdNjNDmX

C:\Program Files\ReasonLabs\EPP\System.AppContext.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.978537519188193
Encrypted:	false
SSDEEP:	384:/DNxWQFWWrjP9Z95Xa/rl9qX2Ip4z2TTjdAA1m5wMT9YMWuuwlNA5DdD:/DNVTHRKrLy2Ip42Txf1mlTAwlN+p
MD5:	2DFF1B9CA7F8F5306847F4E9A3B6986A
SHA1:	0972B9A567C63F8D9A9DAA5E53F05B6C9A2DB5D0
SHA-256:	606611B5159500AC591813A658540F59A147C66100F622AD8B44A5540E573FE7
SHA-512:	8E9EBEFE85B0000BF6ACB1ADE4A42832D61E56675386351A6CCA8B65E711B29091A6985DA9D92D1FC316B6BCE2ADC1742518FD8053673C153EFC2005317DB308
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ...................................@..................................(..O....@...................>...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files\ReasonLabs\EPP\System.Collections.Concurrent.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.038714011015616
Encrypted:	false
SSDEEP:	384:9m2igOWnW8rWGrjP9Z95Xa/rl9qX2Ip4i/jTjdAA1m5wMT9YMWuuwkNA5D6v:lthHRKrLy2Ip4AjTxf1mlTAwkN+o
MD5:	7AC4FDFD4937947B05A24FBC521B3F94
SHA1:	684BA6B2AE151A48CEA3838B8AB13D44A988757B
SHA-256:	3356CCEC48B70923560CAE1FC92A8778CB22089D1B955AC691B6BF49C1A682B4
SHA-512:	B0D9D93C81268C33EBDEC4D50220A2014D950BE17D50382248051E4E38756DFDB04A26762B87AF03A7344FB2C8646A4B76919073BCE0D61935F226471B5ECD4A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ............................../.....@.................................t)..O....@..D................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EPP\System.Collections.NonGeneric.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.038869248646308
Encrypted:	false
SSDEEP:	384:dnapn1iwwPWcGWHrjP9Z95Xa/rl9qX2Ip48qTjdAA1m5wMT9YMWuuwWNA5DT:EDuFHRKrLy2Ip48qTxf1mlTAwWN+v
MD5:	DE4F6EEF2E6CA33D0ADFAC45FD34103B
SHA1:	FFA22597139DE334AC0E4DA91B13067E1B6AC391
SHA-256:	90A0E014766A51776A99260E21268A320B30C4024AF276FB0FB25414A15559D5
SHA-512:	2FD3B491675B3BB4349251D1113992D098AF61C1055EAFFBA33AE939720FA2EA9A60FFD755AFE5F55CBF4F8358BB97AD32605F66698614215E8CD87E3AD3C964
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................iw....@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EPP\System.Collections.Specialized.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.038266147487603
Encrypted:	false
SSDEEP:	384:aHLaEav5aaUa6arWVLWNrjP9Z95Xa/rl9qX2Ip4CCjdAA1m5wMt+uKn2MDug26U:rPv5t/NOEHRKrLy2Ip4CCxf1mltdKnNb
MD5:	73590CA143A8BDB34145D491F3D146FC
SHA1:	0F1EF5093DFF48D9B0FC0A8E3351D151AA87F0AD
SHA-256:	B090BAF1A8A5CAC4835F3DE5D60B8B98C550349915E9FBE360605CD143C68777
SHA-512:	28678930E560D79FD34C31FF5F58BDAC53012BB8D5F2E7DC750E119C0DA12B5FCA830C0ACBEA5FA800B2D5534AB4850FEB11EECEFAADED1691B4AE2FC62C3639
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................`.....@..................................)..O....@..P................=...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\System.Collections.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.9403371462839605
Encrypted:	false
SSDEEP:	384:56iIJq56dOuWSKeWHrjP9Z95Xa/rl9qX2Ip4e6LTjdAA1m5wMQhKuVdJm5vZYaG:niA9HRKrLy2Ip4e6LTxf1mlQh5VdJm5G
MD5:	3787FD49F76887523CA6EE358EFE211B
SHA1:	39CC297E1CB3A02608C9A687FA063DFC37124AE4
SHA-256:	E8A46F40D416E1636F067C621C69FA64C959915AA59922F3FFFE61C349FC0BF5
SHA-512:	C6F4EEEA71C55BA5C5A77248539FC5D454953BB2A58A8553677419EAC5B9BC7F5CFF5E53EBD89126BCE16BA6372BE833A43BC7D2AE242AE62DB57FF39F83AD39
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0................. ...@....... ..............................g.....@....................................O....@...................>...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\|....................(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k..............0....M...............................#..........x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files\ReasonLabs\EPP\System.ComponentModel.EventBasedAsync.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.969557757793759
Encrypted:	false
SSDEEP:	384:onzz+MpSaLWW0+W3rjP9Z95Xa/rl9qX2Ip4aCU9CjdAA1m5wMt+uKu2MDug2Ecf:mpuNHRKrLy2Ip4a3Cxf1mltdKuN
MD5:	205CFCD6412BD6E73B6D76AB425FEE45
SHA1:	1F81DD9DC0794C7C700894A76DC409A1EC734228
SHA-256:	9DB96E9B00B7D4761890BADC3CA6988C882CA98C67693FC9C969603B07F5C912
SHA-512:	60277DC31CE4C6ED9543CC3284F7640B79B84D033478A2C6D01E79E292A424CD17DB8AC9D8023661A3E21E6931D543BAA8954BADA8540D04B05B35C16587BDCE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B... ...@....... ...............................!....@..................................)..O....@...................=...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files\ReasonLabs\EPP\System.ComponentModel.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	7.003252995869171
Encrypted:	false
SSDEEP:	384:0Ghr+YUfyHxsW/HWIrjP9Z95Xa/rl9qX2Ip43CjdAA1m5wMt+uKj2MDug23:DkmDHRKrLy2Ip43Cxf1mltdKjN
MD5:	FAAE39EA5667034ACA5FE9695F7842AF
SHA1:	D14F68156029D6A69CB831AD5935DDC08F3C7B1D
SHA-256:	C5DE6F3CA7476F1EB517A24C96CC4D654CEEA3F5679946A8887CF48F10A603DF
SHA-512:	15117974C027B03CBD81B07CEE0330336247D48D696187A1CA10A48FBC71F696DB58C4C1C326CC805B668A21697AD3CC81C196749C388E37125FF783E4B11189
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ..............................a?....@.................................<+..O....@..`................=...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EPP\System.ComponentModel.TypeConverter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22400
Entropy (8bit):	6.946606868220202
Encrypted:	false
SSDEEP:	384:sRE+ruiA5vzWeNWqrjP9Z95Xa/rl9qX2Ip4BtCjdAA1m5wMt+uKz2MDug27Q:sS9bHHRKrLy2Ip4BtCxf1mltdKzNy
MD5:	32EDB888088E971503F899257BDF5C3E
SHA1:	E8A3AFAAC560318591A9DA9E64258F2C1F2B93DA
SHA-256:	F07FDB5720B64DFC55FD49742F041D07BFB9C006167E12DD68033077F6FFB529
SHA-512:	DF68B9FE96B68A2B138DCD482470369AD902792CA6CC97FE16EFA61D517E85E0A612213CB79B809D7527CF5C87792E7D41871589173C0A4BCF0AD915D0B084BE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ....................................@................................../..O....@..p................=...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

C:\Program Files\ReasonLabs\EPP\System.ComponentModel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.992218618555366
Encrypted:	false
SSDEEP:	384:dT+6ywnVvW0LWYrjP9Z95Xa/rl9qX2Ip4sk6CjdAA1m5wMzsPu:d99DHRKrLy2Ip4sjCxf1mlzz
MD5:	AD599C4F1182F117CB2EFFD67B81FE00
SHA1:	72DE534F8AD7DDAAC63AF05CCE5F09118F002718
SHA-256:	A2F1BB86811D01DD872DC22C1791C906C8761EB9E277E16F67CCEBC34525E558
SHA-512:	E78D3614EA65F507C6882EDCE51FE6BA7435C3AFBC70D26A6787620F5205AD8DFC39268350D87A874832BFD6D7ECEB36BCD67005B05E5D47D766C6AEDEA45ACE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................>.....@..................................(..O....@...................:...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EPP\System.Console.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	6.9972717627617875
Encrypted:	false
SSDEEP:	384:LRbzriaXT+WlEW6rjP9Z95Xa/rl9qX2Ip40CjdAA1m5wMt+uKb2MDug2K:N7icoHRKrLy2Ip40Cxf1mltdKbN
MD5:	D04BAB647A4535646AF7907572D2F416
SHA1:	29D08751EF6296F3CD817A85D7FA8734B90E5452
SHA-256:	AA607E257803A266057CD3A3231BF28656164636753A73153FD69AD374E52B79
SHA-512:	1A4E4A00BCBC81CA473C2F7C58E4D059B763C3BEE88837FD9CB419E34F552307BFEC08DB57C35E0A91C1998792A311CF0DF4DE9D91097FF2D66D17985BA93307
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ....................................@..................................(..O....@...................=...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files\ReasonLabs\EPP\System.Data.Common.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	153984
Entropy (8bit):	5.51941877191699
Encrypted:	false
SSDEEP:	1536:rHOdYYWg+GImdMEGK61wb5nx03LBblQ6Ndk66byYSI4Zki+BReD4pK/uYxtl+DH1:KdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+Q
MD5:	38AE6C349E82C48143368F320E9D3334
SHA1:	FEAFB1B6F68B2B2B4BADCD26E955392132EC0598
SHA-256:	C6689E8B6D972E3F3B8C8D553D3297013280FCD254CE67A253F8C5599D6251C0
SHA-512:	4244F1A46E867D69165555CCADBAFC802F2CAF911E64F817D86444307625CB71B4055DBDB343B74F027A050A2E0F5D2BA5DBFF5238CDAD6239EB45129E4EF9C5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................d.....@..................................,..O....@...................=...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r;..p.(....2ro..p.(....2r...p.(....2r...p.(....2r...p.(....2rK..p.(....2r...p.(....2r...p.(....2r...p.(....*2rM..

C:\Program Files\ReasonLabs\EPP\System.Data.SQLite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	370320
Entropy (8bit):	6.097287838038304
Encrypted:	false
SSDEEP:	6144:1ruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cmg:oNWx6xz+nRo2GGWHQZMaLyJSJFNFaFeL
MD5:	0ABD891534524A6F338A47D9FB607809
SHA1:	5DFD01F659AC840B59B98108E5ABE7519CA29E59
SHA-256:	69BACBBCC9F64B4A3A5E4AC155306139410740776780856C6F268B4778EC8672
SHA-512:	D2F5316282F874F9B132829209326B9A6C5CC85EA953EFD9828B076D38F65CBC6A0CADA901C6E53FA90072774C6C2087F242616481354C569F4E3F2981325D7F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.].........." ..0..b..........j.... ........... ..............................n@....`.....................................O.......$............l...:...........~............................................... ............... ..H............text....a... ...b.................. ..`.rsrc...$............d..............@..@.reloc...............j..............@..B................L.......H...............................`~......................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(......~;...(<...,r.....s....}.......}............{............%......(=....%...:....%...!....%...%.........%....%.........s....(....z.{....,......(=...o>...s?...z..0..'........{....-..(......o........(A.....}.....*..................0..T........{....,K.{....o@....+...(A......(B.....,..o;.....(C...-...........oD.....{..

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Contracts.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.97137335485154
Encrypted:	false
SSDEEP:	384:mRtRWjYWQrjP9Z95Xa/rl9qX2Ip4p5CjdAA1m5wMt+uKp2MDug2:QiqHRKrLy2Ip4TCxf1mltdKpN
MD5:	46C3A5D639EA85E10F9D1586D4A5DEF9
SHA1:	AE021C65C29185807DEFD8704BBDE13A5C0CCE79
SHA-256:	D5E78C7417B778A2225FB1AA518D32714E12974B5B9B51177A27DC8AD811F850
SHA-512:	E5412FE8BBD065D819CD20D3C5EFCDAD9672479D9DBD0E2F52C13AEADEE1BA0FBBBA6056D577F263BF8CA8F8119A8F8A5A65C2E99E1F3ED9ECB9EBF571555CBB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................x..O....@..@................=...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.......................H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Debug.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.038357471463953
Encrypted:	false
SSDEEP:	384:hjeWnoWxrjP9Z95Xa/rl9qX2Ip4CEB9MTjdAA1m5wMAvru4LTgZIjhIEOnD:hjn5HRKrLy2Ip4CEfMTxf1mlA6tZgOD
MD5:	D04EE873D87F1CF5695D31F86CBA4278
SHA1:	73AEC30B5428C3F0E10CD9B98FF4C19A2190CAAB
SHA-256:	83F8910AE3F0D1B95AAD265A42AF82012BBE88476842B71F768D3EB5ED0D2316
SHA-512:	18D8A69AFE3DCE5074907ABFE81D09C7D9B880D53F912CF19848AC5C4F54F134B75FFB491392EA97A0B240CBAA06402A4CABDA809BD105CF8CCF375EC172ADB3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................X)..O....@..$................>...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.FileVersionInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.001464127739083
Encrypted:	false
SSDEEP:	384:x6oWJjWtrjP9Z95Xa/rl9qX2Ip4SCjdAA1m5wMt+uKt2MDug2X:x6v0HRKrLy2Ip4SCxf1mltdKtNm
MD5:	47510476D42A1E6DD5F9E6CFA8E9D6D8
SHA1:	376574A12D975EF0D78F99ADA722D5B11059E712
SHA-256:	70E554C0E1D4C4EC7016BA649E141AE58594D413D5A1D90B5AC754A3F44D5B55
SHA-512:	9FC00B095BA4A60E0EAB56E6812F35CBCE2D668F409917DE3CE4055A010AC9D8D911F2417421B8F2EADAFF77098E14BBF6FC340795E795A6A87164D3B22D99CE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................(.....@.................................H(..O....@..p................=...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................\|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...\|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Process.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.945463408943383
Encrypted:	false
SSDEEP:	384:Cqk53/hW3fZ+zWVbrjP9Z95Xa/rl9qX2Ip4WAVgCjdAA1m5wMt+uKU2MDug2:Cqk53M5ZHRKrLy2Ip4WAyCxf1mltdKUN
MD5:	4CFB2E34693018E465658F779B0BDDE6
SHA1:	2CD83A865FF0BF72F12117BD175231AEC50BF700
SHA-256:	0B92293628B413CF914D6E7AD16D6976C307C115EB0B101B2BC9A966C3CF6516
SHA-512:	166CB361C2E0AB7E5F570B11EB11AB89888758FD552942D21E5C2A73D94A46308F27DC16A585AC8FE9B410C3D96AEBCF5AD454EE7EDF014F8DE848B2C4D6413C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*... ...@....... ..............................D.....@..................................)..O....@..0................=...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.StackTrace.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	6.855660382428409
Encrypted:	false
SSDEEP:	384:MFCc4Y4OJWfOWqWWOWdrjP9Z95Xa/rl9qX2Ip4+FTjdAA1m5wMAvru4LTWZIjBsp:ICcyCzHRKrLy2Ip4+FTxf1mlA6PZHp
MD5:	798570CC1DB66CC342FA38F275D75D4F
SHA1:	819D8F7806C26ECCF670D593AB9660285ACC8FC9
SHA-256:	E823C5C674318872ADFD5F9E5FBB83965E7F5030ADF24292D7EEFF5E53184606
SHA-512:	175005A2D32C2BA628108484CF1E63DCD23EBEEDAB2B500E08F75EC5276D3AE9F7AB62DF2FC3EE15F4657E9F3B2927FB0B5CE21A5482DBEF750EBD7DC09F2CCE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ....................................@..................................-..O....@...................>...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....6.o.....(....6.o..........*.o........~.....~.....BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.\|.....Z...1.Z.....$.....$.......3.D.......\|...F.\|...c.\|.....\|.....\|.....\|.....\|.....\|.....Z...I.\|...}.Z.....Z.

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.016242383612687
Encrypted:	false
SSDEEP:	384:nAWxMWQrjP9Z95Xa/rl9qX2Ip4L/nCjdAA1m5wMt+uK5v2MDug2:nv6HRKrLy2Ip47Cxf1mltdK5vN
MD5:	08E3E0F118B430982B94ED6ABB25382B
SHA1:	406F98E588A9F7EECEC07792B851C452B52E1B75
SHA-256:	C3E6DDACB8D0B505BFE81CF063FD9843DC7173AAD30C9E6DE3D46F9CB8771DA4
SHA-512:	D921C2E8DB77B9A1ECE0A59412A9D4199076886AF88710B53CF9D68DDD6DEE8EB0AB6748860EDD62A1588D7EC7CF5F7978A6E858179A29AAA52C4A5DA52506A3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................`....@..................................(..O....@...................=...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..\|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tools.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20104
Entropy (8bit):	6.995066534914386
Encrypted:	false
SSDEEP:	384:8AlcWHaWZrjP9Z95Xa/rl9qX2Ip4jlRCjdAA1m5wMzsPugRt:19jHRKrLy2Ip4BRCxf1mlzzgRt
MD5:	278F5B46B1C9E6109A65CA5FBE594A89
SHA1:	E6648323BA045947C0411419F621E83BD7D223E8
SHA-256:	F18350E20E583009BE9D758EBC998158BF4BAD6E68D4B19CBADEC6898156C36F
SHA-512:	346B0E93EB8F15B78A3BD3995A8C708041BEA40EF6925DEA2898D6339A2C426E7A298CE618F6E068CA20F1D50659393E6F93261256BE7E6EC3995BB6806EE309
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................n.....@..................................(..O....@.. ................:...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TraceSource.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.947354078253707
Encrypted:	false
SSDEEP:	384:9lIZnWlNWErjP9Z95Xa/rl9qX2Ip4pX9CjdAA1m5wMt+uKE2MDug2:TUyVHRKrLy2Ip4jCxf1mltdKEN
MD5:	4A8846936A8E09232C82977B877A9B20
SHA1:	7FE242D157DC0B3D0627CC94390C90CF44B09D8D
SHA-256:	E8D49993C6FD98CE6B356D9EF3F8866214D08F900899453A254015A8D4069333
SHA-512:	7AF5B55A38A7A93558DD7BC4B15CEA22AC9639148FDA5E9F50335C2F5A98A24A39DBCCB3BB09D13066CF2F4077F1159A03402608FFD24319FFF73C22976FB4D4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2... ...@....... ....................................@..................................)..O....@..P................=...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\System.Diagnostics.Tracing.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30344
Entropy (8bit):	6.663317009056621
Encrypted:	false
SSDEEP:	768:eQq33333333kX+TBi8xHRKrLy2Ip4JCxf1mlzzd:xu1i8xHi/9efIPd
MD5:	D1DA0724F22A4FBCB7758EB7EF38696A
SHA1:	0E798048BE830BF25431469FDE0BE7EC4F487AF0
SHA-256:	666841D9F5BC6AE09A49DD1489CED8AFB992BE962A86FC59C4FA0D1B371FF9D0
SHA-512:	F88EF2B992DA027257D73D75A124F20BA94A09DB95211DEA42E22D3FF43B3CB2039EE7B1060357B9ECA08483866D76106D26D5F09AAE04D526F40F6E022574D7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<...:..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o...."..(........0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....&...{.....0..4.................}......+....{.....".......X.....{.....i2..0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

C:\Program Files\ReasonLabs\EPP\System.DirectoryServices.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114832
Entropy (8bit):	6.2259167984140324
Encrypted:	false
SSDEEP:	3072:j781mqR5JriAGnUKh17T6glQ6xBIwNSB:vu5wAGnUM1ZzPIwN
MD5:	8464F5D99D9A00AC125A48F656867B61
SHA1:	011DCBF2DB20C8A67E552FAC80C49208F17BA80C
SHA-256:	5F755B209F31B531796CAF3FAE5CB018E402A3431E51F5C56A482F10CFF2148C
SHA-512:	B114379487EC341B13F2F5A0B7F1BE00A59C4151CB4F58A414BD2396CD3821D66D020C8EBA6160EEDBDD4D5FAEE3DA0FC21E865AD7CC89AA1EFC67A3104D4CFE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W.........." ..0..\|..........j.... .........c. ....................................`.....................................O.......h................:........................................................... ............... ..H............text....{... ...\|.................. ..`.rsrc...h............~..............@..@.reloc..............................@..B................L.......H........&...................j...................................................................0...........0...........0...........0...........0...........0...............0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0...........0......

C:\Program Files\ReasonLabs\EPP\System.Drawing.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.993611820038077
Encrypted:	false
SSDEEP:	384:J28YFlXulWY/WKrjP9Z95Xa/rl9qX2Ip4Ee2XLCjdAA1m5wMzsPuHi:J0qRHRKrLy2Ip4EL7Cxf1mlzzHi
MD5:	C26D67F215E17C4173AD7725DE4A9130
SHA1:	C65379A9B92ED71511EA5F7E2393BC0D00ABBE15
SHA-256:	3DD500CA615786015FEBCB9A7B6F2BEC1C19D24FB90AAF810831D772FA18F959
SHA-512:	3C7F5C1F66873A5112E5262FE514B7FC5F3397B18EA27A66FEF2DA9351AED081F8B7548F5128859B8F566689D6AEA14C1920D12DA0B638C6CCDA2A0950D529C1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................:...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\System.Dynamic.Runtime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21136
Entropy (8bit):	6.895040972202649
Encrypted:	false
SSDEEP:	384:VuMLcdQ5MW9MWfrjP9Z95Xa/rl9qX2Ip48DS/CjdAA1m5wMzsPu:EOcSpzHRKrLy2Ip4LCxf1mlzz
MD5:	79D4D3FEF35DE357C3E9B0DA22230BD7
SHA1:	130063A58B3CCCD4EC889D8C0347E7521E8DC160
SHA-256:	8485B02BC0A877B2719652935FE4B81F83B05EBB7444CF373D35153A0936C32B
SHA-512:	7144EFF5D1311B03BE4D5A713399FC8B726ED896A5B624704E249781530F20EFE08880CC855A718EAF2E7BCD03C5920FE09E87C444D676367AA11DA20971807B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ..............................h.....@..................................+..O....@...................:...`...................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .............................................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\System.Globalization.Calendars.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.961688394250093
Encrypted:	false
SSDEEP:	384:VZ7RqXWDRqlRqj0RqFWOrjP9Z95Xa/rl9qX2Ip42STjCjdAA1m5wMzsPuo:z9qKqjqjuq/HRKrLy2Ip42SPCxf1mlzU
MD5:	368EF630398E8653410CEA57695551EA
SHA1:	0D20730CCE83B5DFB7B22821E44C81FDB5411630
SHA-256:	C68B619757B9F5B7662F4E93A242E1A4181EFAAE4365DB394DE97C5C9731BB04
SHA-512:	1CD4963673C882E64E0D4E80A155790EFFEAAC4B298A3DFAF20F3C65759FCA3C68CD40D83AF6751A8BE68E8D5594BCFD2F910727BD49B3C06F9F8AE3E125EECA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ...............................S....@.................................X..O....@..P................:...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\System.Globalization.Extensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25472
Entropy (8bit):	6.806988625442559
Encrypted:	false
SSDEEP:	768:3vMhF2SzNzwu/NljuQHRKrLy2Ip4wCxf1mltdK1N:3vMhaKRHi/9BfI/K1
MD5:	998B608546A2129C7A0A6250E23BDA86
SHA1:	BF519F3A049F7FD131486E17592FAE69E80718A0
SHA-256:	2CC4C989B76BC93251881273E8274D0D5F4B3FEEA67F04A69FFC707539AF41C9
SHA-512:	9CF2F2955B35D5DE925903FCED9F1DD9995CFD721B47FD15DD724065856F0D628838CE1CB296C1300B820E6DBFD74870CE919A972DD0B1A1413ADB99A8757408
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ....................................@.................................a6..O....@...............&...=...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o...."..o......o...."..o....j~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(.......0..K........-.r1..ps....z. ...@3.(..... ....3.(....*. ...._,.(....rI..ps..

C:\Program Files\ReasonLabs\EPP\System.Globalization.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20104
Entropy (8bit):	7.025957682532363
Encrypted:	false
SSDEEP:	384:EZ4RLWdRfRJ0RZW1rjP9Z95Xa/rl9qX2Ip43CjdAA1m5wMzsPuREx:EZK0pJumHRKrLy2Ip43Cxf1mlzzRW
MD5:	9E68EF9807635098495C4691027E2894
SHA1:	A51F0061A74A95F80E75DB502A76842C4C6B6FB7
SHA-256:	A88DD60478376843166145F91ED97D4BC1047ADE4769BAB4EBB7E14570117A3C
SHA-512:	31A98EE8EC3D6C1F55AE55E7B90E71AA3B1B42CD5CFB1ACB9DE9109D7FA166E1ECFD505DFE14E7A03839B57858274972887A0370A916A38975EDD29564A5058C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@...................:...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\System.IO.Compression.ZipFile.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	6.961301734790314
Encrypted:	false
SSDEEP:	384:4YWsmWVrjP9Z95Xa/rl9qX2Ip4hv9CjdAA1m5wMt+uKQ2MDug2:42DHRKrLy2Ip4h1Cxf1mltdKQN
MD5:	36F75710F33734896D90F65CAD7C2AD9
SHA1:	44F39226CDD1F55F1E5AFB13ACC1C24CC88E8AEC
SHA-256:	40F80C59D227234209E372CF13B68CB68F1DD60903BBF2AD402086174E62645B
SHA-512:	69161D15DBD399DBF0F5F1C2BCB20C4518B37F5E13A06C2B7F0C8AA97306946F83DFB1FDCCB59018FFE6CC4BEC11C67B00151601C5047CC3BF29A0DC19947802
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ....................................@..................................'..O....@..@................=...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

C:\Program Files\ReasonLabs\EPP\System.IO.Compression.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110464
Entropy (8bit):	6.4473067267179065
Encrypted:	false
SSDEEP:	1536:7vc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXlHi/9ZfI/KYX:bgk1tiLMYiDFvxqrWDWNoJXZ
MD5:	DAF3E5DD2EE18B843AA7AE7EA626707F
SHA1:	415F56AB834B4C6154B508929AB45869C08C8153
SHA-256:	F061FE1B914A06B26B286E0CF240504E906F3A2E84C1568B5155C9595B0F4C2C
SHA-512:	E7AAEDA753427CE2BB5744FCCA75B54FA9DD5194BC4455A6B2782845DCE3AEC674155A141AB836E2AABD043117FEAAD0E5A92F006A196B6763A27DDA06373C61
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ....................................@.................................5W..O....................r...=...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r7..p.(....2rs..p.(....2r...p.(....2r...p.(....2r...p.(....2r=..p.(....2r_..p.(....2r...p.(....2r...p.(....*2r...

C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.DriveInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.004024120526974
Encrypted:	false
SSDEEP:	384:gKcuz1W1cWcrjP9Z95Xa/rl9qX2Ip4Wo2CjdAA1m5wMt+uKf2MDug2bK:wu8CHRKrLy2Ip4oCxf1mltdKfNJ
MD5:	AAB985F9BAF075B8FEF0A285437B1C2C
SHA1:	B6F26238DE84C30244BABCEEE9E5C23B4957B1BE
SHA-256:	6EF4FB27066AA0F4B84E94912F1B4E39F2FB6DEDCB46CE9BFF8F07C9B7B452CB
SHA-512:	A737B55AA4F4B670B418A87BF7AA75C59600DE61CB56A5BACF6FB84AA120D866AEEDDB6448719C486CD03D2CD7F47FD8B08710A72E864BDF440D6F4691806F09
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................I....@..................................(..O....@..P................=...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.015928217476137
Encrypted:	false
SSDEEP:	384:1+SWikW2rjP9Z95Xa/rl9qX2Ip4yTjdAA1m5wMBq5ul0Wevfh+C2:1+eoHRKrLy2Ip4yTxf1mlBqsCvJ2
MD5:	E73A79701E00DFDE3FCBC7BE60AB6031
SHA1:	1B3966632B3292C7DE09A6496AD7AA5A41068245
SHA-256:	073592FE8FBADEAFD388CB9327C462C953C2D844F252B170B87A4150AFC92263
SHA-512:	BCEF67565C355549131942FFE4F808508D301E395EC127C5E68C3B944A34C2FE5EA8F3FAC15536BA11BDFC5A7A81FE4E6B8984B60FF3FE9BFA8A7C0D31ED2DDA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.Watcher.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.033515096452303
Encrypted:	false
SSDEEP:	384:GAWzgWJxrjP9Z95Xa/rl9qX2Ip4SbJnCjdAA1m5wMzsPu:GtLHRKrLy2Ip4SRCxf1mlzz
MD5:	16FE78EDC4C2B0435ABBD8B57BFF1683
SHA1:	E9E1797801F0CDEAC79520795F3405774599F4E8
SHA-256:	D87BAA2359DB3584B098ABD3D376B2E7B00DF21FD2408DED9F5CC4195B27D5E5
SHA-512:	2B13B83707E43C8553EAE1056DCDBB433ECE88A1E9F92910E00448F502B2AEA3B361A4350520CF8F6CFD73967152013EDA3237617BE110C5F6818E96B34F68FD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................:...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\System.IO.FileSystem.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.010993463774131
Encrypted:	false
SSDEEP:	384:UBLRWbYWfrjP9Z95Xa/rl9qX2Ip4JCjdAA1m5wMt+uKd2MDug2l:UB2XHRKrLy2Ip4JCxf1mltdKdN
MD5:	627658C98D56F21BA4B4869528DF47D0
SHA1:	B1BFD69286D77C5C39D90A06DB1AF4C9724A4735
SHA-256:	DC09C0286397AD1A567F5C45ED279C2B2F68BD9775CBD20638A388D848BA8C4B
SHA-512:	86D2C7E69C99D62EBDD40DD60AE50E8F622277803266056C246E2E8EF4EA1086846BB96879533F6425CB3C1ED671B1783CEBF298CCFC0817259FCBFA6616B3C3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ..............................h.....@..................................)..O....@...................=...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\System.IO.IsolatedStorage.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.992158648190345
Encrypted:	false
SSDEEP:	384:XHW4/Wh+rjP9Z95Xa/rl9qX2Ip4Bh3ZCjdAA1m5wMzsPu8z:XrEWHRKrLy2Ip4vZCxf1mlzz8
MD5:	4D5FC69F7C0B4A69AC7DEDCBACDEE8B7
SHA1:	D239969D823374B41C5A0B2C51620E559C4351AC
SHA-256:	F86BC2D92EFDF25991B67D96572581FEB3985880ADAD2C10556B550A10295ED2
SHA-512:	E4D29A2085968A6CEFEF7BCB5D25D6F18DBD238D406C5F9B9DB447C6C0DA79A14335118C0AAD6AE012133543B25F882D9DAFB4AA1FFDDEB51192472930257EF1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................Zi....@..................................(..O....@.. ................:...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\System.IO.MemoryMappedFiles.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.044497037369271
Encrypted:	false
SSDEEP:	384:Ovk7hWmCWJrjP9Z95Xa/rl9qX2Ip4jTjdAA1m5wMAvru4LTuZIjOz:Os7/7HRKrLy2Ip4jTxf1mlA6vZ5z
MD5:	12CF683B4FC3D703092F203EAD04168A
SHA1:	830F120CB51BE0536E04D3D4A5E5495621EB06BD
SHA-256:	8A3C25B70BC1F5C9481E6D1F9E1F22E7FC3CEFCFEA5FA156258720063551BC37
SHA-512:	C87BB035026A50256F7DA00EF144D6F6201519ADAA82809F388A18A12A2EB357586108088E25A84587D314250536BD54446E8438F6F18DB18842F83F793D4112
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................h)..O....@..0................>...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files\ReasonLabs\EPP\System.IO.Pipes.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.006094828452657
Encrypted:	false
SSDEEP:	384:dGMWCUW4rjP9Z95Xa/rl9qX2Ip4N+CjdAA1m5wMzsPuT:d36HRKrLy2Ip4kCxf1mlzzT
MD5:	14E892A0E1F04DD40F0BF129EFB0D170
SHA1:	5A79D45A7748065D9EF2ECE5E19E919625A34450
SHA-256:	A394584966884F781A52C0EBD04AFCC76B3B9B64B3E271E25EB645D272A6EBF5
SHA-512:	642DF58022D04794AF4ADF8C11E24D037E96A338BC4C587076DFDFFED7E7D8B4AFB319236A28BD1127FA2D5026705724C045E56FA801DDAD42480A56991F5947
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................,.....@.................................@)..O....@...................:...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files\ReasonLabs\EPP\System.IO.UnmanagedMemoryStream.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20888
Entropy (8bit):	7.0015647853208876
Encrypted:	false
SSDEEP:	384:cBhwI7WSQWzrjP9Z95Xa/rl9qX2Ip40JqjdAA1m5wMRv3cquhqjlLb:cDwIBjHRKrLy2Ip4uqxf1mlRv3cZhqj
MD5:	D44D5DD154CAD3B1C6B9ABB5DF068DDD
SHA1:	81969B84137CC13E83D58ABC70341B05D1FADA1C
SHA-256:	8667D8765649E1F7BF3DDB72A3C1BD69D21B797D42BEBBC472C1DEACD8353C6A
SHA-512:	B30C1F8BA6872E477978321BEB0B3AED75E78F3DE96878EE1A315E236952D68F44C25328AE415C9CE092561E0E35DA9A2398BA3586B3B0697E497B46E8F19D1F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................l(..O....@..P................=...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EPP\System.IO.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20856
Entropy (8bit):	7.0141346287170565
Encrypted:	false
SSDEEP:	384:6yvPRW4lWtrjP9Z95Xa/rl9qX2Ip4OCjdAA1m5wMt+uKZ2MDug2E:/39yHRKrLy2Ip4OCxf1mltdKZNX
MD5:	9FF070C6EB7760F09DB611BD2F5B318A
SHA1:	6F481AF69D8A7BD589C1BCA7CF3E4D60AFDB6E56
SHA-256:	35770C71A9F9FB00A1670FC84C4F2F3F8EC4D9B916B989797AC2617D12A9B234
SHA-512:	5AF364BB4016F9283287F3F4FDB7B672338A750AA50828FF5366CFB5726CC9658465C1B0405500EBFE4803F26A53960DAAA2D9F171072F809546F12C22FBB10A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................v....@..................................)..O....@..................x=...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

C:\Program Files\ReasonLabs\EPP\System.Linq.Expressions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.974962300073246
Encrypted:	false
SSDEEP:	384:96RW6eWSrjP9Z95Xa/rl9qX2Ip4hUTjdAA1m5wMBq5ul0fvfh+7sA:967iHRKrLy2Ip4mTxf1mlBqs4v7A
MD5:	8785C40B625CB1CA0EA659E020A7E6E7
SHA1:	4D3F0F5D090C0A0C203F5768029C527533475263
SHA-256:	7788B97CEEC5516732CA7D9B28811510406834C7C2CD61B61FE43218806C2B08
SHA-512:	64D1F2BECFDA8D4CC7E272BD31D3ADB8BC305A8765E20F8BE92F96E540EE84F3BDDBB0E1F4533640FCAE3C42E83B994E33F0B249593810246F9EC8A1199DA9C9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ...............................0....@..................................-..O....@...................>...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\System.Linq.Parallel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.014336643161851
Encrypted:	false
SSDEEP:	384:xSUP9W70W1rjP9Z95Xa/rl9qX2Ip4zRQTjdAA1m5wMBq5ul0dvfh+Q2eE:4UeNHRKrLy2Ip46Txf1mlBqsSvkr
MD5:	C0D9607847BAA5B0CCAA5665B1EA0CE6
SHA1:	F10332D5D80917CAA332291B9995AC3435FFB268
SHA-256:	358F5A8DC2E4D95D833E07425624450700157AC0193B43DEC899363777A2CBDF
SHA-512:	BAD4B3FBCDF7D675790BAC05A66AF1D3E8954370E9C40491C3693EDB069788ECE42D22CD1962E74DAD6D44CB32EFA6BDE7D7C1CA36C7549D5BB4EBE6853FF080
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................V....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\System.Linq.Queryable.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.009137368657855
Encrypted:	false
SSDEEP:	384:38yg07W0/W+rjP9Z95Xa/rl9qX2Ip4YTjdAA1m5wMBq5ul0svfh+5w:3BHZHRKrLy2Ip4YTxf1mlBqsfvr
MD5:	497A902D35AB8232116EE89D21E38D66
SHA1:	C4822D2D2B4B4C4F42AA8476C1B079CBE826D0AC
SHA-256:	89CC50C586627CBA755433C5F5553523EEBD098CC62390CF7DA3B01488301603
SHA-512:	2E7B6C5AC6F3B5B1D66E42BE50CBC1E0892D0802B5ACFB56FC4B9CC9722792AB16E192B395CC4936E5AA2C1C6E9E25C3997F2A3FEFE736141B77AFE0BF3B6906
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................(....@..................................(..O....@...................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EPP\System.Linq.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	6.976370301041513
Encrypted:	false
SSDEEP:	384:We1WmRW/rjP9Z95Xa/rl9qX2Ip4cqCjdAA1m5wMt+uKz2MDug2W+:WejkHRKrLy2Ip4NCxf1mltdKzN
MD5:	B559A8455E4270263625C155F0686265
SHA1:	67931AF4D0813B6827FBCA1944632E2771CF606E
SHA-256:	FB0B1D70F997EAB63CAA50A41CB3E164456DDB26C17547E1C874C881CFC156CA
SHA-512:	125BD456B80904A7CD4DA64B516FC2DDF1DAB1912984BD91E3101BDCE9EEBDE6B31BE644999BC2BF83604DEA1033D6D6B7B2588A013B3B55F7CE705B575175A5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................1r....@.................................p(..O....@...................=...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

C:\Program Files\ReasonLabs\EPP\System.Net.Http.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	198144
Entropy (8bit):	6.163642467505993
Encrypted:	false
SSDEEP:	3072:JeruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgNy:cW60VcTvakcXcApOL
MD5:	A6305F8C82C0CCF2D0BE25887BCC625F
SHA1:	BEEC702FCDA79322193BA4207F82924ACA0BB364
SHA-256:	9A1ABA67CD581E40A4DAA2BCA86276F5568608D011D0D2070BB83D76F80E4E77
SHA-512:	281FCFDB90E45DE12CA91EDBF9BADA4FCEA64F1416C37840F2C5D7F1AD55B14BAF23EB8C7124475A027AC7715FB9828249DAEF8F4E6519D12C801F49166199BC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ......P ....@.....................................O.......h................>........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1....0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2..J.Xo3.....J.Xo3...(...... ........J.XT....J...XT.o3.....o2....Y./....o3....%3 ...Xo3......Xo3...(.... ..........0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._......0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

C:\Program Files\ReasonLabs\EPP\System.Net.NameResolution.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.983124585784105
Encrypted:	false
SSDEEP:	384:g6ZWYLW6rjP9Z95Xa/rl9qX2Ip4q31vcCjdAA1m5wMzsPu9:g6l1HRKrLy2Ip4q3JcCxf1mlzz
MD5:	BC3F5D6D722774A570B3A1DE58E2EBBC
SHA1:	C579AEBDFDF288064705CBC2F1AD178E258AF039
SHA-256:	BC53C02FA05BCBBB8144E6D9B8AC036362332EED3B67A6FDA073C2D015D86701
SHA-512:	ABFE28100E4603F6C48AEB9C8E7F8D2C6559B533E566DED65A69B489C96D275A0137AB29CF43718972323E763B98B77273D30A8E1C6D64654859F03E9CE6766D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................R....@.................................T(..O....@.. ................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\System.Net.NetworkInformation.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21136
Entropy (8bit):	6.940990717284523
Encrypted:	false
SSDEEP:	384:A1W1WMQWvrjP9Z95Xa/rl9qX2Ip4zq7CjdAA1m5wMzsPuG:b17HRKrLy2Ip4zsCxf1mlzz
MD5:	360717B2996F9A21186CB6C6333015CE
SHA1:	D0EFE923ECAC3D152F0B34EBC693EC85D7A13092
SHA-256:	A13B2B226C3153B81D12DBC33A9966030D9330069FDDC9A474D35408AA452E7D
SHA-512:	CA010E618AB0EEFFB38D825A66FE90521EBABDDD8A91E8F04EE512D43C9910E84BE74FB759F64484D42B2E343BACAC33903F3BBCB0A51CC45125D1430B2C02B5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ...............................G....@..................................,..O....@..@................:...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files\ReasonLabs\EPP\System.Net.Ping.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	6.9839807358827395
Encrypted:	false
SSDEEP:	384:LdSWSKWIrjP9Z95Xa/rl9qX2Ip4YOCjdAA1m5wMt+uK42MDug22:ROcHRKrLy2Ip4YOCxf1mltdK4N
MD5:	A96BEA342F91D186767C7A03BC6D3A65
SHA1:	716D819F7DA2893C5265836EC11BE33951413F29
SHA-256:	0E7B4A7119FD0E19DB10BD9E3C9B7BC76486BDC88C5BC24CCE3B0CEAE5AF7EB4
SHA-512:	CC6E1CCABCCEFC8513395A5ECC3DBF03F539C6E5DE513283946D0FEF1FDD4789D223CC368F8A64DF38B6943B2165B5E1E7AE96324E515C27CA6C9449B8928C2A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................A.....@..................................(..O....@...................=...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files\ReasonLabs\EPP\System.Net.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21888
Entropy (8bit):	6.917946536927677
Encrypted:	false
SSDEEP:	384:EJEYA2WkIW8rjP9Z95Xa/rl9qX2Ip4/CjdAA1m5wMt+uK82MDug2T:EyYA8CHRKrLy2Ip4/Cxf1mltdK8Nu
MD5:	78AE99457050BBE396A1AD9F4369B093
SHA1:	35DED67BD7D99FA6E561ECC19BE92E96E4A7C32B
SHA-256:	3B0A67438822ABDC4BD07B61CA4E7F089E235885F1F98B72F0A10EFF9F7165A0
SHA-512:	0C1808D342F1A9F2E5145A55E02A48487D40A1F97FAA36D6853870310F728461C3D53F178C5E55000F6CCC132180D4F1FB033C814B1ACB1ABFFB5728E45E6A47
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...............................u....@................................. ,..O....@...................=...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l.......#~..\|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EPP\System.Net.Requests.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.024383643761439
Encrypted:	false
SSDEEP:	384:3JGWe4WKrjP9Z95Xa/rl9qX2Ip4vTjdAA1m5wMBq5ul04vfh+7L:ZmgHRKrLy2Ip4vTxf1mlBqsHvm
MD5:	07D1968A9D4796A602BDD87D1DE640DA
SHA1:	032E8EB6C6ED8802F444C1A3AF213ABDA6680C2A
SHA-256:	FF56F726AD14116AD4760AE1211A916B177B1796CC5CFA9C1AFE53A25DFF0306
SHA-512:	0D860913063F11CD5E17F78AFC48B7E11094AA3C5937CC5BF492DD4443A122E293AFACA9C6A4128C8BA6256AC96EEA9C8CD93F11FDA5C6525642F15CCBDBD98D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................B.....@.................................0)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files\ReasonLabs\EPP\System.Net.Security.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21376
Entropy (8bit):	6.949503664344784
Encrypted:	false
SSDEEP:	384:BdW1w3WesWorjP9Z95Xa/rl9qX2Ip4kjBdCjdAA1m5wMt+uKu2MDug2:e1wx2HRKrLy2Ip4k7Cxf1mltdKuN
MD5:	67F5D9F0420089641C4A586F67E4AD8E
SHA1:	46F305FAD2BC4394E204285D115C99911F0BD2CC
SHA-256:	6DE73632E3B5C91C65A8EF22D0DCDEFD5F4D79401D6106AC45EFF9FF62308452
SHA-512:	3EEC96DC2D36CAC18BEEF1E84822D25B2F4CD871FA53CC9A7D0919A450BE07D4E50AC1B2BCB76ACFE106D59025AA20311C8A7D3DB4D3F6621140F5030CC4088F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~... ...@....... ....................................@.................................,..O....@...................=...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files\ReasonLabs\EPP\System.Net.Sockets.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	6.767793329723504
Encrypted:	false
SSDEEP:	768:Nyp12Bhkg3qnV/sPMHRKrLy2Ip4ATxf1mlBqsQuvEk:y12zkg3qV/sPMHi/9MfIQs/D
MD5:	536E8F3C34410C25A83952179FCA8862
SHA1:	137C88DCD584D0741994FAA263B47359D10C018B
SHA-256:	730C10E5A6ACB38DD0D58B4EC4A296D609392385494EBBC77D064E60833EF99D
SHA-512:	96CCC78A577BB063ECCC91562E368C114845F7ED60207E95867DAD75ADD6EC261750D5EC9A2E44521BEE94DEC90D791BC97505C1B4A41835C11669E4A5C8A498
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............I... ...`....... ..............................`"....@.................................gI..O....`...............8...>...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o.......0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..L.......(....~....%-.&~..........s....%.....~....%-.

C:\Program Files\ReasonLabs\EPP\System.Net.WebHeaderCollection.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.012312379517373
Encrypted:	false
SSDEEP:	384:yHPAW1bWjrjP9Z95Xa/rl9qX2Ip4IN3TjdAA1m5wMBq5ul0Qvfh+C:qrWHRKrLy2Ip4I9Txf1mlBqsXv7
MD5:	093EEEDB8C88A75C6A4EFFC1424552FC
SHA1:	91B63883B48FE79F7FDC5276DB4875272EE8A8D3
SHA-256:	FAC3EE2E6DD6ABFEBA4043F69AFD6D8761CB96763DE2B4CBA0567E61220E8D21
SHA-512:	83BCBFCD0A5E5B0C37C52E25E9B4ED4821670D65FAFAA42F6807B683533BE9110E196C57F1B435A16C2373659BFFF5B1FFF4E11ABDA0C69A0B861AB4D4A9A8BF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.Client.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.990449962762576
Encrypted:	false
SSDEEP:	384:KNoqWD7WPrjP9Z95Xa/rl9qX2Ip4TaCjdAA1m5wMzsPu:KNofOHRKrLy2Ip4mCxf1mlzz
MD5:	FCFD3EDDED347FC06BA08FD9A4874E0F
SHA1:	8869063AAF7EBB264E3C8D8CEA1933364A9FE8B4
SHA-256:	3AC4F6D4D123671D92CCF1C70D594CF0DDDB20D10658E494994D23E686EFC5AB
SHA-512:	C6DCC2D0D280320F13E7212B03D672803F2DE684F98153DF9371777D403CDF2E328266858E0A3371E5E7C1572F3E9863AEC07E1C6FBE54841DD45FAE85BCAC55
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................-(....@.................................\|(..O....@..@................:...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\System.Net.WebSockets.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.016070802680104
Encrypted:	false
SSDEEP:	384:cGETSAWUEWIrjP9Z95Xa/rl9qX2Ip4dtaTjdAA1m5wMBq5ul0nvfh+4:ST1CHRKrLy2Ip47aTxf1mlBqs4vt
MD5:	48A9F245C1FCD9CD421526374C8FC42A
SHA1:	78D5DB17A57F476CD8DA8BE5E9AD8721CFB2638B
SHA-256:	C2D8D7D77B50991327DC9940B896306AAAA7A63D682EA708BB48F12EBAB1CE6D
SHA-512:	D038949B35F84ACEB6F405FB389820EC3241E712797C82F1E4FAB1E0F5734FF715DF24677ED81F67F5B5A67201ED4AC073D4E9CAB681EAF0EF808A9886560F6F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files\ReasonLabs\EPP\System.ObjectModel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.985562996876628
Encrypted:	false
SSDEEP:	384:lcDagtDApWSKJWnrjP9Z95Xa/rl9qX2Ip4FOCjdAA1m5wMzsPu:lPKBAHRKrLy2Ip44Cxf1mlzz
MD5:	3B88B9BE220E36D7F8729B488EE4F6DC
SHA1:	34BE6187882F312305C45D440BF427CD695013CA
SHA-256:	B0C016655C302D3DC25F369D6087D669B2D4EDC05CA48AAF9CBA48EF239DF41F
SHA-512:	5F1F48A77F4A46C4BD5275F5466AB24E830C965A80400C7CC314A888D904A90254E335BD9A0F7B08ABD9451DF4CF0E3B2966A99C3EA05C7A8FE3F9F228BED8BD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ....................................@.................................0+..O....@...................:...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files\ReasonLabs\EPP\System.Reflection.Extensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20864
Entropy (8bit):	7.004484897309742
Encrypted:	false
SSDEEP:	384:fIWD4WPrjP9Z95Xa/rl9qX2Ip4dCjdAA1m5wMt+uKA2MDug2GwW:f1/HRKrLy2Ip4dCxf1mltdKANP
MD5:	1D5F9A52D4F45D8A9410EAEDADBA77EA
SHA1:	EB5A23D3842F1BDFC074D9A0D47DBBFD8AA71771
SHA-256:	A531CD972442CF7A6C98446EC3CBB607B8F147B2DD762C97B2D4AA397DFEF300
SHA-512:	730CE31E52EFAE2882394552F7A8DE774C4E0887764CC0DAE5308F7F18D81D6FE5930106563D7AFCC7232216ABA444ADA618BB4A13FAD75C14D8E364A6C528AF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................=....@..................................(..O....@..@................=...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\System.Reflection.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.956883982952257
Encrypted:	false
SSDEEP:	384:iMWzQW3rjP9Z95Xa/rl9qX2Ip4UoOTjdAA1m5wMBq5ul0Vvfh+1f:i57HRKrLy2Ip4UhTxf1mlBqs2vif
MD5:	FD2AB5130049284E205256F6D21B4FF9
SHA1:	F5BCB68D775ED244205716AA2AF6BFC31C336DFD
SHA-256:	45E8FFB0FDF3B114E717333EA544E8438DE146778A7CFF9EEA1E39063E538011
SHA-512:	A9998074ED4F8FE09D667DDC2B9E8F15C338E07D2C13098F454C95E54610555C18909E8809820C88D1846FA52B783887C9B39030988945B339ED392729E97725
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N... ...@....... ...............................W....@..................................)..O....@..@................>...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files\ReasonLabs\EPP\System.Reflection.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.907071338300692
Encrypted:	false
SSDEEP:	384:wxDHKWAMWHrjP9Z95Xa/rl9qX2Ip4bYTjdAA1m5wMQhKuVdRm5vZf:4D8bHRKrLy2Ip4bYTxf1mlQh5VdRm5t
MD5:	8A252F1FB85086D035FAD4B976F84421
SHA1:	B2BB9B4CE4B6D25B35091B6765AC080D1779CBC1
SHA-256:	BB05FA6215A3B9FD9B2EB0F559FE7A30E944F03F07F7D79CDF4DDD7B57DEEE01
SHA-512:	8482D445DE1B26EBEE5E486C36C27B3FDFACC09AED8619F66EFF4106CC717EC393D2DB181891F58A6B696053AE8F5E5402F2B9D62AA5F3E0C3494E10CC850864
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...................................@................................. ,..O....@...................>...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files\ReasonLabs\EPP\System.Resources.Reader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.993420993671583
Encrypted:	false
SSDEEP:	384:cLNBEW6pWerjP9Z95Xa/rl9qX2Ip4UTjdAA1m5wMQhKuVdDm5vZyo8:cbMzHRKrLy2Ip4UTxf1mlQh5VdDm5UL
MD5:	5353D2CC4393D2DE1EAE1A00B7848BB9
SHA1:	017ED99087BCE6A35826FD861E555869D3B1550F
SHA-256:	5734A2041DAFC60696583043AD4E5613306C760B9F895F80E58C049AB63B7EB0
SHA-512:	A856661DB9B3068B6D64F202B1C9C71A0129658CDD6F25C6E3C219A3CCA63AB20C708ED12B6C0FBD17BF6EB13C27A04F6BB8F74DC22040EA3B6D6DFFC9603F1D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\System.Resources.ResourceManager.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.0244524304384015
Encrypted:	false
SSDEEP:	384:CKkHKW/tWNrjP9Z95Xa/rl9qX2Ip4OeTjdAA1m5wMBq5ul0ovfh+YV:XuWHRKrLy2Ip4OeTxf1mlBqs3vN
MD5:	26478EDBE547D0DBDDCAC468D8A4FAE1
SHA1:	FE1B850C11229BC091E725FE4DB6EC379030AE40
SHA-256:	ECE642BD2BB8CE7B18583961C68C1F050DC639C7459581CD4E3C4068B6A67516
SHA-512:	E4AFDD796F8CA6FFDF2B57B761C78A872DF6A881C30576F36EF5EAAABB58C26C53E9D1B220BE86B9CBED28ECED2E14BB10CA8BC29403A159466E7C6235207286
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................].....@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EPP\System.Resources.Writer.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.978820551680673
Encrypted:	false
SSDEEP:	384:BLnfIWqrWXrjP9Z95Xa/rl9qX2Ip4tf6CjdAA1m5wM36QNuZLQrQY:BDf4GHRKrLy2Ip4B6Cxf1ml36QgZS
MD5:	0DC9CCC1D26214E4A95847F7C6335926
SHA1:	A7F4E12DBA444C5EEA2624F7A88F77142AAA74FE
SHA-256:	A739636CD6CB162D927E6C203F4BA8E9164E5EB44E1AAD9F045470B61CEE39DF
SHA-512:	A3DB6DB5710C985B78F3FF706FAE31C797937A3AE5B50439C7C18A2F222000ECF85686C86B8FECE69593972C6A5E1DA327A200ABD8DC9D3DE5E163143066BFC1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................B....@.................................D(..O....@...................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.800053693288702
Encrypted:	false
SSDEEP:	384:eybU8ndrbbT9NWB2WTrjP9Z95Xa/rl9qX2Ip4j/TjdAA1m5wMQhKuVd3gm5vZ2:ey5ndvWZHRKrLy2Ip4LTxf1mlQh5Vdwz
MD5:	0F9957AD9E020ABF5F3B4B06E5D6B953
SHA1:	AF9BD1B21D22421D6B95C191007267393F9FD8BC
SHA-256:	381F5473A17720FBED4F960867E9457C035EE22F76AEEBCEB3DBA60009A0B45E
SHA-512:	19611204AC5D1A64D6E8726FCBF83DE84BAE8C6C35980D3EBE2711ADF3B219AA39C887197B1CF8369719AC398AB3CC56AF3F0B831BD79D4ED84A17F025894C79
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ..............................o.....@..................................6..K....@..............."...>...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v...#.;.-.h.......0..#.....a5\|T%W...].!.%'..9.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..............0..................0...............*...0..............

C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.976445569058889
Encrypted:	false
SSDEEP:	384:jna8WK1WWrjP9Z95Xa/rl9qX2Ip48YTjdAA1m5wMQhKuVdygm5vZssqy:jna0/HRKrLy2Ip4PTxf1mlQh5Vdygm5F
MD5:	5862163035701C1C8C83E0A00EA0A4EE
SHA1:	69C1AFAF61FA70CB70EE4E638B610E2350C88001
SHA-256:	2CB315BD1C4E9050C35F6DD253C9C499FB4AACB76593240438B2BC56792E3B92
SHA-512:	9DD8FE1B96238310DEA332699BBD062EB89924C37C2DB0FB1B7ED0C7AF9A4627A2B8BFEFD3A608449033F401F191C51F5ADF4170A3AE4120F5A3B718195FC51C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j... ...@....... ...............................=....@....................................O....@...................>...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EPP\System.Runtime.Extensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.9265541297950595
Encrypted:	false
SSDEEP:	384:4BSWITWprjP9Z95Xa/rl9qX2Ip4Iky6CjdAA1m5wM36QNuZL:46YHRKrLy2Ip4Ly6Cxf1ml36QgZ
MD5:	806ACB0354C1DE48BB61DF96E2FAD5D1
SHA1:	ACC1AE918D897C8BC3279B6C1F6A96485546AB86
SHA-256:	AA84EE4FE186F4CCFBCAFACAE30016A8CF877787C56E05CC6B12D9C228E19831
SHA-512:	20872A5896FE19C087E9C374410108BDB3074D7C284C2BF7F0CD09DD207E3FE141B1637152C56C98B1F29178604CB43C2804073588D3E03C8AF89DD64B8B49B0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0................. ...@....... ...............................!....@..................................)..O....@.. ................:...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................\|.....\|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\System.Runtime.Handles.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.024914500099341
Encrypted:	false
SSDEEP:	384:C88cIIWNoWLrjP9Z95Xa/rl9qX2Ip4z/6TjdAA1m5wMQhKuVdcm5vZ97CU:C9cUbHRKrLy2Ip4GTxf1mlQh5Vdcm5P
MD5:	1DF480B3EF676A09D9DD11890C70EE66
SHA1:	8E827424C2B2766D71A36742501F4B631C34FD6E
SHA-256:	D2C88FE15D78332989A507E36EA1A8A2C4CC8B25BE7500C855E9F76D4991585B
SHA-512:	4E3FF3B1C6A2402A69A435D207A33E7D504683E0F8FE7F25D6E31EC04B717495F065FC2DBF513F8DDE7C27B520CA864CC501D24E69C247FE1E4F1D8CC92A252F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ..............................2'....@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..........................................................c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	6.790350767912065
Encrypted:	false
SSDEEP:	768:crmoFmWdO9HRKrLy2Ip44ODTxf1mlQh5Vdkm5n:caEFdO9Hi/9/BfI+vkGn
MD5:	562379760F9E686652297B3180E05C1C
SHA1:	24B16EC8CF800C81C789E1F279E64CBC55BAC596
SHA-256:	24B63A98A0D136BACDD057DBFD173A95C10EFCF706A71A51942741983C383EC8
SHA-512:	C60057EB8D985204E0816A397252668F8CCD5170961DDAE052E67E4EAD43F470780D79D6B7602E35455EDC72DBBCEEEAD50241711B87BC3E1DD0FD328E77609A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ..............................b.....@.................................PE..O....`..x............0...>...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r/..p.(..........(....2(.....(....^~....-.(.........~.....0..........~..........(.........(....-Y..(!....{/......5..,

C:\Program Files\ReasonLabs\EPP\System.Runtime.InteropServices.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	6.86244677413669
Encrypted:	false
SSDEEP:	384:O09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsz:3OAghbsDCyVnVc3p/i2fBVlAO/BRU+pF
MD5:	4B9E6A397BAF62480D1D642C539982D2
SHA1:	EFDBFF45B098CE1A36F08D07D4F70B474FB29B54
SHA-256:	A602F22DE6691C1ECDE9CB9A186541A60759B87AC3C1FD281BD5E5FF9CE7D64D
SHA-512:	DB65D862A86567262FF79009C08139C280CE0912A015351118151E1AB64E5CD88906954285707AEE38E180EAB9B2DBDA1D53F611334EAB1F078992826EDF6F0C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ..............................L6....@................................. 5..O....@..P............ ...>...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\System.Runtime.Numerics.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.98121423453462
Encrypted:	false
SSDEEP:	384:G7W6RW+rjP9Z95Xa/rl9qX2Ip4+C6CjdAA1m5wM36QNuZLRv:G5rHRKrLy2Ip4z6Cxf1ml36QgZFv
MD5:	F030F3E4D0EEE23DF31E5C684BEDAD97
SHA1:	322FB4F7CFC4BB2DFADC2F71B1216B2A6F82F0D6
SHA-256:	37073DA1F5A20BF1FE1B33CCB42F0B29D32196241BFCF1A3A2A70FD601EDF1F3
SHA-512:	0AD034960ABDFF4FBF506DAF87CAABB5DE6F79C0394D019FC05A8A5D90D5828FA938E96868DC7E058E04FA8CCD199DD5CEE7900A03008345F791C6DC70417C0B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...............................>....@.................................T(..O....@...................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Formatters.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.05428802807611
Encrypted:	false
SSDEEP:	384:qI5HeWFwTBsWNrjP9Z95Xa/rl9qX2Ip4JKTjdAA1m5wMQhKuVd2m5vZL:qI5HFwTBlHRKrLy2Ip48Txf1mlQh5Vdl
MD5:	799BBB26B86D38A7F621AF8FFFDD8E01
SHA1:	CEC6F288C85E4581CB8876733E3EE6681808F249
SHA-256:	E6098F2253327D950B81076337EE0B92667EF6508F41F527372F7FCAB57E36F1
SHA-512:	AF67B37AE0BBDB17FB0A798D085630904CD23D0E56FE502E4CDE8B984FCCFCFA1CFD82BD7C8BCD20CE2E316568DFA5C49FE34E73EBC4C5393275D40807237E50
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................u....@.................................\|)..O....@...................>...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.032938959830146
Encrypted:	false
SSDEEP:	384:iAJpVWbfkBnW6rjP9Z95Xa/rl9qX2Ip4scTjdAA1m5wMBq5ul0zvfh+BzR:iAJpWfkBdHRKrLy2Ip4scTxf1mlBqs8m
MD5:	A8FFF498E33FFB86C678046527186133
SHA1:	A9749F87CF0F7FA8685EFE1F22DCA999C56E6475
SHA-256:	B5303D326DC0D0CA787EF8569AAA6F2EB15A73BC0B901920CCCEB00BFE16567F
SHA-512:	57AEED077A4A27CD08AC7221A3A1C3D5B938AE07B6E1A9896339651530B9B438C7A5C61BC7C9ADE8F22AC71938240F91F7B8B44818E2469A11124A29E45D9E1A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ...............................u....@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	6.744878476669213
Encrypted:	false
SSDEEP:	768:W1dyAqgQBfqyTBQHRKrLy2Ip4kWTxf1mlA6RZy:YdK1WHi/9kWfInRU
MD5:	CC2E63CBCBB9960B8D20AB217B6753D8
SHA1:	792ACA3B73401780A272EB8F0B2AD242E2057C22
SHA-256:	8816399ACCD5340398DFE2825666C0EE95CBD7A10A435BE9BF3F4F0C5C42A845
SHA-512:	27FE73E2D221E60B48BA5D3876F685C33C656E1D78CB1B2E44DD90C232621B5CCB32D917261D9824D7D9116BF5E6BF5B551D14B540E6AEAE5CAA4CF3AACAC16D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ..............................o.....@..................................8..O....@..8...............>...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......\|!..l............1..p...X7......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

C:\Program Files\ReasonLabs\EPP\System.Runtime.Serialization.Xml.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.862001295533237
Encrypted:	false
SSDEEP:	384:hpsBljcZQIVI8CNwbcyMWs4oBOW9MWG4tBOWIrjP9Z95Xa/rl9qX2Ip4qyTjdAAs:XsPMQMI8COYyi4oBNw4tB4HRKrLy2IpH
MD5:	91F23081484BE9044502E179DFFD0B5B
SHA1:	C8767E1515A3B453B7E9EA386CD892B6BB9566CB
SHA-256:	CB21115EEC55C3B2998D4E820C0B609535660CCA8B8FFBCBF044CD6A879AB2E5
SHA-512:	6E202B60FC061D7C1A5B97ECC69381F902EFF7CFD2E61D4C90050190CADB1D0FA72D3492628F543C5E9BAA43E8B664D407BE3AB11F9E0A9B3C5423639BB4B91B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ..............................,{....@..................................3..O....@..............."...>...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s......s......0...........o....u......,..o......0..%........s..........(....r...p.$o......o....:.(......}......{.....(....z.(....z6.{.....o....:.{......o.....(....z:.{......o.....(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

C:\Program Files\ReasonLabs\EPP\System.Runtime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	6.563794164270402
Encrypted:	false
SSDEEP:	384:nbhigwLAuZtM66g/Id7WVXW0rjP9Z95Xa/rl9qX2Ip4HTjdAA1m5wMBq5ul0Avf0:nbhzkKs7HRKrLy2Ip4HTxf1mlBqsTvBC
MD5:	3D4BB4CA05BA61CF938055E75C74E93B
SHA1:	688F6D9B94C76CF251632BB61642CBC4BFD973ED
SHA-256:	4C4FD044311E64557A9C5D48C86A92D0B7A6C7A3B36B4657762F9EDC0AD01973
SHA-512:	297CCF91CEA0E1DF52490A696413BE638B9C66562C703B18EFAA9803FC903D00A116B4335ADA3C586953E4FF936277FAC077687EA19B260C57F5FB95427A01C7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0............"H... ...`....... ...................................@..................................G..O....`...............4...>...........F............................................... ............... ..H............text...((... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8....8.....8.....8.....8.....8.....8..........8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files\ReasonLabs\EPP\System.Security.AccessControl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	6.258801189412649
Encrypted:	false
SSDEEP:	768:yTIrKFsESvNsStEpOqPOmizx1qYDpjhHsH5KDs6L5C4ioDElwr1ZWBky351iQHRa:d6lw1IbiQHi/9VSfIQsCq
MD5:	C60DB20B29E88958D9465CF180B78944
SHA1:	354F0623DD0FD9868B27758737FC25B96C8E0B97
SHA-256:	68DD8B93139014803DC11A5398CCAFB1ABF5450635AB4FA6E5DE7C27098ABAA3
SHA-512:	E17EA0E31A2F246C096E7D0CC94A6B20789AD2BB3A39CE28A89DC5A310A044F0595CDD1CDBE3CB25A0BD01864D4016AECF277F637E3AB853C078E8067F723EC1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..J..........>h... ........... ..............................& ....@..................................g..O.......h............Z...>..........8g............................................... ............... ..H............text...DH... ...J.................. ..`.rsrc...h............L..............@..@.reloc...............X..............@..B................ h......H........#..8)...........M.......f......................................j~....%-.&(7...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r9..p.(....2r...p.(....2r...p.(....2r...p.(....2r3..p.(....2rk..p.(....2r...p.(....2r;..p.(....2r...p.(....*2r...

C:\Program Files\ReasonLabs\EPP\System.Security.Claims.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	7.002325554132072
Encrypted:	false
SSDEEP:	384:1UcX6W9aWsrjP9Z95Xa/rl9qX2Ip4LKGY6CjdAA1m5wM36QNuZLin:1UchwHRKrLy2Ip4LKt6Cxf1ml36QgZ
MD5:	0347D6FA68EF104062D2F03BD2836C51
SHA1:	907FEBC4AA739CCED0AFAD90CB2457335CFB174F
SHA-256:	5F5BB112A5ADC3D3999DEB912D8C428EECDAAD68CA3B65FE62492B82655D7A4A
SHA-512:	093F240E2C1F8857BB991AF1BE4ED60DCFC9C9D28CF8A660B7822474408436B9D05C0579F8B3644BA1A74876C4D0DB1C0F14DC127637B4C7096B5B168FFAD3A3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................:...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Algorithms.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	6.171207295782074
Encrypted:	false
SSDEEP:	768:+oBj7kS+8mjvHTeaWKs0Sd4eehHRKrLy2Ip4kOTxf1mlBqsqv/e:FPmb9WKs0PeehHi/9vfIQsqO
MD5:	368CDE2C1517D0370689048DFEFBBE01
SHA1:	18B56375A8FF8D0B5A51C2EF09154F4F598F4966
SHA-256:	D100C10F273171C43BD6A6DB1F08FB8EF7E69D0A65470566EFECAB68AD5EE150
SHA-512:	E25E29290F49E71B4291042D255F24FB877D04FB4B56B76249DD6188C601E4201CBDA6EE0205CCD58B84AF26D43B4E7755F2EE62AF5196E83A20025E4F1198D8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ....................................@.................................u...O.......8............x...>........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rI..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r9..p.(....2rm..p.(....2r...p.(....2r...p.(....*2r=..

C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Csp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.036231673830498
Encrypted:	false
SSDEEP:	384:STI2pWPzWkrjP9Z95Xa/rl9qX2Ip4STyTjdAA1m5wMBq5ul0fvfh+7U:SE3zHRKrLy2Ip42yTxf1mlBqskviU
MD5:	DE4C7C34DE0EE77E22BE7BD4DCB12EF6
SHA1:	F292FAE6FE6443516156BD63CD424CCEE1162F76
SHA-256:	6D1B52839B5C28352B4B5DC63D40253BFC9A05C1D93F76042AB2A0F324A5C88F
SHA-512:	1D847BE48A9F9370E3CA239314CAD3C20322033C52AA74568F1F2A24A5C4D053510F3F93C53B0CDD0B16400D5D57743527E5E2F376EA52D14809B9C13662060A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ..............................lw....@..................................)..O....@..`................>...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Encoding.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.043752496308506
Encrypted:	false
SSDEEP:	384:zcezoy4W04WxFrjP9Z95Xa/rl9qX2Ip4wQoTjdAA1m5wMBq5ul0gvfh+9o:zBzoy+fHRKrLy2Ip4wQoTxf1mlBqsbvj
MD5:	C706B0668387A2ACF3E8C6E2A11390EF
SHA1:	6108CEDFE1301AE1A381AB15D05E6F1ECABC5885
SHA-256:	ACC37223E0389865D94131FF72E7E9A81A468A73F5E648E66496E11ADF68D72F
SHA-512:	4B880649BFFA7B8DBBE4EA2CE23F2A4D9462518DB1A41C44A2D64CC75D327032FC7A2C4C7159D99BB712E4D0B3B872F5F5B507951A467FED0063D810C1CD7A10
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ....................................@.................................,)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Primitives.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.964569325909888
Encrypted:	false
SSDEEP:	384:DH/JWKpW5rjP9Z95Xa/rl9qX2Ip4psrpTjdAA1m5wMQhKuVdbYm5vZdb:DH/jyHRKrLy2Ip4WtTxf1mlQh5VdMm5
MD5:	16F83A3369AFD8F913FD9FBF2BE2E09E
SHA1:	DE0D9DF9581050AEEC9F77CAD32D452E021A6A72
SHA-256:	29451952BF4887D95F2F34A47EB5F1487B0371B93D14CBBE3AB12634356CC505
SHA-512:	68106DF7EF3C8D23FD4C5849DD8575C6CE23821B408BEC175CCE61D5D0A77BC4D1E7B016942117B7BEC588762A9A1CA8A39002F63A5B1160EC20ADB76F391FED
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."... ...@....... ..............................2N....@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.918646557026692
Encrypted:	false
SSDEEP:	384:KTjbocNsWMhWwrjP9Z95Xa/rl9qX2Ip465TjdAA1m5wMQhKuVd4m5vZXVy:aboYyxHRKrLy2Ip465Txf1mlQh5Vd4mY
MD5:	053CDE539558C043EF0D98D277A225E4
SHA1:	433526427E83F939C8074C326367703A94A5D6B5
SHA-256:	923C9B96CC5F054C309816CC90C0A1B2C65E9432B2E38AEE50CCA1557B051FC7
SHA-512:	0F3150292BF8BB20D1C106251E8C670AC959C4A42CE84475DF0BF90010BED07D8608561D5F87CBE0045E1572800BC324296E532070770521D0A62B001F234042
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ....................................@..................................-..O....@...................>...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....x.......#US.\|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

C:\Program Files\ReasonLabs\EPP\System.Security.Principal.Windows.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	6.890329778208696
Encrypted:	false
SSDEEP:	384:ResTEpq4YiZUlW/AWXIZWWAWXkrjP9Z95Xa/rl9qX2Ip4LF0TjdAA1m5wMAvru4x:FwTiuHRKrLy2Ip4LF0Txf1mlA6XfZ9W
MD5:	C5B6F82F05364033B9FD4B5204E34F26
SHA1:	9255FEFDDEE9FE6568B91665ADA3C19C3246D480
SHA-256:	24DDDE4EB0276C3CB82E3FCC3B5A4EAEA32867004A7D2EC0F885ADAE06A6EA66
SHA-512:	9F86A85915E45DFD7D7987AF92A895AD73754C9AD4245040FBE14A3F343C71F7995F7A754E8E3DC6D1A1B3DC4950846D95CCE604679BA3C7D17EADBA6AD07B0D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..............+... ...@....... ....................................@..................................+..O....@...................>...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ......................T......................................BSJB............v4.0.30319......l...l...#~..........#Strings............#US.........#GUID...........#Blob............T.........3.........................................._.........-............./...../.........O...........I.....f........................................._.............................y.............................!.....).....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .....&.

C:\Program Files\ReasonLabs\EPP\System.Security.Principal.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.003345288923658
Encrypted:	false
SSDEEP:	384:MSKiWIhW+rjP9Z95Xa/rl9qX2Ip4YZh4TjdAA1m5wMBq5ul0Qvfh+r:MSK8jHRKrLy2Ip4YZh4Txf1mlBqsTvC
MD5:	BA49CEC30FB0DB7466AAA605878CDDD1
SHA1:	0C7F6967FCB69D76EC8FAEB8CAB1BFEBB1DEF616
SHA-256:	45E5B19DFF471EF416B6F46B42AD3FDBE4C58DAB33C1C12D3D0D71982E62CFC5
SHA-512:	B10CED8BB341E51A82CB395B072B0960AF5B18BD93E916B1D82373CA74F1028927245204F9B03A461AC08A73B5B61955DBFE15CA87F61A7C8881EBC6494A65BE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................:q....@.................................t(..O....@.. ................>...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files\ReasonLabs\EPP\System.Security.SecureString.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.952617106985068
Encrypted:	false
SSDEEP:	384:40KbZWApWmWTpWNrjP9Z95Xa/rl9qX2Ip4DThTjdAA1m5wMBq5ul0Nvfh+Vt:nKRyiHRKrLy2Ip4DThTxf1mlBqsqvkt
MD5:	24046188160DAD513AD213EEBB9BF585
SHA1:	53D4E09F3F739D2A8E5EB59D156A52A7748D106D
SHA-256:	B28ED96F3D699D5A6B1B88A3E4E2D855945C8BD9F10EAE62F42A910FE7D31377
SHA-512:	5D5462F87D9720FFFB9FBA73DA246C25475F854B65AACDFC27C302570DF3290C3EFE1CEB2A9CF9B02CDA8327B4C7A951117DA08853D5056CBBD341D281856E5D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ..............................._....@.................................>)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(......(......(......(....BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.Extensions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.025793572253596
Encrypted:	false
SSDEEP:	384:yb1nWCXWbrjP9Z95Xa/rl9qX2Ip4fTjdAA1m5wMAvru4LTyZIjWYzF:M7mHRKrLy2Ip4fTxf1mlA6TZfYzF
MD5:	4C471F1FA1733D378B9F76125EA13D4D
SHA1:	DF3165A865220EA5AF741F7293CC131F6D58A375
SHA-256:	714736E69B61DAC9D6C3EF6C7D36AAA8ECAB2D1B02DB018C6FA24E5641AD1424
SHA-512:	70A1ED5B34BC2D5ABD955C1B37BA3C6D0C8AB4509E08263FC469BC134946E6188E593BB9E129D735B09F0FA5AB8B2EA3199558E5B0F2F36C7B16549D7808A1C6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................;.....@..................................(..O....@..T................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EPP\System.Text.Encoding.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.950125579722336
Encrypted:	false
SSDEEP:	384:5NyW7TWXrjP9Z95Xa/rl9qX2Ip4cTjdAA1m5wMBq5ul0uvfh+0PL:vf2HRKrLy2Ip4cTxf1mlBqs1vfL
MD5:	D93D4BFA4526FB0C604410F445BA6C83
SHA1:	820E6E420D2FE3C97F0B22489EAA95449F6F08B2
SHA-256:	35B54B143B778769511843B4C493952F63B5F08F7A5947885B3CCFCB349894F9
SHA-512:	2E892D8C05337DD7BC553C29A70462B8548159EBFACB548DEB7120000845792DDA83E4B801D8EDEAD4F20100EFB28C09C5BEA33DE1BD814CE0CA9B494F49ACFD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2... ...@....... ...............................1....@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\System.Text.RegularExpressions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.044767989073116
Encrypted:	false
SSDEEP:	384:k6Rb32WVzW5rjP9Z95Xa/rl9qX2Ip43cVTjdAA1m5wMQhKuVdUm5vZ4:zRb3dkHRKrLy2Ip43cVTxf1mlQh5VdUZ
MD5:	CCC96D3D8E531D7411636B2D3F24E55C
SHA1:	57FEE930236DFD4571A68B41657DBA8FF08614B4
SHA-256:	7EC1720789541966183A2538BBD46D271333A7B382EDD0A2B142F49BF123A20E
SHA-512:	8D9EB4C6F692B856DAA3CA60D1912542F580B1692E8EE31A16641EB026CFB156630B9FECDBFA19F283568AD99CC92D35E26AFA8E8357059FEB186F25468CDEC4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................M.....@.................................t)..O....@..P................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files\ReasonLabs\EPP\System.Threading.Overlapped.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36496
Entropy (8bit):	6.6902083286878415
Encrypted:	false
SSDEEP:	768:du5I+sqOylryry8qqIfUc7a5AHRKrLy2Ip476Cxf1ml36QgZI5:dYIVBpry8qqIfUcm5AHi/9zfI5gC5
MD5:	4D8FD560D264D9D2F9CC360809053DE8
SHA1:	20F80B422BF59D580A59514D2F06EB1E00316553
SHA-256:	555962091DAE5AABF44DEFCDDE0A2D98CD46E94DDC6C199AADD73DE08DA5B93B
SHA-512:	B911AFCA1DC43D010FC8053451DB2104982FC2F7E69CF7FB1D136D1AFAD08BA9D5AB54BD36F11FB4BC7D5117EB699A77145080EC3CA3E8EE51AF2F5B932589F2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ...............................P....@..................................c..O.......x............T...:...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rK..p.(....2ry..p.(....2r...p.(....2r...p.(....2rc..p.(..........(......0..;........\|....(......./......(....o....s

C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.Parallel.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.02247507672201
Encrypted:	false
SSDEEP:	384:fvn4HREpWiQW3rjP9Z95Xa/rl9qX2Ip43ETjdAA1m5wMQhKuVdnm5vZWM9:4SXHRKrLy2Ip4UTxf1mlQh5Vdnm5v
MD5:	1C6034027DF04E156FF60B0F09A12DAC
SHA1:	651400F7A2F86C4C6273D1225C19631049894DCC
SHA-256:	358A76309D3D26CAC4C021E8FC5DB847C9D45FE6A1474B0789004E57B9BB3135
SHA-512:	2618C604EA80AE5210AAAA4ECFCF12182475252642EA86F709CA8DFF1579909F83E4B342D2471A567674E48C2F2BEB8E9A2241FC1EB4CEA2CFD4C237E7EAC473
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................VX....@..................................(..O....@..P................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files\ReasonLabs\EPP\System.Threading.Tasks.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.946165235196381
Encrypted:	false
SSDEEP:	384:r8MjKb47T3UCcqFMkJ59WdtWurjP9Z95Xa/rl9qX2Ip4jJoTjdAA1m5wMQhKuVd8:wMjKb4vcGdOnHRKrLy2Ip4j2Txf1mlQ0
MD5:	FD32901AD58EDA4E8BA9A56187C360B5
SHA1:	090398A1AC61FA530596DF1B6C42CA651F698A27
SHA-256:	37A4BC0B6C9873F1FA36F1372C0A2AEABA038430D8CB649151626A2CFE5EE972
SHA-512:	DFE1101D0B6F56ABE153542B90A2F766E3C420DB7279A77652E560CD8ADD998A56838AEAF170F18E27A2B82A9372F1CD93C9AEF33CA8BBDF241724B7315FCFFC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................4b....@.................................`,..O....@...................>...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\System.Threading.Thread.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.015976194477571
Encrypted:	false
SSDEEP:	384:3zyNXd4+BW6FW8rjP9Z95Xa/rl9qX2Ip4ne3TjdAA1m5wMAvru4LTUZIjP:mzZHRKrLy2Ip4oTxf1mlA6VZk
MD5:	939491A792A9A207C16E50C4D76D63D2
SHA1:	0CB73A19297E30369703D1A57EC68648B349CD38
SHA-256:	3F9461B26DA4236B975BF0DBA56B6E9FECBD333BA0E84AC9DABCE7D7F8968DCE
SHA-512:	143E0650F4876996337AA870659955D705DEA24873BD614A43B0D36B558F0D13A43258B071FA71317609E5A61C83C7E588AACD5FE0BB5CA214B2AC0CCE186C93
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\System.Threading.ThreadPool.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20104
Entropy (8bit):	6.999581586913751
Encrypted:	false
SSDEEP:	384:Wvs2Q3HKJNrWWRWkrjP9Z95Xa/rl9qX2Ip4By7mdCjdAA1m5wMzsPuO:WuMRHRKrLy2Ip4B3dCxf1mlzzO
MD5:	1F4B2EF214A0E6E0A74D9F7AD997FA55
SHA1:	70D9D29C100A5E1DE5A55511FEDB3D320F1336F1
SHA-256:	6A37AE19E656D95778D917D68686994C0BF899CF4033646B12CD2476DBEEED2A
SHA-512:	2101C4681DD9F915C617215BFB3BE986D203A837D906DA4EA6D49C401B03E5322409FB0EBC6C44E77D812A83F8328F0138F4E2B8097BEAB6232D6AFCBBD65DAE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...............................!....@..................................(..O....@..4................:...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files\ReasonLabs\EPP\System.Threading.Timer.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	6.980722029632896
Encrypted:	false
SSDEEP:	384:GFz0Q6gcqRhcsMWdMW0rjP9Z95Xa/rl9qX2Ip4bbkOCjdAA1m5wMzsPu9:GFz1c6KHRKrLy2Ip4HPCxf1mlzz
MD5:	69074C045653E6A61DB94CC48F74778C
SHA1:	98852A0E6B68AB3E1E28F192E57C1EB77C15B77B
SHA-256:	F52AA52FCF186B83B56500B2D50F6B3A72C4DDC9CB6E474CDAAB9FAF5E64EE87
SHA-512:	C01A3DB152C3B3DD03C92B126985A70803EB4C349EDDF6B32F90D1E7C0845D6ED57B06BEAF17EC4B4777491BF04D059FEB0D7B0966D05E1C4D757CCE8894D74C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................@.....@.................................L(..O....@...................:...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\System.Threading.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.910677968918354
Encrypted:	false
SSDEEP:	384:K6xWA3W4aW/NWUrjP9Z95Xa/rl9qX2Ip4OTjdAA1m5wMQhKuVdAm5vZ9q1:KaBJHRKrLy2Ip4OTxf1mlQh5VdAm56
MD5:	418BE29B62A24A1ACA13E31A72415198
SHA1:	31BD7839E973C5ACA50AD50AC8E1FD3BCB85994B
SHA-256:	4A2D205DCF3607CA4B9723325B94ABDF0E795FEE5AE357B76C6BA47422F642F5
SHA-512:	CEB86E3ED47AF6B4C78AA5391E041F24B0C703DA720BE68CB30344C770336CB7148BC1872792445092D3789A0D70655C92669DF7B5720C879E258EFA6DF4065F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................RM....@..................................+..O....@...................>...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .............................................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files\ReasonLabs\EPP\System.ValueTuple.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	77960
Entropy (8bit):	6.069856591381686
Encrypted:	false
SSDEEP:	1536:L784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSATHi/9XfI5gs:L7NV8v36tI0XCKAv5h
MD5:	062043C4CBF910C829E24CFE5941A9E5
SHA1:	88527923E47525DA468EC708D3D4E6FE0F044A0F
SHA-256:	BD7B95E588DC552A4092D5CA917E75FCC0643DC00A90C9051DA0B4EB24FFFF71
SHA-512:	FC22DE7A246FC6BC56A535F7AAB379D0F46CD4AA5C91DA1F5022BC9DD7736E7EEA049FB5A5778366EEDD2C7D663C03F4A09097FCC7E2925DA5FC51C6D19AAF67
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`....../.....@.....................................O.... ..P................:...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Program Files\ReasonLabs\EPP\System.Xml.ReaderWriter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	7.004031307297091
Encrypted:	false
SSDEEP:	384:mr97WquW+rjP9Z95Xa/rl9qX2Ip4Q9ATjdAA1m5wMQhKuVdqm5vZaj:mRJGHRKrLy2Ip4jTxf1mlQh5Vdqm5Uj
MD5:	D92A0F1DDF807D1BCC3EB3E6E166690A
SHA1:	CB158BA1F7AEB5CF6EE80E7F31421F4F6E6A91DD
SHA-256:	F8C65EBD07C69DA5577515174011E704E362611E6B092E3E0017E6913325DED5
SHA-512:	AECB1AC24F60332D763D116E022A848E9F0F2A4F912E46D1D6247C262D83CD5E79E5916AD5AE05AF38C62572EC79958B9D0AADCDD716057229167D9ADB081874
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ..............................t.....@.................................\+..O....@...................>...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files\ReasonLabs\EPP\System.Xml.XDocument.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.968105530882379
Encrypted:	false
SSDEEP:	384:G16eWLDWxrjP9Z95Xa/rl9qX2Ip4lTjdAA1m5wMQhKuVdem5vZyYB:C6LgHRKrLy2Ip4lTxf1mlQh5Vdem5LB
MD5:	60C26F8A9719F7B4FB617429DA9A3158
SHA1:	376356D56F21FACAE15172E80C75A5C49122246C
SHA-256:	F1BFCBDF1CAC8AF8295EACCB3F8E66218A95F7FFCD2CF8D5EA4AD0CE9C5F9D83
SHA-512:	0F5FF0C16C268DB1B7FF0E71D811239F8007126AF21146693457CD6787E976F38F5269908D0B708FFACC105F6D6AFDADB65BF960A0D72023F4EB6600E6DD3963
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0................. ...@....... ....................................@.................................\|..O....@...................>...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.XDocument.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21648
Entropy (8bit):	6.936296264713254
Encrypted:	false
SSDEEP:	384:c8G4YC2W+wW8WpwW+rjP9Z95Xa/rl9qX2Ip4jdM6CjdAA1m5wM36QNuZL0:/GZ5sHRKrLy2Ip4jq6Cxf1ml36QgZ
MD5:	4ACDFE5373BDCAEF6F79F9EB64DDEE1D
SHA1:	C090D98D272A627525F9D1166E63A5E2DD799D2E
SHA-256:	2ECC2C6B418B04EAFD00F6C2C2278FB13DA6E853194FB56478D315655DF8FBA3
SHA-512:	5D740D96FDED5409FD543399D5CFF52D6F9F42FAC1B4CB269E8241921FB7EB5A96A65B273F0F26478C18177D704ACF4BC2FEBFB69A11542709D811B727901811
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ....................................@.................................z+..O....@..x................:...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P........................................s....:.(......}....2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

C:\Program Files\ReasonLabs\EPP\System.Xml.XPath.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	7.038633483362159
Encrypted:	false
SSDEEP:	384:L6ziqTEkGWvRWZrjP9Z95Xa/rl9qX2Ip48JnTjdAA1m5wMBq5ul00vfh+F5:LYT1eHRKrLy2Ip48dTxf1mlBqsjva
MD5:	825AD627DBA9F0C3C7A770F696E6947F
SHA1:	2066D011588BD747763AA95492DB045BA3096F9A
SHA-256:	274BFBE88FDDD305E371DBA66C940BB67B26AC51E5C4CF1F74F72557B375F3E4
SHA-512:	DF6A7C5AEE18E9200EA095EA917AA8161A80D6767D2AAEC527471EAEF7905214B64FB2FCA847A642D1C70379D2632A21CAAE6E00B3FF513F6058FEE29A21F456
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................e....@..................................)..O....@...................>...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files\ReasonLabs\EPP\System.Xml.XmlDocument.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.975499885006936
Encrypted:	false
SSDEEP:	384:FUv7c7iWNCWjrjP9Z95Xa/rl9qX2Ip4HTjdAA1m5wMBq5ul0Pvfh+8Q:FM7c1tHRKrLy2Ip4HTxf1mlBqssv/Q
MD5:	CBACEA8BBF166AED9AAEC25EFD2819A0
SHA1:	7E055A8842B4F6FB75C4F5A94FA4F4BEC39146A4
SHA-256:	A8C93DE53CBA7166EFC70B2EE73EC6499132C4F4E2E42112FFF1E56231E3D046
SHA-512:	7C91480657B086D22B3BAFEC5E1351661FC5F19F4EED06E3D1C9C397B7F7D49AA4F763820B35B344F31A5EEF12D45769B91C1EE725DC7927DD28AD2846170FE4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0................. ...@....... ....................................@....................................O....@...................>...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files\ReasonLabs\EPP\System.Xml.XmlSerializer.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	7.00528420868397
Encrypted:	false
SSDEEP:	384:bSWnRWCrjP9Z95Xa/rl9qX2Ip40KTjdAA1m5wMBq5ul06vfh+2v:bzXHRKrLy2Ip4LTxf1mlBqsBv3
MD5:	07EABA4F76B4E982E4D3B7EC268A6DEA
SHA1:	75442424E3196F4B3B339079FDC3143D16AE2354
SHA-256:	DA38AB286AB29491AD8FD0F34C5CD9A0AC32119A85EB1AB3B313743311CA68CE
SHA-512:	019054285EAF91E55CAD4F1323D8DC67901378E21B519522BC8DC1859D7F983EBCD696E6C517E6850B95EDBBABB7037D0F4D8F7970B114B8AC9CB82EC602CD9E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ...............................7....@.................................L+..O....@..$................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files\ReasonLabs\EPP\TraceReloggerLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22160
Entropy (8bit):	6.932114236344035
Encrypted:	false
SSDEEP:	384:eoMeAKyr1jSC6ErjP9Z95Xa/rl9qX2Ip4eR6CjdAA1m5wM36QNuZL3y:eoMbKK1OBMHRKrLy2Ip4Y6Cxf1ml36QC
MD5:	55CFC9F443E2D115AFE56DC32B60E523
SHA1:	CDEA8BCC2A11BE43C6B13B4AD535620C66B4D5DE
SHA-256:	3A0CD656D1AAA8667BA91C36FBED4034A0115423498AA1BD16E678F5083F37D7
SHA-512:	250A92485CDE3729DC3CBD2B32924F7CB700817E8B796830520C4EB4BE3DF8C0F7C8E30E083D2B23376EEE5DE5836A6A71105AB685076856A1353010087ED1ED
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.NZ...........!.................2... ...@....@.. ..............................[.....@..................................1..S....@...................:...`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H........ ......................P .......................................t..Ar..(9...8.7.Y*(...x.R.[#.e..3.A.8]...a?..o...W..%...,U.8Rn...^..?N ...0....f..X...G.P..Z.X.....ih.Du.UPxSh.............BSJB............v4.0.30319......l...h...#~......d...#Strings....8.......#US.@.......#GUID...P.......#Blob...........W.........%3................)..."...'.........................................p.........).....L.....d.....r............................................... .....5...

C:\Program Files\ReasonLabs\EPP\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1952048
Entropy (8bit):	7.807173257576082
Encrypted:	false
SSDEEP:	49152:oTl+Ffl0KCV8rEKbhHJikCz/NqoNcugBhnem0XA:oTl+xLRHAVLVNcpipQ
MD5:	6C0F8BF824E17C2F0DDFF150D8DC7488
SHA1:	BA9C27DA2BABACD1B9EC63F3C27EFAB3DDD1673E
SHA-256:	7A3BB8C2326FF535C6582FA627AA384B0D1E89DA1D7722B4230BE7080126E04E
SHA-512:	B3B593F34E2FD43DEA8C587AFD3D527E21011BB02DBD085908CDB92C1A134E26A16FADBE8B25DE498AEAFCFF894322F9C90EB729CA6E3D5AD8CD793631B86BF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".......5............@.................................>.....@.............................................(............i..x_...........................................................................................text...ve.......f.................. ..`.rdata..X............j..............@..@.data...8............~..............@....ndata...p...............................rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\WhiteList.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	377176
Entropy (8bit):	5.999945871691186
Encrypted:	false
SSDEEP:	6144:1BDotCsX0mytklk/i2PziH5XiX2huoW9h7dp9Q5FG85I2YYCQLk6j:jWCsDytkxMzUhYhFH/i/eLkA6j
MD5:	F2C339446D80393CF12236A064FA5182
SHA1:	4274F6487AC9249FD4B49DD5D22EB7CF60A67046
SHA-256:	863A22F58523D47B94E1273ECF9E2F280D0715FFC20A46D704993A32F54829BE
SHA-512:	E65CF3BBD78AB8DE244E47AEA6BFFE1CCD3B22B32A2260C9BA761D2C1F00A03AED17E6144E271435DC44C1F139AD74743F4F52A6140253B77842DEEDEA4DCF00
Malicious:	false
Reputation:	unknown
Preview:	ECc+ipJzcwkbZhHH6D1ciQjLEdRYh2hxwL6t/gI/aKzFhP0JZ+o5RIJUuC6/SkyIcfEFK5ngKBkQ1fvVMN//LTvf565Sl+AVaap/4k4EptyHPj7I4OILB+ncy7swuiZtl3+1Wp6PX+vCWTGe4GqB4ngQZT9u8DhbT1rCWvkw2WT3Y9DEfpISoufMWf3NoVOzqCIojN21hORpmAQGvoajCOuhLkVo1t05PggD8+Et608IkI7f5XwJOlxQc5UQRikZNMOmJvi1LncghPiSSeM+a5bjR3DuO1jhUPDTVnQODj2RvNHwNZwYBCr64Av8cQT2gKS+Hs5Lui/gpf5xf5fGZuVAm56ioEBqOO9DZGQ/SQahAU1yudisgt5XB0z9efK+b6/EAPVLrUgZ3wHKwOZZtpECfmVrXRxUm5k5pgLlyMRBN2b8I9Wmqf9X+rfv0OhkLYM/yw3xSIo3ge3BOI+h1vmtfYHahQZWoEKC3rTcFRu19M8ii/gCiD7NiTuu1F2z1l/oxXz4XLr2r4QBGSBM19jsFpaaqITyTIEqwRCde7v6PSekbGgg6ZkklM2dC0HKq35eHdDQZni4kMhyqGlFWYudbMpxARQFtI0yEyKCgiF2VALSsHpckoW+JBC77U81je2vYYd1HjbeFBHdjPxYuiL5tVGWfPXvyKbMMPCMhOJCvrQTLusJs8Wxkl4KLJ0whNNdHJrPCTYREEf0K1PhYTJhIoCJcgEcD9FiK4LLBVGwgtFwLNQbFAC1dVI8EaT7c4ajDWdBB6ZwdFyiOsgaVSJIiykb0icL5G8I2mt7KkzCZed+2VY4AS8X5IiERwRolxc946p7jXl5YLwQXCPFJBAqI+z2mC+DK8bMF1/d8mymt0zXXmFuvnusX9R+/VUB27QIHT6iAj66SwD++dVDnut2Dhf9LSuNQTOD6QXDUY+VqquajycJ0iodaqasTCKzYXubGVjq1mOfsPKubp5P5IPqmCQoU/idhouWq58V

C:\Program Files\ReasonLabs\EPP\amd64\KernelTraceControl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	273920
Entropy (8bit):	6.063893530470953
Encrypted:	false
SSDEEP:	6144:jlPLikZqxz9Prt9e1bd6JcAMaLD0qjR0FC4YPHnG:jFmX9e1bd6JcAMq+FpGG
MD5:	5F3DD6D4469C25B3100035493E84B287
SHA1:	375784997D26D0F30D5BCDB9B37E1C481F0C3D60
SHA-256:	04BAAF4E558FC18828E65002CEB130CE0CF79AAED507FB1C5A2ACA5B4A37182F
SHA-512:	27C61ECBA96DC53945A0881C29AF457C7DC9EB174D2FE1C854DC26143A80906023D9FFA4504014DA7CFF924F0ED05325158AEAB352F6D63208C1F1D38D822B3F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................y................`..y......y......y......y......y......y.@....y.B....y......Rich...................PE..d....5............" .........P......................................................z-....`A.........................................X.......Y..........x................>......$.......p...........................p...8...................pW..@....................text...;........................... ..`.rdata..............................@..@.data... (....... ..................@....pdata........... ..................@..@.didat..@...........................@....rsrc...x...........................@..@.reloc..$...........................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\amd64\msdia140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804288
Entropy (8bit):	6.342131904971123
Encrypted:	false
SSDEEP:	24576:frPHIDLY5h/Ud23lAy7ldZyzjIK3Y9bni0QwURlG3xA44jqfBlMoTVe:fUo/Ud2V17liz29utwURluxN4B
MD5:	0D12B6457B990E150388E5906F61C6BB
SHA1:	28B8087E023783DDA50C6BAEC351416F68BD5628
SHA-256:	214DC7E1C6E93CF7CC902E824E36F091FCF54A90754247F6A221299978AD2E9C
SHA-512:	718F162C96D896FFEA6AA3A3AB2FCF6E2054C8D1DBE1FD138B273A86D80A39869041FCAF1B17B6AB5F212A10D55F54F8B10485385B53FA66F7C6F7A5ED6E2A90
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]............K.......K...5...K.......<.......<.......<......K.........../...<.......<.......<.4.....<.......Rich............................PE..d....)?t.........." ...$.....z......`....................................................`A...................................................(....p..X....0.......J...>.......H... ..T.................... ..(....m..@............0......t........................text...L........................... ..`.rdata..zm...0...n..................@..@.data...@........:..................@....pdata.......0......................@..@.didat.......P......................@..._RDATA..\....`......................@..@.rsrc...X....p......................@..@.reloc...H.......J..................@..B................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	4.908284940509403
Encrypted:	false
SSDEEP:	48:o55s8iPgzK7W96MhM5IVkZJElInU/9ysI1qNA:o550ozK7WFhM5I6eo89ysI1qNA
MD5:	2AF5B11A9B5F5B7C2BFEA7A3D7186B85
SHA1:	E1F32261FD6D3D4679740B69E923CB053B30CE5F
SHA-256:	6953F1DB3172307E77B65295FDE86915E77A0589B6669EB80ADFCDB8056802A6
SHA-512:	4BD531D81FE46B1ABE933258C945683D98209E3C83BA3B3A0AB136F6D1A3D22D8731131FD6D11B58D8FD7B642E324C3DB1942BA22E9033CB76302E110E8D01DF
Malicious:	false
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='utf-8' standalone='yes'?>....<instrumentationManifest.. xmlns="http://schemas.microsoft.com/win/2004/08/events".. xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events".. xmlns:xs="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd">.. <instrumentation>.. <events>.. <provider.. guid="{b5a0bda9-50fe-4d0e-a83d-bae3f58c94d6}".. messageFileName="%SystemRoot%\System32\drivers\rsElam.sys".. name="Reason ELAM Driver".. resourceFileName="%SystemRoot%\System32\drivers\rsElam.sys".. symbol="DriverControlGuid">.. <channels>.. <importChannel.. chid="SYSTEM".. name="System" />.. </channels>.. <templates>.. <template tid="AllEventsTemplate">.. <data name="message" inType="win:UnicodeString" outType="xs:string">..

C:\Program Files\ReasonLabs\EPP\elam\rsElam.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	5.230162000430176
Encrypted:	false
SSDEEP:	48:FhHP8wMlKnfM2nnwrIP5yHvb2/oyzvTB+X:zkDlE0ow2yHvb2XzLB2
MD5:	EC813E1F8F193DCE5B07ADA4FEE1D43A
SHA1:	9464FB33B041B54E20BC71D4BD67185B255A3809
SHA-256:	FDACE7F8EBF8CD4A8CA18A172A604132CC2BCF000083DF69A4B9D54A10DC1BE6
SHA-512:	9EE51D25D5F7679C3038F0B77AECF0AC29DE57E4065BCE3105AD21A9D37CF9818F67B2AF32823E781E5D38E360BC249E46979F674BDF1DCE85072ADA4795CC5E
Malicious:	false
Reputation:	unknown
Preview:	[Version]..Signature = "$Windows NT$"..Class=System..ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}..Provider = %ManufacturerName%..DriverVer = 04/12/2022,0.0.0.6..CatalogFile = rsElam.cat......[DestinationDirs]..DefaultDestDir = 12....[DefaultInstall.NTamd64]..OptionDesc = %rsElamDescription%..CopyFiles = rsElam.DriverFiles....[DefaultInstall.NTamd64.Services]..AddService = %ServiceName%,,rsElam_Service....[DefaultUninstall.NTamd64]..DelReg = ElamDelReg..DelFiles = rsElam.RemoveDriverFiles..LegacyUninstall=1....[DefaultInstall.NTx86]..OptionDesc = %rsElamDescription%..CopyFiles = rsElam.DriverFiles....[DefaultInstall.NTx86.Services]..AddService = %ServiceName%,,rsElam_Service....[DefaultUninstall.NTx86]..DelReg = ElamDelReg..DelFiles = rsElam.RemoveDriverFiles..LegacyUninstall=1....[ElamDelReg]..HKLM, "SYSTEM\ControlSet001\Services\rsElam"....[rsElam_Service]..DisplayName = %rsElamDisplayName%..Description = %rsElamDescription%..ServiceType

C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.115904530529
Encrypted:	false
SSDEEP:	192:L22mPMNY+DHa3eLzeCvUkjWHhELVWQ4aWSWDqF9e+X01k9z3AzsJO4gdHfQhW:L4M1u3LCskJpWe99R9zusZwfQhW
MD5:	8129C96D6EBDAEBBE771EE034555BF8F
SHA1:	9B41FB541A273086D3EEF0BA4149F88022EFBAFF
SHA-256:	8BCC210669BC5931A3A69FC63ED288CB74013A92C84CA0ABA89E3F4E56E3AE51
SHA-512:	CCD92987DA4BDA7A0F6386308611AFB7951395158FC6D10A0596B0A0DB4A61DF202120460E2383D2D2F34CBB4D4E33E4F2E091A717D2FC1859ED7F58DB3B7A18
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q...q...q...e...r...e...t...q...y...e...p...e...r......p......p......p...Richq...........................PE..d...n.Ub.........."............................@....................................4S.....A.................................................P..<....`..x....@.......(...%...p..$....$..T............................%............... ..P............................text............................... ..h.rdata....... ......................@..H.data........0......................@....pdata.......@......................@..HINIT....^....P...................... ..b.rsrc...x....`......................@..B.reloc..$....p.......&..............@..B........................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\elam\rselam.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	11062
Entropy (8bit):	7.302964587285633
Encrypted:	false
SSDEEP:	192:TohIuPyyJCx0jnyKQvAIFWQFljudcCFaqDu0K9X01k9z3APi5t:000ivAIFR78cCFYj9R9zqSt
MD5:	DF4EAED5CF816C9F03DBC95AB74BC8A8
SHA1:	CA40FF3D91D3D3D75286EFD1C320CD1DCCB6C3DC
SHA-256:	34C442AA2B53F2256108FC54CAD61C820884C8195193CECDA2BCBBE33D05359E
SHA-512:	E53F25823A9B875EB67C16888E61566357853CCECDBB287AFCE8637FE08674EFF5EAB825CA687F66838AC6F01A1B0A1CC561F4BA12BCFB756DD20CB8B102BF50
Malicious:	false
Reputation:	unknown
Preview:	0.+2...H........+#0.+....1.0...`.H.e......0.....+.....7......0...0...+.....7.....).#...\J.@.RL.<...220412160200Z0...+.....7.....0..G0.... ....zg.X?w .!.{...`.Mp..~^..n..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........r.s.e.l.a.m...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ....zg.X?w .!.{...`.Mp..~^..n..0... VG..k..V..P.xg.'......,.......G1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........r.s.e.l.a.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... VG..k..V..P.xg.'......,.......G0........k.+t...1.U4J9.h1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........r.s.e.l.a.m...s.y.s...0......J.c..t.!?..\|.a...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...1*0(...F.i.l.e........r.s.e.l.a.m...i.n.f......10..-0J..+.....7....<0:.&

C:\Program Files\ReasonLabs\EPP\manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.005190565270453
Encrypted:	false
SSDEEP:	3:3H9ifFQtJdVQWNtNg/IBF+WVlIvDn:3HW2trVfNgKYWyD
MD5:	B887FD9A0E3798FD3482667E21561155
SHA1:	87188CDC055C857561333942FB24E7F209C51178
SHA-256:	F698ED945129085C527E4E79C0475D989DB367EF223F0A6E833AD151E31ED5DA
SHA-512:	533AEF3F4E4CB4619881B391388FE465608936A525B18EC6B9A5B0B5F80802CEEE6717B390C178CA71B6D121B5D77B3988C4C695C04047BD4F51DD865E9A1214
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "epp",.. "dependencies": {.. "epp-ui": "5.30.4".. }..}..

C:\Program Files\ReasonLabs\EPP\mc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1102848
Entropy (8bit):	7.3551536456680635
Encrypted:	false
SSDEEP:	24576:g1F/DU/0v79/tgAOA+dGog4gGxHn2CbEXZndw:WF3TgA5+rxH2CbeG
MD5:	C85B6E5CBC8CD0CD668A95378CF2339F
SHA1:	A53D71A00A4D1EE74DE71543846DDBEB568B29A1
SHA-256:	EF6F5493F21FA5FDAC8B6B669AC6DBC0923E5C7C794F075413F27CA6EBEEB4B1
SHA-512:	7067887375C5AA40B1732D648185A0D231B8D87A43B63FB3670DC5099A56C7C7356CCE43DC48CAD6E96C1585FDB2955AFA8A50D3A1C7DF1994E80705F76AAEC2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\mc.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0.................. ........@.. ..............................3.....`.................................P...K.......8................>........................................................... ............... ..H............text........ ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B........................H........t...<...........................................................(6...(,....0..............0.............AL......i.......\|...Y...........w...A.......@...........+.......>............0...................../B.......0......................8.y.....0.............AL......`...............................2...................m...{...t...............0...................D...........D..e.......0..............0..............0..............0..............0.............*

C:\Program Files\ReasonLabs\EPP\netstandard.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97424
Entropy (8bit):	5.6163370964241635
Encrypted:	false
SSDEEP:	1536:C2Ec05j4eAH64rh5fSt5T9nFcI94W0Hi/9ufIP:xlK4eA7mDmWV
MD5:	C91FFF17BFA6C8C8ED4E001A8C58BF87
SHA1:	4D6D22AF0EB8499E2AC8D349CBAAE9A5C622E4FC
SHA-256:	EDF0CEF60BBF8118937606D878FAE05B8EAA9B486EA4B45992029BF5FC07EA36
SHA-512:	A1AED700093E42F1E805CD50B314E59125C879F2FC0E7D206F146D84E3335F47868A520CBE60D8BC86837DE63104E1E3B71179A951CB9C750390A6E4F6BC4BBC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ...............................f....@..................................U..O....`..,............B...:........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Program Files\ReasonLabs\EPP\rsAssistant.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1352192
Entropy (8bit):	6.5007445296681965
Encrypted:	false
SSDEEP:	24576:CrXxKmWyc6Xwb9/BSWh/7Ds0x1QbD+JRyxpCcLwg4LjXPpS2FV4VFAFh0lhSMXla:CrXxKmWyc6dWh/7DQLpqp/FmVFAcq
MD5:	526C976F4BE230C8DEE35360EE51F483
SHA1:	DFF228568C2BC51BDE041A679A6DE76151846033
SHA-256:	691C72DE6BE0FE2BD90DCCBF9B9E162A3FB7C320D7DF7E82AC09B7BD441C0EC2
SHA-512:	A4C09F13C5506BEE016CB161B6A5DFBBCB90AE5FB513A64684710EB644EE2E868E2CCD5E531F2E06B62FC91C7B7FB82ED6B8CC4389BACBBED7B82ADF74621465
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......%...a.c.a.c.a.c..`.l.c..f..c..g.}.c...g.r.c...f..c...`.m.c...`.`.c...f.R.c..b.n.c.a.b.e.c.u.j.r.c.u..`.c.a...`.c.u.a.`.c.Richa.c.........................PE..d....M.d.........."....$.......................@....................................N.......................................................\|...........h.......t....d...>.......%.....p.......................(.......@............................................text...l........................... ..`.rdata..............................@..@.data....D..........................@....pdata..t...........................@..@_RDATA..\............6..............@..@.rsrc...h............8..............@..@.reloc...%.......&...>..............@..B........................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\rsAtom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	162816
Entropy (8bit):	6.4347197585730385
Encrypted:	false
SSDEEP:	3072:OX5TgLoWlo6zvLblsvv5Emm16e68QNmTNh3l2AuZejZnjjWr:KOom9Av6RvfltqEZ+r
MD5:	044D60780B0C40D3F9B0B5A3FC040948
SHA1:	2E16C926F11ED5FAAE22D9AF5D935748C57EC1F8
SHA-256:	7493F645BB04092AEE30A47A681494251C79A38A941C9A3D2DEE4293A265F428
SHA-512:	7653A0A46E3EB9331E92A09937754302F939100ADBFB283242C25BF0F73F8508D6F7E9D5AA08DBBEFDD14BF682AD7D0D77F4999B3274D329D281E22934C445EA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0..4...........R... ...`....@.. ....................................`..................................Q..K....`..T............>...>...........Q............................................... ............... ..H............text...$2... ...4.................. ..`.rsrc...T....`.......6..............@..@.reloc...............<..............@..B.................R......H........g.................1X...Q.......................................(....(....:+.([.%^.(..................................0..............0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................HP.u.....0.............B(....( ...(......................................................................................................*....0..

C:\Program Files\ReasonLabs\EPP\rsBridge.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154112
Entropy (8bit):	6.1143850196696885
Encrypted:	false
SSDEEP:	3072:TW6KrX3r/EEgTUSNc24mY5n1sclb2sDzgWGE:TW6MX3gEgTUp6cld/n
MD5:	B6984D0E136E087316B339D8AAD2DFD1
SHA1:	3B2F7BE133AA525B76AAC9D9049A9730D76237D3
SHA-256:	491A021E4F3E5ABDC937C1329E35028CC805F78F84D10398C2DB692E7E2FB43D
SHA-512:	781556A889855ED5F7203ED21D3559EB0DCD007F859349DCC1286A0EB05BECD2D841570FD19DFC6941053F2F1A07D65D8E779EF3C55C263DFF459189CEB7123B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsBridge.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q8.............!..0.............N0... ...@....@.. ...............................Z....`..................................0..K....@...................>...`......./............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@....reloc.......`......................@..B................00......H..........................m...5/.........................................B(....(....(.........(......(.....0..W.......(.... ........8........E........9...\|.......................].......8....~....(....8....(....8...........s(........ ....8....(.... ....~....{y...:....& ....8v..........s-........ ........8S...(.... ....~....{]...9>...& ....83...~....(.... ....8....~....(.... ....8...........s#........ ....8....~....(.... ....8...........s2........ ....8............*...

C:\Program Files\ReasonLabs\EPP\rsBuild.Runtime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20624
Entropy (8bit):	6.903857312303968
Encrypted:	false
SSDEEP:	384:zGK3h8ZRSrjP9Z95Xa/rl9qX2Ip4CIhCjdAA1m5wMDBuZ:6K3h8niHRKrLy2Ip4CECxf1mlD0
MD5:	0069E67AF86418ADD8F693EEB86A384D
SHA1:	8B6490755B0B78342C192518141BAA08212ED65F
SHA-256:	90AFF2D97BEF3BF98A1BD315379094D361194184EE35C6ED2661DBFD65DC619C
SHA-512:	AEEBCDBB39737D7FB1A7BB397A4EA9DC2B26F20CCBB131480FFF787087A1CCD5742D3D20D6507CD07CAB63B46808F52DABD5FD4596CFC83A800D19679FA48CE2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0............."... ...@....... ...............................`....`..................................)..O....@..x................:...`......0)..8............................................ ............... ..H............text...(.... ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.......................H........ ..\|..........................................................."..(....V.(......}......}....:.(......}......(......(....:.(......}....:.(......}......(....BSJB............v4.0.30319......l.......#~..l...$...#Strings............#US.........#GUID...........#Blob...........W..........3............................................................$...........\|.f.....................D.....x.....]...................y.........<...........d...........Q.................

C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.70434675005567
Encrypted:	false
SSDEEP:	768:m4wXL42btPdC3h8YcHRKrLy2Ip46Txf1mlBqsnvcY:yDbtMR8YcHi/9yfIQsnj
MD5:	107CA49B4915F14FB922F5D5ABEBE845
SHA1:	E4EF5C0FD743B9228945E62D00482AC3DA9711A8
SHA-256:	F165BC0C4E4622171B2967CFD5C4379473E07D1EF16EA4CA3ECD12C3B3F0EC72
SHA-512:	25D51D21801693DFB964A2B554A1DA0CFD232DFA21BEDC8B7D51FEF749C7D32CDD1087906B2FA254FD8A8A433E6FBD7E2C893FE18007F0EFDDFE2EBCF5CFC8ED
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C..........." ..0..(...........F... ...`....... ....................................`.................................uF..O....`...............2...>...........E..8............................................ ............... ..H............text....&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H........)..(............................................................0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..:.......~....--~..........(....~....-.s............,..(.....~.....................v.s....}.....s....}.....(.......0...........{....,.*..s#...}.....{...........s4...o.....{......

C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	5.010777093927904
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOodBQV7VKXRAmIRMNHjFHr0lUfEyhTRyAEDDQIMOov:TMVBd1InV7VQ7VJdfEyFRyAqDQIm
MD5:	DDC25AEFCAE9826CCE1754C2C89E959D
SHA1:	36899490B8B0CF36AE8A1477468F3884C0CC9664
SHA-256:	F8AD17C37D444521B3905CCBD75EA6CB6E3D2763B16EB56B2E1AA4274173E614
SHA-512:	4C52E02E4E6A17FD36714E3769D34BC14675D47BE0322B14F4BBB13268C34DFE647A37DB7DF0DE7D8C31494BF878B597EDF85913E7FB648CB0D993E89FB5D611
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>..<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/></startup></configuration>..

C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	673280
Entropy (8bit):	6.493909069727573
Encrypted:	false
SSDEEP:	12288:rOguoezLfVAMFgCNS+MvHY/8j+7rmboDhgkEHoNOvPar/z:rOgud/jFgq6Is+7rmbGhcHsg2
MD5:	9170244A34CB903FC5DFBE4159DB6F16
SHA1:	F70791F187F14DD11B3893CF378E2B2871B40D7D
SHA-256:	C843C458A26D98D0AE7A4B280F77AD193225B84882EC98650EBBA7B51B322D44
SHA-512:	BC50DB62BAA8FC60469982E0D986E89EA094497C617D4A1C6849403911457E11DFF98E5F2CDD7F9F6453EF3D0363A1DC4664FA38DB83155CF850108706EFF128
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z3.`.R.3.R.3.R.3U.2.R.3U.2.R.3U.2.R.3L'.2.R.3L'.2.R.3L'.2@R.3U.2.R.3.R.3.R.3.'.2.R.3.'C3.R.3.R+3.R.3.'.2.R.3Rich.R.3........PE..d....GPf.........."......H.....................@.............................`.......z....`..........................................................@..l.......hI.......>...P..........p...........................@...8............`...............................text...~F.......H.................. ..`.rdata..z?...`...@...L..............@..@.data....;..........................@....pdata..hI.......J..................@..@_RDATA.......0......................@..@.rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\rsDatabase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	6.477895770562103
Encrypted:	false
SSDEEP:	3072:MSa2SASiV7/3JThFoPdXTssFBSKvvvvnPPH6Gi5tPArrYeiYiPKiA15/ph9r6rrP:HjiWbJTPo1XTPPSKvvvvnPPH6Gi5tPAK
MD5:	D58DD4CFD84A514AE70E1A72C037A161
SHA1:	FD134A72D801261CB6E143A54A868696FCE22474
SHA-256:	D9DF5C9CF429C714615770480AA9076D1EC2A25F9D52CBDF6D7300000C3BBC39
SHA-512:	2A3A5673DE138B47C969BB8078CF6A95BEEF4A822633A91AD728CB68D6DB8E461D43A739A8546FBBAEE4FD5716E4AF86C131EDC292334CD3F019C9FE2B80C73B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsDatabase.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!..0..d............... ........@.. ....................................`.................................P...K.......\............n...>........................................................... ............... ..H............text....b... ...d.................. ..`.rsrc...\............f..............@..@.reloc...............l..............@..B........................H........v..<................k...........................................(....(....:+.([..X.(......0.....................0..............0..................."....Y.....0.....................VV.Q ....0......................... ....0.............AL......Z.......q...................j.......................................................................................................0.............*A4..................;...............P...X....... ....0..........

C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	254608
Entropy (8bit):	6.109726763458205
Encrypted:	false
SSDEEP:	6144:fdsKWU2shBl9Dsj6sUxZwIgC3ZWkd5n5WiSdlJRt:fRpdDsj6fxr5na
MD5:	AD6AB7F88A7F20DCFF9364FE3C606EB1
SHA1:	F7877ED46BC5E07D0397F5DD268FC5FCC0BE49A6
SHA-256:	666DB7971ADD6AEFBF31E599E1784AF2977F714439DBA20B6676CA4DC03DCD4F
SHA-512:	EC53720D20AA67A2C272F1C3D738F794CBD78F988B458432772A21CFB73106389954C2C487B85A5ED062CA4385FD4AB84064709C8270C8933DAA52482071C16A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.API.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0.................. ........@.. ...................................`.....................................K.......h................:..........s................................................ ............... ..H............text........ ...................... ..`.rsrc...h...........................@....reloc..............................@..B.......................H.......d...............`p...I............................................B(c...(....(.........(X.....(........................8........E....a...\...n.......k...8\...r...pr...p.. ....~....{....:....& ....8....r...p.o....:.... ....~....{r...9....& ....8....8....8.......(+....(,.....8Y.......E........+.......8....s...... ....~....{....9....& ....8.....(/..... ....8........E....:.......................85.....o....(5..... ....8.............i(2...8........E....+...8&.....

C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224256
Entropy (8bit):	6.2226977365106215
Encrypted:	false
SSDEEP:	6144:5gieg/fp3Rublq6d4VKl9RQx504T9jP19:eieOfB62VVx5zJ9
MD5:	30AECE1972D91CEC63777681926A73B7
SHA1:	192550747A794D2054654589068C5BDD23ACE302
SHA-256:	CF74774291BFA8F6B6B5EBE54DEFAD51D52E08FC97614558FD4F1CC7FA54855C
SHA-512:	BCF64ADD4E1698D3A6E55EE74088C35926A090E6105EA51C430FD63F6072E4A60D34FCF122A950904F4A1CEC0201388A3054665BB7FEE95F160A9E42A149ADB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.Messages.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=.............!..0..$...........B... ...`....@.. ..............................0.....`..................................B..K....`...................>..........8B............................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@....reloc...............,..............@..B.................B......H.......@...X...............+G...A.........................................B(V...(....(.........(K.....(..........................(.... ....8....8........E........+...R...x...=...8......}.... ....~....{....:....& ....8.......}.... ....8......}.... ........8......}.... ....~....{....:z...& ....8o.........................{....s"..............B(V...(....(...................................................................a~....{....a(P...s.....(......o....*.....

C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	369664
Entropy (8bit):	6.625460113459136
Encrypted:	false
SSDEEP:	3072:i0yhs1rgLEr7DBPAqz5x9Sw7UDBvmLUMPHEJnCs11PAVhLvruoQe9PZD6e3Cc5NU:Awhlx9SMc4RPqnBMN9dJD3CcHLI6/Ywe
MD5:	AB81BAB4ADFD7DF6DC8F9BF867603E81
SHA1:	5B46F2D85B63C3F115AC9BEABE756143B90B5EF9
SHA-256:	5FE722B79C37605C713C61FCC530A0A1C42F791584AF5B74CACD9C1DF8720EDC
SHA-512:	271952E237C2186083AAB496ECA4909F5EFBEA3D4700C93130BF37ADFC3B4DC6BF57108B2A0E3E9B9290DF552ECC67B22D92DE7FC46F53AEA8DBF7937B366DF9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Client.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p.............!..0..\..........~z... ........@.. ...............................5....`.................................0z..K.......t............f...>...........y............................................... ............... ..H............text....Z... ...\.................. ..`.rsrc...t............^..............@....reloc...............d..............@..B................`z......H...........h...........0+..9L..^y.........................................B(....(....(.........(......(........................8........E....1.......^.......[...8,...r...pr...p.. ....~....{....9....& ....8.....(+....(,..... ....~....{....:....& ....8........E....Y...Z.......8T... B...e .hRfa~....{....a(...........%....(....s...... ....~....{1...:....& ....8.....(-..... ....8........E........>...=...........2...8......(3...(4..... ....~....{....9....& ....8......o....8

C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354304
Entropy (8bit):	6.112385200418826
Encrypted:	false
SSDEEP:	6144:Mvm33r4BCvAQZn7fboYz+Mbvkqqx0J1aeL22/ISPAyXDiJ6:Mvm33ryC7Z7fkYSMbUxO1d/ISYas6
MD5:	FA16D0DC50B77C9F8703B5B36D774107
SHA1:	EC426639F3BF3A563491AC53B70BB5EB92E5C314
SHA-256:	94AD9F2B387A5E6CBD0F7B2259E37533CA80AAA69BA044DB6A022661EAEB606D
SHA-512:	B2E50634A6A7A116C71BB56DC045F29F79ABD5D831ED1AC4A4FB7AB6A452321A814B9877B1C98CC0E185C6B6CAB5BFE3E9435A43F9F4D1FF4D515109779372CD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E=............!..0.. ...........?... ...@....@.. ....................................`..................................>..K....@..h...............>...`.......>............................................... ............... ..H............text...$.... ... .................. ..`.rsrc...h....@......."..............@....reloc.......`.......(..............@..B.................?......H........s..xE..........\........>.........................................B(....(....(.........(........................8........E....W.......f...A...K.../...8R....()...:1... ....~h...{....:....& ....8......8.... ....8....r...p.(...9....8....8.... ....8}....(+....(,..... ....~h...{....:....& ....8........E............c...8.....(/..... ....8........E................F...[...Y...8........(3....s...... ....~h...{l...9....& ....8......(4... ....8......o....(6.....8........

C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.221783549418622
Encrypted:	false
SSDEEP:	3072:9bISftpuc0OA1pxW4kNnDZaXNG0Qir2XviGMSFCKq7PcwixGt:9bPlB0OA1SqXNzQLKaQcC
MD5:	99692C5CC13EF293197CDE6C912379CA
SHA1:	17C504578DCB26E7DF87955362A7EEFB12386555
SHA-256:	41950668DB2EB5AB7017484AB74955B664EEDFB543FBD078F6DAE21078EA319E
SHA-512:	BDFF8F225933462ECD166359473AD0F0A7A9EE84F92E1EC1B0706AA97257348F134490176E73B6E08E8A586C765C2BE59590135E6F266E076A94B12ED82EF7C5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a.Z............!..0.............n.... ........@.. ..............................8J....`................................. ...K.......h................>.......................................................... ............... ..H............text...t.... ...................... ..`.rsrc...h...........................@....reloc..............................@..B................P.......H........................l..s7..S..........................................B(....(....(.........(........................8........E....w...T........... ...8r............(...+.. ....8........@+...8....~...... ....~....{....:....& ....8........ ....~....{l...:{...& ....8p......(....t...... ....8W........................E....@...X.......W...8;...~......8`............(...+.. ....~....{....9....& ....8........@(... ........8....*...(....t...... ....8z....... ....~....{s...:b

C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196096
Entropy (8bit):	6.250386192319483
Encrypted:	false
SSDEEP:	3072:UOASlPt5xg7Osb2bPszL5YeYtS8i4cTASYk4IMa6Ldlw:UOASFt5xv0zLxpTvoaF
MD5:	A802608C39518F4D5AA0D0ACA476F2F7
SHA1:	B67E4ADCE2DE5984818131375A8C0A7239D7AEE1
SHA-256:	11374C4265F281819C7DB93B648C8B072D07E0EC599EA203C95C427D5E0CE97E
SHA-512:	23AF5CB8AACD5AD060A428185306D57162058CDA1AE52BE576E5BCBA4DFE7901F06D9C0DEED96A7281CCFEBC9DB65C7945B00BD0F6B074DC5EE874FB0533807D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Extension.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@B............!..0.................. ........@.. ....................... ............`.....................................K........................>..........7................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@....reloc..............................@..B........................H............................@.............................................B(....(....(...........*................... .Q.Ve ".U.a~....{g...a(.... ..S. ....b .!..a~....{m...a(............(..... .B.> .d.?a~....{s...a(.... ...5 .k1.a~....{d...a(....."o.... ....8........E............=.......8......;V... ....8.......(.... ....~....{....:....& ....8.... .... .VZ.a~....{....a(....8&...8.... .... .G(Y &...a~....{....a(..........(....& ....~....{c...:H...& ....8=.........8.......

C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141968
Entropy (8bit):	6.095571910595917
Encrypted:	false
SSDEEP:	3072:q5qgBA2D+nqGVAZvG3hnrTvvvviYPPLG6Gi5tPUrYeiYiPTizo5i0s/KXrrii55G:Sqgy2qq1U3RTvvvviYPPLG6Gi5tPUrYa
MD5:	63F68035F2EDE62811EEECF169136E55
SHA1:	DBDE8D4BBDCA350080F4701934301C12CD88211F
SHA-256:	FFEE7222A6202BF31B2F3058B5003ED0E7A98FD9C5F245B362F64371FF69D497
SHA-512:	F3AD7C90B3B48117885778E0721D678CEB47EB7C432FBAB1A60ED6D11AF803EC333822C56ED279C80E9217C64259EBB7EC1CB6F3AC66C28720551C3043E499B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Features.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V............!..0.................. ... ....@.. .......................`......r.....`.................................`...K.... ...................:...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@....reloc.......@......................@..B........................H.......8m..0...........h...:..............................................B(U...(....(.........(J.......................~.....%.~.....%.~.....%.~.....%.~.....%.~.....%.~.....%.~.....%.~......(...+~....%:....&~......!...s....%.....(...+(...+...9,... ... ....b .wlWa~h...{....a(O....(....8!... 8{.= ...a ..".a~h...{....a(O.....(...& .P. R...Y ...a~h...{....a(O..........*.............(.....0..\|.......(U... ........8........E................@...v...0...g...................

C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	153088
Entropy (8bit):	6.096015765166375
Encrypted:	false
SSDEEP:	3072:Rar5BdXMvCqqYMpshETiAwnOd5FIE/lSs1veWzn:RatBdcv2ZgRO2Q/n
MD5:	FBE815423A8D6D1C06FD83F3CC06E76C
SHA1:	F854D1C2F917B7E40435CCB2F5AF46CB887F046A
SHA-256:	1720C9D432A5DB0216B12BAFD315E86A6719EE138F3D09C4B91A0214F1281333
SHA-512:	C60BD6B8558ADB880778B9E8B2C1A3ACA7F14ED881F5165250596A959BD30CF2048615AD5A8E653706F51733C5D8F7688B1B6317AD34A0FFC3CEAFC1DCC44AEE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Helper.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w..............!..0..............-... ...@....@.. ....................................`.................................@-..K....@..t................>...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc...t....@......................@....reloc.......`......................@..B................p-......H.......T.............. ...a...i,.........................................B(_...(T...(.........(........................8........E....(... .......T...8#........(.... ....~....{s...:....& ....8........E....=...L.......88...s......... ....~....{....:....& ....8....8.... ....8....~....9....8..........:?...8........E....)...O...8$...8E... ....~....{f...9....& ....8......(.... ....~....{l...:....& ....8..... ....~....{....9....& ....8.......8....~....*~...... ....~....{....9

C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Application.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	155136
Entropy (8bit):	6.100208779846344
Encrypted:	false
SSDEEP:	3072:mXXryQmjkr+ff93/q9LrWI1wdfKVwon8IVWDX0IxxRrasF6aDOm:ymj++XNcjwdKVG+Y
MD5:	1DB37D2AA8DFAD273BC92B2860B4EFA8
SHA1:	CD6AFB90C28905F1592D50013F081A6C45371BD2
SHA-256:	BDA4BEEA60EF8FB05073B6CD1DE57B77A4B2E29068411E7128803B90E7359859
SHA-512:	78FE5ECE62D36641FA7CDC90D7389D493A8AFFAFE987602AA73AB7FB7EFF65A258B1399B1503DFA30C2463E8AEABD1259D1DD819F9A78D7AA486E048A8EAB066
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V.............!..0..............3... ...@....@.. ...............................'....`..................................3..K....@............... ...>...`......U3............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@....reloc.......`......................@..B.................3......H.......l...p....................2.........................................B(y...(....(.........(n.....(..........................s....}....8.....s....}....8.....(.... ....~....{....:....& ....8....8........E............8.....s....}.... ....~....{....9....& ....8...........*................8........E........<...'...v...P...8....... ....~....{{...9....& ....8....~....9.... ....~....{....:....& ....8....~...... ....~....{U...9\|...& ....8q........(.... ....~....{M...:....&

C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	202752
Entropy (8bit):	6.084395898584841
Encrypted:	false
SSDEEP:	3072:IhI3WaidnUVoKnRV3+ovvBR8OKql4qxoAMrZlhMvxS7BE4YV3vxYzh+jW:oeWagUD+ovvBKg4Y7F3/xA
MD5:	5751FC3807356C1857B5B91E7DE45B5D
SHA1:	D64906E807DFA80C69C82907395A9660A4AC7FE9
SHA-256:	73E2992C703DC532C2205A8956A4E08BA78B3B5D4AED07DB39D7A55547B83E66
SHA-512:	BA2FFB30DD22FF0FF743369573D02264154F7AE7DEED16C2D39FC957AFE5FC8020131BA18D621AEF122D498D86109CAD2D9D8A29DB02551610ADF963BA4B0B65
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Loggers.Business.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g;.............!..0.................. ........@.. .......................@............`.....................................K........................>... ......U................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc....... ......................@..B........................H........... ................/.............................................B(....(....(...........................8........E............5..._.......8....r...p.()...9.... ....~....{....9....& ....8.....((...9.... ....~....{....:....& ....8....8?... ....~....{....:o...& ....8d....(*....(+..... ....~....{....:....& ....8........E............a...8.....(,..... ....~....{....:....& ....8........E....d...)...............X...8_............i(0...8........E....+...8&.....(1... ....

C:\Program Files\ReasonLabs\EPP\rsEngine.Needle.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	151040
Entropy (8bit):	6.110094403881827
Encrypted:	false
SSDEEP:	3072:uszfe8gqYmOuYOfzzyb2Dkji1FQaEOV18GcAw0v+PYaxNu4md:usLe8gqYfgybGKaEAr/WXk
MD5:	50A6E9A1962918386B795C23F3D51071
SHA1:	678185A86ADC440859F78F54442BAC328A327521
SHA-256:	16D0311D1487F6EEA7594FA8D1836434F49BACC7536E7A98960A9C6B9D99C402
SHA-512:	830651C72AD83FB7509B78E792406CFBEEA4BF8789D5A13078EBA3428A14AC5E5BD60183C3601CB1C5D610F238FF4FEF7980CBC52E98862E992EB1E2ACE2D349
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Needle.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1..............!..0.............~%... ...@....@.. ...............................C....`.................................0%..K....@..t................>...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc...t....@......................@....reloc.......`......................@..B................`%......H..............................Y$.........................................B(q...(....(.........(f.....(........................8........E............O...s...8.... ...U .,.[a~w...{....a(k...s....z. ....~w...{K...:....& ....8....~......*8.... ....~w...{....:....& ....8x...(....(....9.... ....8_....~....(.....>.... ....~w...{I...:....& ....8........E....u...<...............8p....i... ........8....8.... ....~w...{....9....& ....8....~....(....{.... ..E ?.HDa~w...{c...a(..

C:\Program Files\ReasonLabs\EPP\rsEngine.Performance.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149648
Entropy (8bit):	6.105238189284848
Encrypted:	false
SSDEEP:	3072:gVZJLDlibf9fHhD1+/17Fp/XE1wVR2wG1HxY:WJHiZD1+561
MD5:	489BF057DCFC83929FA8FE632FA70DCD
SHA1:	2EB2FCA6C0FC58590C5618149768D7AAF560F870
SHA-256:	B1CFFCCE2079D2FB7AB641F8BBAE7D8844C28B3B6ACC55DC2802D6F97A68436D
SHA-512:	EF57E882A05D090964710FFD140E3A1C9D2A7C64EBEB5775B6219BB332E0E635E9D13F74D6242CF0BBBD85EAFF74AF628C1B1C57AA414BF63BDCD81D077A68F9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Performance.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....H............!..0..............#... ...@....@.. ....................................`..................................#..K....@...................:...`......Y#............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@....reloc.......`......................@..B.................#......H.......H~..............P........".........................................B(}...(r...(...........................8........E........:...h...8.... ..R R.:1a~....{....a(....s....z(....(....:3...8[...(....(....:.... ....~....{....9....& ....8.....(.... V..O ....a~....{e...a(w...(....(....(....(....9.... ....~....{c...:7...& ....8,.........................8........E....3.......8....(....(....9)... ....~....{\...9....& ....8....8,...8.... 8y2. ....b 8.d.a~....{....a(w...s..

C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	248976
Entropy (8bit):	6.089407589245316
Encrypted:	false
SSDEEP:	3072:fCdWsprbc/X+sa4UmBR9OBvkqkzmTfQtFfVqmgCmOpypx/mYWzJzoxR:LOrpsRavkmfSqmgCmRLmYYz
MD5:	6CAA478DF71ADA01A4651A96FA422322
SHA1:	3175422D1A11076C2970324A702145C3DB8E1E07
SHA-256:	943EEB938CDEC5BEA182CE8AA2CA479CA9A3275D9255C2A47DB3D9DB01B1008A
SHA-512:	D045863187BAA25CF4CCABA5C1AF91C55E3F8E5111D0DA1E571E721EB0A459AF45B62532B7E0A4488985D2BE18286A918C2DADF51CB566C292B67031047BE3C1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.BTScan.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.............!..0.................. ........@.. ....................................`.....................................K........................:..........Q................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc..............................@..B.......................H.......4f...............]...F............................................B(i...(....(.........(^.......................E....B.......~...8=....(.....(+..... ....8........E............r...8.....(...... ........8........E............ ...O...........8..........(,...(.... ....8.............io....8........E....+...8&.....o.... ....~....{....:....& ....8..........:5... ....~....{....9....& ....8........E....+...5...8&.....o.... ....~....{....9....& ....8....8....8..... ....~.

C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Camera.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196744
Entropy (8bit):	6.1481222343305175
Encrypted:	false
SSDEEP:	3072:Ef05aI0u7OhDTEutfz8kjbS30RKsboQi8S8MGTqApA5upj+hcDllfyu5dc:Ef0wIT78Dt4kfVRHoQi8l3pOPE5o
MD5:	F4A4B6F512164745D16EE1DC826302F2
SHA1:	79A9C24DF7476E7B3B5083931CCD4EC6E17EAB0E
SHA-256:	C40F961E08F614D11404D3D66D25B7D257E3BBBDDBA7B709FEDA16DC05DD333F
SHA-512:	F5C4D26C06440C259137321C9F75CC37970D93E30DE75ADC56CA8B86A96EDA231D531BBF2B6F8A8613D698AAC1DB91225B1951079E14D98A4127FC4CD300335D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Camera.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.v............!..0.................. ........@.. ....................... ............`.....................................K........................:..........o................................................ ............... ..H............text...$.... ...................... ..`.rsrc...............................@....reloc..............................@..B........................H.......x...(...............g4.............................................B(&...(....(.........(......(..........................(.... ....~....{....9....& ....8....8........E........8.....B(&...(....(.....................................................(.... ....~....{....9....& ....8....8........E........8.....B(&...(....(.................................................*.................:'...8.... 3.YWe J[..a~....{....a( ...s....z d.D.e 'fcfa~....{....

C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142992
Entropy (8bit):	6.073743042549598
Encrypted:	false
SSDEEP:	3072:mpf+vwThHIsceScHje/Jk9ZXOOGNiFCDZrSztUuiW:XwxbTSCqJm4OuGT
MD5:	6AB35008C89413796D5D0CAABE0244BB
SHA1:	6ADA52E9AB24007308064FB26E37E3C96197F269
SHA-256:	19F9083ECFB8D33C85F494DD4F96F37827D25A8E23C3E5836C2B8ED55EDB52A7
SHA-512:	DE4BF52E7E7AA5015E5618E68F3F65ED7407B3B58D664B648087A5C7A53901015B0D31DE82B63654E4FD2CFDE6D737749269DBE94C804D2E68CF9AA4EEF25C80
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y..............!..0.............~.... ... ....@.. .......................`.......:....`.................................0...K.... ...................:...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@....reloc.......@......................@..B................`.......H........o..................V...V..........................................B(Q...(....(.........(F.............................8............................%...%....%....(....8............................%...%...%....%....%....%....(....8............................(.... ....~L...{....9....& ....8....8........E........8......0..........(Q... ........8........E........H.......$...8....s.........8....(.... ....8....*(.... ....~L...{....:....& ....8....(F... ....~L...{

C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	172176
Entropy (8bit):	6.157002851606526
Encrypted:	false
SSDEEP:	3072:BnDciVGhexCSXHa6aw0Pts5mMUFmq6dCs2yjrX7HbPgW:xDciVNQt6awM7MB9C8b
MD5:	3A7ED929230A613C54604A443E35EDF7
SHA1:	DC74D6F7892253E6647952764506F5C52D39D16F
SHA-256:	B5F24733328A24C240FA87963A50F8D0C16AD3A1BD76BC91D44C19C446CE6A04
SHA-512:	F6F6900A44475A5FB806E1CC1E8CADB9AB4D7371FBCF45F831E2BEA92601F24BB1CF278BC273D7037A8E407D842400420C76CC4121720EBA374E54B734911878
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Microphone.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..\...........y... ........@.. ....................................`..................................y..K....................f...:..........Ry............................................... ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@....reloc...............d..............@..B.................y......H...........H...........LN...(...x.........................................B(....(....(.........(......(..........................(.... ....~....{~...9....& ....8....8........E........8.....B(....(....(.................................................... ...X $_p.a~....{t...a(....s....z D..ve J..a~....{....a(....(....(....(....:....8..........................8........E........u.......8.... .... .@.VY E?ena~....{....a(....s....z .... ....a~....{v...a(..........

C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	332800
Entropy (8bit):	6.178315042612466
Encrypted:	false
SSDEEP:	6144:DNzdJXMSRhdSvGYtbp/chiZEs9d1PomUfyGzph2:xJJXnhL439d1P/Uayc
MD5:	289FA505F765127810156291E21695C3
SHA1:	842695BEA52D01E5673B6675A88F2FC9FEE5221E
SHA-256:	D20872D6DE07D18E6BF92AC729D9A078CDBBAC23C302E5AB761531B1949820B9
SHA-512:	EE97C0BA5575AB23631E98D46C8EC0F99935A2CDC94D115B83227F5D16D5B07CB666685A7FBDF3F99105D6BAC165D5AFEAD255409FBDA7CB751A85FE97D292E6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6dG............!..0.................. ........@.. .......................@......B(....`.....................................K........................>... ......9................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc....... ......................@..B........................H.......\...d............^.................................................B(w...(....(.........(l.......................8........E....5...........'...80...r...p.(...:.... ....~....{....9....& ....8.....(+....o......8@.......E........~.......8....s...... ....~....{....9....& ....8.... ._.; hK.ua~....{~...a(q..........%.>...(,...s...... ....~....{....9\|...& ....8q....(-.....8c.......E........q........... .......8........(1....s...... ....8.............i(2... ....~....{..

C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1521296
Entropy (8bit):	7.847329578221486
Encrypted:	false
SSDEEP:	24576:LKCYNFxuyWWTcH4IMkfS0HCHp7z00CxeTrTg3mh3/y86joi+7bxKCa7z8JgQtU:Ro1WxMgSCCHlzDCxqrk2h3/ync7b3
MD5:	2885C6DA9DB101EE2CD99F69A2C7E431
SHA1:	F9065CB9D42E7CAB8ECF7755D8DC79D263E79307
SHA-256:	79B529C7373C56AEF90B0FDB6BDD0A69ACBE4E914955A87A70A3C7CB056CEE12
SHA-512:	99DEC4C58C6194AFC4AA8A5F2238905D34A239CA5F8465B4C280987F80171AA77B970DD116FBE5BE22A905FA417BC769935F7FC1DA8FE9CEB501D529711C28B1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0.................. ... ....@.. .......................`............`.....................................K.... ...................:...@......4................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@....reloc.......@......................@..B........................H...........T...........$..................................................B(....(....(...........................E........n...a...1...8....r...pr...p.. ....~....{....9....& ....8....r...p.()...:.... ....~....{....9....& ....8.....(....o...... ........8........E................8.... >.0t .&.Ha ..%Aa~....{....a(+..........%.P...(....s...... ....~....{....9....& ....8.....(...... ....~....{....:....& ....8........E....G...........w.......T...8B.....(1... ........8......(3

C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	171520
Entropy (8bit):	6.170576629726866
Encrypted:	false
SSDEEP:	3072:rl9yiQCmAf0TW629ElqcpcGlLQJ5/xvttOqzmnWS:rlA4mNWF9Elfp3LE5p/O6w
MD5:	3E3C2B5EEBCF2967204602A6CBCB7517
SHA1:	FD94F8433D46C762D18D5CDF95D7653730436062
SHA-256:	C580120DD5B29E5FF34D4ED41B86FF45CD596FE102914508C7D67CE112FE0DF6
SHA-512:	87C71D2D52FE19AF261B422AC764E477172F1C13B25B891768E7ADDCE88594C72B1DD808E109A6A107C2BB07A1B3AEC5A0387CAF45EDDB8141254CA7137EDE96
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Self.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F.S............!..0..V...........u... ........@.. ....................................`..................................u..K....................`...>...........u............................................... ............... ..H............text....U... ...V.................. ..`.rsrc................X..............@....reloc...............^..............@..B.................u......H.......................HN..~$...t.........................................B(....(....(.........(......(........................8........E.......................8%.....*..R ....~....{....:....& ....8....(....(....9.... ........8.......(....9.... ....~....{....:....& ....8........E1...............3...........8.......<...i...v.......................................-...................d...................p.......p..._...........W...I...n...........................J.......W

C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160400
Entropy (8bit):	6.153604832369825
Encrypted:	false
SSDEEP:	3072:CdWzTvFO5YfsLs3DR/zduFTeGuZN4GEQzecGv7yu/R+Ysq/R+FZ:CdOTvFc0somT4z3ifkViR+
MD5:	E5F0DD373E7B18B968FDC1087734F249
SHA1:	7AA65A636B7308F2BF9857530928DD50F0ED23E5
SHA-256:	EE4ADDB2FDFB0196F64D291F658377E7911643840DDE4D360AA2C7EEA3BCC020
SHA-512:	0CF3FD3A0FEEC3FF292BC0A81A33F022E46F1DD8BEE84D830628C80E96F2033975671D3B2C9B2386554074E3595A20DFE4EC3C0360FCF6B3FDF4AA1D1BD086B8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Detections.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6:.............!..0..............M... ...`....@.. ...............................O....`..................................M..K....`...............8...:..........'M............................................... ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@....reloc...............6..............@..B.................M......H...............................L.........................................B(....(....(............................(....t............(...+...@...........................(....t............(...+...@...........................(....t............(...+...@...........................(....t............(...+...@...........................(....t............(...+...@...........................(....t............(...+...@..........*.................(....t............(...+...

C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnAccess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	514560
Entropy (8bit):	6.409490598681187
Encrypted:	false
SSDEEP:	6144:xzAxZAn4A7V7xZ8dKOpMjampeKWBg1at/MKBVIMtYBeNVLq:x/4AxdBedrMKpZdq
MD5:	73452F58EA360501168391ED51967414
SHA1:	CCA89D6093F987572967042CD6321D13B1FF342B
SHA-256:	D314FE22DCB040B8A7AD183C15C872E4B0E14ECBB169AA8F4DDE84389A1513DB
SHA-512:	6E663E9462E5A1A1BB88A7B88DB35994B8B9A2A5FB0C47DA5D6038524439790F72D2A3A5EE8602AA3E49CE9EE24708D3E3F368D8DF931491794BD598F6481F08
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnAccess.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7.............!..0................. ........@.. ....................................`.....................................K........................>..........O................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc..............................@..B.......................H............T...........m..7@............................................B(....(....(.........(........................8........E....q...K...2.......$...8l............(...+.. ........8........@D...8.......(D...t)..... ....8....~...... ....~5...{....:....& ....8v....... ....~5...{t...9^...& ....8S........................8........E....i...[...j...-...F...8d.......@M... ....~5...{I...:....& ....8.......(G...t)..... ....8.............(...+..8........ ....8~...*~...... ...

C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	472064
Entropy (8bit):	6.199008548625321
Encrypted:	false
SSDEEP:	6144:cCz7cTxZKL1JmzPydmULmHQ1c6yqmZ4EdzktLRuCXzYbdWrFQEp5ze:cCMT20P5vD67wvzsRudWrFfze
MD5:	D39E273EE94BBC10711BD117681C012C
SHA1:	DBA8D0169DC6010C78F323194558AA0CF4675983
SHA-256:	A2B2ABF5E7B80135C07A35BB9200BADD4C0C12B997234B063D6F6E1EE395A55C
SHA-512:	2CA1432FF29212CB8F33F220650314B93F415A4203A10DA55E58D7B6B22CE2A71EF9AA6C79F82B168152DA4D36A4D9AC150DDBAED806B98D4AF9F6ACB8C61A59
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..............!..0.................. ... ....@.. .......................`....... ....`.................................P...K.... ...................>...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@....reloc.......@......................@..B........................H.......0....k............._...r..........................................B(#...(....(.........(........................E................2.......8......8+... ....8.....(+....(,.....8........E............Y...8.... ....f ..0}a~x...{....a(-..........%.....(....s...... ....~x...{~...:....& ....8.....(/..... ....~x...{....9....& ....8........E........l...........4...Z...8......... (0...(1... ....~x...{....9....& ....8......(7... ....~x...{t...9....& ....8........(3....s.....

C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	416400
Entropy (8bit):	6.284768478175249
Encrypted:	false
SSDEEP:	12288:8CeUGvX2vrwWyfKVuiDBvnFLJevzfXjvZ:8zUGv2Dw/yVugnFLJevzfF
MD5:	FEF47B4E7B63CB25325B309501C1277F
SHA1:	1855189CC7572FA17E6140100930F33B7C567883
SHA-256:	426C7A2EB540DB5B688D9D49DFAB819178AF4D1EEBD23ADF979BB0178EC6FE5B
SHA-512:	316ED1CF7F6438481E13BAFBE5DD21550A86AB7AC20A1FDFFA4AA9A934757A0E570745E1D96B6AD28DA665C0B63E5EB460FDE1F5676445A18A71745B78D54850
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8N.............!..0..............5... ...@....@.. ..............................M.....`..................................4..K....@............... ...:...`......k4............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@....reloc.......`......................@..B.................4......H........7...!...........X......3.........................................B(....(....(.........(........*................8........E....................0.......8.....(.....o...... ....~....{....:....& ....8........E........$.......8.....(+..... ....~....{....:....& ....8........E....?...n...8.......^...s...8:.....(2...(3..... ....8........o.....s...... ....8......(0... ....~....{5...9....& ....8..........o....(....8.............i(/... ....~....{....9....& ....8........E...

C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2771600
Entropy (8bit):	6.630252356589734
Encrypted:	false
SSDEEP:	24576:Vo5aD7iyJuZetjPsDpGg+LHH4YvbCPv7KOuNXU9QtCofuHMBgNTaH9+4/V5WE7li:VRscg+i7KXlCKQ+8uN7lEUjkAW
MD5:	E3AEDD60FA756973BFA4BF4DF12D0E3C
SHA1:	8C4ADFF407EE0FAFE72F3FD6AEE2D2EE56B53819
SHA-256:	A634608BCECA94C010B383B1B4CCC4750F875C41C458C3FC26A1941F2F09D836
SHA-512:	2C1725561C2E43DEB329CFA50E7A1E185AFE8E5C84E52F00A14C1BE81684D5EDA2708231F69DA5B9FA5FD94DF0F32DF809A581CA1D13809E7565535FCDBB3EB0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.q............!..0............^$.. ...@...@.. ..................................`..................................$.K....@.h...............:...`......#.............................................. ............... ..H............text...d... ..................... ..`.rsrc...h....@....................@....reloc.......`....................@..B................@$.....H........<..\|...........(....?..C#........................................B(Q...(F...(.........(........................8........E....5...S.......Y...\...80...r...p.(...:L... ....~....{....9....& ....8....8.... ....~....{....:....& ....8......r...pr...p..8.....(.....o...... ....8........E........5...A...8.....(...... ....~....{....:....& ....8........E....W...\|...B.......O...4...8R.........o....(.... ....~....{....9....& ....8........(/....s...... ....8......o....(..

C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	218112
Entropy (8bit):	6.125510337455106
Encrypted:	false
SSDEEP:	3072:dHfzQNeguktxKD8AOQnzdGp/uaONd3aDDqnuHkFSSSqw9ZG9G+4c3TP:xoeg5wD8AOuztNcDD2lSZN+4cL
MD5:	E921ED7413602B2083B92D2A59B3CED8
SHA1:	D7D39380690EBF37980478BF0147355706AF90F6
SHA-256:	E97376D9A88F7162CA726B09F275C3C8AC9D46245F596B0F70670B1F6B211624
SHA-512:	256B7D71E8E31F4ADE989D6CBCDA70D49897F88E591298C3E19DD06E97218EEBB92D47B7A959F2FB9C100B7D706E141D2BFDF2AA20623948B78C3807E2D1FE08
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.UDI.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0................. ...@....@.. ....................................`..................................)..K....@..h................>...`.......)............................................... ............... ..H............text...4.... ...................... ..`.rsrc...h....@......................@....reloc.......`......................@..B.......................H........1..0...............k8...).........................................B(_...(T...(.........(.......................................(....t............(...+...@...........................(....t............(...+...@...........................(....t............(...+...@...........................(....t............(...+...@...........................(....t............(...+...@...........................(....t............(...+...@..........................8..

C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	166400
Entropy (8bit):	6.158608866537054
Encrypted:	false
SSDEEP:	3072:DXjdRFYnUGOU5EkAOb1G4/bYEDJNsg8Ta/PM38ovau1FHdGXa7:DXjLFYn7GkPXbYU+vt1F9Go
MD5:	E0D4F80FBCEEC79CCE5938FE9F01CFC1
SHA1:	DBCDFC09652F84486671121BE2F1CA37F043C94C
SHA-256:	ECCAEEDE0D5EC2B32DCDCFC96E1A4BB0D6C495B04B1EAEE5A56A8314C5B5DFA5
SHA-512:	A9E303EBF5392DF9AC804B220846116FDC9EF308E99920C6F2F240F20B8EBDC2C696A02730DD429D15E5D8E22AEBEB280BB2222E23D3DE0E19D249CADAD858BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f............!..0..B...........`... ........@.. ..............................8u....`.................................p`..K....................L...>.........."`............................................... ............... ..H............text....@... ...B.................. ..`.rsrc................D..............@....reloc...............J..............@..B.................`......H...........4............;...!..._.........................................B(....(....(.........(......(........................8........E............n...+.......8\|...~...... ....~o...{N...:....& ....8.......(....t......8.............(...+.. ....~o...{....9....& ....8y.......@.... ....8f....... ....8X........................8........E....:.......i.......w...85.......@Z...8....~...... ....~o...{....9....& ....8.............(...+.. ....~o...{....:....& ....8~....... ...

C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	534016
Entropy (8bit):	6.1378496343217614
Encrypted:	false
SSDEEP:	12288:ruFjirA1cQ3luN7Ce9+YLgtXsXNvSgKc4D7SBinCCwCy:r6jUA1cQ3luN2e9hLGsXN6A4D7TnCl5
MD5:	3D99E12DEB19BAA369F7FDCD78602852
SHA1:	D2C3DCAC19A1F2E6F0766830B034D3792708C5C6
SHA-256:	25D5733DE291FC13A5377E293A1DB0628BF46028C1A75451363218043EDC71B7
SHA-512:	EB600DB4E7A4139FF105995E2F6A58278772AECF66EFD7406C1B2461312554756CD2F1423CD5C69202FC5D4FBE5F274B1A7F46A4A5C2894EBDD34AE99AF4DB4E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.Browsers.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5.............!..0.............~.... ........@.. .......................@............`.................................0...K........................>... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc....... ......................@..B................`.......H............<...........'......Y..........................................B(....(....(.........(......(..........................9......o....(....9......o....(....9......o....(....9......o....(....9......o........"............................E...........8%...... ....~....{`...:....& ....8......*.~....(....(....(.... ..4. ....a~....{....a(....r...p(....(...... ........8........E:...........O...".......C.......................:...~...............>...........,..........

C:\Program Files\ReasonLabs\EPP\rsEngine.Utilities.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2464400
Entropy (8bit):	6.218158032777317
Encrypted:	false
SSDEEP:	24576:26nuotpeZ9F9wQ7YO6GWZ1VlB6F00QEXiAuT6A6yl2XhKNO8s3+WB:C2QMDHCTAHemO8I1
MD5:	3E90B6DE455F8A6EBF19F909EEF0F2BD
SHA1:	EF08B47F6A311DE7FBE94B64A5BA3FF30B4CDEE7
SHA-256:	57BF1B550404462301C0610BF33865B504B5D0B09C87B6F97F55B089E059A6D1
SHA-512:	1A92732CA78D52076D16A751882AB9A9CBAB8558BF3DC1558C39854547E7430A7D278D048433459A6D3FC4D06820FDE74DDA6B4BC109B057DB6480B5ED4B38D0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f..............!..0..V%.........~t%.. ....%...@.. ........................%.......%...`.................................0t%.K.....%..............`%..:....%......s%.............................................. ............... ..H............text....T%.. ...V%................. ..`.rsrc.........%......X%.............@....reloc........%......^%.............@..B................`t%.....H.......X=..,S............ .....`s%........................................B(....(....(.........(......(........................8........E....2.......{.../...G...<...8-....(....:;... ....~y...{....9....& ....8......8....8....8.... ....8....r...p.o....9.... ....~y...{a...9s...& ....8h....(....(+.....8........E....O...X...u...8J... .!.. .@.>a~y...{w...a(,......#...%....(-...s...... ....~y...{3...:....& ....8.....(...... ....~y...{....9....& ....8........E..............

C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142848
Entropy (8bit):	6.084168906551222
Encrypted:	false
SSDEEP:	3072:U0ufITLt74jugCBnwQ5pbYehtBw2uF1/A/zTkRK1b6jeWpV:U0ufITJ74agCJwQ56ehtBw2ubYV1bx6
MD5:	C52264E3E8AAA14A7F8F5101BBA18730
SHA1:	A19A6C8BE9BB38FEECD49EDB09A66BD725312A26
SHA-256:	ADFFE3F17B6812A7B0AAE6AA8BD97645E62F91B79E10E405905F03C78EBC07C9
SHA-512:	8BCFB822EEBC4E1A70328FAEF907CF028CCBE11A60C6E2A98343E022524B840DEDBE9189E723B7758A2C77187E5B0E471EF1FC47E97B82B6736FDD7435AD64F4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngine.Wsc.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0.................. ... ....@.. .......................`......I.....`.................................p...K.... ..h................>...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...h.... ......................@....reloc.......@......................@..B........................H.......lo..............$..................................................B(R...(....(.........(G.....(........*................8........E........e...........8.........(....8K.......E....Y.......}.......F...8T...s......... ....~R...{_...:....& ....8....~....:E... ........8....8.... ........8.....9... ....~R...{y...:u...& ....8j...~...... ....~R...{....:O...& ....8D..........:5... ....~R...{a...:....& ....8........E....5...+...80.....(.... ....~R...{....:....& ....8....8.

C:\Program Files\ReasonLabs\EPP\rsEngine.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (5824), with no line terminators
Category:	dropped
Size (bytes):	5824
Entropy (8bit):	5.99179572850437
Encrypted:	false
SSDEEP:	96:Rw99zAT1M+bHIEwrgiYlBk9x/rcohy9Q/GDFSf1Ru/M7j0C0wXfAXBT5A:RwLzAZxrIt0Bk7+QZz7jh0wI5K
MD5:	0195B6F2D3E0F5A4947F353E48E15D8C
SHA1:	F29FB502B68A486FFEE0C55ED343C15E5110E6F9
SHA-256:	52B9FF10C412162CE0AC5ECE6CD56B1164C209AF1AD8B3B8E334149ED6E4EA56
SHA-512:	65BA63D1645A1C507C2A8C4728DF0F1F660F3574333925386F1B5B07F11E4E894D8404767A478A384D6A5910915FF040698C6C761047A4CE53A9FABD2D788BEF
Malicious:	false
Reputation:	unknown
Preview:	SeNHHAozzDzx8xafGs52O02M3LrbDRSLIJ5xixluCuxOz2RE7hbtSEc4h5uwlDrbNRkIuc4wJhx4cXXt/BOt9Z+36zGIYFX8XISHgLWcpFjCNyTrdgn2YOwLq7Y7bAKO5yDJj86mhhScMYzZBlyORgFRJ147EDfwm0fcGGR0sjv0p2Gn/ZV4AgD66Ocu+Msv8hkX9Iv4Ny94mQ/t8HdSZcpl3Vs1/Y2/w1eWrsjffIJRQPTst3kD+6PkJ6wESCkalyNysMY7Xym7/aS1fSZWmUxP0m0VZihGj6AV+J3d8we9Z3Jd/GK2Eyq8xg+d0D03kWzKYSSWH6IurX1f0MJ/RdIqVoXOToOeW8FXmrL/mVu1P0Sk9q5GCosFlPYAQdEkM+k9JNb0YPcOmlrbVVF+CU2PekpKhwWF/u6kFjbT3EZbXcfjB4XPqNremlWvMtCo2mOnMIs9Omm9ROlhD28LolaA9zpxsgDoqLGVSb56MA8Z2ho9DdUQHixQWphsJ7efUATXjTeoitUN7qTrigGJXAeGYCeHtHISIi8LkQB6uba4L8w6imPsL/ak8FtVyW2OYkpELVVcBdg5NTDT7hhkgBYjSRz4udHNJAwrHJtQkDcZRu81LGNQBmeEER99cN71j06CjH6xiw5y6Q/bgmQ8OvH0WTMXXcCc3fkVWDHgSDKvj6owxB9+Z3KGjnEbmpOzfxDkI8h4JF2ALQbKSxhTEaLUDm7zsJuljmB7VBsCEAw0yStGo/aTERF+U4Hlh6RrC6jTRnB6hMMY3NJf7nqG7jlAcyoi6/btEFUz0MmFZ6PF7rOuPsIuD3QHWgZdFQIH/TZskLj1YAEXDsU/HSQR/ukB/If5hjj5Lk4ZkZ621Upjc2OVvyFMrSEC8chhTVfauV72ZEIvueY5TFjx+AxdEvShXzTTJJjlss3nI8Qsy2+k/bUAuaJO9qlH6KuWoYT5keJ7IZxJQP0DE1Lfzb6ZWNMcwZLxYXCpR4lLNHDb

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog

Download File

Process:	C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	660
Entropy (8bit):	4.794264233963525
Encrypted:	false
SSDEEP:	12:qLLnR8IJomf6WELXsEjXnC9xkKxkwCsx/nR8IJomf6WS:qLruIF69L9jXIxkKxkwCsxuIF6b
MD5:	705ACE5DF076489BDE34BD8F44C09901
SHA1:	B867F35786F09405C324B6BF692E479FFECDFA9C
SHA-256:	F05A09811F6377D1341E9B41C63AA7B84A5C246055C43B0BE09723BF29480950
SHA-512:	1F490F09B7D21075E8CDF2FE16F232A98428BEF5C487BADF4891647053FFEF02987517CD41DDDBDC998BEF9F2B0DDD33A3F3D2850B7B99AE7A4B3C115B0EEFF7
Malicious:	false
Reputation:	unknown
Preview:	.Installing assembly 'C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe'...Affected parameters are:.. logtoconsole = .. assemblypath = C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe.. logfile = C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog..Installing service rsEngineSvc.....Service rsEngineSvc has been successfully installed...Creating EventLog source rsEngineSvc in log Application.....Committing assembly 'C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe'...Affected parameters are:.. logtoconsole = .. assemblypath = C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe.. logfile = C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallLog..

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.InstallState

Download File

Process:	C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (7463), with no line terminators
Category:	dropped
Size (bytes):	7466
Entropy (8bit):	5.1606801095705865
Encrypted:	false
SSDEEP:	96:R3DrP/zatgCnNjn1x62muDr9aHmzcv/65m7JDcm0BefnanGEkn56vT4ZvR++JDr+:NexdYX7OSRjXsaA0Ndhi
MD5:	362CE475F5D1E84641BAD999C16727A0
SHA1:	6B613C73ACB58D259C6379BD820CCA6F785CC812
SHA-256:	1F78F1056761C6EBD8965ED2C06295BAFA704B253AFF56C492B93151AB642899
SHA-512:	7630E1629CF4ABECD9D3DDEA58227B232D5C775CB480967762A6A6466BE872E1D57123B08A6179FE1CFBC09403117D0F81BC13724F259A1D25C1325F1EAC645B
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?><ArrayOfKeyValueOfanyTypeanyType xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" z:Id="1" z:Type="System.Collections.Hashtable" z:Assembly="0" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><LoadFactor z:Id="2" z:Type="System.Single" z:Assembly="0" xmlns="">0.72</LoadFactor><Version z:Id="3" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version><Comparer i:nil="true" xmlns="" /><HashCodeProvider i:nil="true" xmlns="" /><HashSize z:Id="4" z:Type="System.Int32" z:Assembly="0" xmlns="">3</HashSize><Keys z:Id="5" z:Type="System.Object[]" z:Assembly="0" z:Size="2" xmlns=""><anyType z:Id="6" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">_reserved_nestedSavedStates</anyType><anyType z:Id="7" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/20

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.Proxy.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	167424
Entropy (8bit):	6.165456000712779
Encrypted:	false
SSDEEP:	3072:TdtSl7bGtt5g6RBJ3jqXc6AFBnMkV21vbzy:Zt2bgn32KMc
MD5:	327345B3F3E66A7429BFD822F6C20553
SHA1:	D2A8E73744B1F266B16E18FBA4C61AA5C5B50CC7
SHA-256:	AD6C80D0BE80A6581DAAE0C9A851586D5511C60FD2C2CA4705027259591DD2A2
SHA-512:	B7C1476196782942DC15198B8CE8DF92EAB4E4B388A4C8DF5DE39FC47947A4638FC94EA7657F5636D88A1B8E8098753B80862F5CF87DE47FCDE14A0D40613AC2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.Proxy.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....9.............!..0..F...........d... ........@.. ....................................`..................................c..K....................P...>..........qc............................................... ............... ..H............text....D... ...F.................. ..`.rsrc................H..............@....reloc...............N..............@..B.................c......H.......l................=...#...b.........................................B(a...(....(.........(V.....(........................E........M.......Z...8.............(...+.. ....8.......(....t...... ....~....{h...9....& ....8....~......8(.......@.... ....~....{....9t...& ....8i....... ....8[.........................8........E....G...4...n...U.......8B............(...+.. ....~....{....:....& ....8........ ........8........@....8.......( ...t...... ....8y...~...... ....~..

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	309248
Entropy (8bit):	6.231027305537471
Encrypted:	false
SSDEEP:	3072:JY9xWi4IKRdUa3n5Xuj8NZsaJ6BrdvtFmso7UT+mTDNfXDfKrB+3fCyhM4TKBj7y:JaBjHa3RpZsa4BrdVF9o7UPD0+PDki
MD5:	EDAFCF4340BE2E065FD54D20CBD3DC58
SHA1:	77491716599FC8D874D9E3F320379CD2309D394B
SHA-256:	3F29E100DB1DA87A42B9CD30E96AE9FB1066C0E7ADCB774C76E0A1DE7481875A
SHA-512:	29CD20A20506227FE9F04BBCE632B39B39648EE7621A053D9DC7CAF81F0D586A79E32CEAF29C7B0FF36324FAE08F8CAD5FAE5F5D20E9FCA194F9F5F4E818D1F9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.JSONInterface.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....GPf...........!.....p..........^.... ........@.. ..............................^c....@.....................................K....................z...>........................................................... ............... ..H............text...dn... ...p.................. ..`.rsrc................r..............@....reloc...............x..............@..B................@.......H.......l...t.............................................................B(....(....(.........(......(.........................(....t............(...+...@...........................(....t............(...+...@..........*..................t.........~....o.....i.@.......i...s....(.......j...s....(.......k...s....(.......l...s....(.......m...s....(.......n...s....(.......o...s....(.......p...s....( ......q...s!...("......r...s#...($......s...s%...(&......t...s'...((....

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	190464
Entropy (8bit):	6.260050422590562
Encrypted:	false
SSDEEP:	3072:pk4fIhz6wRxDxwWEIW8lReMzF8hakNzijRcuQGK1mTw:pZfkz6iDx9xmh1VuX4
MD5:	6586DD2E2192CC016D40D6A0439B1923
SHA1:	2A30D5A172BDB44FD4C0A91AD729C684EFF068CB
SHA-256:	6D5EC23B8E664ABDEF46A39A2AE0BB86674A29D342DC11CF9ACA356EEC6C6D07
SHA-512:	3F1A945AC993C6009D8DA2AD466A48CC87B1CE3D702F53448A3F8E253DA7797B4CE9484434A1C9D4B462AE8A0BF808A9CE5A2B3CE4539822A5F461E13700C5FD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.RPC.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Vm............!..0.............^.... ........@.. ..............................E.....`.....................................K.......t................>........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...t...........................@....reloc..............................@..B................@.......H.......................p....-..<..........................................B(....(....(.........(......(.........................(....t............(...+...@...........................(....t............(...+...@.............................(....&8........................8........E........q... .......K...8....8.... ....8......;^...8....(....%:H...& ....~....{....:....& ....8......;.... ....~....{....9....& ....8v....(....*(....%:"...& ....~....{....9N...& ....8C....

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	364688
Entropy (8bit):	6.349300837557166
Encrypted:	false
SSDEEP:	3072:IhN7hsWFCYn1OccgbaLUGj13/ILPYngdruWO8ITeN8fl31171ntnPQvpQ4zc+eMR:ShsWFT1Oc1ijZ/IDddaWGl111BuvRc+
MD5:	D8053B9FDBDBB3E32CF583AACB29D1EE
SHA1:	43D1F93711C410C9458F0C10F98BB89690661F1B
SHA-256:	D241E1EE561D0161455520676504E581CC2FEF4BEA6680C9D447FD2253678B2E
SHA-512:	C436FA0B982E3212A2D7379F3DAE8DCB2984973889544719B6E68CC8FC53A7CCB31BB2190FF7D868A74ED65D5A93435D71A8A5BE6BD4AFA8E075EBDA9C94075C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0..J...........i... ........@.. ..............................z.....`..................................h..K.......$............V...:...........h............................................... ............... ..H............text...$I... ...J.................. ..`.rsrc...$............L..............@....reloc...............T..............@..B.................i......H.......TQ...m..........\........h.........................................B(/...(....(.........($.....(........*.................po.... '...8........Ec...4...........!...........P.......Y...........a.......6.......+...!...................4.......................@...............A...........p...(...........}.......5...........................C...........`...<...<...................j...R...........................!...................?...[..................."...8...........[

C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18070
Entropy (8bit):	4.992549577385435
Encrypted:	false
SSDEEP:	96:hrkUwfx0GReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhubUfSJeZedUaw:hrU5PUDRTHffIz
MD5:	5EF4DC031D352D4CDCEFAF5B37A4843B
SHA1:	128285EC63297232B5109587DC97B7C3EBD500A6
SHA-256:	4B094B7BD38E5BF01900E468DDD545B42369AE510EC2366427804A57DA5013A7
SHA-512:	38B0444E4F07AD0B50891E2B0DA6374B0033CB9656A4918E9EAAE34E381D95671978D19ABBCF2B8FDB079921B85E20DBE2C4392B15984CE6051B48B4A05A172F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.InteropServices.RuntimeInformation" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.2.0" newVersion="4.0.2.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Collectio

C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	153600
Entropy (8bit):	6.136407498903004
Encrypted:	false
SSDEEP:	3072:6K86KKJ/0hDGadf+DZZC3J5Qdl+4e4cwJ5EqP4qCq1RY09:6KvKKShKe5QdM4e4cGT/n
MD5:	42FFE698DABC46C3993D74E2BC6116D5
SHA1:	19D937886A469C3A7EAB1CC4F662476D37E22C44
SHA-256:	031348435351CC53C63FB0C0365AB0612FF405D34DD25D97C2EDA90F00BA3E1E
SHA-512:	9F11A2E661390834D34472D92CA2750B499B379D1E1368E67B48ECCE56BA464F22D3C713DF1AE7805895E9E9568EA91537988232213BE919F58B2E056116FCDC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............~,... ...@....@.. ..............................4.....`.................................0,..K....@...................>...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@....reloc.......`......................@..B................`,......H.......0...T.......Y...........h+.........................................B(....(....(...........................8........E....l...........C.......8g......... ....8....(....o....9m... ....~w...{r...9....& ....8....(....(.... ....~w...{m...9....& ....8{...8.... ....~w...{N...9b...& ....8W....(....8............(...+......................E....9.......:.......\|...84....(....9....8....8 ... ....~w...{I...:....& ....8....* ..y ..xa I.<sa~w...{....a(.....s.....o....(....:

C:\Program Files\ReasonLabs\EPP\rsExtensionHost.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18070
Entropy (8bit):	4.992549577385435
Encrypted:	false
SSDEEP:	96:hrkUwfx0GReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhubUfSJeZedUaw:hrU5PUDRTHffIz
MD5:	5EF4DC031D352D4CDCEFAF5B37A4843B
SHA1:	128285EC63297232B5109587DC97B7C3EBD500A6
SHA-256:	4B094B7BD38E5BF01900E468DDD545B42369AE510EC2366427804A57DA5013A7
SHA-512:	38B0444E4F07AD0B50891E2B0DA6374B0033CB9656A4918E9EAAE34E381D95671978D19ABBCF2B8FDB079921B85E20DBE2C4392B15984CE6051B48B4A05A172F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.InteropServices.RuntimeInformation" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.2.0" newVersion="4.0.2.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Collectio

C:\Program Files\ReasonLabs\EPP\rsFrame.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.868915768817926
Encrypted:	false
SSDEEP:	384:BYzPTJH3h8Eq7rjP9Z95Xa/rl9qX2Ip4VnTjdAA1m5wMBq5ul043Ovfh+LLX:BYztH3h8Eq5HRKrLy2Ip4VnTxf1mlBqi
MD5:	C104DA9AADDEBF969962F11EA3F7F42F
SHA1:	546EC88DB080684694860C9B0B4B2EEA48B9953C
SHA-256:	9E5714777C010A693FCCB69AF0FD3909DF486360B8D8DA67A257F338D0CD3D16
SHA-512:	EE0AE4101130A5E852254543930B5915D74D54145738084DEEC661C74B4D09924D323E7A4FCDBA559FFE38C7522C785FA92CBAA02C1CB24262724BB93C9B4A1E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............".... ...@....... ...............................v....`..................................-..O....@..H................>...`......D-..8............................................ ............... ..H............text...(.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B........................H.......H$...............................................................0..t..........(.....0...R.......-...R....... ....j5...6.r...ps....z.i.................Yo.......1...X...1...2.....s....z..R...0..E.........i..,-.j%(.......X..........(.......o........o......(........o......(........0..^........~....7T.~....7J.~....7@.~....76.~....7,.~....7".~....7..~....7..~....7................0..B........(............T...J...XT....j_ ....j`...d%..-...J.Y.....%G.._.R.*..

C:\Program Files\ReasonLabs\EPP\rsHelper.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	6.099711845700752
Encrypted:	false
SSDEEP:	1536:/Wy17X7LCWgHARJGojSkT3j+iCFCKJVLgEYyoE/58ceViIZF45Lw2aR8PTMDz+VK:/WQLJDTGh83qhsKbLzoke74I0Fn32io
MD5:	FBEE628345F36CDDE1AA68500C805888
SHA1:	990C2FF6F1CCD1B3AECF7137C8EEE764EFECD754
SHA-256:	BD8DBBF36AEB46474A5C087B939F96979C65E3EDFAF0B0C889EDF4B3316E0FC0
SHA-512:	B3A0285AE5B6F614EC1DEA34C9276A9F44982B5E16F01A71FC7168424F035B05093AC95BC47888B80EDC607C5E7865A253D5FF6996E9F7FCCC9CA1CB6DBC6E8B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsHelper.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....?...............0.................. ... ....@.. .......................`............`.................................p...K.... ...................>...@......)................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@....reloc.......@......................@..B........................H........k.................................................................B(f...(....(.........([.......................8........E....9.......)...v...............84......... ....8....(....r...p(....8>....(.... ....8....(....(....:.... ....~....{....:....& ....8x...(.... ....8i...(.... ....8Z...(....(.... ....~....{....9;...& ....80.........................8........E...........8%...(.... ....~....{....9....& ....8..........8........*................E..................

C:\Program Files\ReasonLabs\EPP\rsHelper.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18070
Entropy (8bit):	4.992549577385435
Encrypted:	false
SSDEEP:	96:hrkUwfx0GReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhubUfSJeZedUaw:hrU5PUDRTHffIz
MD5:	5EF4DC031D352D4CDCEFAF5B37A4843B
SHA1:	128285EC63297232B5109587DC97B7C3EBD500A6
SHA-256:	4B094B7BD38E5BF01900E468DDD545B42369AE510EC2366427804A57DA5013A7
SHA-512:	38B0444E4F07AD0B50891E2B0DA6374B0033CB9656A4918E9EAAE34E381D95671978D19ABBCF2B8FDB079921B85E20DBE2C4392B15984CE6051B48B4A05A172F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.InteropServices.RuntimeInformation" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.2.0" newVersion="4.0.2.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Collectio

C:\Program Files\ReasonLabs\EPP\rsJSON.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224400
Entropy (8bit):	6.7771936576354355
Encrypted:	false
SSDEEP:	6144:R7IEMtFMZZi+Ng9999994f9oMlnhcNx3Bn:BZi/MlevB
MD5:	FA63504382F4F3F92FA86841D9E97F29
SHA1:	0BDE02C98741BB24EAF501BD8E2D9738742CD042
SHA-256:	5F0764E1998464F63C6583F870DD3784921B752B91D8E450FE2C90153CB5E58D
SHA-512:	C8483D9060A6800C8DEDB4D5FEA7CDA346F742CA1A149C3EB608823209AFF1F00BFCC5B0CAF9C482C7B01D75F6E198EDFAE3B0100CB0DCA6E5B5F18336ABDEE5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..............!..0..(..........nG... ...`....@.. ...............................)....`................................. G..K....`..D............2...:...........F............................................... ............... ..H............text...t'... ...(.................. ..`.rsrc...D....`.....................@..@.reloc...............0..............@..B................PG......H....... ...P...........p\......_F.......................................(....(....:+.(.N.R.(......0.............A...................:........0.............B(....(....(..................................................................................................................................................................0............................0.....................0..............................0.............*....................

C:\Program Files\ReasonLabs\EPP\rsLitmus.A.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	111616
Entropy (8bit):	6.294958596524468
Encrypted:	false
SSDEEP:	3072:XfL+72PsK9Qd/RpgyxMkJfjQmMCdwMzTVVAP:XCqkK2/Rp5DzTVKP
MD5:	25E82984602B03AE3572A1AE582B3392
SHA1:	7407428D1B7E82F5266B1FD9F010F9C63079B7E3
SHA-256:	D1DBA91B162DA215E091701BAA4A662EDF22911CAE67C64DF0ECA8FF7A1EAA78
SHA-512:	72CE8E33C1A1D2AA8AA68906A89787AC589DA86845211E066E5D1B41948FD3D7FE16FDBBA8A6CDFCF5DC944943A8ABD4ED4E582D959D1C6A1AC802DB3D5F5480
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Lq..-..-..-...E..-...E..-...E...-...X..-...X..-...X..-...E..-..-...-..;X..-..;X..-..;X..-..Rich.-..........................PE..d......b.........."............................@.............................................................................................V..(...............t....v...>......8....E..p...........................@F..8............... ............................text............................... ..`.rdata..V...........................@..@.data........`.......R..............@....pdata..t............\..............@..@_RDATA...............j..............@..@.rsrc................l..............@..@.reloc..8............n..............@..B................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\rsLitmus.S.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105456
Entropy (8bit):	6.166230469207198
Encrypted:	false
SSDEEP:	3072:8fL+72PsK9Qd/RpgyxMkJfjQmMCdwMzTVK:8CqkK2/Rp5DzTVK
MD5:	7C97046701CB82E4E409DF20AF386275
SHA1:	051267E447CF42B2ECA5F695526F18ADD1CCF3E4
SHA-256:	38CA46547C8C7C5C0C8E394EA355A03C26A08ADB63B39FC95AA5461B5321DA7C
SHA-512:	22E2CFBDA6E47D62E0F87535F4F61ECC67408EFDF020C41A29993BD80FAC9CC40D4513708C0BC96CBAA0D70686BBBD2D7CB1FBB95BD273937159D6516452B691
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Lq..-..-..-...E..-...E..-...E...-...X..-...X..-...X..-...E..-..-...-..;X..-..;X..-..;X..-..Rich.-..........................PE..d......b.........."............................@.............................................................................................V..(...............t....v...%......8....E..p...........................@F..8............... ............................text............................... ..`.rdata..V...........................@..@.data........`.......R..............@....pdata..t............\..............@..@_RDATA...............j..............@..@.rsrc................l..............@..@.reloc..8............n..............@..B................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\rsLogger.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	182920
Entropy (8bit):	6.549984856278825
Encrypted:	false
SSDEEP:	3072:5Uy/CR6dEfViQ+7gLmiEw/zrQUTkkySNP0dbNIprWrL:Cy/CVQILmil/zrQV2YbNGy
MD5:	E3FA0916F33BEE8A14F28421D2DCDC9F
SHA1:	FD3DCA4DB55E81EBFFC7609C5D63A4FFBD6629B2
SHA-256:	29AAFF11E775C800575B1A5D4160DAEC749DDE528E68BC3B6E9B340279ED991D
SHA-512:	FE96EFD3CF162BBB766634C3D90F707D868378DD04E47AA9D55C03E03130F54827F781639383B053C9335D022CCD6B244B67E586197C2B40D193DD58A4EE8CB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...oe.............!..0.................. ........@.. ..............................Y.....`.................................P...K.......P................:........................................................... ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................H........s..d...........t".. ............................................(....(}..."...........0..............0..............0.................................................0..............0.....................0..............................0..............................0..............................0.....................00.......0..............................0.....................00.......0..............................0.............*........00......

C:\Program Files\ReasonLabs\EPP\rsPerformance.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43152
Entropy (8bit):	6.52771924462892
Encrypted:	false
SSDEEP:	768:NWti03xJqc90G9LylSEJHRKrLy2Ip4PCxf1mlzzA:NWtbq80S4bJHi/9AfIPA
MD5:	3418BCC93F638C6546B5E65B178F3FB4
SHA1:	75A5668656A41FBF9010C2A06A42A4A03B4BE17D
SHA-256:	E5E37F425D3DB3ADE0340CA8D0D787A00C1CB3FA392BC525A56632D6A8983B9F
SHA-512:	173CAD6D3787BDED545D8DF9A4C1CE248E9AABF4DA3AF9DB80E9B2BBCEE59923CF6FF32F9021EC7FD880AF609680C3EF3DD3F3C7E7E6B231D9113CF306ECE73C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F.w..........." ..0..f............... ........... ..............................3.....`.................................l...O....................n...:.............8............................................ ............... ..H............text...xe... ...f.................. ..`.rsrc................h..............@..@.reloc...............l..............@..B........................H........>...D............................................................(......(......(.....0...........~....}.....s....}.......(....~....s....}......{ ...r...p(....}......+&..{.....{!.........(2...(1...}......X...{!....i2...{....(3...}....~.(_....\|.....(.....\|....(....&..0..2.......sa......}A.....}B....{.....{B......b...s....o.......0..$.........(......o ....0.~.....{.....(!....0...........\|.....(......("...-..(#...,.~.....-..\|....($...+..\|.....j(%....{......{...

C:\Program Files\ReasonLabs\EPP\rsRemediation.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141968
Entropy (8bit):	6.096258611111406
Encrypted:	false
SSDEEP:	3072:0wGLJwGeXmUy1hjvSn27sXc95eOioAXUxuIORpDa06i9i:rGLidXXKw2Mc95eLo/MQU
MD5:	AFB4F88146753AE0BB5C19E4DAECBB63
SHA1:	2A69DE6264B486D92D0CF08013209E997816D529
SHA-256:	E51CF661C3D51CD72B1D70DAC281579C4A94A7BA691D5933C316BE3718C1251E
SHA-512:	88C2C090190C9CA920C55CA2B02B31D345634418AEDEE742437197737EA67EAA38252F7453DA5D09CC9C283D0DE76B8984D3B655B2AB56F722BD0A0E5A77E605
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsRemediation.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.................0.................. ... ....@.. .......................`......hb....`.................................p...K.... ...................:...@......#................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@....reloc.......@......................@..B........................H........j..p...........`...[..............................................B(N...(....(.........(C....0.......... ........8........E....$.......5...............\|.......+...........3...w...{...........8......9.... ....~....{l...:....& ....8..... ...r w)..Y .Z.a~....{N...a(H...(....(...+9.... ....~....{....:K...& ....8@...8.... ....~....{j...:'...& ....8.....9.... ....8....(Z... ....~....{....:....& ....8...........s....(..... .@.. ....b ..a~....{V...a(H...(....(...+9/..

C:\Program Files\ReasonLabs\EPP\rsRemediation.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	532
Entropy (8bit):	5.071669869884946
Encrypted:	false
SSDEEP:	12:TMHdG3VOcrL59LNFF7ap+5EPf/2/+ZS9FicYo4xT:2dErvPF7NEPH2/+w39y
MD5:	801C6F8CE1CA9EAC249D7CD896E49649
SHA1:	6C39302A125ED0D5B4E7FAB0F04231264B5E59FE
SHA-256:	30F7E43D8512DE6CD64FAA58F6AD86046DA331E979AB4AF38F57BE57F7469EBD
SHA-512:	CC310126D9FE3857ED7F335400C11749911611EE782C172426F31ED7B6B7B3921C53BBFA5FEAB3BF1B0637A53581ACA231A7ED144D77F7B0237C77E4096F4D76
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\ReasonLabs\EPP\rsServiceController.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	179072
Entropy (8bit):	6.562871128885791
Encrypted:	false
SSDEEP:	3072:fT9nvidN3G9nZm4feQPMYGQh5AB9vaTiYuzdNd6iB6KA5U:fT9nvDB75Fq91dNd6iB6K
MD5:	8DCD92DE516608670F57193D74824A3B
SHA1:	C67C347DFA47C2DB1628FAB8BF9906C353F33DD9
SHA-256:	96DB49DB4DD12B9F86144FEDF83AC7DC12D855C5D7E3C863FD5B1696966AC345
SHA-512:	E5FDE81AE57E68DF69FC7695B9E16D8C7D188A30A4D68FFB682A3DCFEDF2C028874145815AAD2F957A02B0EAD6AD8F1442635DFA580339816110E7B1CDBC0C0E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsServiceController.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.C............!..0..t.............. ........@.. ..............................".....`.....................................K....................~...=..........A................................................ ............... ..H............text....r... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B........................H........q..<...........$................................................(....(.....0.............A...........(...;...:........0..............................0..............0...................,....5.....0...................L..6.:.....0.............AL..................Y.......................^...............~................0...................T..".......0..............0..............0.............A.......C...........c.......B(....(....(5........................

C:\Program Files\ReasonLabs\EPP\rsTime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21136
Entropy (8bit):	6.90635157752554
Encrypted:	false
SSDEEP:	384:hYZv554sAHo3T8VNrjP9Z95Xa/rl9qX2Ip4EDeCjdAA1m5wMzsPuMV:hYr9P3T8VTHRKrLy2Ip4tCxf1mlzzu
MD5:	3B2E281F09FCA19A7DDFA60F05566101
SHA1:	2F03319A5840EB8C2E12DAF8C9E7870FB022EAEB
SHA-256:	4041ECEC136A63E97B5FF0C980B95A4A5A193F95024C36BF56BC45DFBAC0558F
SHA-512:	F0C261714666BD5FF804BF6FD72C71AEFAAC0C9F13A74A1551FF65D5808B5E2C624A6B660B611B64714583C9B3363A33426C30223AEAF9D95F7770D06AD039F3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$ k..........." ..0.............~,... ...@....... ..............................N.....`.................................,,..O....@..H................:...`.......+..8............................................ ............... ..H............text........ ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................`,......H.......l"..8............................................................0..E.........(.........(........(....(......,...(....+...(.....#.........(....j....0..2........(.......j1..,....l(....+....l(.......3...(......2(.....(....J ...........s.......0..\|.........(....,....j...(.........(...._,...........(...........(............(...._-&......(....-.............(....Ys.....js.....0............j/..j.(......./...Y.j*...0..\|.........(....,....j...(.........(...._,.......

C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog

Download File

Process:	C:\Program Files\ReasonLabs\EPP\rsWSC.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	606
Entropy (8bit):	4.827799104208526
Encrypted:	false
SSDEEP:	12:qLLnY8bomf6uLZA2tXnC9xkKxA2YCsx/nY8bomf6U:qLr3X6uLFXIxkKxaCsx3X6U
MD5:	43FBBD79C6A85B1DFB782C199FF1F0E7
SHA1:	CAD46A3DE56CD064E32B79C07CED5ABEC6BC1543
SHA-256:	19537CCFFEB8552C0D4A8E0F22A859B4465DE1723D6DB139C73C885C00BD03E0
SHA-512:	79B4F5DCCD4F45D9B42623EBC7EE58F67A8386CE69E804F8F11441A04B941DA9395AA791806BBC8B6CE9A9AA04127E93F6E720823445DE9740A11A52370A92EA
Malicious:	false
Reputation:	unknown
Preview:	.Installing assembly 'C:\Program Files\ReasonLabs\EPP\rsWSC.exe'...Affected parameters are:.. logtoconsole = .. assemblypath = C:\Program Files\ReasonLabs\EPP\rsWSC.exe.. logfile = C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog..Installing service rsWSC.....Service rsWSC has been successfully installed...Creating EventLog source rsWSC in log Application.....Committing assembly 'C:\Program Files\ReasonLabs\EPP\rsWSC.exe'...Affected parameters are:.. logtoconsole = .. assemblypath = C:\Program Files\ReasonLabs\EPP\rsWSC.exe.. logfile = C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog..

C:\Program Files\ReasonLabs\EPP\rsWSC.InstallState

Download File

Process:	C:\Program Files\ReasonLabs\EPP\rsWSC.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (7463), with no line terminators
Category:	dropped
Size (bytes):	7466
Entropy (8bit):	5.1606801095705865
Encrypted:	false
SSDEEP:	96:R3DrP/zatgCnNjn1x62muDr9aHmzcv/65m7JDcm0BefnanGEkn56vT4ZvR++JDr+:NexdYX7OSRjXsaA0Ndhi
MD5:	362CE475F5D1E84641BAD999C16727A0
SHA1:	6B613C73ACB58D259C6379BD820CCA6F785CC812
SHA-256:	1F78F1056761C6EBD8965ED2C06295BAFA704B253AFF56C492B93151AB642899
SHA-512:	7630E1629CF4ABECD9D3DDEA58227B232D5C775CB480967762A6A6466BE872E1D57123B08A6179FE1CFBC09403117D0F81BC13724F259A1D25C1325F1EAC645B
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?><ArrayOfKeyValueOfanyTypeanyType xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" z:Id="1" z:Type="System.Collections.Hashtable" z:Assembly="0" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><LoadFactor z:Id="2" z:Type="System.Single" z:Assembly="0" xmlns="">0.72</LoadFactor><Version z:Id="3" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version><Comparer i:nil="true" xmlns="" /><HashCodeProvider i:nil="true" xmlns="" /><HashSize z:Id="4" z:Type="System.Int32" z:Assembly="0" xmlns="">3</HashSize><Keys z:Id="5" z:Type="System.Object[]" z:Assembly="0" z:Size="2" xmlns=""><anyType z:Id="6" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">_reserved_nestedSavedStates</anyType><anyType z:Id="7" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/20

C:\Program Files\ReasonLabs\EPP\rsWSC.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	208416
Entropy (8bit):	6.66794417577223
Encrypted:	false
SSDEEP:	3072:DelSSyM0edH6EPcfkUlpOepc4b6SBw8b+tjzyXOjnBYJwdkJjd/09xHcxOz:8SSl08EfkUlnp96Sa2u/yuBpdcu3h
MD5:	D8021F3B7E9C952B7EC33B929183E8EF
SHA1:	ED2D1DF3E7CAE24754DF2B59AB69263CA2EC8D13
SHA-256:	3744DB07F72992950FF14D39E7E82302B99557592649A855497C18DB3D7A3B39
SHA-512:	07C7DF63D4DD21B65ECE55BD6EF6D513F9DF400F5FE456BEDBCD24AE5C58800F4FB189CE00B2C0BB05B724234FA227904C021C4160D8C5541CD4B599DB2AAB47
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0R...............0..~............... ........@.. ..............................5 ......................................`...K.......l............... ..........."................................................ ............... ..H............text....}... ...~.................. ..`.rsrc...l...........................@..@.reloc..............................@..B........................H..................=....<..2^...........................................(k...(....:+.(.^K5.(a.....0..............0..............0.....................0..............(k...(....................................................................0...................Y....44.....Y....95....0.............AL..........E...M...8...4...........E.......8...7...........E.......8...5....0.............Ad..................:...5...........~.......=...4...........~.......8...

C:\Program Files\ReasonLabs\EPP\rsWSCClient.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	167056
Entropy (8bit):	6.47173453338494
Encrypted:	false
SSDEEP:	3072:X2kniFpIq4pOYs2sMR0i4xcHlyMTz4cU2bf3CLkPUWv2hK:mkniRQOYs2jRr4xcr3ELkPUY
MD5:	FD49CDA141634DFD2CB9538878D4FB0D
SHA1:	E52637CBF9724A59EDB51194A8F9B2784D019465
SHA-256:	9D7B2A3F3B53A3999B085466F4D12C80B062812FB871AAE34A621082EBC81BD7
SHA-512:	69BB9B3234B2EDBF93010DB72C47B00DE1D3C39E5F72FF8DDD7F408334709CDA3C6B27981F90E3BC1DFE43CEA82CD4363241A74C7824FC04BB189E0A622DBE2F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsWSCClient.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..H..........>f... ........@.. ....................................`..................................e..K.......\............R...:...........e............................................... ............... ..H............text...DF... ...H.................. ..`.rsrc...\............J..............@..@.reloc...............P..............@..B................ f......H........l..L...........X....i..!e.......................................(....(....:+.(...W.(......0.....................0..............(......E.........l.p..c......^..?.......0.....................0.............A...................}........0..............0.....................t...".......t..}.....0..............0...................$.k..}....B(....(....(..................................................................................................

C:\Program Files\ReasonLabs\EPP\ui\EPP.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2285056
Entropy (8bit):	2.0558079294683314
Encrypted:	false
SSDEEP:	3072:BWaGrR1sGXh2YGmO+OB69vV7GVrKEu1aeBv1L8ajGCsCMldD:BWaGrQGXhZ7OS9vV7G5MphKlV
MD5:	4BE222B0796DF9D496E9FF02C389C304
SHA1:	A50131CC3683AED3C32847CDD0B8B976951296BA
SHA-256:	AE6D512A1D4F0F4B91A699C80EB6B97ACD3BC59B22375A3039D74B58B31E9C2D
SHA-512:	26CCCEA83B3F1DFE84C63CACD4698D9EEA373219CDF810F5DBC1ACE313B1478D753EB5547CA186076E878883B462364DD80136805D7AADABD5917CF485A55EAA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........I...I...I.......L..............C.......Y.......@.......b.......H.......L...I...........H.....E.H.......H...RichI...........................PE..d...X>Pf.........."......H...T!.....PJ.........@..............................#.....ke#...`.....................................................<....`.... ..0..X....."..>....".t.......p........................... ...8............`..h............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data...............................@....pdata..X....0......................@..@_RDATA.......P......................@..@.rsrc..... ..`.... .................@..@.reloc..t.....".......".............@..B........................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\ui\app.asar

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	19517294
Entropy (8bit):	6.694656838901371
Encrypted:	false
SSDEEP:	98304:d+ST74motPO6kP2yKFZ18eBEUuvO2iVTmkPF6F5iyNbQ0/ynL:4STsdhB2UUiVBP0IIsL
MD5:	5B3C96E8253407BB4D731B00F64F42C3
SHA1:	F6F1C01CCA4DEBF091A8A6A76CF65D8FE47E9881
SHA-256:	8EE98FEC98550BFB5404406191838972977EFBE8B38B043D91BE2D2A5DF80C4D
SHA-512:	F257F5BAE982DE279D29475CBAD159C79B3BF7834434F944FF92CC34B6190C84489B755BAF513203578F105A106405428E84A58A6A3978D8A666765523CDFC42
Malicious:	false
Reputation:	unknown
Preview:	................{"files":{"asset-manifest.json":{"size":22307,"offset":"0","integrity":{"algorithm":"SHA256","hash":"1c397dbeb5572ee886bf7ad240ec1d6a49fdc39467eef0435c0bc2ec078d1b28","blockSize":4194304,"blocks":["1c397dbeb5572ee886bf7ad240ec1d6a49fdc39467eef0435c0bc2ec078d1b28"]}},"electron":{"files":{"assets":{"files":{"icon.ico":{"size":2127654,"offset":"22307","integrity":{"algorithm":"SHA256","hash":"b79838b15a988ea1aaaead3ba1353d54085cc76008489fb42f614e96f8b46aab","blockSize":4194304,"blocks":["b79838b15a988ea1aaaead3ba1353d54085cc76008489fb42f614e96f8b46aab"]}},"tray_icon_notification.ico":{"size":16836,"offset":"2149961","integrity":{"algorithm":"SHA256","hash":"195607d97318343d29f77215740adce9a8029f7944db37f912a4b1b2290f115e","blockSize":4194304,"blocks":["195607d97318343d29f77215740adce9a8029f7944db37f912a4b1b2290f115e"]}},"tray_icon_rtp.ico":{"size":28078,"offset":"2166797","integrity":{"algorithm":"SHA256","hash":"ac1878c446d7434ad43262739b23085830a9bd4c67864ea0fc57228ea218

C:\Program Files\ReasonLabs\EPP\ui\app.asar.sig

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (684)
Category:	dropped
Size (bytes):	685
Entropy (8bit):	5.950928481801507
Encrypted:	false
SSDEEP:	12:ctCb0Vz+/Zq+hQrXSx2zIAtw3LAvljajTo25nmEOAIKb2d+MQRs0Cv8Q3Tz2On1+:4809+/fm7Se23LmzcncAxW+MQe0Cv/ut
MD5:	39990FB3FBE164F5CCA526FFF6678787
SHA1:	7037190DC2C2D10C9220B30A6AC3E5186215CC8C
SHA-256:	513EEC3066E2C6ABAA5654D14157DAC092B8546A22F88F64F17A3B0FA31FDFB5
SHA-512:	FD2F93C033B1A35BCEDF459573E12DF9529ACAF919AEBAB0F0296E90230E0A2D1C758FCD5DC1EB6533DEC4EF11077D832C245F284FCF38E4B1188FDAF8749C3B
Malicious:	false
Reputation:	unknown
Preview:	NNWiHoYKUNP4wim/xps0pIZW91JrzgVqVKdk6/6p/0VFB+U6s116mOKSdx+CEtHEJQa5FpngO7YuDx5amohtSnS9F5vpFqIAFTpczGGYHkDJ7J0+RvDIrR6IxDEJB/8M5yEw4Df8NV2dvKjHoYEVgKgpDIASXxDufeJW4syXz3+UCdWaS2rSz03vmSmBlsQNIwMTBD/PVpSEqLvT49UiP9b+Dy5zopLHWd/F5zo+DUJnX98OZCQ1DYAwwqHyXIvPBDamJraD4ja3C7ARVl0ALRif5Ju/ONOqPsVBQRvhM43X7zwZfnpWJZ+8FwWu+3UnRXZfbP3FX1D71/tCLUb44bykmgaKEkH0kMA8TAkEWlSmYZTr+Zt+n8l2HzB/5gX1mfcqDAJxWGlyAQu/6mzzmnWaJgdWR7HmsIPZ3LrR/aGHuJp9RVpj5xmkkiWPSkt+Kh79kKit44CzavGzx+5VLTuGghqBbfTKRzklFAAEMKRNEfj9Y5FD+ort4NwD0HKmehYcrv5G6dN33P11BWIe0CYAme6aJjqJ3CkxG7+2g3CAJM1I7dbRysLWD6gunrkYvjvVJKd+ew2ol9Af5Y0ROYYTupmTFRGoV6ZSx6E7mLL7/Mu+hNPdual3xBaLYR8Ac7Yjb4QEkFGziaFPRZz8qp0ywLbjqgHKqcHFEzL69yQ=.

C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	6.408978814111418
Encrypted:	false
SSDEEP:	3072:Bxa137c+Jw+7mlU6UFyAIJXw9AlbLI+aYroEWOV4iDh:Bo37c+JwGIApIJA9AlbuJEfbN
MD5:	9504727B1D15A8BDF74F28F40C85D1F3
SHA1:	DBDFCB492A583EE82C86013FD03C3F9FA1288D59
SHA-256:	F5DD2E25F142BFC75060DD1000B858349998497196C2509D508368131A89FDD5
SHA-512:	4EF87E1507C95C4B012F03D7E9D1664D3CA73FED8960D48D1E791C9C16A2A57855EE299526DEE0BE89ADE9B98A0E76B7CD6065B312DB1D559267FB8381FF2DD6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... .. .. ..@P.. ..@P.." ..@P.. ...U.. ...U.. ...U.. ..@P.. .. ..+ ...U.. ...U.. ...U1. ...U.. ..Rich. ..........................PE..d...*..b.........." .........................................................@............`.........................................P...D.......<.... ..........(........>...0.......~..p............................v..8......................@....................text............................... ..`.rdata..............................@..@.data.... ..........................@....pdata..(...........................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	6.408619361294289
Encrypted:	false
SSDEEP:	3072:6xa137c+Jw+7mlU6UFyAIJXw9AlbLI+aYroEWOV4iCY:6o37c+JwGIApIJA9AlbuJEfbz
MD5:	CEDCC6CEAFF8EB1C4BE2A5E6E2B012C3
SHA1:	D53FAB8D1FA4A2AFF8E490C8F7F13F5B1C691C8E
SHA-256:	282519F369B7D642BE6B1AEBDCF83B113101B812896C379E53D99A859A39B8DA
SHA-512:	D3F4A6C01EEC58418DA43BCCE2BB74C8FCB4B75CCF6140CEB402CFEEB05997324F7E583249F905CB31750E2C00703E3A04F7823681AEEDE84C07E0018C635AA1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A... .. .. ..@P.. ..@P.." ..@P.. ...U.. ...U.. ...U.. ..@P.. .. ..+ ...U.. ...U.. ...U1. ...U.. ..Rich. ..........................PE..d...*..b.........." .........................................................@............`.........................................P...D.......<.... ..........(........>...0.......~..p............................v..8......................@....................text............................... ..`.rdata..............................@..@.data.... ..........................@....pdata..(...........................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\windows-notification-state\prebuilds\win32-x64\node.napi.node

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124560
Entropy (8bit):	6.262453461799155
Encrypted:	false
SSDEEP:	1536:N+rSugvaDzJGezUUSBxlezTESfWwjbE42qyGHzdHKcQsWydp9dlscxHi/9afI5g:N+rSu15XslsTEMPs42qyqKaB+cs5
MD5:	04BFFD5DEC81CBD4A75C00D36A1E0510
SHA1:	48B7E059157AECF0CEE08F7C5273929572499704
SHA-256:	F17416F61D9DDAEF528CC1121205E6526AAA0600114A61535D6C1D7CB76DEB00
SHA-512:	67CA87F152D7B63030BD24F2DE1E60F8C9ACC6A2B401350AF168CC03A1A7C8FBCCB81D097F6E4AA6608FF4E8FB119A426F1397BB0DFAAA02D86B99FBF84D76D5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............N..N..N...O..N...Ol.N...O..N...O..N...O..N...O..N...O..N..N..NS..O..NS..O..NS.eN..NS..O..NRich..N................PE..d.....a.........." ................................................................P.....`.............................................h.......<........................:......d...P{..p...........................0x..8...................T...@....................text...@........................... ..`.rdata..z...........................@..@.data...............................@....pdata..............................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\ui\manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.19896048699559
Encrypted:	false
SSDEEP:	3:mifFQiXvF9+GNHfFQ3TRpvF/FHEYd7QWNwFiOv8KAfFHURXPFMY:v2KdgGjYVC4OFAt0RSY
MD5:	E250CCE095CCDBA7CF7B0399DC8D8970
SHA1:	49A4AA2D4240C6E68BC2E4A17C1006ACA156EF6B
SHA-256:	8188F879E93D568204BCD78E8F1B43F120A6F0917DCA9B045EAB946D84907A3F
SHA-512:	248832E5358BA06338C061AB675CC1CF6F01B17CAE5BD62FE1A65E8A9BD46BEBCEE76EC187628C27B67AB919040558F636698DB9A08335AE431CEE4964715373
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "epp-ui",. "arch": [. "x64",. "arm64". ],. "dependencies": {. "electron-shell": "1.4.2". }.}

C:\Program Files\ReasonLabs\EPP\uninstall.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	174592
Entropy (8bit):	3.1176056240139736
Encrypted:	false
SSDEEP:	384:URqHi9xDnRbDPi6ag9rucqkerzUCgIMSfZHqdefc8+YZ9:SqmpD66h9lqkerzgIPfF+efc+
MD5:	AF1C23B1E641E56B3DE26F5F643EB7D9
SHA1:	6C23DEB9B7B0C930533FDBEEA0863173D99CF323
SHA-256:	0D3A05E1B06403F2130A6E827B1982D2AF0495CDD42DEB180CA0CE4F20DB5058
SHA-512:	0C503EC7E83A5BFD59EC8CCC80F6C54412263AFD24835B8B4272A79C440A0C106875B5C3B9A521A937F0615EB4F112D1D6826948AD5FB6FD173C5C51CB7168F4
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ......... .... .........00.... ..%......@@.... .(B...D..HH.... ..T......``.... ............... .(....p........ ..1..Vx..(....... ..... .............................................RRR....n...........e???'..................................................................q...................................................................y....................pppQ...........WWWC........vvvF...........```8............................1116................YYYC...........}.........................................................................................................................................................888,................1116.........................\|Z....b...........5551........NNN3...........sssM.....................................................................................0.................................6....................{{{Mzzz....2...W...................M...6.......................0..............X...&...........#~~

C:\Program Files\ReasonLabs\EPP\x64\7z64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1857536
Entropy (8bit):	6.308114326702068
Encrypted:	false
SSDEEP:	24576:y8sHeHKHplfu94i55tbhris2CCEnWaWBvYyozGUIjnRnUC:y8Y/Q94iZNrP2t0ZyyIjnRnUC
MD5:	ECC83C860D6D7A1B8A6206948900FC0C
SHA1:	E07003B71BCF02DF865F65B5F763268AEC60D05A
SHA-256:	AEDB54DDA1ED189430E942D85DC50031565544694C8229FC8F6D4394235764CF
SHA-512:	A260B1DFD2985E565231A66939D7966204EB8861159CBD88A2C0DA96F0747214B8B52EA25420D157FE244E34862F1A2C8025A54965E01F5C54CAE11DBFA4C47C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..07.sc7.sc7.scA-.c6.scA-.c<.sc7.rcR.scA-.c.sc!.wb4.scA-.c..sc..pb0.scA-.c6.scA-.c6.scA-.c6.scRich7.sc................PE..d....\.d.........." ................pe...............................................@....`..........................................-.......$..x................1.......>.......!...................................................................................text...]........................... ..`.rdata...^.......`..................@..@.data........0......."..............@....pdata...1.......2...(..............@..@.rsrc................Z..............@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\x64\SQLite.Interop.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1646736
Entropy (8bit):	6.5502084862762135
Encrypted:	false
SSDEEP:	49152:JKBZFqX8TvXzlaPmAA6rKmEOwksSf0WB:JK3/z0h
MD5:	5796085AF562C2E98939B4230AE14723
SHA1:	3049BEA83BA556F021E34D8B4B8176A8B29B8096
SHA-256:	31560913EF14B54FAE7A0A3AA38F531E7705ACB0BA69E50483B5F6447E1805D4
SHA-512:	A39903B3E321DDE00EFD6C4E1FC19D2F2E9601AE221C8EE6A51D6BB5D35AB1AEF65F282A74A846AA6AE2A2EA8CC338ACF89F8A31DE4ABFF473D9B218536BE338
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..7...d...d...d.i.d...d.i.d...d.i.d(..d0..e...d0..e...d0..e...d..=d...d...d...d...e...d...e...d...d...d...e...dRich...d........PE..d....<.].........." .........J...............................................@...........`..........................................V..X1......<.......<................:... ..$.......p............................................................................text............................... ..`.rdata..............................@..@.data....L.......6..................@....pdata..............................@..@.gfids..............................@..@.rsrc...<...........................@..@.reloc..$.... ......................@..B........................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\x64\ext_x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	378368
Entropy (8bit):	6.323464271782006
Encrypted:	false
SSDEEP:	6144:eBYqz/61Z2lKHQM/QX1ahKrJQRB2XHbV7iFGrwGav4VohWrtdmXR:eJ/UIwQM/qo4rGREXH1o8oR
MD5:	56C7619C00F192566EB83574A8DB52DE
SHA1:	04B70963A8A4DD097D5485F5955A9CB8EAEF688E
SHA-256:	89C96ABE36042E6486D1E6A5A3233B30F9D8CDD08C8300237C75F33BC2F46610
SHA-512:	CE5B801CD8B3E9C10F0AFAAE39DD98A75E9FFD32EBDB6E38C6BF6803A9543FB364B1E60969BC398B020CF7534E8699E178CB2E4191D36D052E454D44AA505E1C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................3~+....3~)....3~(......................Z..........................%..........Rich...................PE..d.....]Y.........." .................`...............................................e....`......................................... 4.......4..P........................>.............p.......................(...`................................................text............................... ..`.rdata.............................@..@.data....2...@.......&..............@....pdata...........0...@..............@..@.tls.................p..............@....gfids...............r..............@..@.rsrc................v..............@..@.reloc...............x..............@..B........................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\x64\lz4_x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	121856
Entropy (8bit):	6.2949477851647835
Encrypted:	false
SSDEEP:	3072:8vysFz2cyiAtLfc57mfngv6ALQ09tNdUNtDfBv5XvEX6c+y:8vy6z2GAtLfcCgv6ALehJcR
MD5:	499BA5735A47E2B547C86BE363DF89C2
SHA1:	9FB9BCA2DA6D33B54761D9B4F739F9DA2DEF5B25
SHA-256:	8488F38CA4DBB8A3AF6C39281C8774A6BD9F3E0AED2E3B046FA250C238875D24
SHA-512:	BE9BA4494AFBF630906AA27E7B3AF63A63D28D666C5EBA7613192DE0F3196E011AADD442FFED2C69ED8BE9255B77F1070A5FB969D7CB4CD18FE3445DEC78AA75
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L^."..".."...!.."...&.."...'..."...!.."...&.."...'.."...#.."..#..."...+.."...".."......"... ..".Rich.".........................PE..d....HSZ.........." ................D/...............................................=....`..........................................\|..d...$}..(........................>......L....c..p............................d..................(............................text...`........................... ..`.rdata..~...........................@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\x64\rsCamFilter020502.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48944
Entropy (8bit):	6.755780295147749
Encrypted:	false
SSDEEP:	768:68vbBtr3uL645Mx5wm9sKN6DRtoQpH3e6n9yEM1didV1VaXLkj3XV13hwOOPO9z4:Hp3uORwOO3/c1dGP0+xnOiz4
MD5:	633861D85B60EB7DE2E820F4FAC586E0
SHA1:	E5666AECD7B9D97627C4A0FC06D52AEA59D7C37D
SHA-256:	8EEBBE6A69D030FF7944524E22126218B6AE8CDB349C97FEEDB83CD0686BBB38
SHA-512:	8F26D38ABEF1CA2B365A2B1CC6B2A49C55319C59D790C32EC8D5728596FDDCF9252230C200ABAE4609884CBA3449B3EA778785244330F98C8C21CADF8C921AE1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........'F..tF..tF..tF..tG..t...uC..tF..t...t...uA..t...uN..t...u@..t..*tG..t...uG..tRichF..t................PE..d....<\|d.........."....".L.....................@.....................................`....`A................................................t...<.......h....`..`....l..0S......$....D..8...........................`C..@............@..H............................text............0.................. ..h.rdata.......@.......4..............@..H.data...@....P.......B..............@....pdata..`....`.......D..............@..HPAGE....a....p.......H.............. ..`INIT.................V.............. ..b.rsrc...h............d..............@..B.reloc..$............j..............@..B........................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\x64\rsJournal-x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	136328
Entropy (8bit):	6.275782785750883
Encrypted:	false
SSDEEP:	1536:TOJMZaVYm1tAF3f5tqKhRWmGBASRua3jXKqMVqhcWMsWCdt9dl3RDsp3rPHi/92X:TOJMucfP9WmSAmNzaqM0hnF9BRDsJMM9
MD5:	9BFDBCFA3233482D9DEB99F115505CC5
SHA1:	FCCE0D2EF738808E203DE6923EA5F463D1132C33
SHA-256:	AA4A93069098D1D67BF6A731FE87CFE877886B25ED18FA8EC30811C30636EA22
SHA-512:	90A9933ED21C68D18A5CAC2D41889FAF428EF6B2A137D5D809F8DE63A9331EA1C8E78BB5693AF3B80E25E3D8151C216ADCCD11C1557361674FCA51796D5DEAB2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V2.`.S.3.S.3.S.3.!.2.S.3.!.2.S.3.!.2.S.3@&.27S.3@&.2.S.3@&.2.S.3.!.2.S.3.S.3OS.3.&.2.S.3.&.2.S.3.&v3.S.3.S.3.S.3.&.2.S.3Rich.S.3........................PE..d....Ia.........." .........................................................0......Jl....`.........................................@..........(.......h................:... ..l.......p...........................p...8............ ..x............................text............................... ..`.rdata..$.... ......................@..@.data...............................@....pdata..............................@..@_RDATA..............................@..@.rsrc...h...........................@..@.reloc..l.... ......................@..B................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	3063
Entropy (8bit):	5.014088126389475
Encrypted:	false
SSDEEP:	48:utXfcDLNthOyA9Bd8WMv/EhtF/qi/Oaucosld2dVBBiBklmP55I4kYlIRF7osFrr:uNfcDLNPOyALd81v+tVR/qlPsBklA5IL
MD5:	E8EF8570898C8ED883B4F9354D8207AE
SHA1:	5CC645EF9926FD6A3E85DBC87D62E7D62AB8246D
SHA-256:	EDC8579DEA9FAF89275F0A0BABEA442ED1C6DCC7B4F436424E6E495C6805D988
SHA-512:	971DD20773288C7D68FB19B39F9F5ED4AF15868BA564814199D149C32F6E16F1FD3DA05DE0F3C2ADA02C0F3D1FF665B1B7D13CE91D2164E01B77CE1A125DE397
Malicious:	false
Reputation:	unknown
Preview:	;;;..;;; rsKernelEngine..;;;..;;;..;;; Copyright (c) Microsoft Corporation..;;;....[Version]..Signature = "$Windows NT$"..Class = "ContentScreener" ;This is determined by the work this filter driver does..ClassGuid = {3e3f0674-c83c-4558-bb26-9820e1eba5c5} ;This value is determined by the Class..Provider = %ProviderString%..DriverVer = 03/25/2021,1.0.0.2..CatalogFile = rsKernelEngine.cat......[DestinationDirs]..DefaultDestDir = 12..rsKernelEngine.DriverFiles = 12 ;%windir%\system32\drivers..rsKernelEngine.UserFiles = 10,FltMgr ;%windir%\FltMgr....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..;CopyFiles = rsKernelEngine.DriverFiles..;, rsKernelEngine.UserFiles....[DefaultInstall.Services]..AddService = %ServiceName%,,rsKernelEngine.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..;DelFiles = rsKernelEngine.DriverF

C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49456
Entropy (8bit):	6.631066056716293
Encrypted:	false
SSDEEP:	768://Vqt92EbtYnekejiYF5blvhBVu8suwIppriCAVUValkjvJt3Hy5Z:EmeLT0CpprAqs6tXqZ
MD5:	F77B9B6CCCA206535EB9672266A462B1
SHA1:	479345A89FB7362CAE53A3040F4EFCEE55B92BF7
SHA-256:	BC4EBE3656BE0F502B65A2CA247FFA1B3065EC6FE2E76D3AF21511A0616F855C
SHA-512:	9C80E9C83A58C9E2C63F22C17E4FD4DF227F04960AA2212C66A1308512FE02E71CB7300455965109A7E3931ABD38EBD15162FE3CB46C3328F28D1AE175B4EFE3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2.P.Sg..Sg..Sg..Sf..Sg..5f..Sg..5c..Sg..5d..Sg.C:c..Sg.C:...Sg..S...Sg.C:e..Sg.Rich.Sg.................PE..d...".\`.........."......H...&................@....................................A......A................................................4...<....... ....P.......r..0O......D....5..8........................... 6...............0...............................text...D........................... ..h.rdata.......0......."..............@..H.data...$....@.......2..............@....pdata.......P.......4..............@..HPAGE....N....`.......8.............. ..`INIT....6............R.............. ..b.rsrc... ............b..............@..B.reloc..D............p..............@..B........................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\x64\rsYara-x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2368144
Entropy (8bit):	6.822279556639425
Encrypted:	false
SSDEEP:	49152:EGtlqmIU6i9WVwASOgrXZLIgUivtw6jx5+8678vcWs4jdNsgiPLI:w+3zjdsZF4jTsgsI
MD5:	A43118B1455E67429B40C004379D0EC7
SHA1:	862B1B00F881BAEF639D517C6772DAAFE06B135D
SHA-256:	0E020A3A096FF4A161ADBC501C3D71F2B4B0587735E86CF8673544286808494E
SHA-512:	887A0E7E46804CD79C91F313E9AD32E5E5EEE594CCD126A6CBC491AEE2B90E623D666DB1FCDB5B7CE65193F02653855E63B673F888EA7BDCA712081CA8AE390D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......}..o9r.<9r.<9r.<r..=3r.<r..=.r.<r..=7r.<?.U<8r.<?.=.r.<?.=+r.<?.=-r.<9r.<.r.<r..=4r.<9r.<$r.<..=.s.<V.=.r.<V.=8r.<V.=8r.<V.W<8r.<9r?<8r.<V.=8r.<Rich9r.<................PE..d......e.........." ...&.....f................................................$.......$...`..........................................i".t...Tk".......$.X.....#.D.....#..:... $.lS..0k!.8............................i!.@............................................text............................... ..`.rdata..............................@..@.data....v...."..0...f".............@....pdata..D.....#.......".............@..@_RDATA........$.......#.............@..@.rsrc...X.....$.......#.............@..@.reloc..lS... $..T....#.............@..B........................................................................................................................................................

C:\ProgramData\EPPBackup\rsEngine.config.backup

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (5824), with no line terminators
Category:	dropped
Size (bytes):	5824
Entropy (8bit):	5.99179572850437
Encrypted:	false
SSDEEP:	96:Rw99zAT1M+bHIEwrgiYlBk9x/rcohy9Q/GDFSf1Ru/M7j0C0wXfAXBT5A:RwLzAZxrIt0Bk7+QZz7jh0wI5K
MD5:	0195B6F2D3E0F5A4947F353E48E15D8C
SHA1:	F29FB502B68A486FFEE0C55ED343C15E5110E6F9
SHA-256:	52B9FF10C412162CE0AC5ECE6CD56B1164C209AF1AD8B3B8E334149ED6E4EA56
SHA-512:	65BA63D1645A1C507C2A8C4728DF0F1F660F3574333925386F1B5B07F11E4E894D8404767A478A384D6A5910915FF040698C6C761047A4CE53A9FABD2D788BEF
Malicious:	false
Reputation:	unknown
Preview:	SeNHHAozzDzx8xafGs52O02M3LrbDRSLIJ5xixluCuxOz2RE7hbtSEc4h5uwlDrbNRkIuc4wJhx4cXXt/BOt9Z+36zGIYFX8XISHgLWcpFjCNyTrdgn2YOwLq7Y7bAKO5yDJj86mhhScMYzZBlyORgFRJ147EDfwm0fcGGR0sjv0p2Gn/ZV4AgD66Ocu+Msv8hkX9Iv4Ny94mQ/t8HdSZcpl3Vs1/Y2/w1eWrsjffIJRQPTst3kD+6PkJ6wESCkalyNysMY7Xym7/aS1fSZWmUxP0m0VZihGj6AV+J3d8we9Z3Jd/GK2Eyq8xg+d0D03kWzKYSSWH6IurX1f0MJ/RdIqVoXOToOeW8FXmrL/mVu1P0Sk9q5GCosFlPYAQdEkM+k9JNb0YPcOmlrbVVF+CU2PekpKhwWF/u6kFjbT3EZbXcfjB4XPqNremlWvMtCo2mOnMIs9Omm9ROlhD28LolaA9zpxsgDoqLGVSb56MA8Z2ho9DdUQHixQWphsJ7efUATXjTeoitUN7qTrigGJXAeGYCeHtHISIi8LkQB6uba4L8w6imPsL/ak8FtVyW2OYkpELVVcBdg5NTDT7hhkgBYjSRz4udHNJAwrHJtQkDcZRu81LGNQBmeEER99cN71j06CjH6xiw5y6Q/bgmQ8OvH0WTMXXcCc3fkVWDHgSDKvj6owxB9+Z3KGjnEbmpOzfxDkI8h4JF2ALQbKSxhTEaLUDm7zsJuljmB7VBsCEAw0yStGo/aTERF+U4Hlh6RrC6jTRnB6hMMY3NJf7nqG7jlAcyoi6/btEFUz0MmFZ6PF7rOuPsIuD3QHWgZdFQIH/TZskLj1YAEXDsU/HSQR/ukB/If5hjj5Lk4ZkZ621Upjc2OVvyFMrSEC8chhTVfauV72ZEIvueY5TFjx+AxdEvShXzTTJJjlss3nI8Qsy2+k/bUAuaJO9qlH6KuWoYT5keJ7IZxJQP0DE1Lfzb6ZWNMcwZLxYXCpR4lLNHDb

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_000B005C003C0011001B.txt

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\uihost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	560
Entropy (8bit):	5.209364827816918
Encrypted:	false
SSDEEP:	12:ZRVA2yRbbs8J1VxJRVAfGRbbs8J1V3JRVA5W7Rbbs8J1VxJRVAIyRbbs8J1V33:C2yRoY1VYfGRoY1Vi5yRoY1VYIyRoY1F
MD5:	44914D8D64EF2F18D4ABFC8371B7C38B
SHA1:	0DAC01D92DFF57E1072092F2F38335ECDB3105A8
SHA-256:	86F8CAACD869E752ABC7E6D7DE6BE8CA090291C055B03071DA8FEBA867BB6FF5
SHA-512:	A6E3E8B5D9CCB4FD979FAF94856C98CE8B6B556A20FCAC8CB97224B59063CE755F1166084532BC275156D1E73AFCFEC3B754EE3B464F9024B24108BEFE344BD2
Malicious:	false
Reputation:	unknown
Preview:	[ERR][20240602 00:21:20.244][wps_utils_scriptable.cpp@58]: Failed to get value of WPS setting CloudSDK.cache: GET /subscription/v3/details..[ERR][20240602 00:21:20.463][wps_utils_scriptable.cpp@58]: Failed to get value of WPS setting CloudSDK.cache: GET /subscription/v1/details..[ERR][20240602 00:21:20.713][wps_utils_scriptable.cpp@58]: Failed to get value of WPS setting CloudSDK.cache: GET /subscription/v3/details..[ERR][20240602 00:21:20.932][wps_utils_scriptable.cpp@58]: Failed to get value of WPS setting CloudSDK.cache: GET /subscription/v1/details..

C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_000B005C003C0011001B.txt

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	4.853067463677383
Encrypted:	false
SSDEEP:	24:urt5b7rtHrtYrtORyrtUrt3tMrtCrtLMrthjrt15rtOrtvyrtqrtn:uZp7ZHZYZORyZUZ3GZCZLMZhjZ15ZOZX
MD5:	7A101EC59D18F114369E72D3A095BBC7
SHA1:	D0BE670A93584899AE833CD451024C36150D6F57
SHA-256:	169772532B257598802D996A4ABECF4A7D31C175BC3EEB166A2DFD24088D1313
SHA-512:	ECBB068B290920FB1DFB6B510ADF299B070820ED8523E590237247509A9C3201A828EA590A26E8417E40D47DDC534D7EA7D51FFD8BAB47CD304A62CFC7F33677
Malicious:	false
Reputation:	unknown
Preview:	[ERR][20240602 00:22:17.048][ProcessUtils.cpp@186]: Failed to open process with id 0. Error 87..[ERR][20240602 00:22:17.061][ProcessUtils.cpp@186]: Failed to open process with id 4. Error 5..[ERR][20240602 00:22:17.070][ProcessUtils.cpp@186]: Failed to open process with id 92. Error 5..[ERR][20240602 00:22:17.076][ProcessUtils.cpp@186]: Failed to open process with id 324. Error 5..[ERR][20240602 00:22:17.082][ProcessUtils.cpp@186]: Failed to open process with id 408. Error 5..[ERR][20240602 00:22:17.105][ProcessUtils.cpp@186]: Failed to open process with id 484. Error 5..[ERR][20240602 00:22:17.121][ProcessUtils.cpp@186]: Failed to open process with id 492. Error 5..[ERR][20240602 00:22:17.124][ProcessUtils.cpp@186]: Failed to open process with id 620. Error 5..[ERR][20240602 00:22:17.130][ProcessUtils.cpp@186]: Failed to open process with id 1476. Error 5..[ERR][20240602 00:22:17.135][ProcessUtils.cpp@186]: Failed to open process with id 3304. Error 5..[ERR][20240602 00:22:17.140][Pro

C:\ProgramData\McAfee\WebAdvisor\WATaskManager.dll\log_000B005C003C0011001B.txt

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.805819005673068
Encrypted:	false
SSDEEP:	3:Q+tRVZVXXXNL/tDaxltNREIkFRekLQNd2mn:rtRVd/tGBNRM7Gd22
MD5:	FF660A6A505840E614920FD1F20769D0
SHA1:	8BF10BD0FA9497C66B0E980A9F5B6AEE2547B0AB
SHA-256:	8DB909CE96A4A34E449F84E8D6B239DC60162B41BE922D0A521DA492C69C7F27
SHA-512:	AFAF53B3FD7F129CCA6DD527617275A23FDC9F31D733738BA7ABE699CC249D4CBB719CCD5BC8103CAFD63934D317808D32ED267E66C17C5B202B7608BD89EE14
Malicious:	false
Reputation:	unknown
Preview:	[ERR][20240602 00:22:19.005][install_extension_task.cpp@179]: Failed to install firefox extension...

C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_000B005C003C0011001B.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.050538732260775
Encrypted:	false
SSDEEP:	6:rtRVs6k2JM0RG0DKhSm0tRVOZVjwOrADGq:ZRVzk2JTDFnRVOrjhroZ
MD5:	6393A0F0AA7DCFC4E34559071589D5E9
SHA1:	7B67973CBE996D7B2CF8D175B1E951C7AE92263C
SHA-256:	35A9B88E4777ABFB23496F2965E3586D10137631B905199CD5C4760A5A5AAA64
SHA-512:	E22B21DD54C573E6F81BBAEA24BCC058EB93F6B30EE053B4093F933A4847D27595A413D4C7D538982C4B91882D0FAA632881912E180D0C3A11AB6624EACF3EFF
Malicious:	false
Reputation:	unknown
Preview:	[ERR][20240602 00:20:29.251][ProcessUtils.cpp@210]: Failed to get executable filename for process with id 476. Error 31..[ERR][20240602 00:20:44.378][HttpsDownloadFile.cpp@200]: Unable to open HTTP transaction..

C:\ProgramData\McAfee\WebAdvisor\wa.dat

Download File

Process:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3043002, file counter 198, database pages 14, cookie 0x3, schema 4, UTF-16 little endian, version-valid-for 198
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.346752492614131
Encrypted:	false
SSDEEP:	768:e6KCpAi3mNIAtf/zdAbYeweTf+uW3T45I3KAWd7LXQ1X:wCDWNIAtfrdAbYeffvW2I3KAWd7jQd
MD5:	03516602498819322D590F5A746C79E2
SHA1:	5B72C1407EDBC9685DF4CCC1604DB3E14FDF3ACF
SHA-256:	B73E89876CE53B137E2DB97191056204F9436439B720FF911D446413DF7AC853
SHA-512:	878BE6F7052E29F7FE3D947273CA5C2D40DBE0649D01990D08301AA12A2F83B56E5C07D0D29360E9D52000FA46EC7A243B9AA797DE555EB3A4C9EB50263E4910
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................n......._..=.R._......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wechat-3.9.7-ins_68a8b591412c4b8ed0403ffee56766889eb0a2c5_10714536_25227083-5e4f-4728-bbc7-374b17ddb1e9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3899496444384478
Encrypted:	false
SSDEEP:	192:uth26evX0s7Rjj0/O3TfR95iXzuiFqZ24IO8s:wh26evks7RjjHfRrszuiFqY4IO8s
MD5:	A29BA7E34DC5555567578AD8D49FCED3
SHA1:	D633CEE975B9C41D582E04E5F80B672B6B3C3151
SHA-256:	C1E0D8F8F6062794CF8D4311ACBAF95CC0C11530FC8F8BC722E8CCCF83DC427C
SHA-512:	FBB9BB8E776F9487C7F2B29EAD9DAD8082288A99E87D90136BC34E7C70B89818120A77D8DCA876E790CD1F763D3573D3024607D0F83D0EA3E4FC8CCDED6F9200
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.7.6.9.7.8.1.3.7.1.0.8.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.7.6.9.7.8.2.0.5.8.5.8.1.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.2.2.7.0.8.3.-.5.e.4.f.-.4.7.2.8.-.b.b.c.7.-.3.7.4.b.1.7.d.d.b.1.e.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.3.d.f.0.6.0.-.3.d.6.3.-.4.4.8.f.-.8.d.8.e.-.3.2.c.5.5.6.8.1.9.3.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.w.e.c.h.a.t.-.3...9...7.-.i.n.s.t.a.l.l.e.r._.a.e.-.G.F.z.1...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.8.c.-.0.0.0.1.-.0.0.1.4.-.4.2.8.7.-.5.6.7.6.9.6.b.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.2.7.e.7.1.1.c.2.5.c.1.d.b.3.5.4.7.c.4.a.0.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wechat-3.9.7-ins_dba8ecde917bbddce16788080d685a4b09996f7_10714536_86075aa1-a747-4e82-ae34-f2fb53e677e9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3901109461052281
Encrypted:	false
SSDEEP:	192:gh26eqb0SuhBb+j0/O3TfR95iXzuiFqZ24IO8s:y26eqoSuhYjHfRrszuiFqY4IO8s
MD5:	FE5E2F5143C9D380AFA962F664F7E555
SHA1:	5609C13D8F0AEE6C9148EDB25636B128EE101C34
SHA-256:	33B0C8286E9843CC154B931359FBAA855B49A4F17A7B3D979B9F5398D9B3E46F
SHA-512:	B791033DA071D0EAE86E06257048F11A9F848749B404CFFDE95FB224FF7835561D6FFCBF9B58C4116828E7C669B1EB54E0C43B3FD506BC689089D7B5C0D4DA03
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.7.6.9.7.6.6.6.2.0.7.3.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.7.6.9.7.6.7.5.8.9.5.0.5.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.0.7.5.a.a.1.-.a.7.4.7.-.4.e.8.2.-.a.e.3.4.-.f.2.f.b.5.3.e.6.7.7.e.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.2.6.a.5.e.7.-.7.d.4.6.-.4.6.b.0.-.9.b.d.8.-.7.5.4.6.d.d.2.7.7.4.2.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.w.e.c.h.a.t.-.3...9...7.-.i.n.s.t.a.l.l.e.r._.a.e.-.G.F.z.1...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.8.c.-.0.0.0.1.-.0.0.1.4.-.4.2.8.7.-.5.6.7.6.9.6.b.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.2.7.e.7.1.1.c.2.5.c.1.d.b.3.5.4.7.c.4.a.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC6D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Jun 2 02:42:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	123560
Entropy (8bit):	2.2098763157302264
Encrypted:	false
SSDEEP:	768:pLQX2Ob1aA91pzPf42awysygHaLFNpdFF3F:p6J3pc2awySHaLFrX
MD5:	06C96DBFBD065FD8275EC647E9048579
SHA1:	6226E28ACF362BA88E95100ECB51FC50929C2C67
SHA-256:	535B7C1F5584E6C16FD0E6FDFF77C4C8DB1B1B1C4CD8BF0E96696EC0FBFEE7BE
SHA-512:	E0447B1719781538AB661CC99CA9DA4127213EB6B44A853949E2B2CC7799D0EC60BC34572802D99E9DFFF1B36448D4A52118477CFF0D77E985CD03DF6C320BE3
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......&.[f........................(-.............. 6......t...`f..........`.......8...........T............i...x...........6...........8..............................................................................eJ......X9......GenuineIntel............T.............[f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE52.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8502
Entropy (8bit):	3.7053905631355772
Encrypted:	false
SSDEEP:	192:R6l7wVeJcS6nSc/P6YXb6oGgmf5ubiprD89bdRsfofm:R6lXJB6nSc/P6Yr6oGgmf5mdKf9
MD5:	7E22DFA52A9D5EEA86D538BBAC36C63B
SHA1:	65DC3B307B74E1CF2CFA39A2304C366B46F40AB1
SHA-256:	386028A5DE3B09D5640649C072FC53B87EAE0455C4BB83B0414659555524F3B8
SHA-512:	4BE61A69259DA5F94AB0E9C5CC0626BDEEF9C861F8801B3A359FC96059B93B8FA2B75FF05FC786AA8E897E5E4B81DA9C91C7093F1312FB2C786EA5E50C5373EB
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF5D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4841
Entropy (8bit):	4.494234159912735
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9MNVWpW8VYrYm8M4JT9AXDGzX/FV+q8CyXUpXFo5Ndxumxhd:uIjf6I7SNk7VrJCXoXr2XsXQNuWhd
MD5:	97EAFED9BA2726B0831E7CA26C0690A9
SHA1:	9C8271EE3F15999C7DC7D544CFF293E8ABDB500B
SHA-256:	FB236727026283506C1736E2A3091A907398C2436DAEF3EE210FD9313557A283
SHA-512:	671837281A234F81F10A4E4BB63E8D763C20EBE9D99F5F7E2BAF8A69B86C16355FA6E61AB90068909D9C87E6181DD6B5A9D2601044AFD1CF64AE7EB08B9A1820
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="349545" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF7A.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	81662
Entropy (8bit):	3.1028510284881223
Encrypted:	false
SSDEEP:	1536:yX5A9ZErV8hbOQm0fidyyOAELy5999vTNIg+CotR1PZcaPKxnH/uPuvEH+/PfvNB:yX5A9ZErV8hbOQm0fidyNAELy5999vTV
MD5:	0281303CA435DB4216C99F8D58F34287
SHA1:	B4B4BBC100ACD7CB154141A87AE779160C9FBC9B
SHA-256:	EE9BC172A34B50FB3DDBB91F01FBBBA2D68847310860B8956CEAAAFC2CC85C30
SHA-512:	EE592743B4205CF3B31F6A2CC27E85EE07DDEC690C7744E10ACE8F451F67BCBE8640DFD050701F4CE7F2345D0874ACED136ABFFCBA5D5417892B6AEBC0BA2877
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFE8.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6852687820902976
Encrypted:	false
SSDEEP:	96:TiZYWhK8wtZnhYsuYXkWYHtUYEZxWtHiRITlKw0r1lWaz9wDM4R/If93:2ZDoXhiof3vWaz9sM4RQf93
MD5:	505084D4CFE97DED7E6A6A3559BFBE80
SHA1:	2568E4148D6AC4E388B7216295B672F8A898A800
SHA-256:	1D45C17497FAF80DCBD29C671C5173D3DBDE3EB1638D67FAB47BE82D0EDE8360
SHA-512:	052D1B6801ECDBF0C94AA4BC04C3F02DC102EE27D872472A1DCF6A5537580B46E73B8EBDB5435172870D9FC0F6093EF5A5ED332FBFA03F81B7C70AA07A1F736D
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5FB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Jun 2 02:43:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	119308
Entropy (8bit):	2.222248935027177
Encrypted:	false
SSDEEP:	384:1BolE6DP41TX8RDaOb1IRAM9JHd+8z45LfPKakqymYWKFrO/psJ0oLjaujRUJWLT:kLQX8sOb1aAqpzufbymYWIdoWLRM
MD5:	913D89F77A386206F9070F12560207B6
SHA1:	754B72FED7052F6EC2DFF4D0D0E3542ECEADCEB5
SHA-256:	6B1B2A90535CB770EDC82CCD51BDCD1E9F6E3CB72498AF2D78A38581F5067F9B
SHA-512:	DA0E0624407205DB58FBAB5C6FD469DF9C05F7FCF89BD2EDBB9E16B436F9202AC6D9CA33337630819B231EA112252B7DB338AC7D45B0BD9364F2279C28CB6619
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......5.[f........................(-.............. 6......D...`f..........`.......8...........T...........`i...h...........6...........8..............................................................................eJ......X9......GenuineIntel............T.............[f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE783.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8488
Entropy (8bit):	3.7062603524904767
Encrypted:	false
SSDEEP:	192:R6l7wVeJcd6dSLR/P6YXZ6oGgmfN1pDB89bORsfSam:R6lXJu6dSl/P6Yp6oGgmfNuOKfm
MD5:	90F55A820C2DB6EEDFF3F181CCCA116D
SHA1:	2AA7BD5A7B148CB585BDAC2E828291F1E4137F37
SHA-256:	8B221D6581C68C13FB5903C5C492DE7A7DAB0BBBD8E739ED8E0D78DE038FFA9C
SHA-512:	D330FFBCE1992755F76357535E2C24FA9379658C694E15B69D5DB0843B3025B75D3AD01A2A56412C286B0A717563ADCBB224CF197EE2ECB1E656C17089F0494B
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7B3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4841
Entropy (8bit):	4.49617640494632
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9MNVWpW8VY4PYm8M4JT9AXDGzXZFt+q8CyXUpX/o5Ndxumxf:uIjf6I7SNk7VVSJCXoX52XsX6NuWhd
MD5:	278ACCF29A3650DEF289BE8571873F11
SHA1:	FCDE43C0837B131B42299A634CBB63E9AA9C2235
SHA-256:	F0F913A6BC429FF0CC894C852B0BFA743B5FC278E7BA8D70F7EAD5816F4A0227
SHA-512:	EFCC29AF3347888371518CDAD2CE7A049EC1B6CBA38B60B007C8FB235C3BD390932E9C6CEEA5FA069AF2C990CBAA31FDFE3A02C06A5C9EC311715FFE05E9B2C5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="349545" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7D2.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	81804
Entropy (8bit):	3.1028539557466517
Encrypted:	false
SSDEEP:	1536:fHtYbZCdRa78VYaY9HOhFdHIFYOAELy5999vTNIg+CotR1PZcaPKxnH/uPuvEH+C:fHtYbZCdRa78VYaY9HOhFdHIFDAELy5y
MD5:	9FB64DC9E7A490A2D24DCC5E9A109774
SHA1:	3C16D241B03681CE67571FFBD6D6B07EB440761C
SHA-256:	18B40FB837112CC6E5A7113510E90BF7BBE3E063794156F78245BF17CD703959
SHA-512:	5B33F497DD240CA1F46E6CE20AFF5F4E5B8C21CF176746E07668CEC255C87CFF9E6A531B4CC4B0A169097DC8A9789066250F442FA4B1B89EAC2EA3857A03BF02
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE86F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.691019788354358
Encrypted:	false
SSDEEP:	96:TiZYWXTxZvPJYDYgWe1H0UYEZuYtHiBIjl8wqUUma4y1qMMDwSIUfh:2ZDX1kcPlma4y1MDw1Ufh
MD5:	994F695BA10201DC148176B57C597036
SHA1:	651B25BFD5EA9F8BC8F0B5019738BE60862AA945
SHA-256:	53BC2A261100EC27361A23FD01921FF737580C8C04D185F1DCCF51D290000C96
SHA-512:	9820C30422EE5F9BA883949216AFFB2BA0548E0828F072182EF3D95316A3B085CCAE1950DC7FA8C3AA843E652D384921A66A612DF3BAB6F55CDFEF5A7B89ACF1
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\ReasonLabs\EPP\Signatures.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2022592
Entropy (8bit):	5.999974579136952
Encrypted:	false
SSDEEP:	24576:+dK+qRAhQZWnHFRGGbk0kLHYCFOEx3BMHAE4d/R0l7lRmRj5/Kz3PYez2OQJBmx0:eKYdRxknOEx352P57PFj1xVYNcXsn
MD5:	FB84325FD7362B5634C4DE62B3A2C001
SHA1:	EBB54EC78A071CE47A1C86F47903D56D77B34CF7
SHA-256:	23BDCCB16E5900857C621B67C779B2A49179ACA564EEAF1E74FD10C4EB1651EF
SHA-512:	D59933302521C9B3EEAD330A38577FAF1DF0378AA926690C6001186D495ABE4FC470BF578BC9DEABD82E26D7B1F8ED446957494122BD65047456C657DC9BADE2
Malicious:	false
Reputation:	unknown
Preview:	LtAADqVO7UZPm5M2i6U0Ut+519EhIs7fDC28Wl1pQ3a5caHSrw+Gx5gPpgKjm6512l6HKUBJcXQoHbNGYOCA49Q3BTXE41yS8brQXEozdrMJ/QdDxGcC56TGJwEI91lQyrkOtRfocRkRscRbJGGAiyLm3qgIwtTxwz1Jjb4Pecxp6sC2gikNX1FsfN9m6z1LyQNZnfcuQ/6nD0PPsgLRx3rKTfu8eICM9LWsz2LcMcH5EgncDPPlUBccIAOoNxcwirnig5V7fYkq5PCmIeJV/foKrhkvtj2sNYOZMBtbUvSWsEGn6a6TOU/Piv2Sl43XCYBaSV+MbZD2Fa7N4XNtgSjNH8CbppSZk5+xCm2MtTAwzdHIONHn1L8zBeGZwdAbocx7Qon0DNvHkJmVNpIMiH03GwfpOb7+a7jO6UjzphzFDZTTetf0odM6bxJE5mmTkX8tHVeJZDsSRtH/kxPrlWwaJ/GDcy18HIbQYhCSoTZ7U2D0D6O+3vJNh/gXcd1/hA9EWe8sZr9+92Z7fQPHW0W1X9gXdbysOmQ53nZiTGa2LVaen84GWnaQmiNuAr8KeAYqKQLpTCHHt8HnwIB+EKPHbi5fTgHNK+5QnHZnexdkrlNEG8iJhoHPW5yMNGtxKY2j6SHQVMPeRC7IyRSSfHZjarSYlrbAwmLjM9omyK9uScT2ZUWhDXLAB5t1g/C+YFWFKgCi/fZM9BZZd6gBosg+t/ajXVDxgq4JXCDTGuarqflQgnAhx9f4UizVRedmiupelpZ7OYPPKxRHxRUXxFaijSPvFqUNjwVHEiq1D2CWLAiq1EmGZBvW5DXozhpi/Ibsj9v1rVkmO365wPql2zKxSwA41CV/ezqtyB2v9YoEFEhD5ovN6/RgP/chRBlu617VTprMUa0OiPA6jkDPVwo+H1iSLxJVFAUW7SgkDPwAmu5aL88lIJz74HBh6gEKsS/qYtzEJHt34OdPBAf+FcrmWK4rQ9vzpdNjNDmX

C:\ProgramData\ReasonLabs\EPP\WhiteList.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	377176
Entropy (8bit):	5.999945871691186
Encrypted:	false
SSDEEP:	6144:1BDotCsX0mytklk/i2PziH5XiX2huoW9h7dp9Q5FG85I2YYCQLk6j:jWCsDytkxMzUhYhFH/i/eLkA6j
MD5:	F2C339446D80393CF12236A064FA5182
SHA1:	4274F6487AC9249FD4B49DD5D22EB7CF60A67046
SHA-256:	863A22F58523D47B94E1273ECF9E2F280D0715FFC20A46D704993A32F54829BE
SHA-512:	E65CF3BBD78AB8DE244E47AEA6BFFE1CCD3B22B32A2260C9BA761D2C1F00A03AED17E6144E271435DC44C1F139AD74743F4F52A6140253B77842DEEDEA4DCF00
Malicious:	false
Reputation:	unknown
Preview:	ECc+ipJzcwkbZhHH6D1ciQjLEdRYh2hxwL6t/gI/aKzFhP0JZ+o5RIJUuC6/SkyIcfEFK5ngKBkQ1fvVMN//LTvf565Sl+AVaap/4k4EptyHPj7I4OILB+ncy7swuiZtl3+1Wp6PX+vCWTGe4GqB4ngQZT9u8DhbT1rCWvkw2WT3Y9DEfpISoufMWf3NoVOzqCIojN21hORpmAQGvoajCOuhLkVo1t05PggD8+Et608IkI7f5XwJOlxQc5UQRikZNMOmJvi1LncghPiSSeM+a5bjR3DuO1jhUPDTVnQODj2RvNHwNZwYBCr64Av8cQT2gKS+Hs5Lui/gpf5xf5fGZuVAm56ioEBqOO9DZGQ/SQahAU1yudisgt5XB0z9efK+b6/EAPVLrUgZ3wHKwOZZtpECfmVrXRxUm5k5pgLlyMRBN2b8I9Wmqf9X+rfv0OhkLYM/yw3xSIo3ge3BOI+h1vmtfYHahQZWoEKC3rTcFRu19M8ii/gCiD7NiTuu1F2z1l/oxXz4XLr2r4QBGSBM19jsFpaaqITyTIEqwRCde7v6PSekbGgg6ZkklM2dC0HKq35eHdDQZni4kMhyqGlFWYudbMpxARQFtI0yEyKCgiF2VALSsHpckoW+JBC77U81je2vYYd1HjbeFBHdjPxYuiL5tVGWfPXvyKbMMPCMhOJCvrQTLusJs8Wxkl4KLJ0whNNdHJrPCTYREEf0K1PhYTJhIoCJcgEcD9FiK4LLBVGwgtFwLNQbFAC1dVI8EaT7c4ajDWdBB6ZwdFyiOsgaVSJIiykb0icL5G8I2mt7KkzCZed+2VY4AS8X5IiERwRolxc946p7jXl5YLwQXCPFJBAqI+z2mC+DK8bMF1/d8mymt0zXXmFuvnusX9R+/VUB27QIHT6iAj66SwD++dVDnut2Dhf9LSuNQTOD6QXDUY+VqquajycJ0iodaqasTCKzYXubGVjq1mOfsPKubp5P5IPqmCQoU/idhouWq58V

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.676048742462893
Encrypted:	false
SSDEEP:	24:ujsZPSIPSUcnA3/46giyfV4Hxk7P3Gus6acCQ4CXmW5mOgs:ujul2nQ4XfVkk7P3g6dB42mVs
MD5:	E94FB54871208C00DF70F708AC47085B
SHA1:	4EFC31460C619ECAE59C1BCE2C008036D94C84B8
SHA-256:	7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
SHA-512:	2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
Malicious:	false
Reputation:	unknown
Preview:	0..r0..Z.......vS..uFH....JH:N.0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0....H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....\|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn\|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.089762364481949
Encrypted:	false
SSDEEP:	6:kKze2dk6WFkYGhipWhliK8al0GQcmqe3KQjMIXIXL/:y2dPYkYGIWzyZ3qe3KQjxXIT
MD5:	043BCF7A0333FD71621BB629F6E270F3
SHA1:	9AE0B5F9AFF3F16253728771036992F35A5C0F88
SHA-256:	A6F3AD26F0CEEC30F7DB8032003ED26ABC22A9BF29A5478063837E657EC639A4
SHA-512:	A0690265C8B727553AF5C99BC47F9337C6EF56175DAD4100C1D8BDB1EB94C76A0BC99C5EA86CC74381EFD6881F57D8A06E0924C7106B906C3FCE076977282488
Malicious:	false
Reputation:	unknown
Preview:	p...... ....v..........(....................................................... ...............(.............v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.4.8.4.5.-.5.7.6."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RAVEndPointProtection-installer.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2777
Entropy (8bit):	5.360797665263905
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6ouHlJH/lEHuFKHKSqtHTHhAHKKk9H6HNp51qHGIs0HKS8mHDp6q:iqbYqGSI6ou/fmOYqSqtzHeqKk9atp5G
MD5:	9AB025225AB007D87A072B6151338CBD
SHA1:	72D19468FA5450D99F29F8DCA047E63260751958
SHA-256:	3D7C3D5921DA186FDC9C912EC11CAC4A968B9C77418A330782A5A7419C9EBF66
SHA-512:	025826B31F5485C87C30A93CB3B25B7017D2E7EEAD73EB8411CF3492DF34AD335A2E8F17CBB5ADE2AFE9B0A3F0286F506FA332D89ED8E69C3E3CAE22F79E60D0
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\95a5c1baa004b986366d34856f0a5a75\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ef4e808cb158d79ab9a2b049f8fab733\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\component0.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	932
Entropy (8bit):	5.3513116750497405
Encrypted:	false
SSDEEP:	24:ML9E4KQPE4qXKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQPHiYHKGSI6oPtHTHhAHKKkb
MD5:	DC44AFCF2CEFB9DAFD63D3F66DC3E56F
SHA1:	2A9E4B596A1228EF80F9260470A69C8BAD1DCB33
SHA-256:	FF8AA6405466EFE14E46AF701D97610DC9164109C11367C4F9F68D9D7FFB9411
SHA-512:	0A49D361F885B86221D15FCA2E7490D4BBF5C3393A2E0FF5EE21DCD75C9E04B7E89E541C2FD4426957349B70CB37E499608ECAF3984934455389EDEA75DBD142
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..2,"System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rsEngineSvc.exe.log

Download File

Process:	C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	2279
Entropy (8bit):	5.366129416202737
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPIHTQ0q8mHDp684tHTHhAHKKk+HKlT4NfHKi1qHGIs0HKaHKmL:iqbYqGSI6oPIzQ0mCtzHeqKk+qZ4xqiG
MD5:	BA346387C10C6503D9B2AD6BF30C7896
SHA1:	891C5C9F34095915B26BAFA1F548DF6DC4F97D56
SHA-256:	32867BB5EB48B3D3FA9094BB0AA41BEF5C826C90EFBE6863FF98B5E6B9924EAE
SHA-512:	65989EA869DA8B5A27F689C58FFFBEA79AF426DF4E5B66AD0F3C441E2C64548043F0BBE1ABBDBF0ABC051C7D06EA42901EDE744175FD893C7D5AF0CC253EEEF2
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\434f871c532673e1359654ad68a1c225\System.Configuration.Install.ni.dll",0..3,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\e2ca4e2ddffdc0d0bda3f2ca65249790\System.ServiceProcess.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rsWSC.exe.log

Download File

Process:	C:\Program Files\ReasonLabs\EPP\rsWSC.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2185
Entropy (8bit):	5.367446816394887
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPIHTQ0q8mHDp684tHTHhAHKKk+HKlT4v1qHGIs0HKaHKmTH3:iqbYqGSI6oPIzQ0mCtzHeqKk+qZ4vwmG
MD5:	62B9D2ED372903CD33F45FECF9D8DFEA
SHA1:	7D555C411EB64F901CEC5C1A47698D5FA6A79BE3
SHA-256:	03043AF46FC1C99BECE2C49E9007654A162031F14DA7B405FBCDFBE3C492C914
SHA-512:	F7EF2AF36B1F7ABCCD46DED57D06C7ED472F95802C444E74907D020870E0009C764F382B321AC9CA32AEBBCDCC3F24FDB0E32036FCB1D555CBF7C2BCEC254178
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\434f871c532673e1359654ad68a1c225\System.Configuration.Install.ni.dll",0..3,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\e2ca4e2ddffdc0d0bda3f2ca65249790\System.ServiceProcess.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\a

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Windows\System32\runonce.exe
File Type:	data
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.083360363049019
Encrypted:	false
SSDEEP:	384:YUpOHOh0hTNVqvHimUYJU7i0TiXyZ2QL0cMsb2pipI1CaYGNOzF9caAeGS+y1650:Ah
MD5:	36C93C2667008C461F27730F9546002D
SHA1:	A21000747F25CC2626FDDC853D314E55912B91D2
SHA-256:	5F5DF4D5A3D5EC5BF42062BE3597DEE59C7B1595A1D17F4C2CAEEB692F31651F
SHA-512:	E6D14595DEDB83B63E255915205F391CDA2DBA4735AA21232F0AD7DCB33C5A22778BFCAEDB4EB65BBF5D1AE8B8A75D538D35C002BE565085DB65341AA7B76E6C
Malicious:	false
Reputation:	unknown
Preview:	. ......................................................................................K..8............. ......eJ......&#(.....Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................N9..............s..............E.x.p.l.o.r.e.r.S.t.a.r.t.u.p.L.o.g._.R.u.n.O.n.c.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.E.x.p.l.o.r.e.r.\.E.x.p.l.o.r.e.r.S.t.a.r.t.u.p.L.o.g._.R.u.n.O.n.c.e...e.t.l...........P.P.........N..8............................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cldwur4x.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1952048
Entropy (8bit):	7.807173257576082
Encrypted:	false
SSDEEP:	49152:oTl+Ffl0KCV8rEKbhHJikCz/NqoNcugBhnem0XA:oTl+xLRHAVLVNcpipQ
MD5:	6C0F8BF824E17C2F0DDFF150D8DC7488
SHA1:	BA9C27DA2BABACD1B9EC63F3C27EFAB3DDD1673E
SHA-256:	7A3BB8C2326FF535C6582FA627AA384B0D1E89DA1D7722B4230BE7080126E04E
SHA-512:	B3B593F34E2FD43DEA8C587AFD3D527E21011BB02DBD085908CDB92C1A134E26A16FADBE8B25DE498AEAFCFF894322F9C90EB729CA6E3D5AD8CD793631B86BF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".......5............@.................................>.....@.............................................(............i..x_...........................................................................................text...ve.......f.................. ..`.rdata..X............j..............@..@.data...8............~..............@....ndata...p...............................rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\electron.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	65191698
Entropy (8bit):	7.999995303724521
Encrypted:	true
SSDEEP:	1572864:1/WrzMfs5kLrol4Ca5aGYw7zGszhDrywTWXC8PEW3wv:1/SzMckL8loflDuwTSEW0
MD5:	F2024F4CD75F6C6880520286F2121A60
SHA1:	996E4D115ACC038B555E164985734B085B3591E6
SHA-256:	983A7586C3A54C9206FDDA9643E9E500CDF24242A815E07B42847122FA8C6550
SHA-512:	E06070294E50DE530364F1E8DEC7096EE9C9D90C6E67CBA9968E14E7126B7E7344A238C041415B858B0A7702F5F8FB2A7071501B8024B20DE4629EF3CF9F1046
Malicious:	true
Reputation:	unknown
Preview:	7z..'.....V........%.........>......]...6...E.../.-u.......xO.8..1..-.8..5..u+m..Q7.u.iO!.t}.Ew....V......6.....(.B$o..G.O.)Q.Gk.....V.P.?....6.~....G<.P...}w..A.H^.?..9rS%\|..s2...3.$..Pk......8..^.\|.."O.....{2.`RBPE.y8F2...W!.....6......./..q....sa....0..J.o.q..B.J.V..Pi/.p.y,.....#..5Y..R.m#b\Wx[.....E..M...!]v.d.11......:.....b....tK..I`B....z....;.......D{..4S.b..(..o....j.L-,...s.&.....E.).v`.p.%..L...e...:.....lZ..Vd...b........X.F.2W......x..b........&f..p...3QXv.....7.r&q.I.,...........#..m.q..V.=.c_w.W.7;............R..Y5WD.r%..o....O6..#..?...Hw.-LE..[m...PT..L.F[.e..i.?.(S"..(..k.....-........C.~..(..n_.{..M..0..L..L`V'.(....."..jB.z...w'P.V`w..k...T...S..vP.W:....b.........X.q...b.2C\|/.j.R....A....0p..v... .`m.B.......aQ...\|.` .h.N.5 ...R.\|.......'.Aw8.]..V..d.%.....di7.7....R~0...iC.3....j...Em&...)....F.k.^.f....[E..-wi...s:_.L..?.A.Ynl...9c.C%......$~.h..I.......X!.W...g[...&..y...zV.X#s......Scu'S.y.H..

C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp

Download File

Process:	C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3209792
Entropy (8bit):	6.332772710233832
Encrypted:	false
SSDEEP:	49152:SWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYS:etLutqgwh4NYxtJpkxhGj333TB
MD5:	053B158842578C53DB20AD6835B8658B
SHA1:	4B3E035E7D86ACB1F2EEAB850E940E70FC63AC20
SHA-256:	FBB3B174E158168DB58855286AA1CF9537DE8084070EE5751DD3B252E9B7DACA
SHA-512:	CF96CEBFDF18C6C0069D8436A2147246F36B5DC808A6CA84104A47B20F9C8832BB72CEDD8530CE7E21C1E1C90306868854AA3A3DC59077EF5C32A8848EA68D81
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.....$.1...@......@....................-.......-..9....................0.@(...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\RAV_Cross.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	58209
Entropy (8bit):	7.972991367414719
Encrypted:	false
SSDEEP:	1536:6OUhw1+qeEfOq4pFzFAKrm9OHUuYNNoqcYpt8VCY7zlO:V7eEfM1B0uUtyCu0
MD5:	4167C79312B27C8002CBEEA023FE8CB5
SHA1:	FDA8A34C9EBA906993A336D01557801A68AC6681
SHA-256:	C3BF350627B842BED55E6A72AB53DA15719B4F33C267A6A132CB99FF6AFE3CD8
SHA-512:	4815746E5E30CBEF626228601F957D993752A3D45130FEEDA335690B7D21ED3D6D6A6DC0AD68A1D5BA584B05791053A4FC7E9AC7B64ABD47FEAA8D3B919353BB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx......U....g....,`F@RY..j0.........t..U.....u..z3Q\u.....>...]..zwzd...`&"..{..t....<$.l<N.L..L.f.W...9u...z..g2s.Wuu...9.[.N......`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0...iK....`0..3.%K..T.#.N...-....(J...l>z.ha.]EL.F.5.....0#..].....Sv.....p.....%..B6..x.n.\.S....EO.].c......`0.....7...;.xG7.S......T/.0.....`0..Vv..E..).......k.4.....`.1.e...f.j+....S.Rz..><022.V...i.....`0.....z..(.S...T...X....^..`0..3....YO....c.-Dm...8;....CI...j..?+..`,.:..7..0..I.+.$..q.]>.y....xx.o...8h..`0..... .=".P..ZG...M.7.!....>..;V{.v.J...(xG..C....v....~h....S.Y'..x.U../.P\|+E.P...a..a.H..."...]oV.S.%.V....fN.^...oW.[..6$.fy.Y....r..`0...C..l.6.s../.wlCp....(. .[...Z..v.W...+..<.J<{ gIs.N5.n.!......'.'..Q-\.....,....H..Km.7.....`0....L.jii.......{W1s.Y.......ni..G3..a..fUiF:j.+..._..

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\WebAdvisor.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48005
Entropy (8bit):	7.924596711570388
Encrypted:	false
SSDEEP:	768:kLse/Ia4qCtiJ5BX17ZzMt1itbKT6GbnMHFFQCIN3HklYMsfa1pDLfkh:kLshpqCtiJ7179Mt/T6SMD/80lYMsULQ
MD5:	5FD73821F3F097D177009D88DFD33605
SHA1:	1BACBBFE59727FA26FFA261FB8002F4B70A7E653
SHA-256:	A6ECCE54116936CA27D4BE9797E32BF2F3CFC7E41519A23032992970FBD9D3BA
SHA-512:	1769A6DFAA30AAC5997F8D37F1DF3ED4AAB5BBEE2ABBCB30BDE4230AFED02E1EA9E81720B60F093A4C7FB15E22EE15A3A71FF7B84F052F6759640734AF976E02
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....sRGB.........gAMA......a.....pHYs.................IDATx^....mWu.....%. ..+t....v..F.s.N%@U...r....v.J%.\|i..r......)W..../I.I.Hc.....]p.n.@.....-..........g.9.Z{..Os...o..\s.9.c6{.u...c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..4.Wc.1.C.._~.x<~.d2....+....f/x..{766n;u...w.}..[...ox..;.......y..MN~u.=.=r/.u.......g.\|...4...mW?.g.;.....;.L.pOs....~v...-}:.T>v....nR..H....r....}2.`1.1~...O.gvb.9...............n=r....n...W\qn..^1.N.w..;...=w.u.[%...lxo.....L.....\|.K..Y.Rx./.f............8....y..\...{.7..._..,{!>..oy...~...Y.........q./.......N...t...y..1..L...._5]....x\|y..@.Zy.\y..W>.../....g<._t.....N..^w.'n..m...x<.!...{....Kf.;...../...W....f.K...^~.x4.xvZ......T...W.....k.?q..t.....Gc....~5.......z.f..wJ....1.U..P...}c2{]....1.O..;.<~WY\~..k.=2..(..\|........wp....O=9...5y..&....}...~...:..Y..\|..\z.W.~.S.._..7..[[.qd2..9

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45608
Entropy (8bit):	6.102967271122138
Encrypted:	false
SSDEEP:	768:9x+kL+W392KwbG3S8gUtYcFA/Vc6KJcQqCPtspPxWEJ+Z+cQqCPtJGPxWEJN7:9x7SGwbGC8gI8VclTqUtoPxmAqUtJGP7
MD5:	DDFFAA966C03DC4BEF4DCB947DCC474B
SHA1:	6215788E0E4E03647054C58531C9B76F8B1508A3
SHA-256:	EFB72E3CC8A9623CC7230D1B4884DDC353F3D60A070511E327C9244720A823D5
SHA-512:	483AA44EBCB66A3682DEA58166E5E573D4B1E90810A95873D00CF8CE51398AED0AA074686647EC23F996D594B6EBBF452C617CA94533CBBC00DAEF2878BC35E5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].$..........."...0..............3... ...@....@.. ..............................cX....`..................................2..O....@...............,..(....`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.....................@..B.................2......H........$.. ............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...ps.....r...ps.....r...ps.....(....(....rk..p(....(.....(....(....rk..p(....(......(....(....rk..p(....(.................-..f...s............8...............%..:..o..........o.........i.0.~....+.........ru..p(....-H..r}..p(....-M..r...p(

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45608
Entropy (8bit):	6.102967271122138
Encrypted:	false
SSDEEP:	768:9x+kL+W392KwbG3S8gUtYcFA/Vc6KJcQqCPtspPxWEJ+Z+cQqCPtJGPxWEJN7:9x7SGwbGC8gI8VclTqUtoPxmAqUtJGP7
MD5:	DDFFAA966C03DC4BEF4DCB947DCC474B
SHA1:	6215788E0E4E03647054C58531C9B76F8B1508A3
SHA-256:	EFB72E3CC8A9623CC7230D1B4884DDC353F3D60A070511E327C9244720A823D5
SHA-512:	483AA44EBCB66A3682DEA58166E5E573D4B1E90810A95873D00CF8CE51398AED0AA074686647EC23F996D594B6EBBF452C617CA94533CBBC00DAEF2878BC35E5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].$..........."...0..............3... ...@....@.. ..............................cX....`..................................2..O....@...............,..(....`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.....................@..B.................2......H........$.. ............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...ps.....r...ps.....r...ps.....(....(....rk..p(....(.....(....(....rk..p(....(......(....(....rk..p(....(.................-..f...s............8...............%..:..o..........o.........i.0.~....+.........ru..p(....-H..r}..p(....-M..r...p(

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	527389
Entropy (8bit):	7.995975187354872
Encrypted:	true
SSDEEP:	12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	true
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1.zip (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	527389
Entropy (8bit):	7.995975187354872
Encrypted:	true
SSDEEP:	12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	true
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29321856
Entropy (8bit):	7.992684463143075
Encrypted:	true
SSDEEP:	786432:35nsrY8OB/PN+rI9z1KiL7muN9Yv60+cwc7UGXuc:35nUY8UgI/KiL7lN060+9GND
MD5:	58B8915D4281DB10762AF30EAF315C9E
SHA1:	1E8B10818226FA29BFA5CDD8C2595BA080B72A71
SHA-256:	C19DF49F177F0FECF2D406EF7801A8D0E5641CB8A38B7B859CBF118CB5D0684E
SHA-512:	49247941A77F26AB599F948C66DF21B6439E86D08652CAA9B52FFBCEFD80A8C685D75C8088361C98DDE44936E44746C961F1828A5B9909FECD6CE9E7E6D2F794
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.K=0.%n0.%n0.%nk.&o:.%nk.!o".%nk. o..%nb.!o .%nb.&o:.%nb. oj.%nk.$o5.%n0.$n..%n..,o<.%n...n1.%n..'o1.%nRich0.%n........................PE..d....j)f.........."............................@....................................OQ....`.................................................8$..(...........p..p2...\.................p.......................(.......8...............p...H"..`....................text............................... ..`.rdata..............................@..@.data....1...0......................@....pdata..p2...p...4...4..............@..@_RDATA...............h..............@..@.rsrc..............j..............@..@.reloc...............P..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1184128
Entropy (8bit):	6.623147525519113
Encrypted:	false
SSDEEP:	24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
MD5:	143255618462A577DE27286A272584E1
SHA1:	EFC032A6822BC57BCD0C9662A6A062BE45F11ACB
SHA-256:	F5AA950381FBCEA7D730AA794974CA9E3310384A95D6CF4D015FBDBD9797B3E4
SHA-512:	C0A084D5C0B645E6A6479B234FA73C405F56310119DD7C8B061334544C47622FDD5139DB9781B339BB3D3E17AC59FDDB7D7860834ECFE8AAD6D2AE8C869E1CB9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......2..}vn..vn..vn..-../xn..-../.n..$../bn..$../on..G2r.tn..$../.n..-../on..-../wn..-../yn...../wn...../~n...../Zn..vn..=o...../{n...../hn....p.wn...../wn..Richvn..................PE..L...V..e.....................h...... .............@..................................1....@.............................................p...............................p...................@.......X...@...............0....... ....................text............................... ..`.rdata..............................@..@.data..............................@....didat...............T..............@....rsrc...p............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\is-77RM8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45608
Entropy (8bit):	6.102967271122138
Encrypted:	false
SSDEEP:	768:9x+kL+W392KwbG3S8gUtYcFA/Vc6KJcQqCPtspPxWEJ+Z+cQqCPtJGPxWEJN7:9x7SGwbGC8gI8VclTqUtoPxmAqUtJGP7
MD5:	DDFFAA966C03DC4BEF4DCB947DCC474B
SHA1:	6215788E0E4E03647054C58531C9B76F8B1508A3
SHA-256:	EFB72E3CC8A9623CC7230D1B4884DDC353F3D60A070511E327C9244720A823D5
SHA-512:	483AA44EBCB66A3682DEA58166E5E573D4B1E90810A95873D00CF8CE51398AED0AA074686647EC23F996D594B6EBBF452C617CA94533CBBC00DAEF2878BC35E5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].$..........."...0..............3... ...@....@.. ..............................cX....`..................................2..O....@...............,..(....`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.....................@..B.................2......H........$.. ............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...ps.....r...ps.....r...ps.....(....(....rk..p(....(.....(....(....rk..p(....(......(....(....rk..p(....(.................-..f...s............8...............%..:..o..........o.........i.0.~....+.........ru..p(....-H..r}..p(....-M..r...p(

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\is-7MD2K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	527389
Entropy (8bit):	7.995975187354872
Encrypted:	true
SSDEEP:	12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	false
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\is-PUHR7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48005
Entropy (8bit):	7.924596711570388
Encrypted:	false
SSDEEP:	768:kLse/Ia4qCtiJ5BX17ZzMt1itbKT6GbnMHFFQCIN3HklYMsfa1pDLfkh:kLshpqCtiJ7179Mt/T6SMD/80lYMsULQ
MD5:	5FD73821F3F097D177009D88DFD33605
SHA1:	1BACBBFE59727FA26FFA261FB8002F4B70A7E653
SHA-256:	A6ECCE54116936CA27D4BE9797E32BF2F3CFC7E41519A23032992970FBD9D3BA
SHA-512:	1769A6DFAA30AAC5997F8D37F1DF3ED4AAB5BBEE2ABBCB30BDE4230AFED02E1EA9E81720B60F093A4C7FB15E22EE15A3A71FF7B84F052F6759640734AF976E02
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....sRGB.........gAMA......a.....pHYs.................IDATx^....mWu.....%. ..+t....v..F.s.N%@U...r....v.J%.\|i..r......)W..../I.I.Hc.....]p.n.@.....-..........g.9.Z{..Os...o..\s.9.c6{.u...c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..4.Wc.1.C.._~.x<~.d2....+....f/x..{766n;u...w.}..[...ox..;.......y..MN~u.=.=r/.u.......g.\|...4...mW?.g.;.....;.L.pOs....~v...-}:.T>v....nR..H....r....}2.`1.1~...O.gvb.9...............n=r....n...W\qn..^1.N.w..;...=w.u.[%...lxo.....L.....\|.K..Y.Rx./.f............8....y..\...{.7..._..,{!>..oy...~...Y.........q./.......N...t...y..1..L...._5]....x\|y..@.Zy.\y..W>.../....g<._t.....N..^w.'n..m...x<.!...{....Kf.;...../...W....f.K...^~.x4.xvZ......T...W.....k.?q..t.....Gc....~5.......z.f..wJ....1.U..P...}c2{]....1.O..;.<~WY\~..k.=2..(..\|........wp....O=9...5y..&....}...~...:..Y..\|..\z.W.~.S.._..7..[[.qd2..9

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\is-T62MQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	3472
Entropy (8bit):	7.887509074097702
Encrypted:	false
SSDEEP:	96:esI8Px/qzfMJ7z40E7o6tBSdqtcIkGcgz:e+PxmfgZx6/IqteI
MD5:	3389CCF9511B5BAB290075AC7C9D6F45
SHA1:	95DB39B91E3EA5DF39EA64BF02BCE3361E401528
SHA-256:	7C1AF7B61C52107EE247482B8D72BB2567813F37660A07824E34DDE35D182834
SHA-512:	A840A4C58E2760A742B8C2D7A9F8FD892FC93266AFD2BBCB9B273EFC867751B172F7AFC9D0D90E8437A76B9F33F00CB7893699D6C2C6EEC8D861DDAA7101423D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....................................................................&""&0-0>>T.............................%......%!(!.!(!;/))/;E:7:ESJJSici.........d.d....................................................................1Q.!Aa..2R."B..qt.......................................................1!AQ.."Rq....a$BS...............?..x..k.ax...q.sn),0....\|.....?>...".t.'.^V....aHb.....pHy."..Ct.n...!.DM..".!.D.E....~3.2...(.....21R<.....dfV..:2.`.x...o..Lie.'....>.6.8....[.....H...Q&.:....2...!.D_3H..X..i...uY.sR"..t.n...!.j&...."IX?.r,.a..!.iR..O.O.k.....;Q.ld.....'h:k.s-....M.....rxu.....Jj.G..P.`...iq..k...b.[.....8tT..`...j.?.EH.."..=C.D.^?.......ygp......~....ZW.oF.Y..X>,j....+..i...(..$=.\|<Z.!oX%.3.C..t.`...rx.......\|D...Z...\.\|..%V.q..1qr...y.`...rO....].a.....~......J.+\.l.b.4.l."...fz.....g7.H....\...n...x....._.../...O.t./....C......YC,2...@.JR:..]..........RV.".(UQ....\U....3g....9PT...Y...<:../f...H.g..#.Yn...`}d....%hPRT.I.`.R..6$. .D.dY%....

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\is-TJ75A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	58209
Entropy (8bit):	7.972991367414719
Encrypted:	false
SSDEEP:	1536:6OUhw1+qeEfOq4pFzFAKrm9OHUuYNNoqcYpt8VCY7zlO:V7eEfM1B0uUtyCu0
MD5:	4167C79312B27C8002CBEEA023FE8CB5
SHA1:	FDA8A34C9EBA906993A336D01557801A68AC6681
SHA-256:	C3BF350627B842BED55E6A72AB53DA15719B4F33C267A6A132CB99FF6AFE3CD8
SHA-512:	4815746E5E30CBEF626228601F957D993752A3D45130FEEDA335690B7D21ED3D6D6A6DC0AD68A1D5BA584B05791053A4FC7E9AC7B64ABD47FEAA8D3B919353BB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx......U....g....,`F@RY..j0.........t..U.....u..z3Q\u.....>...]..zwzd...`&"..{..t....<$.l<N.L..L.f.W...9u...z..g2s.Wuu...9.[.N......`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0...iK....`0..3.%K..T.#.N...-....(J...l>z.ha.]EL.F.5.....0#..].....Sv.....p.....%..B6..x.n.\.S....EO.].c......`0.....7...;.xG7.S......T/.0.....`0..Vv..E..).......k.4.....`.1.e...f.j+....S.Rz..><022.V...i.....`0.....z..(.S...T...X....^..`0..3....YO....c.-Dm...8;....CI...j..?+..`,.:..7..0..I.+.$..q.]>.y....xx.o...8h..`0..... .=".P..ZG...M.7.!....>..;V{.v.J...(xG..C....v....~h....S.Y'..x.U../.P\|+E.P...a..a.H..."...]oV.S.%.V....fN.^...oW.[..6$.fy.Y....r..`0...C..l.6.s../.wlCp....(. .[...Z..v.W...+..<.J<{ gIs.N5.n.!......'.'..Q-\.....,....H..Km.7.....`0....L.jii.......{W1s.Y.......ni..G3..a..fUiF:j.+..._..

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\mainlogo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	3472
Entropy (8bit):	7.887509074097702
Encrypted:	false
SSDEEP:	96:esI8Px/qzfMJ7z40E7o6tBSdqtcIkGcgz:e+PxmfgZx6/IqteI
MD5:	3389CCF9511B5BAB290075AC7C9D6F45
SHA1:	95DB39B91E3EA5DF39EA64BF02BCE3361E401528
SHA-256:	7C1AF7B61C52107EE247482B8D72BB2567813F37660A07824E34DDE35D182834
SHA-512:	A840A4C58E2760A742B8C2D7A9F8FD892FC93266AFD2BBCB9B273EFC867751B172F7AFC9D0D90E8437A76B9F33F00CB7893699D6C2C6EEC8D861DDAA7101423D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....................................................................&""&0-0>>T.............................%......%!(!.!(!;/))/;E:7:ESJJSici.........d.d....................................................................1Q.!Aa..2R."B..qt.......................................................1!AQ.."Rq....a$BS...............?..x..k.ax...q.sn),0....\|.....?>...".t.'.^V....aHb.....pHy."..Ct.n...!.DM..".!.D.E....~3.2...(.....21R<.....dfV..:2.`.x...o..Lie.'....>.6.8....[.....H...Q&.:....2...!.D_3H..X..i...uY.sR"..t.n...!.j&...."IX?.r,.a..!.iR..O.O.k.....;Q.ld.....'h:k.s-....M.....rxu.....Jj.G..P.`...iq..k...b.[.....8tT..`...j.?.EH.."..=C.D.^?.......ygp......~....ZW.oF.Y..X>,j....+..i...(..$=.\|<Z.!oX%.3.C..t.`...rx.......\|D...Z...\.\|..%V.q..1qr...y.`...rO....].a.....~......J.+\.l.b.4.l."...fz.....g7.H....\...n...x....._.../...O.t./....C......YC,2...@.JR:..]..........RV.".(UQ....\U....3g....9PT...Y...<:../f...H.g..#.Yn...`}d....%hPRT.I.`.R..6$. .D.dY%....

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\v.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1198
Entropy (8bit):	7.74076087350446
Encrypted:	false
SSDEEP:	24:1kGbOS8DQ56yg+FXWZ4BRUZpdlGpotv7YzyCp619G2svu2JBmC:1dR8Au0BBRUZkpopYz3Solvu2BZ
MD5:	901CCEF6859BF21318516EC882854058
SHA1:	E4ECA24D52DB414085A0F9F4B3C0DA8B2EB5983B
SHA-256:	00873784B2C875FEFB4FFC71163A3DE9991809C865F750D77990C279D4EBC579
SHA-512:	9785A93BC857CFBDDCC4A5D7F2B3593A3A612225A1EC5DEE5BEAB21006B23B7FD4359146FBDE8B978D710719C2807760A4D2FC6AE2F675D64E068FEC95F3A9D2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........gAMA......a.....pHYs.........j.....CIDATx^.;h.A../.. ...J.Q.C..Gc!V6..........v...XH\|..).JDD.,,,TTD.\|!FETT........;6......\..?.......\|..l_...J.Ul....\T.\.~.o..O..q[..u.3...bL....P.uQ'u{.%.x%,C..i.....9&......-...F....Nf.m.........T...........H..'..L..S.j.'.c.Sb....}....TDE......7...K..(.=.t.9?...x.Z..".....>.u.-m...............V...l.Vl....].mS6P...!A.b.....w&.-m^`ck..G.>.....[....2.....n..A..........J.W\...$t)l...:Zw.'..v.8!.....4..../,1./...L`s0...V._..y.,..-....J..."N...a.k.l7/..A.....u....P./..#N..>..\.`{.a(....8.n..u...v7a......N8..ITU.NX...K.B.I`9j.q7..+_.5.g.Z.VX...N.(...^}_.V.(.E...)..U....N`X.m..).U...Y..-p.GIe.0......3.*Gz..+.k.5..i=.....K..0..?+.../D8....`.. oc..K...G>V.8.9>.LD.vA..Z..pS,...,..q.Y..".z].8B....$..^,:.R.HX.."p.]m..^........!..a.3....H.H.U.5.v................A.Cb....a...#..Y...!.!Z..]..xV...[......C!..8A...,....h...".ae........,NO.:....j.;S....}@..Q)...T.CRM...\S

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\x.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	7.771259555887389
Encrypted:	false
SSDEEP:	24:l0mebqnsCqmPt9umSWmZvfHpPNJbc7OVKByhlCZ6I8ZCcA/5tqt1NiBy:l8msCqm3untZnJ1gOYByhoCkgviBy
MD5:	0BD639D161C88F6B8C31EB55478841F9
SHA1:	C64063B9332AFE09932BCC5919C3E66890C6CE73
SHA-256:	CA825FAB9A9746DAC2AC63EF48722154A1A56A457DA6AB7D80D34FCACF0B010E
SHA-512:	BA003916668255353FD3D40E4A4433B6219969DB45D2918C6BAB4D4BF1B8ACBED134BCFA51950F7878BE813AB9EBF950D2E1ABF295738178AFF026A30D9D5DAC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........gAMA......a.....pHYs.........8.S$....IDATx^...G..g.J..D.B...=,.d......kX..!......#.TD. ...B.!...{ ...\..IO.Et.g.~...M........z......^.t;.j..L<.....T\|,...Z./..'..qF.../&F8}L\...A .A].I..'......u..m.F.sY....M@[.9..-N...e.(.ml.....KXF..l....K.RX...l...0.!....6F....o.j..`+6G....VCm...;..4I.\|.l....0....ZbE..D...m.../.8.9. '...Z..-.....P..Bc....m.+q+w..Vx..e..rE\..c..G..B;..M.3!GZ..&,>..............$........~.V...d)..v.K.u39.OE'.&..E...\|.f3.6.F..~..H~.....D.BG.>o...u..._...?..\|...hD!..=..s.y.#{..(...$..pQx..2....I[......-s.h.../...q.../[.\|.\|..........i....y.PU.....P...."G.ES..IPd}..K......F(.%........".^...;.3...;Q..p>.N4..w62...3..y.......E..xx:.{F.\|B........#.(..s.a.....j...d.4....Wq>...D..%Y.....^.8..N ...A...8XX......M.D'..V..$.P...=.......P :....V.I(..0.9..y."6H.....B.!.V(...8L..LM.p..0_.S....$.a....!..q.h{...d...U.J.....Y<.qB..g.......e+%.B.........g.:.x`b...-)..u..e...#Kd.-.l....[.

C:\Users\user\AppData\Local\Temp\mwaED6D.tmp

Download File

Process:	C:\Program Files\McAfee\Temp3475153614\installer.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	164864
Entropy (8bit):	6.201995701481623
Encrypted:	false
SSDEEP:	3072:q3CSE9n0WjsAGX5Gn39yf19leo13plmJXTD:qM90WoAGJqe1neceJj
MD5:	662DE59677AECAC08C7F75F978C399DA
SHA1:	1F85D6BE1FA846E4BC90F7A29540466CF3422D24
SHA-256:	1F5A798DDE9E1B02979767E35F120D0C669064B9460C267FB5F007C290E3DCEB
SHA-512:	E1186C3B3862D897D9B368DA1B2964DBA24A3A8C41DE8BB5F86C503A0717DF75A1C89651C5157252C94E2AB47CE1841183F5DDE4C3A1E5F96CB471BF20B3FDD0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>..dm..dm..dm..gl..dm..alj.dm..`l..dm..`l..dm..gl..dm..al..dm..el..dm..em..dm+.ml..dm+.dl..dm+..m..dm+.fl..dmRich..dm........PE..d.....3f.........." .................S....................................................`..........................................^......._..x...............@....................;..p............................;..8............................................text............................... ..`.rdata..............................@..@.data........p.......T..............@....pdata..@............`..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg8CEF.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ArchiveUtilityx64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	153872
Entropy (8bit):	6.328830993497698
Encrypted:	false
SSDEEP:	3072:RAZpz3eQkXBlJ6pM91zgrn4oul5ntwc0sOct7Bml+:RAvzD6l0+1grn4vtX
MD5:	EC2D7737E78D7ED7099530F726AC86F9
SHA1:	8F9230C9126DE8F06D1CDDAA2E73C4750F35B3D9
SHA-256:	DD034654CFFD78AABC09822A9A858ECF93645DCC121A4143672226B9171C1394
SHA-512:	E209784FC2338D33834101AC78E89CBA6C1DA144E74330FD0FF2A2372E70316C46C2189B38B34B18B157C9221A44760D20BCE8549573FBEDA248D4CEB03E8365
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.1.q._.q._.q._.:.\.t._.:.Z..._.:.[.{._.#.Z.n._.#.[..._.#.\.x._.:.^.r._.q.^.,._...[.a._...V.s._..._.p._.....p._...].p._.Richq._.........................PE..d...i.Ef.........." .....T..........0................................................I....`......................................... ...T...t...(............P.......$...5......P.......p...............................8............p..`............................text...`R.......T.................. ..`.rdata..p....p.......X..............@..@.data...P<..........................@....pdata.......P......................@..@_RDATA.......p......................@..@.rsrc...............................@..@.reloc..P...........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\Microsoft.Win32.TaskScheduler.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	349024
Entropy (8bit):	6.20955325822065
Encrypted:	false
SSDEEP:	3072:51sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5DfV:51sSmRIt/xhtsOju1DH5NXnIKAco
MD5:	192D235D98D88BAB41EED2A90A2E1942
SHA1:	2C92C1C607BA0CA5AD4B2636EA0DEB276DCC2266
SHA-256:	C9E3F36781204ED13C0ADAD839146878B190FEB07DF41F57693B99CA0A3924E3
SHA-512:	D469B0862AF8C92F16E8E96C6454398800F22AAC37951252F942F044E2EFBFD799A375F13278167B48F6F792D6A3034AFEACE4A94E0B522F45EA5D6FF286A270
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ....................................`.................................0-..O....@..................`;...`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{......{....V.(......}......}.......0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....... ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(......{......{......{....r.(......}......}......}......0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	550984
Entropy (8bit):	6.672465900343423
Encrypted:	false
SSDEEP:	12288:nZLZVgIQtZM1A0+Nwhq3drt0ZAPKYZzrOZW4zlK:nZV661A0ue8lCZAPHZzrOZW4zl
MD5:	31CB221ABD09084BF10C8D6ACF976A21
SHA1:	1214AC59242841B65EAA5FD78C6BED0C2A909A9B
SHA-256:	1BBBA4DBA3EB631909BA4B222D903293F70F7D6E1F2C9F52AE0CFCA4E168BD0B
SHA-512:	502B3ACF5306A83CB6C6A917E194FFDCE8D3C8985C4488569E59BCE02F9562B71E454DA53FD4605946D35C344AA4E67667C500EBCD6D1A166F16EDBC482BA671
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'............"...0..l.............. ........@.. ..............................b.....`.....................................O.......H............&..HB...`..........8............................................ ............... ..H............text....j... ...l.................. ..`.rsrc...H............n..............@..@.reloc.......`.......$..............@..B........................H.......d<...a..........@................................................0................(....s....%r...po....s.........~....o....%{...........s....(....t....}....~....o....%{...........s....(....t....}....~....o....%{...........s....(....t5...}....~....o....%{ ..........s....(....t....} ...~....o....%{!..........s"...(....t....}!.......~....o#.....E............'...9...........o...........8....~....o$...s ....~....o$...s.....+h~....o$...s.....+V~....o$...s.....~....o%...~...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\System.Data.SQLite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	370744
Entropy (8bit):	6.110296146366327
Encrypted:	false
SSDEEP:	6144:eruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cm9:tNWx6xz+nRo2GGWHQZMaLyJSJFNFaFeE
MD5:	110DE32AF906E9EED32332B785F90BD4
SHA1:	37CA7AF131A5DB1E06CB36DB2943C7A4E6F0D8E9
SHA-256:	598ADB6F4A7362FEDF047CE7282F39C0C7DA264CEA10C0C39870932EE1CEB647
SHA-512:	555A006B4B5236D6E6B76C6A8C79A8B0C3E350DE42A0A38C792BFE65B3E7F99A232261A1BF8B357618168FDE7E7C2E3281F38E05D20451FCBABCA15FE35A02C5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.].........." ..0..b..........j.... ........... ...............................;....`.....................................O.......$............l..8<...........~............................................... ............... ..H............text....a... ...b.................. ..`.rsrc...$............d..............@..@.reloc...............j..............@..B................L.......H...............................`~......................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(......~;...(<...,r.....s....}.......}............{............%......(=....%...:....%...!....%...%.........%....%.........s....(....z.{....,......(=...o>...s?...z..0..'........{....-..(......o........(A.....}.....*..................0..T........{....,K.{....o@....+...(A......(B.....,..o;.....(C...-...........oD.....{..

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\System.ValueTuple.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75800
Entropy (8bit):	6.0263750749193274
Encrypted:	false
SSDEEP:	1536:r784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAA7yxpD:r7NV8v36tI0XCKAAQD
MD5:	7AF831F20C4A0C5A78A496AFB62F28BB
SHA1:	4380A7C2ABE739B49F568AF70D8DAB8371B10687
SHA-256:	01DCA2D3EFEDD9F4269427E949E8A3BE64686D8ED84EA863389EF2449B6DC8E3
SHA-512:	11713885D4A11B49088EA220963AE6FE6519EB6B0499D3CE85AAD1EB95ACEE4B5F357AD9EF07D8E20721596B510B8D43138BE9AA6C4DE24DD78D5FEFB88D0CAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ..P................2...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\cs-CZ\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.880723781358086
Encrypted:	false
SSDEEP:	192:ZIY1pQ8vGO4xToxMi5eX2zUA8rYgLIgPrEyz23tMuuVWJkYUECd1Vl7Iru+M3YVe:Z3pQ8vQToxMi5emzUA8rYgLIOrnz8uuw
MD5:	3691CD9A157D027569A203DCDDFB3336
SHA1:	9D9D158B6683CD0CD570A235333303137C890A25
SHA-256:	917DD83D6CB87ADF9ECC3F0F17E5266C6C1E435CE966B45760E7C0244A0FD4A0
SHA-512:	8F41C6C052C4440CDC6C45A21E42F102B7677462E2D78A2F78261DAE80FA7DCFEC8BCF14A5BB9BFD101477B983411435E56A92DA304E7DA47FFF6A933FA3CA9B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&..........>E... ...`....... ....................................@..................................D..O....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..P...........P ..J!..........................................F!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\da-DK\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7480840345925746
Encrypted:	false
SSDEEP:	192:FIYRN3EsGGj3fvKEx8rUrb+M0lIVixNPqDGomU3WUeQoXjAUwMXrAfeMA7AWmBHP:FXN3EsVfvVx8rUrb+M0lIVixNqiomyJD
MD5:	98B6DF5F4E0F1D34A0BD3DD49F92D82B
SHA1:	B69000A0998055612EA5940D4B1D5F2CE07AE427
SHA-256:	3E7D3946C5EFEB9F7A27AE43DE75F1A1D0AF34CCBB69F857217BE97BD28C0761
SHA-512:	833B5E0FC14E247E788D59A7D21EDC7F6DB1FF0D9378A77FB13F25CCFBEA820623B2B5F9823AE409D7EAA3B5526AA61BB367BF83BEE2A33263457FD3049D3FB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................D..O....`............................................................................... ............... ..H............text...4%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........A..P...........P ..<!..........................................8!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\de-DE\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.758334824355771
Encrypted:	false
SSDEEP:	384:45rayxOPAxMtzTxCmf6hC/s2TvOFk6AOPh3+yFdmyndw3s8i:NPAKtnHOdvPhO2dmyndw3s8i
MD5:	00B5369BCD510787679CFAAFB478217F
SHA1:	26A44A1B05FE4314D8CF1D810B759B6A5BC74385
SHA-256:	3B8B89C4241F5E8F0FD101BA84B13B37F40D37F3FF2739CB6C6332B56BEF88CE
SHA-512:	2F6E14A3B06ECB053C261E62058CA99F2E365A88182C02DB4F60231BEA2525A31260A6980187798D8B1685F87E9A307EB928F279F67A6CB139AD6481D421FFD0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....(...........F... ...`....... ....................................@..................................F..W....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H.......4C..P...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\de\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.557060180794725
Encrypted:	false
SSDEEP:	192:0MiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufP/1S5rxg0XWr:0D1Nvb5adVl8P2djJMZJSGu3A5rxg0Xq
MD5:	F83D720B236576C7D1F9F55D3BB988F9
SHA1:	105A4993E92646B5DBB50518187ABE07CA473276
SHA-256:	6909A1C134D0285FBA2422A40EA0E65C1F0CA3C3EF2B94A1166015AF2A87780F
SHA-512:	FD8A464F2BC9D5B6C2EFA80348C3A9362F7473D4D632B2ADDAD8C272E8874E7E67C15B99B67E6515906B86D01D57CD42F9F0F1E9251C0AF93A9391CCC30E3202
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................-E....@..................................9..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........4............... ......P .......................................z..).........*SE.1r.2K58\p.`1....SJ..G.f0d.W.oQY....&1+E..z..:@.n@........S.XEp=C... T.q.l....S.Kg....%..l..._...0..'.+................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\el-GR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	4.985483869790037
Encrypted:	false
SSDEEP:	384:inpUcW/WJsxvxwKW9iu6Wxtp701zA27r+PMvozTi3s8o:QJs5xEGzfOPMvM+3s8o
MD5:	9B86D1ED1D99DDB84B5FB7CF176B3F8F
SHA1:	2E1C164816EE2DE6AC4E3BC6A61214D72516632A
SHA-256:	71093535EC2E97398B13385A7BA9E7AAC046F190FE06BD68E057C8EA0DA1AFDC
SHA-512:	134985A9A7AE78593A760D362C57F430AEB1920E6E7517684DA78573702796E381D99A8DF191A9DFA3BAC9AD1EB6CCD71E7DB40ED4DC9DE76ECFEBD075F98355
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....2...........P... ...`....... ....................................@..................................P..S....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......HM..P...........P ...,...........................................,.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\es-ES\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.714281072425133
Encrypted:	false
SSDEEP:	192:+IYVmGe/VGuDqni6wxCjfp3DocEs5dMvGPcDonP33TewxlhiYwEHU4dIyrokBD7r:+uGe/V0ni6wxCjfpzocEs5dMvkcDqPDR
MD5:	86FF4304190B9ACDCBC4034A8EB910F6
SHA1:	B5D597F31963B35DDE1B024523B5AFDCA9AA454B
SHA-256:	6F5F0BA42A1C4EF8A7CD4B504E959173FA3AC8782200E48548681F7209C1927F
SHA-512:	AEE1A0F3A426A77BA0B9D4EDF8E9EAB2D1B6D9BC2B5379D716F9850021A1816B09F37DEBBEB5E3395B3214AE3F4CC93612AE289344548CEA00F3C8EFF6FE509B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......dA..P...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\es\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.425694157692337
Encrypted:	false
SSDEEP:	192:r0WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAP9115rxg0XWr:r01NvbGVxx6hUltfxgE00cLF5rxg0XWr
MD5:	15DB634B70D6D9D6CD41BAAE3F02EB14
SHA1:	1456FFE09DF896271A746F9CB40A230F188AD397
SHA-256:	E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
SHA-512:	1230E5368D4DAB9776D57056993669327E95FE72E262EFA541ED5D43ABC1BCD3618DB13B6BD6B3A27DA053C103E3FB647EAE759CCAEB443F7D9FFD1ECAA1122B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................n:... ...@....... ..............................pi....@................................. :..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................P:......H.......,5............... ..\...P .......................................2M.. ,.,]...).].....@.l..~.u.....Oz.B.{~*;.......6\..s..$_BZS.b..x.S....-..g.......Jr...{...E..F...s..sa.p.eS....X..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fi-FI\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.723886741305548
Encrypted:	false
SSDEEP:	192:kxIYXkNcDGwgTsxJoRxAM2+9Ul/laxRe+PE8v+GA3kr29zrJzfPWCiqxskBbHUiJ:kxRkNcDtxJMxAM2+9Ul/laxRe8ZGGWgI
MD5:	94BF9DE34C0870791640AB7067F0D24A
SHA1:	B21458166F08902EBFE2A4F68CAF3945ED5364A8
SHA-256:	37CBEC3559E5536DA35D87D72EF8EA37D98D70265C921A0ACADF75695A14331C
SHA-512:	A0E09D4E9F15589043AB2D071F5004AD00F8FE58E85491F32C0D76C8F5CB8EEF95B069A2D532638CB812C05A15BF50A442D8649884E78ABE826E32DCDBD27E7A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fil-PH\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.402460029334098
Encrypted:	false
SSDEEP:	192:60Zne9hwoGBjeCipxwU6LOl+DDUbqN4PPjjDr8d30LfmJyXOhZCa2m5sml+T9lmc:60Y9hwoEipxwU6LOl+DDUbqN4Xjz8V4F
MD5:	DA6B3FE38876D703F7D39B163DDD8BFC
SHA1:	F60B54DE800A5DBB535BABD2667C9FBD9C37766E
SHA-256:	93D2A195E47C1C1E11A2B6960B47C7B4B043CD5CE6A0723AF06CAC91E292F50E
SHA-512:	8A261C61D441E6EBA09BCCDEB8E2C94CD540AA9F07631B477431C717F3F111E4B10819EC8524531584561A6C9FA3C785ED082429D6BB97587EBB074BF357515C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!..... ...........>... ...@....... ....................................@..................................=..O....@.......................`....................................................... ............... ..H............text...$.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......x:..T...........P ..'...........................................#..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....Q.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..]....b..`............)...s..%'..JA*......>.$.\.&...'

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fr-FR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.838168365990566
Encrypted:	false
SSDEEP:	384:gY0al1sBIxgyFzjXZfu14MpXrOUDlK8yXahGY7uXn3s8D:eBImyDM5DtyXwGY7uXn3s8D
MD5:	9EA4BCD8D3C7599A5A8BA78FF9B11C3C
SHA1:	2C859731430A4FA3D82C4CD5088167CF31536969
SHA-256:	C576EA42CEFE28228C341488140C7FCF24DD063FAB2B82D563794772F82B97BA
SHA-512:	61AD6B22DADFA30BA4FAD527BC564414981EBB6F5EB0C7D224ECF1BBA093D071DD3544E08ACB90C4D95505887457C65B44447B6ABB0E2F97E482477CC9E4DD51
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....(...........G... ...`....... ....................................@.................................HG..S....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..P...........P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\fr\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.588569516197988
Encrypted:	false
SSDEEP:	192:YWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VP81g5rxg0XWr:Y1NvbdKJiDjgmlRi0HYZDMp5rxg0XWr
MD5:	3B4621370ADDCF4306669C9E7E45C865
SHA1:	EA1AB3C499E946E152C1FC4A63FA99E1F9BE94B4
SHA-256:	E3EE50E08124A7603BE7D996DCF596EB0D3F9C603768E86E003F7B942D7097F3
SHA-512:	586755F32D16AFD937BFC1FE3C52210AB815D5D4C904DE101150FA052A94BABFCBDC465669FF8C2537B782474658D7912037DDB76D8C9A8FD34715D1FE7B2857
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................^;... ...@....... ..............................1.....@..................................;..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................@;......H........6............... ..?...P .......................................ME....P.<......I.J...Q'D........................X7..'<F..q..o.6G..M-.$.v..i.>...z..'....OV?....+.9..V........I"..9........;..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hi-IN\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	4.803116867134068
Encrypted:	false
SSDEEP:	384:RME5h/2kXJsxw5w2UW4ctvHU+Th60iu2F6mKVZnCyJT2ox8mn9THjI5gE2ac763E:1XJsO57hOt9AZnttxKq43s8Q
MD5:	DF8CF1F932DD7EAE2CC87719B76FB8BA
SHA1:	425089FE01D9C1643CA7A060C55123D20507677A
SHA-256:	5F099F8F37757B98C5C51FB4DF66914E5F155394A349ADAF00211382CF8CF739
SHA-512:	D07EA9CE1DC8B09EAD0B1ED3E48CC71083D750BE0119F1C8587B3E13DC3598E7B6B06F365AF4B809BEA41280190090409B44079BCEA472CDD3D864456E762C2F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....:...........X... ...`....... ....................................@.................................XX..S....`............................................................................... ............... ..H............text....8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B.................X......H........U..P...........P ...4...........................................4.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hr-HR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741373437056816
Encrypted:	false
SSDEEP:	192:eIYVdDpBwGpkiVlZPxZlrPy2o92kGetEQyPIlUVKC3JDsS7qSmKV/4jNni67gXWu:e1DpBwSkoZPxZlrPY92kGetEQII2oANX
MD5:	5F2E0A3D771F9E03D216D81B522C5E2F
SHA1:	C49814ACF4A82130F17DF52074DF16DFFFC216F5
SHA-256:	8F102C7A9F03EDFDBE5D4DF6873418E510F44D8B72D5D47752083832445E1D81
SHA-512:	711D5AF717C65B35D758E9F25BD426CE5084C847DC24194030B08CE9C22A40DFE3E5FD8100061663EB9F39B3DF19A8DBC3F23794F79DEA96D81A8BE7397C7306
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@.................................hD..S....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\hu-HU\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.799981772302711
Encrypted:	false
SSDEEP:	384:qdpTgTI4gNxtBqu+p5DXv00jiOKQosgcekILk0pltfN3s8Z:64gNrBnOVlgcekILfpltV3s8Z
MD5:	FFCDA4B7ADA1943FE544DC922FA8D827
SHA1:	3A332F235E0AFB51D40D3D8890F79803842944A4
SHA-256:	841F86E4911D4593E5EEC47DD28AA1787188D0100A3703ABF23735B2BBF53854
SHA-512:	E406100AC71F7A0414DFF5C3F4A13EDA4193F3801B6C4EE150B0D410DA9A1373C4E1F3B3741C625DAF80C3254DD1B162DF87C2B3286303DB5A584C4950954208
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....(...........E... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................E......H.......`B..P...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\id-ID\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.681398214710318
Encrypted:	false
SSDEEP:	192:rqIYIZcKqG4ny8ZxSWuwCoBWidWjZdPAhDHPBg37eXCIKKXgXruQm8X0tF8HgGC7:rqOZcKqG8ZxSWuwCoBWidWjZ9AhLJ2Sx
MD5:	AD401434A4B7FB07085090031EE973D6
SHA1:	D32A3E0EEF3030392710A4BF5D1DF1614B41BE53
SHA-256:	BE8FFDC0C6EF5811888F8ECF282937DFBDE51996122B3A5CBE601713DFACE368
SHA-512:	DB44A2A0E0848BBCB9059F4A4E006EDA504717895F2E4CDB9519A3D3ED9D6CC91EC37B94F816BFA9EC888EE9D25251660E2256281B739EF1D7DA109B177AF55C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@.................................xD..S....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......(A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\it-IT\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7677799255744775
Encrypted:	false
SSDEEP:	192:nIYr9kupX/Gdq8SQxZdNYobyRXvujVf9UgPw/ev3nww3OajMRD1TLIjB5leULIp4:n3kupX/GSQxZdNYBRXvujVf9UOwGvwwX
MD5:	3601A9397A28672E9A038398590D50A5
SHA1:	13FD281302DF60AA4EC59CC82E13B6BA4423842C
SHA-256:	EB9F211091EFB9DF6167642FBAD48C6C4A0F9CE252283D63C6DE2378C8008C8A
SHA-512:	099868493D34AF70DD2BAAF8F44BB83DA18F9A2A95006CE1F8AE1F9A6A1B1C7DDFE091BB283273A6ABAFC00004A2005A720CDDDB57993BE49FCD2D17FC3F2F23
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......4B..P...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\it\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.368637490829895
Encrypted:	false
SSDEEP:	192:vOiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mPD1q5rxg0XWr:v11NvbGTNgr1nJI3+07MM5rxg0XWr
MD5:	1C331DA4BCE2809E16913C02E385576E
SHA1:	CF8E71E030347749596A53D1B13B9E9583EC0527
SHA-256:	1D0493E38D8B3FCC7EFA4916FEA1EEA69EE6449BF435E1869C1BC3F54D4090C5
SHA-512:	2871119690F3DF0F244384A3F5F65FFE7CF17F1F00F6B530512AEDEB8397C9E357079E8FBA76D2A5BF6BE4E2B18E4AC1AC104EA2D29F8F40CEF6F30A905ECF83
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................GR....@..................................9..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................9......H........4............... ......P ........................................M..+..u.3...i.7.[H\G.4D..dy.*p..L.m..4.....d..dZ...m..f../.@..GXQ.. ...$..."a......-....4..pS.5`@...;.`....Q..mHBx3..w3,!................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ja-JP\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.091016496791667
Encrypted:	false
SSDEEP:	384:bxwAHD6CkxQdCnvRl/oRHx8asale681v/z3s8V:qCkSdK0t81vb3s8V
MD5:	D95F7D238CD97260458ACB3D389246EA
SHA1:	864A3DD1E45B00CC571F2568B08E7566DDCCC475
SHA-256:	0C051B970ACF895BE6FDE7919A7AF780E3219AE19D1818C3E5B4FCDA476D00F5
SHA-512:	FC4A66FA2FE8B74C42852D5B41EC813221DD593FD2DE9EB5B6705D81841947264F53095A06DEB6E1B4DD914E90772EFE849FA9D6F584DD86C502F7123FD79A67
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....,...........J... ...`....... ....................................@..................................I..S....`............................................................................... ............... ..H............text....... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................I......H.......hF..P...........P ...&...........................................&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ko-KR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.202077256063847
Encrypted:	false
SSDEEP:	384:MFWuuyUdKvx4W9SxBmJsEMGFW/uuH2LlLTDUCl9w5JHJ8/uDO3s8r:vdKv+WqV2ZLToU9wXi/uq3s8r
MD5:	A482D56B4F3E8D89919B2BED266D1D0D
SHA1:	660491A4A6CDDACFE38749C18476C6759063FA61
SHA-256:	DFBB9EA022BFF44DDCF3848DE95405F4ABE51EA2D047AFF831FF30DADBD7EE8B
SHA-512:	AFCBC13E805B2E4EC015717D148DA83E09349CAF58AB89099163B8B1989C3B484B6610695F2DB15B3B27AD7207DA970E553B8C40F7CACE84E612695A2C3D2DB5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....(...........G... ...`....... ....................................@..................................F..K....`............................................................................... ............... ..H............text...4'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..P...........P ..=#..........................................9#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\nb-NO\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.693986975113909
Encrypted:	false
SSDEEP:	192:NIYfsK6eGOy+v3qxh7EFBYn1p4hVYTPMPhT9CEGF3aN3MfCExO4MV09J7wcLaaEN:NZsK6epv3qxh7EFBYn1p4hVYTqhTAEGE
MD5:	72DF7D8DAC9CD362BC2BF463369EF420
SHA1:	9D4F4C26617046001F7750D69E7075FA01C7CCE0
SHA-256:	7D5F7D76F7CB7AB750DD0D20219880D4AF7416181F74C3E4B10275885BD27899
SHA-512:	46D26CA9D850A0C66778EF3983EC346AC0BCD08E3CFE4549FDF99B23E501DC5ABF5227F9390743371BD72D5C5D077B673989DD9CDA8D9AD789C67347F605D5FE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@.................................PD..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\nl-NL\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.736378665228804
Encrypted:	false
SSDEEP:	192:DtIYBN1XfOGCvouQTxklOVw/lzyOl/dEf80gPCdmP347U9DC47aqFD37E/avkeZe:hTN1X2HQTxklOVylzyOl/dEf80OCQPAj
MD5:	760790AC69DD2294D548C64A7E7123B0
SHA1:	7530BD2237B86FF04BC1D25E1C3D7AF7090C4626
SHA-256:	7573B73E12D9094BBA18EE9FAAF0BFFA52B9EFEF9F97484F0875C6EA8C9CA735
SHA-512:	58C8E2186F1582F11FC74F0448D3BF78DB5DA321EBBA661E41C4BA82B7996DA22B69EEC0377C8F9D9FBAF3DFA8891F2982B47B564053B62CBEA890D5DE5282EA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&..........^E... ...`....... ....................................@..................................E..O....`............................................................................... ............... ..H............text...d%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................@E......H........A..P...........P ..i!..........................................e!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pl-PL\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.801397650400403
Encrypted:	false
SSDEEP:	192:JIYfp3DcrGr6SHAOzLxE6oMuN50rtbxn/XidPWd3SJC30Gh58xSoHR+hxWfbrVsd:JZp3Dcr2NAcLxE6oMy50rtbxn/Xi9WdR
MD5:	B9315BEFC451F0C68C18D4D9F3C7D4F2
SHA1:	D7FC5673F2B7CEDA352011206D6398C48B6DED99
SHA-256:	B0A689816159819881761B753B36A882642EF418D932A93432D422DF0B9CF70E
SHA-512:	1725A7887E850BAA0F570F9DE5B5E40C345960DC0C02980B1E5839C46EF242BB9280C38811B33418C2E71D1EF3BD8594DAC471475E4735A624CE74BC1325DBDB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@.................................lD..O....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pl\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.594776627495051
Encrypted:	false
SSDEEP:	192:haWWNv/jzSEYtq2dE1cxy8ON0Qsk96sPb1V5rxg0XWr:g1NvbaG1cxy8ONHskdD5rxg0XWr
MD5:	B60817A69E314B22F746917C826DA53E
SHA1:	7D2785A6D1A53A0717C986B959AF67DE6F9300E4
SHA-256:	6E58D86C42B61226DD7AF35D7C9432CE6F0982D1D0D5A2F4120E8ABC5C787A02
SHA-512:	9A8F029329CE105B3F72FEE623E3AB8C88E1AF45F86FAB61F81BE418B2D70F83E4C0466010D312240A01E1EF8F9B9926EBF43E25BDC3C364C2D28AB9B0E5F6FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................;... ...@....... ............................../c....@..................................:..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H........5............... ......P .......................................T`.K.%...N.f..u.........Z..1....#CTR.v....:aq.i#:Z.oAkQ:D...q.6...l....J.W.Pn.J......d........3.F..[.c....#....$.F..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt-BR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7157450468905004
Encrypted:	false
SSDEEP:	192:9IY1nlNKGnxGxIDx+sQ0Y4EQujHOVhPgdfBF3UTVV/Lea/FVgYISK+uZqiF4Afkb:9rnlNK/xIDx+sQ0Y4EQujHOVZgdBtofR
MD5:	BBFC0973B9D3DAC1E716EBA99B37FA18
SHA1:	05811A4846E10E54ED6DA34150CDFD807EA4B95C
SHA-256:	DEAA84302C66EB0242A7C80AB97DA3C5CADDBB5B3D595DF310674C0CB7E88DFE
SHA-512:	980137220EAD6AE8EEA33EDC0FA8C85E5E23CC7D42DC7E4DDAFD181D7EF9CF4D29C25F7256F1957F73D282EC969C4D95E526F4D1B67C4A96D4FA68540DC43041
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..P...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt-PT\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.729428739919532
Encrypted:	false
SSDEEP:	192:CIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4L:CrnlNKNu7xKgUOVBQ6Bo19sPTLM80aoe
MD5:	66FC2EA3F0EA6B897B117482B43DDB4E
SHA1:	E7BD70FEEAE4858F808132C4332F25F13E962689
SHA-256:	3A77957D0F8AE5952BA465382D97DCABF2134B1DC815E26C32F7C612FC94FD5D
SHA-512:	98BD2D15AA0958D52C7F0AC40343A4AD542EAC569C5107196AE21A6A9386BB93AD9A8D570DCD0849E8BF0D7BDA0839B79C06180584E272DAA349A64CA9A5151D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text...4%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........A..P...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\pt\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.723728419745786
Encrypted:	false
SSDEEP:	192:uIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4s:urnlNKNu7xKgUOVBQ6Bo19sPTLM80aoZ
MD5:	3B1DC81511B84F2393C6BA37CBD32FE5
SHA1:	0F87A801905E8CCB99EA7EEAC590308F381C74BA
SHA-256:	02AEE48153086F86580854ECF7E375D7E0C81DFAC7C222AD32EFD850852D36FD
SHA-512:	0B0ACC2CFD2CF95E61BEB3A1E06BE01F0E3C43839650FBE136DE54DF581172BCBA9B11DA57A7B18A6C284BEA74561DF6B30CFE129CEAE9BFF45EB6FA6D2E478E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text...$%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........A..L...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ro-RO\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.786330752122619
Encrypted:	false
SSDEEP:	192:4xIY4puUhG9oHusJxWgAm/45t6lSertHPHrgCs324VfosqPXMdEqljSNPEinIOBU:aapuUhg7sJxWgAm/45t6lSertvHrDapn
MD5:	1FE5185420BF332AE4CA5492A6B2A6CC
SHA1:	0058458B2FCF52E7C478AC13202873DE7A722465
SHA-256:	9C09CDB4FBC5A8F6576B8914148F3660A2E950C2B3A056014EDE45C0F38ADF34
SHA-512:	955B615599F5571AAE8EB71A4E4272E02CB4D67D68B8971053FFFE4374258B8DF58A3C04482B8EAFF67DF6A403544147A406999C6132E9B3896206808E580D4B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&..........>E... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..P...........P ..O!..........................................K!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsAtom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160016
Entropy (8bit):	6.404692888748325
Encrypted:	false
SSDEEP:	3072:d6lrh8aWSI9uVDeMWoWVy5zmndQ1dTZjxO3S/9FVkmiGUV+:d6lrhISL9e1oWE56ndQ19aY9Fjs
MD5:	16D9A46099809AC76EF74A007CF5E720
SHA1:	E4870BF8CEF67A09103385B03072F41145BAF458
SHA-256:	58FEC0C60D25F836D17E346B07D14038617AE55A5A13ADFCA13E2937065958F6
SHA-512:	10247771C77057FA82C1C2DC4D6DFB0F2AB7680CD006DBFA0F9FB93986D2BB37A7F981676CEA35ACA5068C183C16334F482555F22C9D5A5223D032D5C84B04F2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsAtom.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..2...........P... ...`....@.. ....................................`.................................pP..K....`..T............<...5..........0P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc...T....`.......4..............@..@.reloc...............:..............@..B.................P......H........i..(...........0....U...O.......................................(....(.................................0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................MU.z.....0.............B(....(....(...................................................................................................0..............0.............Ad..........

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsDatabase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	170328
Entropy (8bit):	6.475304499658319
Encrypted:	false
SSDEEP:	3072:FR761d9cCg9+zhOzcx9R0KvvvvnPPH6Gi5tPArrYeiYiPKiF15fJ2K/Krrii555V:+1TcpihOk0KvvvvnPPH6Gi5tPArrYeiA
MD5:	C4447F00C8AE467DBA6D3CE3E7E5AE70
SHA1:	9F085025B00112C976B6525BAAE7C3233BA2C423
SHA-256:	71FEFBEB2B693BA44CB45250880B873A818007093E003455DC4358471C28B440
SHA-512:	8B551C90679F8C7D108D2C9715EBB9DF960DFCDDCBB19C52361BACC2D6A4259A57E004767EFCF603574A2E4F5E38E7E064CC4041609F5F7B696B621C18324D40
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsDatabase.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!..0..Z...........x... ........@.. ..............................<.....`..................................w..K.......\............d..X5...........w............................................... ............... ..H............text...$X... ...Z.................. ..`.rsrc...\............\..............@..@.reloc...............b..............@..B.................x......H.......\|l..`...............4k...w.......................................(....(....:+.(Nf%^.(......0.....................0..............0...................-....;.....0.....................VV.Q!....0.........................!....0.............AL......Z.......q...................j.......................................................................................................0.............A4.................Y...............s...........!....0..........

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsJSON.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223016
Entropy (8bit):	6.788381525293459
Encrypted:	false
SSDEEP:	3072:CBuq5tonhw9PY+fAKul0ZJXY9ooyJtTsbbiRl7m76m/GS+KKeA4dtrSspDMK:nqDOhw9PY+4Zl0ZFY9ooyUbc3Kc4dt/p
MD5:	AFD0AA2D81DB53A742083B0295AE6C63
SHA1:	840809A937851E5199F28A6E2D433BCA08F18A4F
SHA-256:	1B55A9DD09B1CD51A6B1D971D1551233FA2D932BDEA793D0743616A4F3EDB257
SHA-512:	405E0CBCFFF6203EA1224A81FB40BBEFA65DB59A08BAA1B4F3F771240C33416C906A87566A996707AE32E75512ABE470AEC25820682F0BCF58CCC087A14699EC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsJSON.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r.............!..0..&...........D... ...`....@.. ..............................=.....`..................................D..K....`..D............0..(7..........cD............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...D....`.......(..............@..@.reloc..............................@..B.................D......H........\|...............W..O....C.......................................(....(....:+.(..4g.(......0.............A...................:........0.............B(....(....(.........................................................................................................................................................................0..............0.....................0.....................0..............................0.............*....

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsLogger.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	181184
Entropy (8bit):	6.53416223904584
Encrypted:	false
SSDEEP:	3072:f0AqxqD7b0Qv6wIMCP1Yr+Xle9WQJTrz96JiBRqMadYMBpCA5LH3d3f:sRkD/0Q7IMCP3ePOUBRqKep5j1
MD5:	4ECE9FA3258B1227842C32F8B82299C0
SHA1:	4FDD1A397497E1BFF6306F68105C9CECB8041599
SHA-256:	61E85B501CF8C0F725C5B03C323320E6EE187E84F166D8F9DEAF93B2EA6CA0EF
SHA-512:	A923BCE293F8AF2F2A34E789D6A2F1419DC4B3D760B46DF49561948AA917BB244EDA6DA933290CD36B22121AAD126A23D70DE99BB663D4C4055280646EC6C9DD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsLogger.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ky.............!..0.................. ........@.. ..............................&w....`.................................P...K.......P................5........................................................... ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................H.......ds..............."...}...........................................(....(....:+.(...W.(\|...."...........0..............0..............0.................................................0..............0.....................0..............................0..............................0..............................0.....................00.......0..............................0.....................00.......0..............................0.............

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsStubLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	254504
Entropy (8bit):	6.540092185448124
Encrypted:	false
SSDEEP:	6144:TeGOfaXMwabZNZr4FgTPFw4+5Jb74HthVqbvIsx6vewjLbqzm9iViRJ:qfacHZsFgT15qb5MmwnliwRJ
MD5:	98F73AE19C98B734BDBE9DBA30E31351
SHA1:	9C656EB736D9FD68D3AF64F6074F8BF41C7A727E
SHA-256:	944259D12065D301955931C79A8AE434C3EBCCDCBFAD5E545BAB71765EDC9239
SHA-512:	8AD15EF9897E2FFE83B6D0CAF2FAC09B4EB36D21768D5350B7E003C63CD19F623024CD73AC651D555E1C48019B94FA7746A6C252CC6B78FDFFDAB6CB11574A70
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p.\..........." ..0.................. ........... ...............................\|....`................................._...O.......p...............(8.............8............................................ ............... ..H............text....... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................H.......d...............p...h.............................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... ..f. )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...*...0...........(....}4....("...........s+...o".....}......}......}.......}.......}.......}.......}.......}.......}......(B....

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsSyncSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	814440
Entropy (8bit):	6.475715690608882
Encrypted:	false
SSDEEP:	12288:DkaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1Ok:BJll87GY2q61llaOZBjKt5qqxG
MD5:	3068531529196A5F3C9CB369B8A6A37F
SHA1:	2C2B725964CA47F4D627CF323613538CA1DA94D2
SHA-256:	688533610FACDD062F37FF95B0FD7D75235C76901C543C4F708CFAA1850D6FAC
SHA-512:	7F2D29A46832A9A9634A7F58E2263C9EC74C42CBA60EE12B5BB3654EA9CC5EC8CA28B930BA68F238891CB02CF44F3D7AD600BCA04B5F6389387233601F7276EF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lC. ("rs("rs("rscZqr""rscZwr."rscZvr;"rszWvr8"rszWqr""rszWwrv"rscZtr)"rscZsr?"rs("ss."rs.W{r "rs.W.s)"rs(".s)"rs.Wpr)"rsRich("rs........................PE..d...x6.d.........."......\...........(.........@....................................0.....`.................................................T........`..p.......xW..."..hK...p..........p...............................8............p...............................text....Z.......\.................. ..`.rdata...'...p...(...`..............@..@.data....F.......*..................@....pdata..xW.......X..................@..@_RDATA.......P......................@..@.rsrc...p....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsTime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	132112
Entropy (8bit):	6.108828543862255
Encrypted:	false
SSDEEP:	1536:vWGCIhUiWgomR1xGU5EplJLT7yPxB7a40oTrM8PNEmriC8f6v9RMjuLjGG79lxz:vWGjyLgosGplJLT7AwoTFGmrY6sWGGt
MD5:	DB36BB6B699417232D15D10147C581C7
SHA1:	616422CE3ECCEAFA37170179E6924BF3D2CF6AB8
SHA-256:	B262F3F36246510BB09E517986945AA022589370BDFBC0B54EC917486C25EBAD
SHA-512:	1A4E0E0449D60A3515E00C97E37324957E487E8FCDA69B293EB696A9F6DE37BB819395DEBC5F9B43EA3770EEE428AB6435FAB723FE46C6FBAC45D32C47226C0B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\rsTime.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0.................. ........@.. .......................@............`.....................................K.......D................4... ......`................................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc....... ......................@..B........................H........Z...i...........................................................(@...(6....0............j.0....................j....0..................0..............0............j.0..............0............jB(@...(6...(......."..........".............l................."..................(@...(....:+.(r.S1.(6.....0..............0..............0..........(@...8].......E........G...R...8.... ....(....( ...o....(!........ .....9....&8....(R... ........8....(....

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ru-RU\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	4.95281393774295
Encrypted:	false
SSDEEP:	384:pZ2vdzqaLxW8w5/EtHjl+dbA5eI00QF7jiE3s8E:zaL88/sd0QF7jiE3s8E
MD5:	91AEFE5B351FB44F6254F938F6AF001C
SHA1:	2A5F15233F612065C865F024FD40F0A64E2F088F
SHA-256:	316477F3FB4FC8831721369C0D85211DD732C95DE7D44A4727AE97CD7E5181A6
SHA-512:	CC1472F27C9487FCB3137A9FC004B0B3448B0C1D8AE785BF49BACFE26CD0BA2EC86F8A4255EEF63055F717D702B6337C171701DD19437BFC02B729B403216141
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.................M... ...`....... ....................................@..................................L..S....`............................................................................... ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................L......H.......hI..P...........P ...)...........................................).............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\ru\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.846136752240531
Encrypted:	false
SSDEEP:	192:phbWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZPlAg1O5rxg0XWr:pN1NvbH7O9JKgglrCPChnYVC5A5rxg06
MD5:	DADE13E423762BDAE745D57CA3DC86EF
SHA1:	7B4122CBEF771C5548A7CB5641B6DB6743C8C3F6
SHA-256:	1A1D5FDAC027144BCAA0E8110F4DE717E80944420C59708B3DD8E2BD31BC7ED4
SHA-512:	77F5050BA87E8ABEB92298D16897D6CEC087FFB7B4C38442C854A0993B398DE529C15B5674ADAACFB3E39CE05165F05A38337B2DBD41E8A7D806751542F6E8D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................~=... ...@....... ..............................>"....@.................................,=..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B................`=......H.......88............... ..e...P ......................................w..4.8b^b..W..i8s....oz...t..tlhp...$.8p..c....U(O'....N.w`...<".1.w....?.*.0=z`Lz5..^....O...Q.....v..z...........`;..a..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sk-SK\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.898855209074261
Encrypted:	false
SSDEEP:	192:dIYK1uOKGEXJ7hxwUmX+41C/TUMZc/ZgPPInsYJNM3TPGdTzXpPbf+oBumIJMr2I:d41uOKl7hx9mX+41CLUMZc/ZOPVYJN6U
MD5:	2B2F55CC12B72CCE0F75717719DEFFE0
SHA1:	AB3C57C0341C641E803B5606A5C86B6BE43A53E3
SHA-256:	0B0962F6E1A523CA3BA2CC7C154C7D9D6B1793C899338DE5DFB2C9EC957BF33B
SHA-512:	FE75CD8D2CC87AF60170114002836346C8CAC4504A976B6B0D687E73455CA90842340564DF69A033C420551F82265FC87DC70C04F371FCEDE4801B7E6AA7449E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&..........^E... ...`....... ....................................@..................................E..S....`............................................................................... ............... ..H............text...d%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................@E......H........A..P...........P ..f!..........................................b!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sl-SI\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.769719426822892
Encrypted:	false
SSDEEP:	192:9IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZE:9TAGeXyuMxUY+iZWBei3gW0dFOaEe3CV
MD5:	5C464BD59BEA811B7193A2C0D1B55F3D
SHA1:	F92C109B53CAFEFF4882E9B033EB0E524436AE4C
SHA-256:	AE4C8375EA5A9588557576C3E67B06EF729D3F0C4E149F7A1F4BF6CD03121C25
SHA-512:	3FFD6E78CF363E95B4E98E34C0B4E61988D9BE443EE8145E79D1C01BC2AE02EB0C7C7E3C1385EC47142D8AA7EC9893516B75546577BDBEAF99C0646C202B859F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..P...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sl\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.767283673011951
Encrypted:	false
SSDEEP:	192:6IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZZ:6TAGeXyuMxUY+iZWBei3gW0dFOaEe3Cg
MD5:	A1BC35FF541202B1B8302AF5EEDF0C59
SHA1:	5627F0ABDB65260EDFF636AEF2786748B1D8AF2F
SHA-256:	7325E25AAA94EEBE2CA0AEAA86876F7922AAC2850D25D6A96D38D08EF1454941
SHA-512:	FB77EDB9F39694A6BE20C24360380123524372022016BB28A18580ACD25D3D5CDD3734929D557825AF3CBEC43D3FA95B9EA6AD7B0F1B8D232BD07C88801DE638
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..L...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\sv-SE\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.728082841655538
Encrypted:	false
SSDEEP:	192:jhIYShuTiGMuLj/kyxI0Nc/yGUbwMgWf2iPMXBSSky3WDeFzMShGOBZ7T3GyRKvJ:jhUhuTiGj/HxI0Nc/yGUbwMgWf2YMXQH
MD5:	BAD6B491D9EBA19ECAAEDC0835AC0AD8
SHA1:	3EEBBF39A3D75CACDB2E6D50C6A51AE0437AB077
SHA-256:	F53F2BE16A7880C44E3481E4427C5870BA7605E3F89D8E5A3B1C9612FA862E54
SHA-512:	BBBF536EE8A4193F32FAE546C734CC65425077A5BBE09A21763E371978C8FE750CAB97B0F68288E6BAF6635907D7C432F7FB2FA4A4A0D1E57FBE33314C436284
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\th-TH\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	4.850184119772995
Encrypted:	false
SSDEEP:	384:PWmNyydz3LxBD5uSw84x/d/dfwJGTV/cEJviNhsFx55n5z5OPMuQ5m5rPzzSvooF:L7LHDFGh0EJviNhsFx55n5z5OPMuQ5m4
MD5:	937D53AE05673F6F15903AEA0D92C34D
SHA1:	D4F72F7E1FC1399FF5972CF6D6C5C592091C445E
SHA-256:	46C980F619B5C604A33BA25968C419EACA4DDDD85682E442C41911D523355379
SHA-512:	486CDBC9B4A7E1C36582C27A3A8B9464FE2D90EA29DD3DD81A268E03442CA76365C9EF33A33CCB7E64FF8A33BF15CEB6B10B3DEF37D7A6041B4837A11408B5C8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....8..........~W... ...`....... ....................................@.................................,W..O....`............................................................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................`W......H........S..P...........P ...3...........................................3.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ATY5CJG3\AssemblyInfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	3.2422749900735943
Encrypted:	false
SSDEEP:	3:AJ/5KlRDgYlARnFrLffKl8HbloIlrJKleEkKRlLEljlgbsYJ/5KlRDgYlF/:eKlVtARNfK0bdlrElbkKvEljObsWKlV3
MD5:	E167544155124FCA596A436E8633A332
SHA1:	C4AD9B66219F3FBD2BF245F07A2EE054755A8657
SHA-256:	0D8AC1873366CEFD9EE8C3408E8F5F27A206DD352754B948D19E835295D2A362
SHA-512:	AB66455A437AAEF89BE94FC2000EBF724F710F263BC7518098980E01320B28054EAC6B965DC73BDCD450218244A7EC22E7B168FE03FB15549013020A52760425
Malicious:	false
Reputation:	unknown
Preview:	r.s.S.e.r.v.i.c.e.C.o.n.t.r.o.l.l.e.r.,.1...2...4...0.,.,...f.i.l.e.:./././.C.:./.P.r.o.g.r.a.m. .F.i.l.e.s./.R.e.a.s.o.n.L.a.b.s./.E.P.P./.r.s.S.e.r.v.i.c.e.C.o.n.t.r.o.l.l.e.r...D.L.L...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ATY5CJG3\rsServiceController.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	179072
Entropy (8bit):	6.562871128885791
Encrypted:	false
SSDEEP:	3072:fT9nvidN3G9nZm4feQPMYGQh5AB9vaTiYuzdNd6iB6KA5U:fT9nvDB75Fq91dNd6iB6K
MD5:	8DCD92DE516608670F57193D74824A3B
SHA1:	C67C347DFA47C2DB1628FAB8BF9906C353F33DD9
SHA-256:	96DB49DB4DD12B9F86144FEDF83AC7DC12D855C5D7E3C863FD5B1696966AC345
SHA-512:	E5FDE81AE57E68DF69FC7695B9E16D8C7D188A30A4D68FFB682A3DCFEDF2C028874145815AAD2F957A02B0EAD6AD8F1442635DFA580339816110E7B1CDBC0C0E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ATY5CJG3\rsServiceController.DLL, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.C............!..0..t.............. ........@.. ..............................".....`.....................................K....................~...=..........A................................................ ............... ..H............text....r... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B........................H........q..<...........$................................................(....(.....0.............A...........(...;...:........0..............................0..............0...................,....5.....0...................L..6.:.....0.............AL..................Y.......................^...............~................0...................T..".......0..............0..............0.............A.......C...........c.......B(....(....(5........................

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\K0L2UM4E\AssemblyInfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	3.332273024272948
Encrypted:	false
SSDEEP:	3:edJkHlrnRVRlVTlrLffKl885RApl0dhOEQlpQlyEklxlXVlKKI664dA2dJkHlRT/:eLkFrRVfKtPElsUEQEdkxiK364dA2Lkf
MD5:	B11F9FD4A7D075312202032B580045E6
SHA1:	AC8211174ECFE4C5DA7686E2BC29601DC8F0A5D9
SHA-256:	82E520E156F8016E4CDE6CDAAE31E3F985B37A26E931162773F926FBB51E2D61
SHA-512:	EFA1F11823E11466C908EA3869E1AFCA5EC91A35F1D8798C20CB890318883EE72311C043B5E1E39AA54DA86A0E9A8CD1932191F9F72C9D385375CCC69E129DFF
Malicious:	false
Reputation:	unknown
Preview:	r.s.S.t.u.b.L.i.b.,.5...3...0...0.,.,...f.i.l.e.:./././.C.:./.U.s.e.r.s./.j.o.n.e.s./.A.p.p.D.a.t.a./.L.o.c.a.l./.T.e.m.p./.n.s.g.8.D.3.E...t.m.p./.r.s.S.t.u.b.L.i.b...d.l.l...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\K0L2UM4E\rsStubLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	254504
Entropy (8bit):	6.540092185448124
Encrypted:	false
SSDEEP:	6144:TeGOfaXMwabZNZr4FgTPFw4+5Jb74HthVqbvIsx6vewjLbqzm9iViRJ:qfacHZsFgT15qb5MmwnliwRJ
MD5:	98F73AE19C98B734BDBE9DBA30E31351
SHA1:	9C656EB736D9FD68D3AF64F6074F8BF41C7A727E
SHA-256:	944259D12065D301955931C79A8AE434C3EBCCDCBFAD5E545BAB71765EDC9239
SHA-512:	8AD15EF9897E2FFE83B6D0CAF2FAC09B4EB36D21768D5350B7E003C63CD19F623024CD73AC651D555E1C48019B94FA7746A6C252CC6B78FDFFDAB6CB11574A70
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p.\..........." ..0.................. ........... ...............................\|....`................................._...O.......p...............(8.............8............................................ ............... ..H............text....... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................H.......d...............p...h.............................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... ..f. )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...*...0...........(....}4....("...........s+...o".....}......}......}.......}.......}.......}.......}.......}.......}......(B....

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\KRK4DVBJ\AssemblyInfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	136
Entropy (8bit):	3.2577550388388063
Encrypted:	false
SSDEEP:	3:yxlrizRlVRlVTlrLffKl8HbloIlrJKleEkKRlLEljlgb1DxlRT/:yvitfK0bdlrElbkKvEljObRVL
MD5:	8BB2C27211D87D945C7DEA2A6D0610F0
SHA1:	44556E695F6A9608CEF5F5B36F77A3F14B7BEAE7
SHA-256:	C5D44160BE7B249FC238A042FAC98AF41FA0F87672B2AC25391C7EB5F7DA509D
SHA-512:	A917ADB19778289CDE6791036EB31D8C816BEA728D3559B743AAD9BB467CF212A8F9032176A6F9EAAD01C0D3358C27A989926AB7AE0797FD242024027AC5519F
Malicious:	false
Reputation:	unknown
Preview:	r.s.J.S.O.N.,.3...0...0...0.,.,...f.i.l.e.:./././.C.:./.P.r.o.g.r.a.m. .F.i.l.e.s./.R.e.a.s.o.n.L.a.b.s./.E.P.P./.r.s.J.S.O.N...D.L.L...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\KRK4DVBJ\rsJSON.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224400
Entropy (8bit):	6.7771936576354355
Encrypted:	false
SSDEEP:	6144:R7IEMtFMZZi+Ng9999994f9oMlnhcNx3Bn:BZi/MlevB
MD5:	FA63504382F4F3F92FA86841D9E97F29
SHA1:	0BDE02C98741BB24EAF501BD8E2D9738742CD042
SHA-256:	5F0764E1998464F63C6583F870DD3784921B752B91D8E450FE2C90153CB5E58D
SHA-512:	C8483D9060A6800C8DEDB4D5FEA7CDA346F742CA1A149C3EB608823209AFF1F00BFCC5B0CAF9C482C7B01D75F6E198EDFAE3B0100CB0DCA6E5B5F18336ABDEE5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\KRK4DVBJ\rsJSON.DLL, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..............!..0..(..........nG... ...`....@.. ...............................)....`................................. G..K....`..D............2...:...........F............................................... ............... ..H............text...t'... ...(.................. ..`.rsrc...D....`.....................@..@.reloc...............0..............@..B................PG......H....... ...P...........p\......_F.......................................(....(....:+.(.N.R.(......0.............A...................:........0.............B(....(....(..................................................................................................................................................................0............................0.....................0..............................0.............*....................

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\UDOOGFD5\AssemblyInfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	136
Entropy (8bit):	3.2283432741329237
Encrypted:	false
SSDEEP:	3:2OmwlrLffKl8HbloIlrJKleEkKRlLEljlgb+sMB/:2ZqfK0bdlrElbkKvEljOb+sY
MD5:	211A20EDCFA8EDB6054082B0C02EBF36
SHA1:	82091C0B6FF618A04D6BAA50CCD258997DB28CE3
SHA-256:	03E750521429FC58D552936101FDF8E4B8A5094998057EE09B5388930992AB41
SHA-512:	9C50160456A35EAE2919405206FDC670D5C6E09C6D617A6E148CD870A9ABD284EB62F53D95709F48D4C213F6E5B64F77B8090B2BE4F61452A374D967375DDFEE
Malicious:	false
Reputation:	unknown
Preview:	r.s.A.t.o.m.,.2...1...1...0.,.,...f.i.l.e.:./././.C.:./.P.r.o.g.r.a.m. .F.i.l.e.s./.R.e.a.s.o.n.L.a.b.s./.E.P.P./.r.s.A.t.o.m...D.L.L...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\UDOOGFD5\rsAtom.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	162816
Entropy (8bit):	6.4347197585730385
Encrypted:	false
SSDEEP:	3072:OX5TgLoWlo6zvLblsvv5Emm16e68QNmTNh3l2AuZejZnjjWr:KOom9Av6RvfltqEZ+r
MD5:	044D60780B0C40D3F9B0B5A3FC040948
SHA1:	2E16C926F11ED5FAAE22D9AF5D935748C57EC1F8
SHA-256:	7493F645BB04092AEE30A47A681494251C79A38A941C9A3D2DEE4293A265F428
SHA-512:	7653A0A46E3EB9331E92A09937754302F939100ADBFB283242C25BF0F73F8508D6F7E9D5AA08DBBEFDD14BF682AD7D0D77F4999B3274D329D281E22934C445EA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\UDOOGFD5\rsAtom.DLL, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0..4...........R... ...`....@.. ....................................`..................................Q..K....`..T............>...>...........Q............................................... ............... ..H............text...$2... ...4.................. ..`.rsrc...T....`.......6..............@..@.reloc...............<..............@..B.................R......H........g.................1X...Q.......................................(....(....:+.([.%^.(..................................0..............0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................HP.u.....0.............B(....( ...(......................................................................................................*....0..

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ZMMW8FDC\AssemblyInfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.1465636617234907
Encrypted:	false
SSDEEP:	3:fI/RJXrJlrLffKl8HbloIlrJKleEkKRlLEljlgbzQIl/:fyfK0bdlrElbkKvEljObEu
MD5:	7E4D096961406FA4F61A4D9048EDD003
SHA1:	51C44AC2EAD43EF4E25996C006D29E3AB3B690A0
SHA-256:	8EAC8EEC32115F3DEBB898F99906BF7A4EE5B234D50C3A1CE3A315AF6BFA3A33
SHA-512:	CB90FDD83FA4943B04D3BA165DE1DAEFC56D36DBD8C4B2819F6EAFB0A109D126C6D3315C169CCA2350717138426FA8B546B253BCA0AC1E72FD2F4BF32B640866
Malicious:	false
Reputation:	unknown
Preview:	r.s.L.o.g.g.e.r.,.4...0...2...0.,.,...f.i.l.e.:./././.C.:./.P.r.o.g.r.a.m. .F.i.l.e.s./.R.e.a.s.o.n.L.a.b.s./.E.P.P./.r.s.L.o.g.g.e.r...D.L.L...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ZMMW8FDC\rsLogger.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	182920
Entropy (8bit):	6.549984856278825
Encrypted:	false
SSDEEP:	3072:5Uy/CR6dEfViQ+7gLmiEw/zrQUTkkySNP0dbNIprWrL:Cy/CVQILmil/zrQV2YbNGy
MD5:	E3FA0916F33BEE8A14F28421D2DCDC9F
SHA1:	FD3DCA4DB55E81EBFFC7609C5D63A4FFBD6629B2
SHA-256:	29AAFF11E775C800575B1A5D4160DAEC749DDE528E68BC3B6E9B340279ED991D
SHA-512:	FE96EFD3CF162BBB766634C3D90F707D868378DD04E47AA9D55C03E03130F54827F781639383B053C9335D022CCD6B244B67E586197C2B40D193DD58A4EE8CB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\tmp\ZMMW8FDC\rsLogger.DLL, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...oe.............!..0.................. ........@.. ..............................Y.....`.................................P...K.......P................:........................................................... ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................H........s..d...........t".. ............................................(....(}..."...........0..............0..............0.................................................0..............0.....................0..............................0..............................0..............................0.....................00.......0..............................0.....................00.......0..............................0.............*........00......

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\tr-TR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.887092087123451
Encrypted:	false
SSDEEP:	192:4IY4kciiGg/kISxvnmkYsPV+tIqMvhBhPYTua1j3SfDpu6WbyLWFTXLgNzCii7oJ:4KkciiwISxvnmkYsPV+tIqMvhBZYquLo
MD5:	BFCB9E414F0E29B774E81AF9951BCD02
SHA1:	13F936A2D2329011A11141D2943AD624B80B841A
SHA-256:	C73DB39422806BB509B76DEC7240EAD22EDFCBB41363955B25AB3C3A615BE3D6
SHA-512:	DEACB0BDC82ED27676793C594B07AA3083B63CE74B1C1D8B38261817450B6C380888FB1E5697EC03AE521074D5D3523A9E85F68D180FC273909D6B746C88517D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@.................................PE..K....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........B..P...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\uninstall-epp.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	174592
Entropy (8bit):	3.1176056240139736
Encrypted:	false
SSDEEP:	384:URqHi9xDnRbDPi6ag9rucqkerzUCgIMSfZHqdefc8+YZ9:SqmpD66h9lqkerzgIPfF+efc+
MD5:	AF1C23B1E641E56B3DE26F5F643EB7D9
SHA1:	6C23DEB9B7B0C930533FDBEEA0863173D99CF323
SHA-256:	0D3A05E1B06403F2130A6E827B1982D2AF0495CDD42DEB180CA0CE4F20DB5058
SHA-512:	0C503EC7E83A5BFD59EC8CCC80F6C54412263AFD24835B8B4272A79C440A0C106875B5C3B9A521A937F0615EB4F112D1D6826948AD5FB6FD173C5C51CB7168F4
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ......... .... .........00.... ..%......@@.... .(B...D..HH.... ..T......``.... ............... .(....p........ ..1..Vx..(....... ..... .............................................RRR....n...........e???'..................................................................q...................................................................y....................pppQ...........WWWC........vvvF...........```8............................1116................YYYC...........}.........................................................................................................................................................888,................1116.........................\|Z....b...........5551........NNN3...........sssM.....................................................................................0.................................6....................{{{Mzzz....2...W...................M...6.......................0..............X...&...........#~~

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\uninstall.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	174592
Entropy (8bit):	3.1176056240139736
Encrypted:	false
SSDEEP:	384:URqHi9xDnRbDPi6ag9rucqkerzUCgIMSfZHqdefc8+YZ9:SqmpD66h9lqkerzgIPfF+efc+
MD5:	AF1C23B1E641E56B3DE26F5F643EB7D9
SHA1:	6C23DEB9B7B0C930533FDBEEA0863173D99CF323
SHA-256:	0D3A05E1B06403F2130A6E827B1982D2AF0495CDD42DEB180CA0CE4F20DB5058
SHA-512:	0C503EC7E83A5BFD59EC8CCC80F6C54412263AFD24835B8B4272A79C440A0C106875B5C3B9A521A937F0615EB4F112D1D6826948AD5FB6FD173C5C51CB7168F4
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ......... .... .........00.... ..%......@@.... .(B...D..HH.... ..T......``.... ............... .(....p........ ..1..Vx..(....... ..... .............................................RRR....n...........e???'..................................................................q...................................................................y....................pppQ...........WWWC........vvvF...........```8............................1116................YYYC...........}.........................................................................................................................................................888,................1116.........................\|Z....b...........5551........NNN3...........sssM.....................................................................................0.................................6....................{{{Mzzz....2...W...................M...6.......................0..............X...&...........#~~

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\vi-VN\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.075990223518278
Encrypted:	false
SSDEEP:	384:6p4EAT1bY2bx1CxHdO35YFInizzX83tNeRFYMvF2MV3s8V:XblbzC5jmtNeRN2s3s8V
MD5:	A974C4DA769FBFBC71993A5AD9A45672
SHA1:	8267CA96388DA057CF799765F0F292B3515141D0
SHA-256:	4F5549DBA22CC5B8A453F34A7CB398E058578850D1902CDE7CE6296A07BD9C8C
SHA-512:	E620970607DAA0D8A3D47CC2F34414763E06807EED930FD7CC561CE27D7C47300D5367777036A049F0E30DC818E535C7710264901972CEDED648BD5E6737716D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!...............NI... ...`....... ....................................@..................................H..S....`............................................................................... ............... ..H............text...T)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................0I......H........E..P...........P ..U%..........................................Q%.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.701646036890297
Encrypted:	false
SSDEEP:	192:HWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yCPVDA1L5rxg0XWr:H1NvbcbSEm22mdqet+wh25rxg0XWr
MD5:	3CEFEC17BAAC089C54C8102A4CFD160C
SHA1:	A54CD9BD4181A591937A99BE88BEB006279837DE
SHA-256:	AAFBE48966DBC5372A308AB9501245CE261D2715F336AD1908C799D354C981A2
SHA-512:	2D45193662C7CE2854CE2D3EE53AE199E094D09BC76D8D8A8E36B24EA60400A5F064CA16CE0078FE6CBDF4117C22565C04E47B99CD99868254C915DB6D18700F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ...................................@..................................8..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................%h...P...y.7....ON(..U.~vT]h.e9dfp*1...oDL..1.M..6.Ku...^5....RE.')f.$......{...mcc......E...g.l.Z.q..M..@._D.{...,...S....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-CN\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.079861170865273
Encrypted:	false
SSDEEP:	192:4IYXbXbaQGf0wwrCwYxzJSKqdy6eY5R6Q3Pyt7g0mY3IC1wx+bDqhbXpVuieenTh:4RbXbaQixwYxzJSKqdy6eY5Rt/A7c+hu
MD5:	63C01E27482A86F45C5FC0B71B947B9A
SHA1:	8E574221E887B696FCE2AD6EDEF5A626704C85D1
SHA-256:	58A32C192D409D82590E015DF80D2ACB0FE93BC171B71F5ECA608873E59A0EC4
SHA-512:	F44D7647D01BD7EDB5B3C85792A428E08AD9A7B374E4EEB0E04BE442315BA6966A747430AD7F2C529AA7FCC5367C92E17C375A551C0C22CB93EB27648CABF925
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....$...........B... ...`....... ....................................@.................................DB..W....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........>..P...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.728551774224484
Encrypted:	false
SSDEEP:	192:JWWNv/jzSEhtimYtEq40uI7Sr2fqmxkNeo7R7L7c7xM757odHK9nPol1f5rxg0Xq:J1NvbOtEq40uYSatEdHwWloA9Pk5rxgJ
MD5:	833F269BA6F0C34F49273DA7FBD7DCE7
SHA1:	D0253D322DCDF7F54E37C7E8911A8B77670D2967
SHA-256:	F8C769A357E6CD27452835E5288FE515FB50BFEEC83EF3969975171174B467E5
SHA-512:	4FA315E23D985AFFB46F6536CDF2DDC1B882F47098EE2D5A4B954DDEEB8904D1C83182B1598E4948A59728339945307B699A147ECD813C0F91986D95BDC57184
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ....................................@..................................8..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................gh....R.xns+....2..b]...c........W\|..C.....\*.~w.?.....%...M.}..K?.`.Y.0%U..........I.:f...p.EB.....]O]..4Sy'.D4N..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\zh-TW\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.069203865429364
Encrypted:	false
SSDEEP:	192:YIY26Y9TGjEWVWxzJS9gSKiLHQhcScP/yggS2w3tWGPO4JRy0ty6WGbdIY9MAFXH:Yw6Y9TEVWxzJS9gSKiLwhcSSqgwmMGx/
MD5:	0F745522B433B128D871F64E5157370C
SHA1:	50C7EC58E9C7B9CB4A806A7DC282B59269D31C24
SHA-256:	3EEF10F7ED70B4CBE19EDC46555F8C9CEC54D7099AF12C1EA40F753F17BEC4B8
SHA-512:	3CD8D722B27096FCA0B914B49208FFAFA8F90044A6E5ADA915BC9F68E46F7B584F381568A23812B15B8B0AE5F1270A5C7FC4B8065EDF65AC3C32575B9247B1C9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....$..........~B... ...`....... ....................................@.................................$B..W....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B................`B......H........>..P...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsiA9AF.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe

Download File

Process:	C:\Program Files\ReasonLabs\EPP\Uninstall.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1952048
Entropy (8bit):	7.807173257576082
Encrypted:	false
SSDEEP:	49152:oTl+Ffl0KCV8rEKbhHJikCz/NqoNcugBhnem0XA:oTl+xLRHAVLVNcpipQ
MD5:	6C0F8BF824E17C2F0DDFF150D8DC7488
SHA1:	BA9C27DA2BABACD1B9EC63F3C27EFAB3DDD1673E
SHA-256:	7A3BB8C2326FF535C6582FA627AA384B0D1E89DA1D7722B4230BE7080126E04E
SHA-512:	B3B593F34E2FD43DEA8C587AFD3D527E21011BB02DBD085908CDB92C1A134E26A16FADBE8B25DE498AEAFCFF894322F9C90EB729CA6E3D5AD8CD793631B86BF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".......5............@.................................>.....@.............................................(............i..x_...........................................................................................text...ve.......f.................. ..`.rdata..X............j..............@..@.data...8............~..............@....ndata...p...............................rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsrA818.tmp\System.dll

Download File

Process:	C:\Program Files\ReasonLabs\EPP\Uninstall.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ArchiveUtilityx64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	153872
Entropy (8bit):	6.328830993497698
Encrypted:	false
SSDEEP:	3072:RAZpz3eQkXBlJ6pM91zgrn4oul5ntwc0sOct7Bml+:RAvzD6l0+1grn4vtX
MD5:	EC2D7737E78D7ED7099530F726AC86F9
SHA1:	8F9230C9126DE8F06D1CDDAA2E73C4750F35B3D9
SHA-256:	DD034654CFFD78AABC09822A9A858ECF93645DCC121A4143672226B9171C1394
SHA-512:	E209784FC2338D33834101AC78E89CBA6C1DA144E74330FD0FF2A2372E70316C46C2189B38B34B18B157C9221A44760D20BCE8549573FBEDA248D4CEB03E8365
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.1.q._.q._.q._.:.\.t._.:.Z..._.:.[.{._.#.Z.n._.#.[..._.#.\.x._.:.^.r._.q.^.,._...[.a._...V.s._..._.p._.....p._...].p._.Richq._.........................PE..d...i.Ef.........." .....T..........0................................................I....`......................................... ...T...t...(............P.......$...5......P.......p...............................8............p..`............................text...`R.......T.................. ..`.rdata..p....p.......X..............@..@.data...P<..........................@....pdata.......P......................@..@_RDATA.......p......................@..@.rsrc...............................@..@.reloc..P...........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\Microsoft.Win32.TaskScheduler.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	349024
Entropy (8bit):	6.20955325822065
Encrypted:	false
SSDEEP:	3072:51sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5DfV:51sSmRIt/xhtsOju1DH5NXnIKAco
MD5:	192D235D98D88BAB41EED2A90A2E1942
SHA1:	2C92C1C607BA0CA5AD4B2636EA0DEB276DCC2266
SHA-256:	C9E3F36781204ED13C0ADAD839146878B190FEB07DF41F57693B99CA0A3924E3
SHA-512:	D469B0862AF8C92F16E8E96C6454398800F22AAC37951252F942F044E2EFBFD799A375F13278167B48F6F792D6A3034AFEACE4A94E0B522F45EA5D6FF286A270
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ....................................`.................................0-..O....@..................`;...`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{......{....V.(......}......}.......0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....... ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(......{......{......{....r.(......}......}......}......0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	550984
Entropy (8bit):	6.672465900343423
Encrypted:	false
SSDEEP:	12288:nZLZVgIQtZM1A0+Nwhq3drt0ZAPKYZzrOZW4zlK:nZV661A0ue8lCZAPHZzrOZW4zl
MD5:	31CB221ABD09084BF10C8D6ACF976A21
SHA1:	1214AC59242841B65EAA5FD78C6BED0C2A909A9B
SHA-256:	1BBBA4DBA3EB631909BA4B222D903293F70F7D6E1F2C9F52AE0CFCA4E168BD0B
SHA-512:	502B3ACF5306A83CB6C6A917E194FFDCE8D3C8985C4488569E59BCE02F9562B71E454DA53FD4605946D35C344AA4E67667C500EBCD6D1A166F16EDBC482BA671
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'............"...0..l.............. ........@.. ..............................b.....`.....................................O.......H............&..HB...`..........8............................................ ............... ..H............text....j... ...l.................. ..`.rsrc...H............n..............@..@.reloc.......`.......$..............@..B........................H.......d<...a..........@................................................0................(....s....%r...po....s.........~....o....%{...........s....(....t....}....~....o....%{...........s....(....t....}....~....o....%{...........s....(....t5...}....~....o....%{ ..........s....(....t....} ...~....o....%{!..........s"...(....t....}!.......~....o#.....E............'...9...........o...........8....~....o$...s ....~....o$...s.....+h~....o$...s.....+V~....o$...s.....~....o%...~...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\System.Data.SQLite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	370744
Entropy (8bit):	6.110296146366327
Encrypted:	false
SSDEEP:	6144:eruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cm9:tNWx6xz+nRo2GGWHQZMaLyJSJFNFaFeE
MD5:	110DE32AF906E9EED32332B785F90BD4
SHA1:	37CA7AF131A5DB1E06CB36DB2943C7A4E6F0D8E9
SHA-256:	598ADB6F4A7362FEDF047CE7282F39C0C7DA264CEA10C0C39870932EE1CEB647
SHA-512:	555A006B4B5236D6E6B76C6A8C79A8B0C3E350DE42A0A38C792BFE65B3E7F99A232261A1BF8B357618168FDE7E7C2E3281F38E05D20451FCBABCA15FE35A02C5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.].........." ..0..b..........j.... ........... ...............................;....`.....................................O.......$............l..8<...........~............................................... ............... ..H............text....a... ...b.................. ..`.rsrc...$............d..............@..@.reloc...............j..............@..B................L.......H...............................`~......................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(......~;...(<...,r.....s....}.......}............{............%......(=....%...:....%...!....%...%.........%....%.........s....(....z.{....,......(=...o>...s?...z..0..'........{....-..(......o........(A.....}.....*..................0..T........{....,K.{....o@....+...(A......(B.....,..o;.....(C...-...........oD.....{..

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\System.ValueTuple.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75800
Entropy (8bit):	6.0263750749193274
Encrypted:	false
SSDEEP:	1536:r784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAA7yxpD:r7NV8v36tI0XCKAAQD
MD5:	7AF831F20C4A0C5A78A496AFB62F28BB
SHA1:	4380A7C2ABE739B49F568AF70D8DAB8371B10687
SHA-256:	01DCA2D3EFEDD9F4269427E949E8A3BE64686D8ED84EA863389EF2449B6DC8E3
SHA-512:	11713885D4A11B49088EA220963AE6FE6519EB6B0499D3CE85AAD1EB95ACEE4B5F357AD9EF07D8E20721596B510B8D43138BE9AA6C4DE24DD78D5FEFB88D0CAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ..P................2...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\cs-CZ\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.880723781358086
Encrypted:	false
SSDEEP:	192:ZIY1pQ8vGO4xToxMi5eX2zUA8rYgLIgPrEyz23tMuuVWJkYUECd1Vl7Iru+M3YVe:Z3pQ8vQToxMi5emzUA8rYgLIOrnz8uuw
MD5:	3691CD9A157D027569A203DCDDFB3336
SHA1:	9D9D158B6683CD0CD570A235333303137C890A25
SHA-256:	917DD83D6CB87ADF9ECC3F0F17E5266C6C1E435CE966B45760E7C0244A0FD4A0
SHA-512:	8F41C6C052C4440CDC6C45A21E42F102B7677462E2D78A2F78261DAE80FA7DCFEC8BCF14A5BB9BFD101477B983411435E56A92DA304E7DA47FFF6A933FA3CA9B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&..........>E... ...`....... ....................................@..................................D..O....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..P...........P ..J!..........................................F!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\da-DK\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7480840345925746
Encrypted:	false
SSDEEP:	192:FIYRN3EsGGj3fvKEx8rUrb+M0lIVixNPqDGomU3WUeQoXjAUwMXrAfeMA7AWmBHP:FXN3EsVfvVx8rUrb+M0lIVixNqiomyJD
MD5:	98B6DF5F4E0F1D34A0BD3DD49F92D82B
SHA1:	B69000A0998055612EA5940D4B1D5F2CE07AE427
SHA-256:	3E7D3946C5EFEB9F7A27AE43DE75F1A1D0AF34CCBB69F857217BE97BD28C0761
SHA-512:	833B5E0FC14E247E788D59A7D21EDC7F6DB1FF0D9378A77FB13F25CCFBEA820623B2B5F9823AE409D7EAA3B5526AA61BB367BF83BEE2A33263457FD3049D3FB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................D..O....`............................................................................... ............... ..H............text...4%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........A..P...........P ..<!..........................................8!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\de-DE\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.758334824355771
Encrypted:	false
SSDEEP:	384:45rayxOPAxMtzTxCmf6hC/s2TvOFk6AOPh3+yFdmyndw3s8i:NPAKtnHOdvPhO2dmyndw3s8i
MD5:	00B5369BCD510787679CFAAFB478217F
SHA1:	26A44A1B05FE4314D8CF1D810B759B6A5BC74385
SHA-256:	3B8B89C4241F5E8F0FD101BA84B13B37F40D37F3FF2739CB6C6332B56BEF88CE
SHA-512:	2F6E14A3B06ECB053C261E62058CA99F2E365A88182C02DB4F60231BEA2525A31260A6980187798D8B1685F87E9A307EB928F279F67A6CB139AD6481D421FFD0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....(...........F... ...`....... ....................................@..................................F..W....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H.......4C..P...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\de\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.557060180794725
Encrypted:	false
SSDEEP:	192:0MiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufP/1S5rxg0XWr:0D1Nvb5adVl8P2djJMZJSGu3A5rxg0Xq
MD5:	F83D720B236576C7D1F9F55D3BB988F9
SHA1:	105A4993E92646B5DBB50518187ABE07CA473276
SHA-256:	6909A1C134D0285FBA2422A40EA0E65C1F0CA3C3EF2B94A1166015AF2A87780F
SHA-512:	FD8A464F2BC9D5B6C2EFA80348C3A9362F7473D4D632B2ADDAD8C272E8874E7E67C15B99B67E6515906B86D01D57CD42F9F0F1E9251C0AF93A9391CCC30E3202
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................-E....@..................................9..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........4............... ......P .......................................z..).........*SE.1r.2K58\p.`1....SJ..G.f0d.W.oQY....&1+E..z..:@.n@........S.XEp=C... T.q.l....S.Kg....%..l..._...0..'.+................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\el-GR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	4.985483869790037
Encrypted:	false
SSDEEP:	384:inpUcW/WJsxvxwKW9iu6Wxtp701zA27r+PMvozTi3s8o:QJs5xEGzfOPMvM+3s8o
MD5:	9B86D1ED1D99DDB84B5FB7CF176B3F8F
SHA1:	2E1C164816EE2DE6AC4E3BC6A61214D72516632A
SHA-256:	71093535EC2E97398B13385A7BA9E7AAC046F190FE06BD68E057C8EA0DA1AFDC
SHA-512:	134985A9A7AE78593A760D362C57F430AEB1920E6E7517684DA78573702796E381D99A8DF191A9DFA3BAC9AD1EB6CCD71E7DB40ED4DC9DE76ECFEBD075F98355
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....2...........P... ...`....... ....................................@..................................P..S....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......HM..P...........P ...,...........................................,.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\es-ES\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.714281072425133
Encrypted:	false
SSDEEP:	192:+IYVmGe/VGuDqni6wxCjfp3DocEs5dMvGPcDonP33TewxlhiYwEHU4dIyrokBD7r:+uGe/V0ni6wxCjfpzocEs5dMvkcDqPDR
MD5:	86FF4304190B9ACDCBC4034A8EB910F6
SHA1:	B5D597F31963B35DDE1B024523B5AFDCA9AA454B
SHA-256:	6F5F0BA42A1C4EF8A7CD4B504E959173FA3AC8782200E48548681F7209C1927F
SHA-512:	AEE1A0F3A426A77BA0B9D4EDF8E9EAB2D1B6D9BC2B5379D716F9850021A1816B09F37DEBBEB5E3395B3214AE3F4CC93612AE289344548CEA00F3C8EFF6FE509B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......dA..P...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\es\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.425694157692337
Encrypted:	false
SSDEEP:	192:r0WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAP9115rxg0XWr:r01NvbGVxx6hUltfxgE00cLF5rxg0XWr
MD5:	15DB634B70D6D9D6CD41BAAE3F02EB14
SHA1:	1456FFE09DF896271A746F9CB40A230F188AD397
SHA-256:	E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
SHA-512:	1230E5368D4DAB9776D57056993669327E95FE72E262EFA541ED5D43ABC1BCD3618DB13B6BD6B3A27DA053C103E3FB647EAE759CCAEB443F7D9FFD1ECAA1122B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................n:... ...@....... ..............................pi....@................................. :..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................P:......H.......,5............... ..\...P .......................................2M.. ,.,]...).].....@.l..~.u.....Oz.B.{~*;.......6\..s..$_BZS.b..x.S....-..g.......Jr...{...E..F...s..sa.p.eS....X..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\fi-FI\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.723886741305548
Encrypted:	false
SSDEEP:	192:kxIYXkNcDGwgTsxJoRxAM2+9Ul/laxRe+PE8v+GA3kr29zrJzfPWCiqxskBbHUiJ:kxRkNcDtxJMxAM2+9Ul/laxRe8ZGGWgI
MD5:	94BF9DE34C0870791640AB7067F0D24A
SHA1:	B21458166F08902EBFE2A4F68CAF3945ED5364A8
SHA-256:	37CBEC3559E5536DA35D87D72EF8EA37D98D70265C921A0ACADF75695A14331C
SHA-512:	A0E09D4E9F15589043AB2D071F5004AD00F8FE58E85491F32C0D76C8F5CB8EEF95B069A2D532638CB812C05A15BF50A442D8649884E78ABE826E32DCDBD27E7A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\fil-PH\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.402460029334098
Encrypted:	false
SSDEEP:	192:60Zne9hwoGBjeCipxwU6LOl+DDUbqN4PPjjDr8d30LfmJyXOhZCa2m5sml+T9lmc:60Y9hwoEipxwU6LOl+DDUbqN4Xjz8V4F
MD5:	DA6B3FE38876D703F7D39B163DDD8BFC
SHA1:	F60B54DE800A5DBB535BABD2667C9FBD9C37766E
SHA-256:	93D2A195E47C1C1E11A2B6960B47C7B4B043CD5CE6A0723AF06CAC91E292F50E
SHA-512:	8A261C61D441E6EBA09BCCDEB8E2C94CD540AA9F07631B477431C717F3F111E4B10819EC8524531584561A6C9FA3C785ED082429D6BB97587EBB074BF357515C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!..... ...........>... ...@....... ....................................@..................................=..O....@.......................`....................................................... ............... ..H............text...$.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......x:..T...........P ..'...........................................#..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....Q.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..]....b..`............)...s..%'..JA*......>.$.\.&...'

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\fr-FR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.838168365990566
Encrypted:	false
SSDEEP:	384:gY0al1sBIxgyFzjXZfu14MpXrOUDlK8yXahGY7uXn3s8D:eBImyDM5DtyXwGY7uXn3s8D
MD5:	9EA4BCD8D3C7599A5A8BA78FF9B11C3C
SHA1:	2C859731430A4FA3D82C4CD5088167CF31536969
SHA-256:	C576EA42CEFE28228C341488140C7FCF24DD063FAB2B82D563794772F82B97BA
SHA-512:	61AD6B22DADFA30BA4FAD527BC564414981EBB6F5EB0C7D224ECF1BBA093D071DD3544E08ACB90C4D95505887457C65B44447B6ABB0E2F97E482477CC9E4DD51
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....(...........G... ...`....... ....................................@.................................HG..S....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..P...........P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\fr\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.588569516197988
Encrypted:	false
SSDEEP:	192:YWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VP81g5rxg0XWr:Y1NvbdKJiDjgmlRi0HYZDMp5rxg0XWr
MD5:	3B4621370ADDCF4306669C9E7E45C865
SHA1:	EA1AB3C499E946E152C1FC4A63FA99E1F9BE94B4
SHA-256:	E3EE50E08124A7603BE7D996DCF596EB0D3F9C603768E86E003F7B942D7097F3
SHA-512:	586755F32D16AFD937BFC1FE3C52210AB815D5D4C904DE101150FA052A94BABFCBDC465669FF8C2537B782474658D7912037DDB76D8C9A8FD34715D1FE7B2857
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................^;... ...@....... ..............................1.....@..................................;..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................@;......H........6............... ..?...P .......................................ME....P.<......I.J...Q'D........................X7..'<F..q..o.6G..M-.$.v..i.>...z..'....OV?....+.9..V........I"..9........;..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\hi-IN\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	4.803116867134068
Encrypted:	false
SSDEEP:	384:RME5h/2kXJsxw5w2UW4ctvHU+Th60iu2F6mKVZnCyJT2ox8mn9THjI5gE2ac763E:1XJsO57hOt9AZnttxKq43s8Q
MD5:	DF8CF1F932DD7EAE2CC87719B76FB8BA
SHA1:	425089FE01D9C1643CA7A060C55123D20507677A
SHA-256:	5F099F8F37757B98C5C51FB4DF66914E5F155394A349ADAF00211382CF8CF739
SHA-512:	D07EA9CE1DC8B09EAD0B1ED3E48CC71083D750BE0119F1C8587B3E13DC3598E7B6B06F365AF4B809BEA41280190090409B44079BCEA472CDD3D864456E762C2F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....:...........X... ...`....... ....................................@.................................XX..S....`............................................................................... ............... ..H............text....8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B.................X......H........U..P...........P ...4...........................................4.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\hr-HR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741373437056816
Encrypted:	false
SSDEEP:	192:eIYVdDpBwGpkiVlZPxZlrPy2o92kGetEQyPIlUVKC3JDsS7qSmKV/4jNni67gXWu:e1DpBwSkoZPxZlrPY92kGetEQII2oANX
MD5:	5F2E0A3D771F9E03D216D81B522C5E2F
SHA1:	C49814ACF4A82130F17DF52074DF16DFFFC216F5
SHA-256:	8F102C7A9F03EDFDBE5D4DF6873418E510F44D8B72D5D47752083832445E1D81
SHA-512:	711D5AF717C65B35D758E9F25BD426CE5084C847DC24194030B08CE9C22A40DFE3E5FD8100061663EB9F39B3DF19A8DBC3F23794F79DEA96D81A8BE7397C7306
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@.................................hD..S....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\hu-HU\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.799981772302711
Encrypted:	false
SSDEEP:	384:qdpTgTI4gNxtBqu+p5DXv00jiOKQosgcekILk0pltfN3s8Z:64gNrBnOVlgcekILfpltV3s8Z
MD5:	FFCDA4B7ADA1943FE544DC922FA8D827
SHA1:	3A332F235E0AFB51D40D3D8890F79803842944A4
SHA-256:	841F86E4911D4593E5EEC47DD28AA1787188D0100A3703ABF23735B2BBF53854
SHA-512:	E406100AC71F7A0414DFF5C3F4A13EDA4193F3801B6C4EE150B0D410DA9A1373C4E1F3B3741C625DAF80C3254DD1B162DF87C2B3286303DB5A584C4950954208
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....(...........E... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................E......H.......`B..P...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\id-ID\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.681398214710318
Encrypted:	false
SSDEEP:	192:rqIYIZcKqG4ny8ZxSWuwCoBWidWjZdPAhDHPBg37eXCIKKXgXruQm8X0tF8HgGC7:rqOZcKqG8ZxSWuwCoBWidWjZ9AhLJ2Sx
MD5:	AD401434A4B7FB07085090031EE973D6
SHA1:	D32A3E0EEF3030392710A4BF5D1DF1614B41BE53
SHA-256:	BE8FFDC0C6EF5811888F8ECF282937DFBDE51996122B3A5CBE601713DFACE368
SHA-512:	DB44A2A0E0848BBCB9059F4A4E006EDA504717895F2E4CDB9519A3D3ED9D6CC91EC37B94F816BFA9EC888EE9D25251660E2256281B739EF1D7DA109B177AF55C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@.................................xD..S....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......(A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\it-IT\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7677799255744775
Encrypted:	false
SSDEEP:	192:nIYr9kupX/Gdq8SQxZdNYobyRXvujVf9UgPw/ev3nww3OajMRD1TLIjB5leULIp4:n3kupX/GSQxZdNYBRXvujVf9UOwGvwwX
MD5:	3601A9397A28672E9A038398590D50A5
SHA1:	13FD281302DF60AA4EC59CC82E13B6BA4423842C
SHA-256:	EB9F211091EFB9DF6167642FBAD48C6C4A0F9CE252283D63C6DE2378C8008C8A
SHA-512:	099868493D34AF70DD2BAAF8F44BB83DA18F9A2A95006CE1F8AE1F9A6A1B1C7DDFE091BB283273A6ABAFC00004A2005A720CDDDB57993BE49FCD2D17FC3F2F23
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......4B..P...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\it\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.368637490829895
Encrypted:	false
SSDEEP:	192:vOiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mPD1q5rxg0XWr:v11NvbGTNgr1nJI3+07MM5rxg0XWr
MD5:	1C331DA4BCE2809E16913C02E385576E
SHA1:	CF8E71E030347749596A53D1B13B9E9583EC0527
SHA-256:	1D0493E38D8B3FCC7EFA4916FEA1EEA69EE6449BF435E1869C1BC3F54D4090C5
SHA-512:	2871119690F3DF0F244384A3F5F65FFE7CF17F1F00F6B530512AEDEB8397C9E357079E8FBA76D2A5BF6BE4E2B18E4AC1AC104EA2D29F8F40CEF6F30A905ECF83
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................GR....@..................................9..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................9......H........4............... ......P ........................................M..+..u.3...i.7.[H\G.4D..dy.*p..L.m..4.....d..dZ...m..f../.@..GXQ.. ...$..."a......-....4..pS.5`@...;.`....Q..mHBx3..w3,!................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ja-JP\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.091016496791667
Encrypted:	false
SSDEEP:	384:bxwAHD6CkxQdCnvRl/oRHx8asale681v/z3s8V:qCkSdK0t81vb3s8V
MD5:	D95F7D238CD97260458ACB3D389246EA
SHA1:	864A3DD1E45B00CC571F2568B08E7566DDCCC475
SHA-256:	0C051B970ACF895BE6FDE7919A7AF780E3219AE19D1818C3E5B4FCDA476D00F5
SHA-512:	FC4A66FA2FE8B74C42852D5B41EC813221DD593FD2DE9EB5B6705D81841947264F53095A06DEB6E1B4DD914E90772EFE849FA9D6F584DD86C502F7123FD79A67
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....,...........J... ...`....... ....................................@..................................I..S....`............................................................................... ............... ..H............text....... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................I......H.......hF..P...........P ...&...........................................&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ko-KR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.202077256063847
Encrypted:	false
SSDEEP:	384:MFWuuyUdKvx4W9SxBmJsEMGFW/uuH2LlLTDUCl9w5JHJ8/uDO3s8r:vdKv+WqV2ZLToU9wXi/uq3s8r
MD5:	A482D56B4F3E8D89919B2BED266D1D0D
SHA1:	660491A4A6CDDACFE38749C18476C6759063FA61
SHA-256:	DFBB9EA022BFF44DDCF3848DE95405F4ABE51EA2D047AFF831FF30DADBD7EE8B
SHA-512:	AFCBC13E805B2E4EC015717D148DA83E09349CAF58AB89099163B8B1989C3B484B6610695F2DB15B3B27AD7207DA970E553B8C40F7CACE84E612695A2C3D2DB5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....(...........G... ...`....... ....................................@..................................F..K....`............................................................................... ............... ..H............text...4'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..P...........P ..=#..........................................9#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\nb-NO\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.693986975113909
Encrypted:	false
SSDEEP:	192:NIYfsK6eGOy+v3qxh7EFBYn1p4hVYTPMPhT9CEGF3aN3MfCExO4MV09J7wcLaaEN:NZsK6epv3qxh7EFBYn1p4hVYTqhTAEGE
MD5:	72DF7D8DAC9CD362BC2BF463369EF420
SHA1:	9D4F4C26617046001F7750D69E7075FA01C7CCE0
SHA-256:	7D5F7D76F7CB7AB750DD0D20219880D4AF7416181F74C3E4B10275885BD27899
SHA-512:	46D26CA9D850A0C66778EF3983EC346AC0BCD08E3CFE4549FDF99B23E501DC5ABF5227F9390743371BD72D5C5D077B673989DD9CDA8D9AD789C67347F605D5FE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@.................................PD..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\nl-NL\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.736378665228804
Encrypted:	false
SSDEEP:	192:DtIYBN1XfOGCvouQTxklOVw/lzyOl/dEf80gPCdmP347U9DC47aqFD37E/avkeZe:hTN1X2HQTxklOVylzyOl/dEf80OCQPAj
MD5:	760790AC69DD2294D548C64A7E7123B0
SHA1:	7530BD2237B86FF04BC1D25E1C3D7AF7090C4626
SHA-256:	7573B73E12D9094BBA18EE9FAAF0BFFA52B9EFEF9F97484F0875C6EA8C9CA735
SHA-512:	58C8E2186F1582F11FC74F0448D3BF78DB5DA321EBBA661E41C4BA82B7996DA22B69EEC0377C8F9D9FBAF3DFA8891F2982B47B564053B62CBEA890D5DE5282EA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&..........^E... ...`....... ....................................@..................................E..O....`............................................................................... ............... ..H............text...d%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................@E......H........A..P...........P ..i!..........................................e!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pl-PL\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.801397650400403
Encrypted:	false
SSDEEP:	192:JIYfp3DcrGr6SHAOzLxE6oMuN50rtbxn/XidPWd3SJC30Gh58xSoHR+hxWfbrVsd:JZp3Dcr2NAcLxE6oMy50rtbxn/Xi9WdR
MD5:	B9315BEFC451F0C68C18D4D9F3C7D4F2
SHA1:	D7FC5673F2B7CEDA352011206D6398C48B6DED99
SHA-256:	B0A689816159819881761B753B36A882642EF418D932A93432D422DF0B9CF70E
SHA-512:	1725A7887E850BAA0F570F9DE5B5E40C345960DC0C02980B1E5839C46EF242BB9280C38811B33418C2E71D1EF3BD8594DAC471475E4735A624CE74BC1325DBDB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@.................................lD..O....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pl\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.594776627495051
Encrypted:	false
SSDEEP:	192:haWWNv/jzSEYtq2dE1cxy8ON0Qsk96sPb1V5rxg0XWr:g1NvbaG1cxy8ONHskdD5rxg0XWr
MD5:	B60817A69E314B22F746917C826DA53E
SHA1:	7D2785A6D1A53A0717C986B959AF67DE6F9300E4
SHA-256:	6E58D86C42B61226DD7AF35D7C9432CE6F0982D1D0D5A2F4120E8ABC5C787A02
SHA-512:	9A8F029329CE105B3F72FEE623E3AB8C88E1AF45F86FAB61F81BE418B2D70F83E4C0466010D312240A01E1EF8F9B9926EBF43E25BDC3C364C2D28AB9B0E5F6FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................;... ...@....... ............................../c....@..................................:..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H........5............... ......P .......................................T`.K.%...N.f..u.........Z..1....#CTR.v....:aq.i#:Z.oAkQ:D...q.6...l....J.W.Pn.J......d........3.F..[.c....#....$.F..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pt-BR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7157450468905004
Encrypted:	false
SSDEEP:	192:9IY1nlNKGnxGxIDx+sQ0Y4EQujHOVhPgdfBF3UTVV/Lea/FVgYISK+uZqiF4Afkb:9rnlNK/xIDx+sQ0Y4EQujHOVZgdBtofR
MD5:	BBFC0973B9D3DAC1E716EBA99B37FA18
SHA1:	05811A4846E10E54ED6DA34150CDFD807EA4B95C
SHA-256:	DEAA84302C66EB0242A7C80AB97DA3C5CADDBB5B3D595DF310674C0CB7E88DFE
SHA-512:	980137220EAD6AE8EEA33EDC0FA8C85E5E23CC7D42DC7E4DDAFD181D7EF9CF4D29C25F7256F1957F73D282EC969C4D95E526F4D1B67C4A96D4FA68540DC43041
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..P...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pt-PT\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.729428739919532
Encrypted:	false
SSDEEP:	192:CIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4L:CrnlNKNu7xKgUOVBQ6Bo19sPTLM80aoe
MD5:	66FC2EA3F0EA6B897B117482B43DDB4E
SHA1:	E7BD70FEEAE4858F808132C4332F25F13E962689
SHA-256:	3A77957D0F8AE5952BA465382D97DCABF2134B1DC815E26C32F7C612FC94FD5D
SHA-512:	98BD2D15AA0958D52C7F0AC40343A4AD542EAC569C5107196AE21A6A9386BB93AD9A8D570DCD0849E8BF0D7BDA0839B79C06180584E272DAA349A64CA9A5151D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text...4%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........A..P...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\pt\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.723728419745786
Encrypted:	false
SSDEEP:	192:uIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4s:urnlNKNu7xKgUOVBQ6Bo19sPTLM80aoZ
MD5:	3B1DC81511B84F2393C6BA37CBD32FE5
SHA1:	0F87A801905E8CCB99EA7EEAC590308F381C74BA
SHA-256:	02AEE48153086F86580854ECF7E375D7E0C81DFAC7C222AD32EFD850852D36FD
SHA-512:	0B0ACC2CFD2CF95E61BEB3A1E06BE01F0E3C43839650FBE136DE54DF581172BCBA9B11DA57A7B18A6C284BEA74561DF6B30CFE129CEAE9BFF45EB6FA6D2E478E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text...$%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........A..L...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ro-RO\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.786330752122619
Encrypted:	false
SSDEEP:	192:4xIY4puUhG9oHusJxWgAm/45t6lSertHPHrgCs324VfosqPXMdEqljSNPEinIOBU:aapuUhg7sJxWgAm/45t6lSertvHrDapn
MD5:	1FE5185420BF332AE4CA5492A6B2A6CC
SHA1:	0058458B2FCF52E7C478AC13202873DE7A722465
SHA-256:	9C09CDB4FBC5A8F6576B8914148F3660A2E950C2B3A056014EDE45C0F38ADF34
SHA-512:	955B615599F5571AAE8EB71A4E4272E02CB4D67D68B8971053FFFE4374258B8DF58A3C04482B8EAFF67DF6A403544147A406999C6132E9B3896206808E580D4B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&..........>E... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..P...........P ..O!..........................................K!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsAtom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160016
Entropy (8bit):	6.404692888748325
Encrypted:	false
SSDEEP:	3072:d6lrh8aWSI9uVDeMWoWVy5zmndQ1dTZjxO3S/9FVkmiGUV+:d6lrhISL9e1oWE56ndQ19aY9Fjs
MD5:	16D9A46099809AC76EF74A007CF5E720
SHA1:	E4870BF8CEF67A09103385B03072F41145BAF458
SHA-256:	58FEC0C60D25F836D17E346B07D14038617AE55A5A13ADFCA13E2937065958F6
SHA-512:	10247771C77057FA82C1C2DC4D6DFB0F2AB7680CD006DBFA0F9FB93986D2BB37A7F981676CEA35ACA5068C183C16334F482555F22C9D5A5223D032D5C84B04F2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsAtom.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..2...........P... ...`....@.. ....................................`.................................pP..K....`..T............<...5..........0P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc...T....`.......4..............@..@.reloc...............:..............@..B.................P......H........i..(...........0....U...O.......................................(....(.................................0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................MU.z.....0.............B(....(....(...................................................................................................0..............0.............Ad..........

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsDatabase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	170328
Entropy (8bit):	6.475304499658319
Encrypted:	false
SSDEEP:	3072:FR761d9cCg9+zhOzcx9R0KvvvvnPPH6Gi5tPArrYeiYiPKiF15fJ2K/Krrii555V:+1TcpihOk0KvvvvnPPH6Gi5tPArrYeiA
MD5:	C4447F00C8AE467DBA6D3CE3E7E5AE70
SHA1:	9F085025B00112C976B6525BAAE7C3233BA2C423
SHA-256:	71FEFBEB2B693BA44CB45250880B873A818007093E003455DC4358471C28B440
SHA-512:	8B551C90679F8C7D108D2C9715EBB9DF960DFCDDCBB19C52361BACC2D6A4259A57E004767EFCF603574A2E4F5E38E7E064CC4041609F5F7B696B621C18324D40
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsDatabase.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!..0..Z...........x... ........@.. ..............................<.....`..................................w..K.......\............d..X5...........w............................................... ............... ..H............text...$X... ...Z.................. ..`.rsrc...\............\..............@..@.reloc...............b..............@..B.................x......H.......\|l..`...............4k...w.......................................(....(....:+.(Nf%^.(......0.....................0..............0...................-....;.....0.....................VV.Q!....0.........................!....0.............AL......Z.......q...................j.......................................................................................................0.............A4.................Y...............s...........!....0..........

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsJSON.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223016
Entropy (8bit):	6.788381525293459
Encrypted:	false
SSDEEP:	3072:CBuq5tonhw9PY+fAKul0ZJXY9ooyJtTsbbiRl7m76m/GS+KKeA4dtrSspDMK:nqDOhw9PY+4Zl0ZFY9ooyUbc3Kc4dt/p
MD5:	AFD0AA2D81DB53A742083B0295AE6C63
SHA1:	840809A937851E5199F28A6E2D433BCA08F18A4F
SHA-256:	1B55A9DD09B1CD51A6B1D971D1551233FA2D932BDEA793D0743616A4F3EDB257
SHA-512:	405E0CBCFFF6203EA1224A81FB40BBEFA65DB59A08BAA1B4F3F771240C33416C906A87566A996707AE32E75512ABE470AEC25820682F0BCF58CCC087A14699EC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsJSON.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r.............!..0..&...........D... ...`....@.. ..............................=.....`..................................D..K....`..D............0..(7..........cD............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...D....`.......(..............@..@.reloc..............................@..B.................D......H........\|...............W..O....C.......................................(....(....:+.(..4g.(......0.............A...................:........0.............B(....(....(.........................................................................................................................................................................0..............0.....................0.....................0..............................0.............*....

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsLogger.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	181184
Entropy (8bit):	6.53416223904584
Encrypted:	false
SSDEEP:	3072:f0AqxqD7b0Qv6wIMCP1Yr+Xle9WQJTrz96JiBRqMadYMBpCA5LH3d3f:sRkD/0Q7IMCP3ePOUBRqKep5j1
MD5:	4ECE9FA3258B1227842C32F8B82299C0
SHA1:	4FDD1A397497E1BFF6306F68105C9CECB8041599
SHA-256:	61E85B501CF8C0F725C5B03C323320E6EE187E84F166D8F9DEAF93B2EA6CA0EF
SHA-512:	A923BCE293F8AF2F2A34E789D6A2F1419DC4B3D760B46DF49561948AA917BB244EDA6DA933290CD36B22121AAD126A23D70DE99BB663D4C4055280646EC6C9DD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsLogger.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ky.............!..0.................. ........@.. ..............................&w....`.................................P...K.......P................5........................................................... ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................H.......ds..............."...}...........................................(....(....:+.(...W.(\|...."...........0..............0..............0.................................................0..............0.....................0..............................0..............................0..............................0.....................00.......0..............................0.....................00.......0..............................0.............

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsStubLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	254504
Entropy (8bit):	6.540092185448124
Encrypted:	false
SSDEEP:	6144:TeGOfaXMwabZNZr4FgTPFw4+5Jb74HthVqbvIsx6vewjLbqzm9iViRJ:qfacHZsFgT15qb5MmwnliwRJ
MD5:	98F73AE19C98B734BDBE9DBA30E31351
SHA1:	9C656EB736D9FD68D3AF64F6074F8BF41C7A727E
SHA-256:	944259D12065D301955931C79A8AE434C3EBCCDCBFAD5E545BAB71765EDC9239
SHA-512:	8AD15EF9897E2FFE83B6D0CAF2FAC09B4EB36D21768D5350B7E003C63CD19F623024CD73AC651D555E1C48019B94FA7746A6C252CC6B78FDFFDAB6CB11574A70
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p.\..........." ..0.................. ........... ...............................\|....`................................._...O.......p...............(8.............8............................................ ............... ..H............text....... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................H.......d...............p...h.............................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... ..f. )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...*...0...........(....}4....("...........s+...o".....}......}......}.......}.......}.......}.......}.......}.......}......(B....

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsSyncSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	814440
Entropy (8bit):	6.475715690608882
Encrypted:	false
SSDEEP:	12288:DkaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1Ok:BJll87GY2q61llaOZBjKt5qqxG
MD5:	3068531529196A5F3C9CB369B8A6A37F
SHA1:	2C2B725964CA47F4D627CF323613538CA1DA94D2
SHA-256:	688533610FACDD062F37FF95B0FD7D75235C76901C543C4F708CFAA1850D6FAC
SHA-512:	7F2D29A46832A9A9634A7F58E2263C9EC74C42CBA60EE12B5BB3654EA9CC5EC8CA28B930BA68F238891CB02CF44F3D7AD600BCA04B5F6389387233601F7276EF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lC. ("rs("rs("rscZqr""rscZwr."rscZvr;"rszWvr8"rszWqr""rszWwrv"rscZtr)"rscZsr?"rs("ss."rs.W{r "rs.W.s)"rs(".s)"rs.Wpr)"rsRich("rs........................PE..d...x6.d.........."......\...........(.........@....................................0.....`.................................................T........`..p.......xW..."..hK...p..........p...............................8............p...............................text....Z.......\.................. ..`.rdata...'...p...(...`..............@..@.data....F.......*..................@....pdata..xW.......X..................@..@_RDATA.......P......................@..@.rsrc...p....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsTime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	132112
Entropy (8bit):	6.108828543862255
Encrypted:	false
SSDEEP:	1536:vWGCIhUiWgomR1xGU5EplJLT7yPxB7a40oTrM8PNEmriC8f6v9RMjuLjGG79lxz:vWGjyLgosGplJLT7AwoTFGmrY6sWGGt
MD5:	DB36BB6B699417232D15D10147C581C7
SHA1:	616422CE3ECCEAFA37170179E6924BF3D2CF6AB8
SHA-256:	B262F3F36246510BB09E517986945AA022589370BDFBC0B54EC917486C25EBAD
SHA-512:	1A4E0E0449D60A3515E00C97E37324957E487E8FCDA69B293EB696A9F6DE37BB819395DEBC5F9B43EA3770EEE428AB6435FAB723FE46C6FBAC45D32C47226C0B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\rsTime.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0.................. ........@.. .......................@............`.....................................K.......D................4... ......`................................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc....... ......................@..B........................H........Z...i...........................................................(@...(6....0............j.0....................j....0..................0..............0............j.0..............0............jB(@...(6...(......."..........".............l................."..................(@...(....:+.(r.S1.(6.....0..............0..............0..........(@...8].......E........G...R...8.... ....(....( ...o....(!........ .....9....&8....(R... ........8....(....

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ru-RU\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	4.95281393774295
Encrypted:	false
SSDEEP:	384:pZ2vdzqaLxW8w5/EtHjl+dbA5eI00QF7jiE3s8E:zaL88/sd0QF7jiE3s8E
MD5:	91AEFE5B351FB44F6254F938F6AF001C
SHA1:	2A5F15233F612065C865F024FD40F0A64E2F088F
SHA-256:	316477F3FB4FC8831721369C0D85211DD732C95DE7D44A4727AE97CD7E5181A6
SHA-512:	CC1472F27C9487FCB3137A9FC004B0B3448B0C1D8AE785BF49BACFE26CD0BA2EC86F8A4255EEF63055F717D702B6337C171701DD19437BFC02B729B403216141
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.................M... ...`....... ....................................@..................................L..S....`............................................................................... ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................L......H.......hI..P...........P ...)...........................................).............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\ru\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.846136752240531
Encrypted:	false
SSDEEP:	192:phbWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZPlAg1O5rxg0XWr:pN1NvbH7O9JKgglrCPChnYVC5A5rxg06
MD5:	DADE13E423762BDAE745D57CA3DC86EF
SHA1:	7B4122CBEF771C5548A7CB5641B6DB6743C8C3F6
SHA-256:	1A1D5FDAC027144BCAA0E8110F4DE717E80944420C59708B3DD8E2BD31BC7ED4
SHA-512:	77F5050BA87E8ABEB92298D16897D6CEC087FFB7B4C38442C854A0993B398DE529C15B5674ADAACFB3E39CE05165F05A38337B2DBD41E8A7D806751542F6E8D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................~=... ...@....... ..............................>"....@.................................,=..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B................`=......H.......88............... ..e...P ......................................w..4.8b^b..W..i8s....oz...t..tlhp...$.8p..c....U(O'....N.w`...<".1.w....?.*.0=z`Lz5..^....O...Q.....v..z...........`;..a..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\sk-SK\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.898855209074261
Encrypted:	false
SSDEEP:	192:dIYK1uOKGEXJ7hxwUmX+41C/TUMZc/ZgPPInsYJNM3TPGdTzXpPbf+oBumIJMr2I:d41uOKl7hx9mX+41CLUMZc/ZOPVYJN6U
MD5:	2B2F55CC12B72CCE0F75717719DEFFE0
SHA1:	AB3C57C0341C641E803B5606A5C86B6BE43A53E3
SHA-256:	0B0962F6E1A523CA3BA2CC7C154C7D9D6B1793C899338DE5DFB2C9EC957BF33B
SHA-512:	FE75CD8D2CC87AF60170114002836346C8CAC4504A976B6B0D687E73455CA90842340564DF69A033C420551F82265FC87DC70C04F371FCEDE4801B7E6AA7449E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&..........^E... ...`....... ....................................@..................................E..S....`............................................................................... ............... ..H............text...d%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................@E......H........A..P...........P ..f!..........................................b!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\sl-SI\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.769719426822892
Encrypted:	false
SSDEEP:	192:9IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZE:9TAGeXyuMxUY+iZWBei3gW0dFOaEe3CV
MD5:	5C464BD59BEA811B7193A2C0D1B55F3D
SHA1:	F92C109B53CAFEFF4882E9B033EB0E524436AE4C
SHA-256:	AE4C8375EA5A9588557576C3E67B06EF729D3F0C4E149F7A1F4BF6CD03121C25
SHA-512:	3FFD6E78CF363E95B4E98E34C0B4E61988D9BE443EE8145E79D1C01BC2AE02EB0C7C7E3C1385EC47142D8AA7EC9893516B75546577BDBEAF99C0646C202B859F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..P...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\sl\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.767283673011951
Encrypted:	false
SSDEEP:	192:6IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZZ:6TAGeXyuMxUY+iZWBei3gW0dFOaEe3Cg
MD5:	A1BC35FF541202B1B8302AF5EEDF0C59
SHA1:	5627F0ABDB65260EDFF636AEF2786748B1D8AF2F
SHA-256:	7325E25AAA94EEBE2CA0AEAA86876F7922AAC2850D25D6A96D38D08EF1454941
SHA-512:	FB77EDB9F39694A6BE20C24360380123524372022016BB28A18580ACD25D3D5CDD3734929D557825AF3CBEC43D3FA95B9EA6AD7B0F1B8D232BD07C88801DE638
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..L...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\sv-SE\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.728082841655538
Encrypted:	false
SSDEEP:	192:jhIYShuTiGMuLj/kyxI0Nc/yGUbwMgWf2iPMXBSSky3WDeFzMShGOBZ7T3GyRKvJ:jhUhuTiGj/HxI0Nc/yGUbwMgWf2YMXQH
MD5:	BAD6B491D9EBA19ECAAEDC0835AC0AD8
SHA1:	3EEBBF39A3D75CACDB2E6D50C6A51AE0437AB077
SHA-256:	F53F2BE16A7880C44E3481E4427C5870BA7605E3F89D8E5A3B1C9612FA862E54
SHA-512:	BBBF536EE8A4193F32FAE546C734CC65425077A5BBE09A21763E371978C8FE750CAB97B0F68288E6BAF6635907D7C432F7FB2FA4A4A0D1E57FBE33314C436284
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..P...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\th-TH\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	4.850184119772995
Encrypted:	false
SSDEEP:	384:PWmNyydz3LxBD5uSw84x/d/dfwJGTV/cEJviNhsFx55n5z5OPMuQ5m5rPzzSvooF:L7LHDFGh0EJviNhsFx55n5z5OPMuQ5m4
MD5:	937D53AE05673F6F15903AEA0D92C34D
SHA1:	D4F72F7E1FC1399FF5972CF6D6C5C592091C445E
SHA-256:	46C980F619B5C604A33BA25968C419EACA4DDDD85682E442C41911D523355379
SHA-512:	486CDBC9B4A7E1C36582C27A3A8B9464FE2D90EA29DD3DD81A268E03442CA76365C9EF33A33CCB7E64FF8A33BF15CEB6B10B3DEF37D7A6041B4837A11408B5C8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....8..........~W... ...`....... ....................................@.................................,W..O....`............................................................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................`W......H........S..P...........P ...3...........................................3.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\tr-TR\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.887092087123451
Encrypted:	false
SSDEEP:	192:4IY4kciiGg/kISxvnmkYsPV+tIqMvhBhPYTua1j3SfDpu6WbyLWFTXLgNzCii7oJ:4KkciiwISxvnmkYsPV+tIqMvhBZYquLo
MD5:	BFCB9E414F0E29B774E81AF9951BCD02
SHA1:	13F936A2D2329011A11141D2943AD624B80B841A
SHA-256:	C73DB39422806BB509B76DEC7240EAD22EDFCBB41363955B25AB3C3A615BE3D6
SHA-512:	DEACB0BDC82ED27676793C594B07AA3083B63CE74B1C1D8B38261817450B6C380888FB1E5697EC03AE521074D5D3523A9E85F68D180FC273909D6B746C88517D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....&...........E... ...`....... ....................................@.................................PE..K....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........B..P...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\uninstall-epp.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	174592
Entropy (8bit):	3.1176056240139736
Encrypted:	false
SSDEEP:	384:URqHi9xDnRbDPi6ag9rucqkerzUCgIMSfZHqdefc8+YZ9:SqmpD66h9lqkerzgIPfF+efc+
MD5:	AF1C23B1E641E56B3DE26F5F643EB7D9
SHA1:	6C23DEB9B7B0C930533FDBEEA0863173D99CF323
SHA-256:	0D3A05E1B06403F2130A6E827B1982D2AF0495CDD42DEB180CA0CE4F20DB5058
SHA-512:	0C503EC7E83A5BFD59EC8CCC80F6C54412263AFD24835B8B4272A79C440A0C106875B5C3B9A521A937F0615EB4F112D1D6826948AD5FB6FD173C5C51CB7168F4
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ......... .... .........00.... ..%......@@.... .(B...D..HH.... ..T......``.... ............... .(....p........ ..1..Vx..(....... ..... .............................................RRR....n...........e???'..................................................................q...................................................................y....................pppQ...........WWWC........vvvF...........```8............................1116................YYYC...........}.........................................................................................................................................................888,................1116.........................\|Z....b...........5551........NNN3...........sssM.....................................................................................0.................................6....................{{{Mzzz....2...W...................M...6.......................0..............X...&...........#~~

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\uninstall.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	174592
Entropy (8bit):	3.1176056240139736
Encrypted:	false
SSDEEP:	384:URqHi9xDnRbDPi6ag9rucqkerzUCgIMSfZHqdefc8+YZ9:SqmpD66h9lqkerzgIPfF+efc+
MD5:	AF1C23B1E641E56B3DE26F5F643EB7D9
SHA1:	6C23DEB9B7B0C930533FDBEEA0863173D99CF323
SHA-256:	0D3A05E1B06403F2130A6E827B1982D2AF0495CDD42DEB180CA0CE4F20DB5058
SHA-512:	0C503EC7E83A5BFD59EC8CCC80F6C54412263AFD24835B8B4272A79C440A0C106875B5C3B9A521A937F0615EB4F112D1D6826948AD5FB6FD173C5C51CB7168F4
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ......... .... .........00.... ..%......@@.... .(B...D..HH.... ..T......``.... ............... .(....p........ ..1..Vx..(....... ..... .............................................RRR....n...........e???'..................................................................q...................................................................y....................pppQ...........WWWC........vvvF...........```8............................1116................YYYC...........}.........................................................................................................................................................888,................1116.........................\|Z....b...........5551........NNN3...........sssM.....................................................................................0.................................6....................{{{Mzzz....2...W...................M...6.......................0..............X...&...........#~~

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\vi-VN\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.075990223518278
Encrypted:	false
SSDEEP:	384:6p4EAT1bY2bx1CxHdO35YFInizzX83tNeRFYMvF2MV3s8V:XblbzC5jmtNeRN2s3s8V
MD5:	A974C4DA769FBFBC71993A5AD9A45672
SHA1:	8267CA96388DA057CF799765F0F292B3515141D0
SHA-256:	4F5549DBA22CC5B8A453F34A7CB398E058578850D1902CDE7CE6296A07BD9C8C
SHA-512:	E620970607DAA0D8A3D47CC2F34414763E06807EED930FD7CC561CE27D7C47300D5367777036A049F0E30DC818E535C7710264901972CEDED648BD5E6737716D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!...............NI... ...`....... ....................................@..................................H..S....`............................................................................... ............... ..H............text...T)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................0I......H........E..P...........P ..U%..........................................Q%.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.701646036890297
Encrypted:	false
SSDEEP:	192:HWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yCPVDA1L5rxg0XWr:H1NvbcbSEm22mdqet+wh25rxg0XWr
MD5:	3CEFEC17BAAC089C54C8102A4CFD160C
SHA1:	A54CD9BD4181A591937A99BE88BEB006279837DE
SHA-256:	AAFBE48966DBC5372A308AB9501245CE261D2715F336AD1908C799D354C981A2
SHA-512:	2D45193662C7CE2854CE2D3EE53AE199E094D09BC76D8D8A8E36B24EA60400A5F064CA16CE0078FE6CBDF4117C22565C04E47B99CD99868254C915DB6D18700F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ...................................@..................................8..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................%h...P...y.7....ON(..U.~vT]h.e9dfp*1...oDL..1.M..6.Ku...^5....RE.')f.$......{...mcc......E...g.l.Z.q..M..@._D.{...,...S....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\zh-CN\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.079861170865273
Encrypted:	false
SSDEEP:	192:4IYXbXbaQGf0wwrCwYxzJSKqdy6eY5R6Q3Pyt7g0mY3IC1wx+bDqhbXpVuieenTh:4RbXbaQixwYxzJSKqdy6eY5Rt/A7c+hu
MD5:	63C01E27482A86F45C5FC0B71B947B9A
SHA1:	8E574221E887B696FCE2AD6EDEF5A626704C85D1
SHA-256:	58A32C192D409D82590E015DF80D2ACB0FE93BC171B71F5ECA608873E59A0EC4
SHA-512:	F44D7647D01BD7EDB5B3C85792A428E08AD9A7B374E4EEB0E04BE442315BA6966A747430AD7F2C529AA7FCC5367C92E17C375A551C0C22CB93EB27648CABF925
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....$...........B... ...`....... ....................................@.................................DB..W....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........>..P...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.728551774224484
Encrypted:	false
SSDEEP:	192:JWWNv/jzSEhtimYtEq40uI7Sr2fqmxkNeo7R7L7c7xM757odHK9nPol1f5rxg0Xq:J1NvbOtEq40uYSatEdHwWloA9Pk5rxgJ
MD5:	833F269BA6F0C34F49273DA7FBD7DCE7
SHA1:	D0253D322DCDF7F54E37C7E8911A8B77670D2967
SHA-256:	F8C769A357E6CD27452835E5288FE515FB50BFEEC83EF3969975171174B467E5
SHA-512:	4FA315E23D985AFFB46F6536CDF2DDC1B882F47098EE2D5A4B954DDEEB8904D1C83182B1598E4948A59728339945307B699A147ECD813C0F91986D95BDC57184
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ....................................@..................................8..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................gh....R.xns+....2..b]...c........W\|..C.....\*.~w.?.....%...M.}..K?.`.Y.0%U..........I.:f...p.EB.....]O]..4Sy'.D4N..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\zh-TW\RavStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.069203865429364
Encrypted:	false
SSDEEP:	192:YIY26Y9TGjEWVWxzJS9gSKiLHQhcScP/yggS2w3tWGPO4JRy0ty6WGbdIY9MAFXH:Yw6Y9TEVWxzJS9gSKiLwhcSSqgwmMGx/
MD5:	0F745522B433B128D871F64E5157370C
SHA1:	50C7EC58E9C7B9CB4A806A7DC282B59269D31C24
SHA-256:	3EEF10F7ED70B4CBE19EDC46555F8C9CEC54D7099AF12C1EA40F753F17BEC4B8
SHA-512:	3CD8D722B27096FCA0B914B49208FFAFA8F90044A6E5ADA915BC9F68E46F7B584F381568A23812B15B8B0AE5F1270A5C7FC4B8065EDF65AC3C32575B9247B1C9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ef...........!.....$..........~B... ...`....... ....................................@.................................$B..W....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B................`B......H........>..P...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Windows\System32\drivers\rsCamFilter020502.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48944
Entropy (8bit):	6.755780295147749
Encrypted:	false
SSDEEP:	768:68vbBtr3uL645Mx5wm9sKN6DRtoQpH3e6n9yEM1didV1VaXLkj3XV13hwOOPO9z4:Hp3uORwOO3/c1dGP0+xnOiz4
MD5:	633861D85B60EB7DE2E820F4FAC586E0
SHA1:	E5666AECD7B9D97627C4A0FC06D52AEA59D7C37D
SHA-256:	8EEBBE6A69D030FF7944524E22126218B6AE8CDB349C97FEEDB83CD0686BBB38
SHA-512:	8F26D38ABEF1CA2B365A2B1CC6B2A49C55319C59D790C32EC8D5728596FDDCF9252230C200ABAE4609884CBA3449B3EA778785244330F98C8C21CADF8C921AE1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........'F..tF..tF..tF..tG..t...uC..tF..t...t...uA..t...uN..t...u@..t..*tG..t...uG..tRichF..t................PE..d....<\|d.........."....".L.....................@.....................................`....`A................................................t...<.......h....`..`....l..0S......$....D..8...........................`C..@............@..H............................text............0.................. ..h.rdata.......@.......4..............@..H.data...@....P.......B..............@....pdata..`....`.......D..............@..HPAGE....a....p.......H.............. ..`INIT.................V.............. ..b.rsrc...h............d..............@..B.reloc..$............j..............@..B........................................................................................................................................................................................

C:\Windows\System32\drivers\rsElam.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.115904530529
Encrypted:	false
SSDEEP:	192:L22mPMNY+DHa3eLzeCvUkjWHhELVWQ4aWSWDqF9e+X01k9z3AzsJO4gdHfQhW:L4M1u3LCskJpWe99R9zusZwfQhW
MD5:	8129C96D6EBDAEBBE771EE034555BF8F
SHA1:	9B41FB541A273086D3EEF0BA4149F88022EFBAFF
SHA-256:	8BCC210669BC5931A3A69FC63ED288CB74013A92C84CA0ABA89E3F4E56E3AE51
SHA-512:	CCD92987DA4BDA7A0F6386308611AFB7951395158FC6D10A0596B0A0DB4A61DF202120460E2383D2D2F34CBB4D4E33E4F2E091A717D2FC1859ED7F58DB3B7A18
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q...q...q...e...r...e...t...q...y...e...p...e...r......p......p......p...Richq...........................PE..d...n.Ub.........."............................@....................................4S.....A.................................................P..<....`..x....@.......(...%...p..$....$..T............................%............... ..P............................text............................... ..h.rdata....... ......................@..H.data........0......................@....pdata.......@......................@..HINIT....^....P...................... ..b.rsrc...x....`......................@..B.reloc..$....p.......&..............@..B........................................................................................................................................................................................................................

C:\Windows\System32\drivers\rsKernelEngine.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49456
Entropy (8bit):	6.631066056716293
Encrypted:	false
SSDEEP:	768://Vqt92EbtYnekejiYF5blvhBVu8suwIppriCAVUValkjvJt3Hy5Z:EmeLT0CpprAqs6tXqZ
MD5:	F77B9B6CCCA206535EB9672266A462B1
SHA1:	479345A89FB7362CAE53A3040F4EFCEE55B92BF7
SHA-256:	BC4EBE3656BE0F502B65A2CA247FFA1B3065EC6FE2E76D3AF21511A0616F855C
SHA-512:	9C80E9C83A58C9E2C63F22C17E4FD4DF227F04960AA2212C66A1308512FE02E71CB7300455965109A7E3931ABD38EBD15162FE3CB46C3328F28D1AE175B4EFE3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2.P.Sg..Sg..Sg..Sf..Sg..5f..Sg..5c..Sg..5d..Sg.C:c..Sg.C:...Sg..S...Sg.C:e..Sg.Rich.Sg.................PE..d...".\`.........."......H...&................@....................................A......A................................................4...<....... ....P.......r..0O......D....5..8........................... 6...............0...............................text...D........................... ..h.rdata.......0......."..............@..H.data...$....@.......2..............@....pdata.......P.......4..............@..HPAGE....N....`.......8.............. ..`INIT....6............R.............. ..b.rsrc... ............b..............@..B.reloc..D............p..............@..B........................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.463169769423515
Encrypted:	false
SSDEEP:	6144:9IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:uXD94+WlLZMM6YFHg+n
MD5:	5FF0A23F6225838EA390B0C5FA4753EE
SHA1:	C45AA5F700A6C66B097E983BE4D2BA860FCC229B
SHA-256:	04B45DDB7FA5DCDF1A2A7B3B5A7BD8A21EBFAB4105D840892561550F9136E7BD
SHA-512:	2D116B7DFA244CAC6EF37C4D175EFA7E783FBCE9DC50508561D2439CF3B5EF8FCB4D4952CD9A9F96471B382009F9ED1EAF521639990917D802C4F69DD8DCA22C
Malicious:	false
Reputation:	unknown
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmz.................................................................................................................................................................................................................................................................................................................................................Jf.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.462428190880134
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	wechat-3.9.7-installer_ae-GFz1.exe
File size:	1'771'256 bytes
MD5:	c9db32520878a90f367b284f5f765ab7
SHA1:	e59b03e0dfe13054a30eb68a04b0cd7cc0456e1a
SHA256:	5dc9eafb99e68c0ef77d151ea645736d19393fffc3e01d9dbb073584893b99a4
SHA512:	c63a3db5fd776eb0998f865de2cae7ad199b4b248746c58a228cb499632084eadd73f66ab501ff0f011b1a2c1b18634ddda856c2af3dddc2c0e11832991abcb3
SSDEEP:	24576:z7FUDowAyrTVE3U5F/X5bOyUQ60UXG9kqtSRQoRQZlEVeMXwdcVqOODxGk:zBuZrEU0PuU2eaZlINXNWck
TLSH:	7085CF3FF268A53EC46A1B3205B38210997BBA61B81A8C1F07FC754DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	05/12/2023 00:00:00 04/12/2024 23:59:59
Subject Chain	CN=Softonic International SA, O=Softonic International SA, L=Barcelona, S=Barcelona, C=ES
Version:	3
Thumbprint MD5:	645062A19EBA838A05F35F9E658A2634
Thumbprint SHA-1:	0826DC0AF20D41B35F929BFD15B8628FFC67BA53
Thumbprint SHA-256:	F01B15B21A7C4E3443E961A9743A2400F6F3BA2374040FA2C968A1382B820378
Serial:	0FB1B101957A7B7B6042138BD4CCF2A3

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F2E0878C715h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F2E0882F207h
call 00007F2E0882ED5Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F2E087A21B4h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F2E08787307h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F2E087A3337h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F2E0882F28Fh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F2E088354AAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F2E087A3C2Ch
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1adeb8	0x2840
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	366d8de3ab89ffba40b5dbfe3b31d799	False	0.18636546415441177	data	3.698855471720625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.2776203966005666
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	22:42:07
Start date:	01/06/2024
Path:	C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe"
Imagebase:	0x400000
File size:	1'771'256 bytes
MD5 hash:	C9DB32520878A90F367B284F5F765AB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:42:08
Start date:	01/06/2024
Path:	C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-BFDMQ.tmp\wechat-3.9.7-installer_ae-GFz1.tmp" /SL5="$1040C,837551,832512,C:\Users\user\Desktop\wechat-3.9.7-installer_ae-GFz1.exe"
Imagebase:	0x400000
File size:	3'209'792 bytes
MD5 hash:	053B158842578C53DB20AD6835B8658B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:42:34
Start date:	01/06/2024
Path:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240601224314&is_silent=true&oc=ZB_RAV_Cross_Solo_Soft&p=fa70&a=100&b=&se=true" -i
Imagebase:	0x22cf9880000
File size:	45'608 bytes
MD5 hash:	DDFFAA966C03DC4BEF4DCB947DCC474B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:42:37
Start date:	01/06/2024
Path:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Imagebase:	0x7b0000
File size:	1'184'128 bytes
MD5 hash:	143255618462A577DE27286A272584E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:42:38
Start date:	01/06/2024
Path:	C:\Users\user\AppData\Local\Temp\cldwur4x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent
Imagebase:	0x400000
File size:	1'952'048 bytes
MD5 hash:	6C0F8BF824E17C2F0DDFF150D8DC7488
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000003.1946551631.0000000002756000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000003.1945288399.000000000275F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000003.1944662901.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000003.1945929444.0000000002759000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000003.1947943093.000000000275C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:42:42
Start date:	01/06/2024
Path:	C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\nsg8D3E.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\cldwur4x.exe" /silent
Imagebase:	0x220fc4d0000
File size:	550'984 bytes
MD5 hash:	31CB221ABD09084BF10C8D6ACF976A21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000008.00000002.2807618602.00000220FE912000.00000002.00000001.01000000.00000038.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000008.00000002.2541457093.00000220952CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000008.00000002.2813307929.00000220FEB02000.00000002.00000001.01000000.00000039.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000008.00000002.2506176810.000002208072E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000008.00000002.2506176810.000002208040B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000008.00000002.2814717721.00000220FEB42000.00000002.00000001.01000000.0000003A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:42:43
Start date:	01/06/2024
Path:	C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
Imagebase:	0x7ff639690000
File size:	814'440 bytes
MD5 hash:	3068531529196A5F3C9CB369B8A6A37F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:42:43
Start date:	01/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:42:43
Start date:	01/06/2024
Path:	C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
Imagebase:	0x7ff639690000
File size:	814'440 bytes
MD5 hash:	3068531529196A5F3C9CB369B8A6A37F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	22:42:45
Start date:	01/06/2024
Path:	C:\Program Files\ReasonLabs\EPP\Uninstall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\ReasonLabs\EPP\Uninstall.exe" /auto-repair=RavStub
Imagebase:	0x400000
File size:	1'952'048 bytes
MD5 hash:	6C0F8BF824E17C2F0DDFF150D8DC7488
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:42:45
Start date:	01/06/2024
Path:	C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe" /auto-repair=RavStub
Imagebase:	0x400000
File size:	1'952'048 bytes
MD5 hash:	6C0F8BF824E17C2F0DDFF150D8DC7488
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000003.2031530548.0000000002749000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000003.2032710312.0000000002744000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000003.2030874846.000000000274A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000003.2035288824.0000000002746000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000003.2033491650.000000000274A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:42:46
Start date:	01/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	22:42:46
Start date:	01/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6540 -ip 6540
Imagebase:	0xb90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:42:46
Start date:	01/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064
Imagebase:	0xb90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:42:52
Start date:	01/06/2024
Path:	C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\nsxAA0D.tmp\RAVEndPointProtection-installer.exe" "C:\Users\user\AppData\Local\Temp\nsmA848.tmp\Uninstall.exe" /auto-repair=RavStub
Imagebase:	0x1dca9e90000
File size:	550'984 bytes
MD5 hash:	31CB221ABD09084BF10C8D6ACF976A21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	22:42:58
Start date:	01/06/2024
Path:	C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Imagebase:	0x7ff72bec0000
File size:	29'321'856 bytes
MD5 hash:	58B8915D4281DB10762AF30EAF315C9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:43:00
Start date:	01/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6540 -ip 6540
Imagebase:	0xb90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:43:01
Start date:	01/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1064
Imagebase:	0xb90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:43:03
Start date:	01/06/2024
Path:	C:\Program Files\McAfee\Temp3475153614\installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\McAfee\Temp3475153614\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Imagebase:	0x7ff7f5990000
File size:	2'990'000 bytes
MD5 hash:	B2B02A72E98408C9E0EBD5036BD7A092
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:43:15
Start date:	01/06/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Imagebase:	0x7ff63ffb0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:43:15
Start date:	01/06/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Imagebase:	0x220000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:43:16
Start date:	01/06/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
Imagebase:	0x7ff63ffb0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:43:19
Start date:	01/06/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf
Imagebase:	0x7ff7c6cf0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:43:19
Start date:	01/06/2024
Path:	C:\Windows\System32\runonce.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\runonce.exe" -r
Imagebase:	0x7ff69e440000
File size:	61'952 bytes
MD5 hash:	9ADEF025B168447C1E8514D919CB5DC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:43:20
Start date:	01/06/2024
Path:	C:\Windows\System32\grpconv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\grpconv.exe" -o
Imagebase:	0x7ff7fbcb0000
File size:	52'736 bytes
MD5 hash:	8531882ACC33CB4BDC11B305A01581CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Windows\System32\wevtutil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml
Imagebase:	0x7ff7f0e10000
File size:	278'016 bytes
MD5 hash:	1AAE26BD68B911D0420626A27070EB8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Windows\System32\fltMC.exe
Wow64 process (32bit):	false
Commandline:	"fltmc.exe" load rsKernelEngine
Imagebase:	0x7ff665e70000
File size:	31'232 bytes
MD5 hash:	6AB08CADCE7DF971A043DCD1257D7374
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Windows\System32\wevtutil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml
Imagebase:	0x7ff7f0e10000
File size:	278'016 bytes
MD5 hash:	1AAE26BD68B911D0420626A27070EB8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Program Files\ReasonLabs\EPP\rsWSC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i
Imagebase:	0x13169fe0000
File size:	208'416 bytes
MD5 hash:	D8021F3B7E9C952B7EC33B929183E8EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000023.00000000.2377819043.0000013169FE2000.00000002.00000001.01000000.00000023.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsWSC.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Imagebase:	0x7ff63ffb0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:43:22
Start date:	01/06/2024
Path:	C:\Program Files\McAfee\WebAdvisor\servicehost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
Imagebase:	0x7ff7127c0000
File size:	879'456 bytes
MD5 hash:	AF384AA87E3D70F7A687C5C60DA2FB7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	22:43:23
Start date:	01/06/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Imagebase:	0x220000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	22:43:24
Start date:	01/06/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
Imagebase:	0x7ff63ffb0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	22:43:25
Start date:	01/06/2024
Path:	C:\Program Files\ReasonLabs\EPP\rsWSC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"
Imagebase:	0x25a56f30000
File size:	208'416 bytes
MD5 hash:	D8021F3B7E9C952B7EC33B929183E8EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	22:43:25
Start date:	01/06/2024
Path:	C:\Program Files\McAfee\WebAdvisor\uihost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
Imagebase:	0x7ff765660000
File size:	858'176 bytes
MD5 hash:	D1BEFCFE26C5C2132BDABBF332306004
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	22:43:26
Start date:	01/06/2024
Path:	C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i
Imagebase:	0x7ff6d89a0000
File size:	673'280 bytes
MD5 hash:	9170244A34CB903FC5DFBE4159DB6F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	22:43:26
Start date:	01/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	22:43:26
Start date:	01/06/2024
Path:	C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"
Imagebase:	0x7ff6d89a0000
File size:	673'280 bytes
MD5 hash:	9170244A34CB903FC5DFBE4159DB6F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	22:43:26
Start date:	01/06/2024
Path:	C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i
Imagebase:	0x2bc3f700000
File size:	364'688 bytes
MD5 hash:	D8053B9FDBDBB3E32CF583AACB29D1EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002D.00000002.2437605904.000002BC41312000.00000002.00000001.01000000.00000034.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002D.00000002.2437311674.000002BC412D2000.00000002.00000001.01000000.00000033.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002D.00000000.2419994897.000002BC3F702000.00000002.00000001.01000000.00000030.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002D.00000002.2437962183.000002BC413EF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002D.00000002.2445270867.000002BC5A9D2000.00000002.00000001.01000000.00000035.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 00007FFD9B880C6D Relevance: .9, Instructions: 856COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2873627742.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b880000_component0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb9a7d3ddebdf15d2ee91793effe74f034db2b5a01e03e60b4abfc2a0241855
Instruction ID: e8fc28e2d1501d4f2c9b8d191bd5442ce8f31cacbbc0d89571e140d2ee4eed11
Opcode Fuzzy Hash: beb9a7d3ddebdf15d2ee91793effe74f034db2b5a01e03e60b4abfc2a0241855
Instruction Fuzzy Hash: 6A52B531B08A4D4FEBA4EF288865B6973E1EF59340F1240B9D41DC72A6DE35EE85CB41

Function 00007FFD9B881482 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2873627742.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b880000_component0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c817f452546a8065a4b1cb64c6b4134f7b96c18368d372b0696daddd6079adec
Instruction ID: dd3aa2722200ee0cdf29200a15c96a2ca96637ac7133e89f015eb08cca43862f
Opcode Fuzzy Hash: c817f452546a8065a4b1cb64c6b4134f7b96c18368d372b0696daddd6079adec
Instruction Fuzzy Hash: AB517A7250E68C5FE71AA764EC128F57BA4EF47330F0402ABD09DC70A3E9266957C791

Function 00007FFD9B880818 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2873627742.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b880000_component0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf37f2351f43e3f446e2d14f300160e6e2419aac0cc190970fd777c1437aa407
Instruction ID: 369ff173c6bc87223ae03e21510aaec7bf4655cf31285f1ed5d5c37f1241f5ef
Opcode Fuzzy Hash: cf37f2351f43e3f446e2d14f300160e6e2419aac0cc190970fd777c1437aa407
Instruction Fuzzy Hash: 8451E131B1990E8FDB94EBA8D865AE8B7B1FF4C310B4101B6D019D71ABDE346941C7C0

Function 00007FFD9B881958 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2873627742.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b880000_component0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d56f9fffe23f71a08f7240f5be837553677608137e7b1accc8f32ea8b5b220
Instruction ID: c8c82423c460ebe1d127f39c5f6563c962cd979e3de67079c0cf37ca66489b91
Opcode Fuzzy Hash: b7d56f9fffe23f71a08f7240f5be837553677608137e7b1accc8f32ea8b5b220
Instruction Fuzzy Hash: F2313A31A29D1D8FDB94EB98D865AECB3E1EF5C710B41017AE01DE32A6DE3469418781

Function 00007FFD9B88143D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2873627742.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b880000_component0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2690e2b0f7cdc0e8a48152405c1e338e5a7c0e80657a1a6b82341980bba2b2
Instruction ID: d0a2a8f1c5c79a7fe81fdf8bc2149be99ba3a5169acf471a4dad4ab786e4c421
Opcode Fuzzy Hash: 3f2690e2b0f7cdc0e8a48152405c1e338e5a7c0e80657a1a6b82341980bba2b2
Instruction Fuzzy Hash: 79016571E0DA1D4FD768DB94E8667F8B7A1EF09321F0101BFD05D931A2DE352A458A41

Function 00007FFD9B881472 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2873627742.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b880000_component0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9408648bedc2a5108cbe6c09436aed72f48d55fd22f91e89bb4a3a593278b92
Instruction ID: 992061edd467f8d97f6f5595d9f32c0bacf63300f7c45789ddf27fcfff035945
Opcode Fuzzy Hash: c9408648bedc2a5108cbe6c09436aed72f48d55fd22f91e89bb4a3a593278b92
Instruction Fuzzy Hash: 4EE0CD7361EB484EE2349244B5171F5B781DE4E174700007BD1AD07D22AE17211B4584

Analysis Process: saBSI.exePID: 4856, Parent PID: 6540COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	48

Executed Functions

Function 007E5318 Relevance: 69.2, APIs: 12, Strings: 27, Instructions: 928
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008388FA: EnterCriticalSection.KERNEL32(008B742C,?,?,?,007D402B,008B827C,4EB79311,?,007D1171,?), ref: 00838905
Part of subcall function 008388FA: LeaveCriticalSection.KERNEL32(008B742C,?,?,?,007D402B,008B827C,4EB79311,?,007D1171,?), ref: 00838942

Part of subcall function 007E4A40: _com_issue_error.COMSUPP ref: 007E4AD2
Part of subcall function 007E4A40: SysFreeString.OLEAUT32(-00000001), ref: 007E4AFD

Part of subcall function 007E61F0: Concurrency::cancel_current_task.LIBCPMT ref: 007E62BF

Part of subcall function 008388B0: EnterCriticalSection.KERNEL32(008B742C,?,?,007D4086,008B827C,008768E0,?), ref: 008388BA
Part of subcall function 008388B0: LeaveCriticalSection.KERNEL32(008B742C,?,?,007D4086,008B827C,008768E0,?), ref: 008388ED
Part of subcall function 008388B0: RtlWakeAllConditionVariable.NTDLL ref: 00838964

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,4EB79311,?,?), ref: 007E57B4
FindResourceW.KERNEL32(00000000,00000001,00000010), ref: 007E57C5
LoadResource.KERNEL32(00000000,00000000), ref: 007E57D1
LockResource.KERNEL32(00000000), ref: 007E57DC
Concurrency::cancel_current_task.LIBCPMT ref: 007E6067
Concurrency::cancel_current_task.LIBCPMT ref: 007E6085
SysFreeString.OLEAUT32 ref: 007E610F
SysFreeString.OLEAUT32(00000000), ref: 007E615A

Strings

ery), xrefs: 007E5407
4.1.1.865, xrefs: 007E597A
), xrefs: 007E6016
UUID, xrefs: 007E5AC8
select PowerState from Win32_ComputerSystem, xrefs: 007E5565
IsWow64Process, xrefs: 007E5F95
PredictFailure, xrefs: 007E5661
PowerState, xrefs: 007E5578
NO_REGKEY, xrefs: 007E5CDE
EstimatedRunTime, xrefs: 007E53BA
Time, xrefs: 007E537F
select PredictFailure from MSStorageDriver_FailurePredictStatus, xrefs: 007E564E
(error), xrefs: 007E54DE, 007E55BD
PCSystemTypeEx, xrefs: 007E5499
kernel32, xrefs: 007E5F82
kState, xrefs: 007E560D
UUID, xrefs: 007E5D88, 007E5C84
t, xrefs: 007E5C0B
Failed to convert wuuid to string, xrefs: 007E5C17
root\wmi, xrefs: 007E563B
kernel32.dll, xrefs: 007E57A8
select EstimatedRunTime from Win32_Battery, xrefs: 007E53A7
select PCSystemTypeEx from Win32_ComputerSystem, xrefs: 007E5486
Version, xrefs: 007E5911
0.0.0.0, xrefs: 007E5816
Root\CIMV2, xrefs: 007E5391, 007E5473, 007E5552
orm, xrefs: 007E5FDD

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CriticalSection$Concurrency::cancel_current_taskFreeResourceString$EnterLeave$ConditionFindHandleLoadLockModuleVariableWake_com_issue_error
String ID: (error)$)$0.0.0.0$4.1.1.865$EstimatedRunTime$Failed to convert wuuid to string$IsWow64Process$NO_REGKEY$PCSystemTypeEx$PowerState$PredictFailure$Root\CIMV2$Time$UUID$UUID$Version$ery)$kState$kernel32$kernel32.dll$orm$root\wmi$select EstimatedRunTime from Win32_Battery$select PCSystemTypeEx from Win32_ComputerSystem$select PowerState from Win32_ComputerSystem$select PredictFailure from MSStorageDriver_FailurePredictStatus$t
API String ID: 2830066208-329860846
Opcode ID: 74ab5b3800fdc0105f9f395e96c9a492470dd4f7ddb295fc2b4327b7785b4982
Instruction ID: cb0ffeeccb6fc40420e64e5c69e60973e377d41917f9fbde3b21889a3dc2fb34
Opcode Fuzzy Hash: 74ab5b3800fdc0105f9f395e96c9a492470dd4f7ddb295fc2b4327b7785b4982
Instruction Fuzzy Hash: A482F270901388DBEB14DFA8DC4979DBBB5BF59304F24421CE445AB3D2EB789A84CB51

Function 007DF110 Relevance: 68.3, APIs: 21, Strings: 17, Instructions: 1782COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DF268
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DF307
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DF37E
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DF8B0
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DFBBD

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DFDB6
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E00BA
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E015F
GetLastError.KERNEL32(?,00000001,?,?,00000004), ref: 007E05D7
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E0614
GetLastError.KERNEL32(?,00000001,?,?,00000004), ref: 007E086A
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E08A7
GetLastError.KERNEL32(?,00000001,0000018F,00000000,X-Api-Key: ,0000000B,00000000,00000000,?,?,00000004), ref: 007E0A90
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E0ACD

Strings

HTTP status error for AWS: , xrefs: 007E011E
Failed to convert the x_api_key string to wide, xrefs: 007DFD8F
HTTP connection failed for AWS: , xrefs: 007E0EBA
0Ywx4MUvRidmWf74nsIlBPIxJYIG9Nf0lSnge8SvgvY3RVy4E6gFLp3VDBcDO830QhXvfpgCb55sRtnVqKb2zUO3Vq7ko1b, xrefs: 007DF5B7, 007DF656
`avo, xrefs: 007DFE78, 007DFE8D, 007E027E, 007E0293, 007E0415, 007E042A, 007E0733, 007E0748, 007E09C6, 007E09DB, 007E0BEC, 007E0C01, 007E0CFE, 007E0D13, 007E0E15
Querying AdhocTelemetryAWS value failed: , xrefs: 007DF217
AWS Response Code received , xrefs: 007E0079
HTTP receive response failed for AWS: , xrefs: 007E05C7
HTTP add request header failed for AWS x_api_key: , xrefs: 007E0A80
HTTP send request failed for AWS: , xrefs: 007E085A
NO_REGVALUE, xrefs: 007DF54F
AWS Adhoc Telemetry Payload = , xrefs: 007DFB62
HTTP open request failed for AWS: , xrefs: 007E0DB8
X-Api-Key: , xrefs: 007DFF28
AdhocTelemetryAWS, xrefs: 007DF1B6
SOFTWARE\McAfee\WebAdvisor, xrefs: 007DF181
Failed to initialize buffer for AWS, xrefs: 007DF889

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$ErrorLast$InitOnce$BeginCompleteInitialize
String ID: 0Ywx4MUvRidmWf74nsIlBPIxJYIG9Nf0lSnge8SvgvY3RVy4E6gFLp3VDBcDO830QhXvfpgCb55sRtnVqKb2zUO3Vq7ko1b$AWS Adhoc Telemetry Payload = $AWS Response Code received $AdhocTelemetryAWS$Failed to convert the x_api_key string to wide$Failed to initialize buffer for AWS$HTTP add request header failed for AWS x_api_key: $HTTP connection failed for AWS: $HTTP open request failed for AWS: $HTTP receive response failed for AWS: $HTTP send request failed for AWS: $HTTP status error for AWS: $NO_REGVALUE$Querying AdhocTelemetryAWS value failed: $SOFTWARE\McAfee\WebAdvisor$X-Api-Key: $`avo
API String ID: 1658547907-3442683205
Opcode ID: bb13f6f0a391b50df0790224ddf54d57bfd0cd301929bc35de49457ecb9d136e
Instruction ID: 845a722a7d2b215c403843dec0ee938f7a5c54716be802b7967b5dd65027bacc
Opcode Fuzzy Hash: bb13f6f0a391b50df0790224ddf54d57bfd0cd301929bc35de49457ecb9d136e
Instruction Fuzzy Hash: E6F28E70901268DBDB25DF24CC89BDDB7B5BF89304F1041E8E449A6292EB799EC4CF91

Function 007F3AC0 Relevance: 66.7, APIs: 3, Strings: 34, Instructions: 1934COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 007F3CE8

Part of subcall function 00823084: __EH_prolog3.LIBCMT ref: 0082308B
Part of subcall function 00823084: std::_Lockit::_Lockit.LIBCPMT ref: 00823096
Part of subcall function 00823084: std::locale::_Setgloballocale.LIBCPMT ref: 008230B1
Part of subcall function 00823084: std::_Lockit::~_Lockit.LIBCPMT ref: 00823107

std::locale::_Init.LIBCPMT ref: 007F4934
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007F4CD5

Strings

TAG, xrefs: 007F3FCA
Precondition "%s" evaluated to true, xrefs: 007F4C2B
EXIT_XML, xrefs: 007F52FB
NWebAdvisor::NXmlUpdater::Hound::End, xrefs: 007F4D11, 007F4DE0, 007F5467, 007F54BE, 007F5580, 007F55D5, 007F5868, 007F58AA, 007F58E7
Command "%s" failed, xrefs: 007F581A
XML precondition array returned false due to sniffer actions, xrefs: 007F426C
EXIT, xrefs: 007F5270, 007F52B2
XML precondition array returned true due to sniffer actions, xrefs: 007F434F
XML precondition failed - no Type specified, xrefs: 007F555A
Unable to substitute the return code, xrefs: 007F56D7, 007F573F
false, xrefs: 007F41FF
Precondition "%s" evaluated to false, xrefs: 007F4B1E
Couldn't find the ReturnCode attribute of EXIT command, xrefs: 007F5676
unknown, xrefs: 007F4103
true, xrefs: 007F42E4
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.h, xrefs: 007F3B53, 007F3EFF, 007F3F67, 007F4400, 007F4D16, 007F4DE5, 007F4E51, 007F51E6, 007F546C, 007F54C3, 007F5585, 007F55DA, 007F5785, 007F586D, 007F58AF, 007F58EC
NWebAdvisor::NXmlUpdater::Hound::ExitResult, xrefs: 007F5780
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\xmlUpdater.cpp, xrefs: 007F427B, 007F42B1, 007F435E, 007F4394, 007F4C3A, 007F4D6B, 007F5569, 007F561E, 007F5746, 007F5829, 007F593F
NWebAdvisor::NXmlUpdater::Hound::Start, xrefs: 007F3B4E, 007F3EFA, 007F3F62, 007F43FB, 007F4E4C, 007F51E1
UPDATE, xrefs: 007F3B7F, 007F54DE
EXIT_UPDATE, xrefs: 007F5344, 007F55FD
Unable to convert ReturnCode into int, xrefs: 007F573A
PRECONDITION, xrefs: 007F43B9, 007F4C71
XML precondition array with tag %s returned false due to sniffer actions, xrefs: 007F42A2
2, xrefs: 007F58E2
XML precondition array with tag %s returned false, xrefs: 007F4D5C
UPDATECOMMANDS, xrefs: 007F4E06
UPDATEARRAY, xrefs: 007F3B18
Malformed XML, no UPDATEARRAY element, xrefs: 007F5930
Exit update command triggered. Exiting..., xrefs: 007F560F
NWebAdvisor::NXmlUpdater::CUpdater::Process, xrefs: 007F4276, 007F42AC, 007F4359, 007F438F, 007F4C35, 007F4D66, 007F5564, 007F5619, 007F5741, 007F5824, 007F593A
XML precondition array with tag %s returned true due to sniffer actions, xrefs: 007F4385
PRECONDITIONARRAY, xrefs: 007F3F1E
ReturnCode, xrefs: 007F5637, 007F568C, 007F56DE

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::locale::_$InitLockitstd::_$H_prolog3Ios_base_dtorLockit::_Lockit::~_Setgloballocalestd::ios_base::_
String ID: 2$Command "%s" failed$Couldn't find the ReturnCode attribute of EXIT command$EXIT$EXIT_UPDATE$EXIT_XML$Exit update command triggered. Exiting...$Malformed XML, no UPDATEARRAY element$NWebAdvisor::NXmlUpdater::CUpdater::Process$NWebAdvisor::NXmlUpdater::Hound::End$NWebAdvisor::NXmlUpdater::Hound::ExitResult$NWebAdvisor::NXmlUpdater::Hound::Start$PRECONDITION$PRECONDITIONARRAY$Precondition "%s" evaluated to false$Precondition "%s" evaluated to true$ReturnCode$TAG$UPDATE$UPDATEARRAY$UPDATECOMMANDS$Unable to convert ReturnCode into int$Unable to substitute the return code$XML precondition array returned false due to sniffer actions$XML precondition array returned true due to sniffer actions$XML precondition array with tag %s returned false$XML precondition array with tag %s returned false due to sniffer actions$XML precondition array with tag %s returned true due to sniffer actions$XML precondition failed - no Type specified$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.h$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\xmlUpdater.cpp$false$true$unknown
API String ID: 3544396713-2181764886
Opcode ID: 22270a60d30a65005385308f50a0ee53b51df4920dbf34ac966c5719dc8d36e3
Instruction ID: b170b7ad2c8d1b52bdd7249272f4b075056a57d942a68651d8e1ff6e419f88fc
Opcode Fuzzy Hash: 22270a60d30a65005385308f50a0ee53b51df4920dbf34ac966c5719dc8d36e3
Instruction Fuzzy Hash: AD13587190126CDBDB24DB54C849BEEB7B4BF04304F1482D9E619A7391EB78AE84CF91

Function 007D5870 Relevance: 60.3, APIs: 22, Strings: 12, Instructions: 780
encryptionfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 007D58AA
GetCurrentThreadId.KERNEL32 ref: 007D58B4
CreateFileW.KERNEL32(\\.\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 007D593A
CreateFileW.KERNEL32(\\.\Global\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 007D595C
CreateFileW.KERNEL32(\\.\WGUARDNT,80000000,00000000,00000000,00000003,40000000,00000000), ref: 007D5991
CreateFileW.KERNEL32(\\.\Global\WGUARDNT,80000000,00000000,00000000,00000003,40000000,00000000), ref: 007D59B5
CreateFileW.KERNEL32(\\.\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 007D59D9
CreateFileW.KERNEL32(\\.\Global\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 007D59FD
UuidCreate.RPCRT4(00000000), ref: 007D5A41
UuidCreate.RPCRT4(00000000), ref: 007D5A57
CryptAcquireContextW.ADVAPI32(?), ref: 007D5D0E
CryptCreateHash.ADVAPI32(00000010,00008003,00000000,00000000,?), ref: 007D5D2A
CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 007D5D43
CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000), ref: 007D5D5F
CryptDestroyHash.ADVAPI32(?), ref: 007D5D6E
CryptReleaseContext.ADVAPI32(?,00000000), ref: 007D5D7F
CryptAcquireContextW.ADVAPI32(?), ref: 007D5F87
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 007D5FA3
CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 007D5FBC
CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000), ref: 007D5FD8
CryptDestroyHash.ADVAPI32(?), ref: 007D5FE7
CryptReleaseContext.ADVAPI32(?,00000000), ref: 007D5FF8

Strings

\\.\Global\WGUARDNT, xrefs: 007D5957, 007D59B0, 007D59F8
AacControl2, xrefs: 007D5AC5, 007D5ACC
Created access handle %p, xrefs: 007D6171, 007D620C
AacControl6, xrefs: 007D5A76, 007D5A80, 007D5A90
AacControl5, xrefs: 007D5A98, 007D5A9F
AacControl3, xrefs: 007D5AB6, 007D5ABD
AacControl, xrefs: 007D5AD4
AacControl4, xrefs: 007D5AA7, 007D5AAE
accesslib policy %x:%x, xrefs: 007D5B78
al delete policy on terminate process 0x%x (%d) rule, xrefs: 007D5C8A
\\.\WGUARDNT, xrefs: 007D592E, 007D598C, 007D59D4
al disable rules on terminate thread 0x%x (%d) rule, xrefs: 007D5F01

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Crypt$Create$Hash$File$Context$AcquireCurrentDataDestroyParamReleaseUuid$ProcessThread
String ID: AacControl$AacControl2$AacControl3$AacControl4$AacControl5$AacControl6$Created access handle %p$\\.\Global\WGUARDNT$\\.\WGUARDNT$accesslib policy %x:%x$al delete policy on terminate process 0x%x (%d) rule$al disable rules on terminate thread 0x%x (%d) rule
API String ID: 4128897270-3926088020
Opcode ID: bcefe36a231eb686b5c9f63392e891bf34a405974c5bea2bdcb96bb868038654
Instruction ID: 61faec55d82d323d1fe66ce70337a3d41772cc81370f38e9dd8458bc48c39509
Opcode Fuzzy Hash: bcefe36a231eb686b5c9f63392e891bf34a405974c5bea2bdcb96bb868038654
Instruction Fuzzy Hash: 8E5236756043109FDB109F64CC98B2EBBE6BB8C714F190559FA4AAB390CB74ED418F92

Function 00811840 Relevance: 56.8, APIs: 5, Strings: 27, Instructions: 754registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(80000002,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,-00000028,?,?,-00000028,00000000,?), ref: 00811932
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000028,?), ref: 00811DAD
RegCloseKey.ADVAPI32(00000000,?,?,?,-00000028,?,?,-00000028,00000000,?), ref: 00811DD3
std::locale::_Init.LIBCPMT ref: 008120C4

Strings

Unknown registry key type: %s, xrefs: 00811C24
NWebAdvisor::NXmlUpdater::SetRegistryKey, xrefs: 00811957, 00811992, 00811AAE, 00811C03, 00811C2E, 00811CF1, 00811D91
memcpy_s failed in NWebAdvisor::NXmlUpdater::SetRegistryKey, xrefs: 0081198B, 00811AA4, 00811CEA
invalid stoul argument, xrefs: 00811E1F
Value, xrefs: 00811EF2
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SetVariableCommand.cpp, xrefs: 0081228D, 008122D3
BIN, xrefs: 00811AD9
Setting variable , xrefs: 00812170
invalid substitutor, xrefs: 00811E8C
DWORD, xrefs: 008119D3
Key, xrefs: 00811E98
Error (%d) creating registry key: %s, xrefs: 0081194D
Unable to substitute variables for the SETVAR command, xrefs: 008122BB, 008122CC
STR, xrefs: 008118AA
to , xrefs: 00812189
Unable to set the variable, xrefs: 00811FA6
(Default), xrefs: 00811D2A, 00811D72
QWORD, xrefs: 008119E9
stoul argument out of range, xrefs: 00811E29
Error (%d) setting value (%s) under registry key: %s, xrefs: 00811D87
Unable to convert %s to hex, xrefs: 00811BF9
Unable to read key or value attribute of SETVAR command, xrefs: 008122C7
NUM, xrefs: 008119BD
NWebAdvisor::NXmlUpdater::CSetVariableCommand::Execute, xrefs: 00812288, 008122CE
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\RegistryCommand.cpp, xrefs: 0081195C, 00811997, 00811AB3, 00811C08, 00811C33, 00811CF6, 00811D96
stoull argument out of range, xrefs: 00811E15
invalid stoull argument, xrefs: 00811E0B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Close$CreateInitstd::locale::_
String ID: to $(Default)$BIN$DWORD$Error (%d) creating registry key: %s$Error (%d) setting value (%s) under registry key: %s$Key$NUM$NWebAdvisor::NXmlUpdater::CSetVariableCommand::Execute$NWebAdvisor::NXmlUpdater::SetRegistryKey$QWORD$STR$Setting variable $Unable to convert %s to hex$Unable to read key or value attribute of SETVAR command$Unable to set the variable$Unable to substitute variables for the SETVAR command$Unknown registry key type: %s$Value$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\RegistryCommand.cpp$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SetVariableCommand.cpp$invalid stoul argument$invalid stoull argument$invalid substitutor$memcpy_s failed in NWebAdvisor::NXmlUpdater::SetRegistryKey$stoul argument out of range$stoull argument out of range
API String ID: 3662814871-412574832
Opcode ID: 9c277905722ddd82924a1570c46837300ac2dae3758dc57f75c9256bb976035e
Instruction ID: eee5032ded59cede5efd123d1cf9ca5ad8d9a9cd905e20ce2758b4c123515a7d
Opcode Fuzzy Hash: 9c277905722ddd82924a1570c46837300ac2dae3758dc57f75c9256bb976035e
Instruction Fuzzy Hash: C952AE70A002189BEF20DF54DC49BEEB7B9FF44704F144199E909E7381E7759A84CBA2

Function 0080FFE0 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 368
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExecuteLocalCommand.cpp, xrefs: 0081003B, 00810098, 0081039F, 00810415, 0081045F
Signature check failed for command %s, xrefs: 0081008C
invalid substitutor, xrefs: 0081002F
Failed to delete executable (%d), xrefs: 00810450
NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand, xrefs: 00810036, 00810093, 0081039A, 00810410, 0081045A
Unable to run %s, error (%d), xrefs: 00810393
D, xrefs: 00810103
Wait for process failed for command %s, xrefs: 008103D5
Failed to get process exit code (%d), xrefs: 00810406

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: D$Failed to delete executable (%d)$Failed to get process exit code (%d)$NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand$Signature check failed for command %s$Unable to run %s, error (%d)$Wait for process failed for command %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExecuteLocalCommand.cpp$invalid substitutor
API String ID: 0-284121414
Opcode ID: 73fb427bd347f6686f9a57d838d023430516803dda87e8467259eb03f89575a7
Instruction ID: 898cd23897fe73f66acf4bed5398897928d8f9faebb3155a4f21162dff171d21
Opcode Fuzzy Hash: 73fb427bd347f6686f9a57d838d023430516803dda87e8467259eb03f89575a7
Instruction Fuzzy Hash: CAE17870A012599BDB24EF24CC49BE9B7B8FF59304F0442E9E449E7291EBB49AC4CF51

Function 007D5110 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 452
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\McAfee\SystemCore,00000000,00020219,?), ref: 007D5225
RegQueryValueExW.ADVAPI32(?,szInstallDir32,00000000,?,?,?), ref: 007D5265
SetLastError.KERNEL32(0000006F,?,?,0089A17C), ref: 007D52B6
RegCloseKey.ADVAPI32(?), ref: 007D52C2
GetLastError.KERNEL32 ref: 007D52F6
OutputDebugStringW.KERNEL32(NCPrivateLoadAndValidateMPTDll: Looking in current directory), ref: 007D53E3

Strings

NotComDllGetInterface: %ls loading %ls, WinVerifyTrust failed with %08x, xrefs: 007D56B7
Software\McAfee\SystemCore, xrefs: 007D521B
%ls\%ls, xrefs: 007D5533
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory, xrefs: 007D549C
szInstallDir32, xrefs: 007D525F
NCPrivateLoadAndValidateMPTDll: Looking in current directory, xrefs: 007D53DE

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast$CloseDebugOpenOutputQueryStringValue
String ID: %ls\%ls$NCPrivateLoadAndValidateMPTDll: Looking in EXE directory$NCPrivateLoadAndValidateMPTDll: Looking in current directory$NotComDllGetInterface: %ls loading %ls, WinVerifyTrust failed with %08x$Software\McAfee\SystemCore$szInstallDir32
API String ID: 1760606849-3767168787
Opcode ID: 1e20ebc65c32faf8d90bbb1b3f104af3853e1f5641707b32e4f8f77e1d3fa0bc
Instruction ID: 61366a2ed21d07479e7b5ec61d9899ce8ce432fab3b0f1da90bdc07c3cd0a0fe
Opcode Fuzzy Hash: 1e20ebc65c32faf8d90bbb1b3f104af3853e1f5641707b32e4f8f77e1d3fa0bc
Instruction Fuzzy Hash: A4029F71E00619DBDB24DF64CC45BAABBB5FF04314F1481AAE409A7381DB789E84CF92

Function 008217A0 Relevance: 27.4, APIs: 18, Instructions: 353
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,00822520,00000400,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00821815
CryptMsgClose.CRYPT32(00000000), ref: 00821827

Part of subcall function 008214F0: CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 00821581
Part of subcall function 008214F0: CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 008215B2
Part of subcall function 008214F0: CryptMsgGetParam.CRYPT32(?,00000006,?,00000000,?), ref: 008215DD
Part of subcall function 008214F0: CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00821625

CertCloseStore.CRYPT32(00000000,00000001), ref: 00821837
CryptMsgClose.CRYPT32(00000000), ref: 008218C0
CertCloseStore.CRYPT32(00000000,00000001), ref: 008218D0
CryptQueryObject.CRYPT32(00000002,?,00003FFE,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008219CD
CryptMsgClose.CRYPT32(00000000), ref: 008219DF
CertCloseStore.CRYPT32(00000000,00000001), ref: 008219F1
CryptMsgClose.CRYPT32(00000000), ref: 00821A1D
CertCloseStore.CRYPT32(00000000,00000001), ref: 00821A29
CryptMsgClose.CRYPT32(00000000), ref: 00821A63
CertCloseStore.CRYPT32(00000000,00000001), ref: 00821A75
CryptMsgClose.CRYPT32(00000000), ref: 00821AA1
CertCloseStore.CRYPT32(00000000,00000001), ref: 00821AAD
CryptMsgClose.CRYPT32(00000000), ref: 00821ACD
CertCloseStore.CRYPT32(00000000,00000001), ref: 00821AD9
CryptMsgClose.CRYPT32(00000000), ref: 00821B50
CertCloseStore.CRYPT32(00000000,00000001), ref: 00821B5C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Close$Crypt$CertStore$Param$ObjectQuery$CertificateFromSubject
String ID:
API String ID: 2648890560-0
Opcode ID: 11eb472a0aa71c38065403dedc624a0bc57a63596394dcce144bca617c207ed4
Instruction ID: f2cff2e7853174123933fee6fd85a1029963db6e76ffd110304ad9e1cdd36e26
Opcode Fuzzy Hash: 11eb472a0aa71c38065403dedc624a0bc57a63596394dcce144bca617c207ed4
Instruction Fuzzy Hash: 9BC13D71E10259AAEF10DFA9DD89BAEBBB8FF14704F244529E501F7280E7749944CBA0

Function 007D70D9 Relevance: 27.2, APIs: 4, Strings: 11, Instructions: 977COMMON

Download Yara Rule

APIs

Part of subcall function 007E4B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E521E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D7D3D
Concurrency::cancel_current_task.LIBCPMT ref: 007D7DFC
__Mtx_unlock.LIBCPMT ref: 007D7DC8

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D7EBB

Strings

Failed to add event category (, xrefs: 007D71F0
Failed to add event action (, xrefs: 007D7379
z, xrefs: 007D7CF1
Failed to add reserved 5 dimension (, xrefs: 007D7CFD
Failed to add reserved 1 dimension (, xrefs: 007D769E
Failed to add event label (, xrefs: 007D7508
Failed to add reserved 2 dimension (, xrefs: 007D7834
Service has not been initialized, xrefs: 007D7E88
u, xrefs: 007D7B57
Failed to add reserved 4 dimension (, xrefs: 007D7B63
Failed to add reserved 3 dimension (, xrefs: 007D79CD

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitializeMtx_unlock
String ID: Failed to add event action ($Failed to add event category ($Failed to add event label ($Failed to add reserved 1 dimension ($Failed to add reserved 2 dimension ($Failed to add reserved 3 dimension ($Failed to add reserved 4 dimension ($Failed to add reserved 5 dimension ($Service has not been initialized$u$z
API String ID: 342047005-3525645681
Opcode ID: 8764a8f11015494a1d5f0affa72a3472f4c2b19dc09f3d9e55d1aa1707fdee6c
Instruction ID: 9fe77464184e5bab44de9b20d8b6f43ec413908e1da80e26a82508bf3426b256
Opcode Fuzzy Hash: 8764a8f11015494a1d5f0affa72a3472f4c2b19dc09f3d9e55d1aa1707fdee6c
Instruction Fuzzy Hash: 7F82A270604244DFDB18EF24C895BAD7BB5FF45304F54419EE8168B382EB79DA48CBA2

Function 007D8FB0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

CoCreateGuid.OLE32(?), ref: 007D8FC8
StringFromCLSID.OLE32(?,?), ref: 007D8FE0
CoTaskMemFree.OLE32(?), ref: 007D9138
Concurrency::cancel_current_task.LIBCPMT ref: 007D9173
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D93D1

Strings

Could not create registry key , xrefs: 007D923F
SOFTWARE\McAfee\WebAdvisor, xrefs: 007D91FB

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_taskCreateFreeFromGuidIos_base_dtorStringTaskstd::ios_base::_
String ID: Could not create registry key $SOFTWARE\McAfee\WebAdvisor
API String ID: 3741506170-3627174789
Opcode ID: d4aa8798c2e539624e8ce0b2426d875ea3ae833b937e505ed2586f71b25136bb
Instruction ID: 5b8cb638f1df60cb2e7b393b00ac3f1536f76c096ee9d3ca4d18f9d34e67ae3e
Opcode Fuzzy Hash: d4aa8798c2e539624e8ce0b2426d875ea3ae833b937e505ed2586f71b25136bb
Instruction Fuzzy Hash: 0981D571600209DBD714EF64DC49BAEB7B8FF84310F50462EFA5697381EB39A904CB92

Function 007C4C8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 007C4CA6
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007C4CB8
Process32FirstW.KERNEL32(00000000,?), ref: 007C4CD3
Process32NextW.KERNEL32(00000000,0000022C), ref: 007C4CE9
FindCloseChangeNotification.KERNEL32(00000000), ref: 007C4CFA

Strings

saBSI.exe, xrefs: 007C4D1C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Process32$ChangeCloseCreateCurrentFindFirstNextNotificationProcessSnapshotToolhelp32
String ID: saBSI.exe
API String ID: 1594840063-3955546181
Opcode ID: ed298e8b7b8ca174f25a4e0ed09edfa360ba567734cd0b559ab8846582757e9f
Instruction ID: 5fae873006b00ef5d8df8ad194035fa49f2168ea3376a246f7704b3233145768
Opcode Fuzzy Hash: ed298e8b7b8ca174f25a4e0ed09edfa360ba567734cd0b559ab8846582757e9f
Instruction Fuzzy Hash: 5C2108312053009FD220AB24EC9DF6F77E4FB85325F14021DF926C72E1E738D94586A2

Function 008214F0 Relevance: 9.2, APIs: 6, Instructions: 215encryptionCOMMON

Download Yara Rule

APIs

CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 00821581
CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 008215B2
CryptMsgGetParam.CRYPT32(?,00000006,?,00000000,?), ref: 008215DD
CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00821625
CertFreeCRLContext.CRYPT32(?), ref: 0082175E

Part of subcall function 0083E960: _free.LIBCMT ref: 0083E973

CertFreeCRLContext.CRYPT32(?), ref: 00821738

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CertCryptParam$ContextFree$CertificateFromStoreSubject_free
String ID:
API String ID: 4059466977-0
Opcode ID: eef6555b28c0a21baa0015ac88274a27f1e134ec609b19537501d78fd2d341be
Instruction ID: de03289eb0ca1a0b28cb360c9cec7d71add5bb0c06174388fd142f84130e720c
Opcode Fuzzy Hash: eef6555b28c0a21baa0015ac88274a27f1e134ec609b19537501d78fd2d341be
Instruction Fuzzy Hash: 7E818B71800218EFDF20DF64E884BEEBBB4FF59304F244119EC24A7252D731AA45CBA1

Function 007F73B0 Relevance: 9.2, Strings: 7, Instructions: 433COMMON

Download Yara Rule

Strings

No section found for %s, xrefs: 007F773A
&, xrefs: 007F74C2
Key was not found: %s, xrefs: 007F7826
NWebAdvisor::CSubInfoDatReader::ReadString, xrefs: 007F75E4, 007F7741, 007F782D
&, xrefs: 007F750E
CObfuscatedIniReader cannot load file: %s, xrefs: 007F75DD
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubInfoDataReader.cpp, xrefs: 007F75E9, 007F7746, 007F7832

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: HeapProcess
String ID: &$&$CObfuscatedIniReader cannot load file: %s$Key was not found: %s$NWebAdvisor::CSubInfoDatReader::ReadString$No section found for %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubInfoDataReader.cpp
API String ID: 54951025-2132657581
Opcode ID: f7091b0100f6711ce0031d9f1307858645cda3e0128a52f26354b45a84432b18
Instruction ID: fd1c719a1abed86201a35256ff50d979bd735839d1889911b1aba5503544ce02
Opcode Fuzzy Hash: f7091b0100f6711ce0031d9f1307858645cda3e0128a52f26354b45a84432b18
Instruction Fuzzy Hash: 2CF1D170A04209DBEB14DF68CC59BAAB7B1FF14704F14829CE909AB391EB789E44CF51

Function 007D4F50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,4EB79311), ref: 007D4FB5
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007D4FDF
GetLastError.KERNEL32 ref: 007D4FF2
GetLastError.KERNEL32 ref: 007D500B

Strings

%ls\%ls, xrefs: 007D5056

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: %ls\%ls
API String ID: 152501406-2125769799
Opcode ID: 9bdfe1a4b6175cd3104506d531cb6f5bc57df999b264f2b7962c439d76c22e86
Instruction ID: a8996bc87c01efe1f5802aacaae8ced388c31f2e571122f28e06faee9d9864b5
Opcode Fuzzy Hash: 9bdfe1a4b6175cd3104506d531cb6f5bc57df999b264f2b7962c439d76c22e86
Instruction Fuzzy Hash: A7416271E006199BDB24DFB5CC46B6FBAB9FB44710F24413AE805E7381EA35D9048BA1

Function 0080D540 Relevance: 7.2, Strings: 5, Instructions: 925COMMON

Download Yara Rule

Strings

Unable to substitute the arguments, xrefs: 0080E16E
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\VersionPrecondition.cpp, xrefs: 0080DB6A, 0080E17A
invalid substitutor, xrefs: 0080DB5E
NWebAdvisor::NXmlUpdater::CVersionPrecondition::IsPreconditionSatisfied, xrefs: 0080DB65, 0080E175
NEQ, xrefs: 0080D892

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: NEQ$NWebAdvisor::NXmlUpdater::CVersionPrecondition::IsPreconditionSatisfied$Unable to substitute the arguments$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\VersionPrecondition.cpp$invalid substitutor
API String ID: 0-4090108046
Opcode ID: 3abe3a9a39606b4cddf575c6e0dcb28664f03e32a2c8428797f1980ed05476b7
Instruction ID: 505363c1e921224dbc742c85e4174bff62706d766503567a1d1a50a37cc10c47
Opcode Fuzzy Hash: 3abe3a9a39606b4cddf575c6e0dcb28664f03e32a2c8428797f1980ed05476b7
Instruction Fuzzy Hash: 1E828C71E00258CBDB24DFA8CC55BEDBBB1FF45308F14829CE419AB291DB75AA85CB50

Function 0084E8FE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0084E8FD,00000002,00000002,?,00000002), ref: 0084E920
TerminateProcess.KERNEL32(00000000,?,0084E8FD,00000002,00000002,?,00000002), ref: 0084E927
ExitProcess.KERNEL32 ref: 0084E939

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c03b845f4610fcc085dc7cc6649812d35acf2791397ca5f4ea8745f9da07ea53
Instruction ID: 5ad986dbaedb4071b3bb08003372534f125adacd2e3ded2ceae8d8ffa19874bb
Opcode Fuzzy Hash: c03b845f4610fcc085dc7cc6649812d35acf2791397ca5f4ea8745f9da07ea53
Instruction Fuzzy Hash: AEE0BD3101050CAFCF626F68ED4DA587F6AFB48352B084854F909CA1B2CB75ED82DA92

Function 007C5C1E Relevance: 3.1, APIs: 2, Instructions: 76comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0088D808,00000000,00000017,0089B024,00000000,4EB79311,?,?,?,00000000,00000000,00000000,00868687,000000FF), ref: 007C5C7A
OleRun.OLE32(00000000), ref: 007C5C89

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 89a098773b29d5ae0e0d2be36a5636364de783d576e2772587448d2d53a4faed
Instruction ID: a15bb3e781aefc0a6ef4ef8cbbeab51b6e6443572f009f7dc7227fd1fc2bf005
Opcode Fuzzy Hash: 89a098773b29d5ae0e0d2be36a5636364de783d576e2772587448d2d53a4faed
Instruction Fuzzy Hash: 82218C75600615AFDB10DB58CC45F6EB7B9FB88B20F10016DF51AE73A0DB39AD008A60

Function 007C4E1F Relevance: 65.5, APIs: 9, Strings: 28, Instructions: 767
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007ED6D0: GetModuleHandleW.KERNEL32(kernel32.dll,007C4E6C,4EB79311), ref: 007ED6D5
Part of subcall function 007ED6D0: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 007ED6E5

CoInitializeEx.OLE32(00000000,00000000,4EB79311), ref: 007C4F3E
CommandLineToArgvW.SHELL32(?,?), ref: 007C5226
GetLastError.KERNEL32(?,00000001), ref: 007C5276
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 007C52A8
GetLastError.KERNEL32(?,00000001), ref: 007C52F3
GetLongPathNameW.KERNEL32(?,?,00000104), ref: 007C535F
GetLastError.KERNEL32(?,00000002), ref: 007C53AE
CloseHandle.KERNEL32(?,?,00000001), ref: 007C58E9

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Part of subcall function 007C136C: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C13A5

CoUninitialize.OLE32(?,00000001), ref: 007C58D4

Part of subcall function 007D6BD0: __Mtx_init_in_situ.LIBCPMT ref: 007D6CC0

Strings

Failed to create xml updater signature verifier, xrefs: 007C505B
Install, xrefs: 007C5622, 007C56BA, 007C5769, 007C5810
SELF_UPDATE_ALLOWED, xrefs: 007C54CE
Failed to create xml updater logger, xrefs: 007C4FD1
BSI installation success. Exit code: , xrefs: 007C57BC
Started, xrefs: 007C5203, 007C561D
WaitForOtherBSIToExit failed, xrefs: 007C4F16
failed to initialize updater, xrefs: 007C51DC
Failed, xrefs: 007C580B
GetLongPathName failed (, xrefs: 007C539E
MAIN_XML, xrefs: 007C5553
TRUE, xrefs: 007C54AA, 007C54B9, 007C55B2
Some command line BSI variables are invalid., xrefs: 007C5700
Failed to allocate memory for event sender service, xrefs: 007C5123
BootStrapInstaller, xrefs: 007C520D, 007C5627, 007C56BF, 007C576E, 007C5815
SA/WA installation failed with exit code: , xrefs: 007C5863
SaBsi.cpp, xrefs: 007C4E6C, 007C510A, 007C51C3, 007C524D, 007C52CA, 007C5385, 007C5669, 007C56E7, 007C57A3, 007C584A
InvalidArguments, xrefs: 007C56B5
CommandLineToArgvW failed: , xrefs: 007C5266
STORE_XML_ON_DISK, xrefs: 007C55D5
/xml, xrefs: 007C5513, 007C5542
/store_xml_on_disk, xrefs: 007C559B
Ended, xrefs: 007C5764
Process, xrefs: 007C5208
GetModuleFileName failed: , xrefs: 007C52E3
InitSecureDllLoading failed., xrefs: 007C4EAB
/no_self_update, xrefs: 007C548C
FALSE, xrefs: 007C54A2

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast$HandleInitInitializeIos_base_dtorModuleNameOncestd::ios_base::_$AddressArgvBeginCloseCommandCompleteFileLineLongMtx_init_in_situPathProcUninitialize
String ID: /no_self_update$/store_xml_on_disk$/xml$BSI installation success. Exit code: $BootStrapInstaller$CommandLineToArgvW failed: $Ended$FALSE$Failed$Failed to allocate memory for event sender service$Failed to create xml updater logger$Failed to create xml updater signature verifier$GetLongPathName failed ($GetModuleFileName failed: $InitSecureDllLoading failed.$Install$InvalidArguments$MAIN_XML$Process$SA/WA installation failed with exit code: $SELF_UPDATE_ALLOWED$STORE_XML_ON_DISK$SaBsi.cpp$Some command line BSI variables are invalid.$Started$TRUE$WaitForOtherBSIToExit failed$failed to initialize updater
API String ID: 126520999-360321973
Opcode ID: 39da873489f4d51addd7440b7b52ff80d610751829f3933bfd7dd22abd6b2243
Instruction ID: a6b2ec9430894a3e4c517d94ac6c11837e2cb1fc852b3161d28ab30931bcd9f9
Opcode Fuzzy Hash: 39da873489f4d51addd7440b7b52ff80d610751829f3933bfd7dd22abd6b2243
Instruction Fuzzy Hash: B2622AB0900248DEDF14EFA4D899FED7BB4FF55304F50805DE919A7281DB78AA48CBA1

Function 007FEFC0 Relevance: 63.7, APIs: 13, Strings: 23, Instructions: 743
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 007FF13D

Part of subcall function 007F8650: std::locale::_Init.LIBCPMT ref: 007F882F

CloseHandle.KERNEL32(?,?,?,?,?,00000006,00000000,?,?,?,00000000,?,?,?,00000000,00000000), ref: 007FFAC8

Part of subcall function 0083E960: _free.LIBCMT ref: 0083E973

Strings

HTTP send request failed (%d), url: %s, ignore proxy flag %s, xrefs: 007FF2C9
GET, xrefs: 007FF1FD
HTTP query content length (%d), url: %s, xrefs: 007FF3C1
WriteFile failed (%d), xrefs: 007FFAA4
HTTP connection failed (%d), url: %s, xrefs: 007FF1C9
Cache-Control: no-cache, xrefs: 007FF23D
Unable to open HTTP transaction, xrefs: 007FF055
File already exists: %s, xrefs: 007FF8C1
NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk::<lambda_2af623cb1b195cc2505e5df23daadde2>::operator (), xrefs: 007FF05F, 007FF26F, 007FF2D3, 007FF369, 007FF3CB, 007FF43A, 007FF54B, 007FF571, 007FF803, 007FF898, 007FF8CB, 007FFAAE
HTTP receive response failed (%d), url: %s, xrefs: 007FF31A
true, xrefs: 007FF2BA, 007FF2C5
CreateFile failed (%d), xrefs: 007FF88E
HTTP status (%d) error (%d), url: %s, xrefs: 007FF35F
Unable to allocate %d bytes, xrefs: 007FF430
empty filename, xrefs: 007FF541
<, xrefs: 007FF0D2
Unable to rename the old file (%d): %s, xrefs: 007FF7F9
HTTP add request headers failed (%d), url: %s, xrefs: 007FF265
WinHttpCrackUrl failed (%d), url: %s, xrefs: 007FF159
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp, xrefs: 007FF064, 007FF274, 007FF2D8, 007FF36E, 007FF3D0, 007FF43F, 007FF550, 007FF576, 007FF808, 007FF89D, 007FF8D0, 007FFAB3
false, xrefs: 007FF2B5
Unable to extract the filename from url (%s), xrefs: 007FF567
HTTP GET request failed (%d), url: %s, xrefs: 007FF227

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CloseErrorHandleInitLast_freestd::locale::_
String ID: <$Cache-Control: no-cache$CreateFile failed (%d)$File already exists: %s$GET$HTTP GET request failed (%d), url: %s$HTTP add request headers failed (%d), url: %s$HTTP connection failed (%d), url: %s$HTTP query content length (%d), url: %s$HTTP receive response failed (%d), url: %s$HTTP send request failed (%d), url: %s, ignore proxy flag %s$HTTP status (%d) error (%d), url: %s$NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk::<lambda_2af623cb1b195cc2505e5df23daadde2>::operator ()$Unable to allocate %d bytes$Unable to extract the filename from url (%s)$Unable to open HTTP transaction$Unable to rename the old file (%d): %s$WinHttpCrackUrl failed (%d), url: %s$WriteFile failed (%d)$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp$empty filename$false$true
API String ID: 2292809486-983596374
Opcode ID: ea3814e76f0aed1a9109e6f9ea63f33d7fbfd1cdb4b9df380edbafe66aef8bbe
Instruction ID: ba784073e6574932e7cbc809fcae745344f06bfbe51fbcca0ec38b55fcee1695
Opcode Fuzzy Hash: ea3814e76f0aed1a9109e6f9ea63f33d7fbfd1cdb4b9df380edbafe66aef8bbe
Instruction Fuzzy Hash: 4B628DB0A40619EBDB24DB14CC45FA9B7B5FF55304F0041E8F618A7392DBB4AA84CFA5

Function 008065F0 Relevance: 38.9, APIs: 4, Strings: 18, Instructions: 416
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(ProgramW6432,?,00000104), ref: 0080683B
GetLastError.KERNEL32 ref: 0080686E
SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?,?,?,?), ref: 00806A15
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000000,?,?,?,?), ref: 00806A6B

Strings

CSIDL_PROGRAM_FILESX64, xrefs: 00806652, 00806B60
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DirSubstitution.cpp, xrefs: 00806749, 00806881, 00806971, 00806A33
CSIDL_PROGRAM_FILES, xrefs: 00806B05
CSIDL_SYSTEM, xrefs: 00806BCD
CSIDL_WINDOWS, xrefs: 00806C45
NWebAdvisor::NXmlUpdater::CDirSubstitution::Substitute, xrefs: 00806744, 0080687C, 0080696C, 00806A2E
CSIDL_COMMON_APPDATA, xrefs: 00806AAE
CSIDL_PROGRAM_FILESX86, xrefs: 00806B47
CSIDL_PROGRAM_FILES_COMMON, xrefs: 00806B82
Error retrieving directory %s, xrefs: 00806A27
CSIDL_COMMON_STARTUP, xrefs: 00806AE3
CSIDL_COMMON_DOCUMENTS, xrefs: 00806ACA
CSIDL_SYSTEMX86, xrefs: 00806C0C
Unable to get the platform, xrefs: 0080673D
GetEnvironmentVariable failed (%d), xrefs: 00806875
Unknown folder identifier: %s, xrefs: 00806965
ProgramFiles, xrefs: 0080682D
ProgramW6432, xrefs: 00806832, 0080683A

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: EnvironmentErrorFolderFreeKnownLastPathTaskVariable
String ID: CSIDL_COMMON_APPDATA$CSIDL_COMMON_DOCUMENTS$CSIDL_COMMON_STARTUP$CSIDL_PROGRAM_FILES$CSIDL_PROGRAM_FILESX64$CSIDL_PROGRAM_FILESX86$CSIDL_PROGRAM_FILES_COMMON$CSIDL_SYSTEM$CSIDL_SYSTEMX86$CSIDL_WINDOWS$Error retrieving directory %s$GetEnvironmentVariable failed (%d)$NWebAdvisor::NXmlUpdater::CDirSubstitution::Substitute$ProgramFiles$ProgramW6432$Unable to get the platform$Unknown folder identifier: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DirSubstitution.cpp
API String ID: 3946049928-1874136459
Opcode ID: 3b7c5b668e49b7340f0960442d8c4af0be3674fb04a20184f316f2fecc8800de
Instruction ID: ffd933c898e746c093e4af301891caf6d64faedbcea307743af93e9b2c033d3e
Opcode Fuzzy Hash: 3b7c5b668e49b7340f0960442d8c4af0be3674fb04a20184f316f2fecc8800de
Instruction Fuzzy Hash: A802C170A00358DADB60EF64CC49BE9B7B0FF54704F20419CE409A72D1EB79AAA8CF55

Function 007FEAA0 Relevance: 37.8, APIs: 8, Strings: 17, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(4EB79311), ref: 007FEBF9
GetLastError.KERNEL32(4EB79311,?,00000000,007F5D40), ref: 007FEC70
GetLastError.KERNEL32(4EB79311,GET,?,00000000,00000000,00000000,00000000,?,00000000,007F5D40), ref: 007FECD8

Part of subcall function 007F8650: std::locale::_Init.LIBCPMT ref: 007F882F

GetLastError.KERNEL32(4EB79311,Cache-Control: no-cache,000000FF,40000000,GET,?,00000000,00000000,00000000,00000000,?,00000000,007F5D40), ref: 007FED2E
GetLastError.KERNEL32(4EB79311,true,00000000,00000000,Cache-Control: no-cache,000000FF,40000000,GET,?,00000000,00000000,00000000,00000000,?,00000000,007F5D40), ref: 007FED75

Strings

NWebAdvisor::NHttp::NDownloadFile::From::<lambda_1effc98e56da47b46c9f3c737083b6c0>::operator (), xrefs: 007FEC07, 007FEC7E, 007FECE6, 007FED38, 007FED7F, 007FEDBF, 007FEE0E, 007FEE62, 007FEEB6, 007FEF92
GET, xrefs: 007FECC9
HTTP send request failed (%d), url: %s, proxy ignore flag %s, xrefs: 007FED78
HTTP query content length (%d), url: %s, xrefs: 007FEE58
HTTP connection failed (%d), url: %s, xrefs: 007FEC77
Cache-Control: no-cache, xrefs: 007FED13
<, xrefs: 007FEB91
HTTP receive response failed (%d), url: %s, xrefs: 007FEDB8
true, xrefs: 007FED6B, 007FED73
HTTP status (%d) error (%d), url: %s, xrefs: 007FEE07
Unable to allocate %d bytes, xrefs: 007FEEAC
HTTP add request headers failed (%d), url: %s, xrefs: 007FED31
WinHttpCrackUrl failed (%d), url: %s, xrefs: 007FEC00
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp, xrefs: 007FEC0C, 007FEC83, 007FECEB, 007FED3D, 007FED84, 007FEDC4, 007FEE13, 007FEE67, 007FEEBB, 007FEF97
false, xrefs: 007FED66
Not enough space in buffer: bufferLength(%d) Read(%d), xrefs: 007FEF88
HTTP GET request failed (%d), url: %s, xrefs: 007FECDF

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast$Initstd::locale::_
String ID: <$Cache-Control: no-cache$GET$HTTP GET request failed (%d), url: %s$HTTP add request headers failed (%d), url: %s$HTTP connection failed (%d), url: %s$HTTP query content length (%d), url: %s$HTTP receive response failed (%d), url: %s$HTTP send request failed (%d), url: %s, proxy ignore flag %s$HTTP status (%d) error (%d), url: %s$NWebAdvisor::NHttp::NDownloadFile::From::<lambda_1effc98e56da47b46c9f3c737083b6c0>::operator ()$Not enough space in buffer: bufferLength(%d) Read(%d)$Unable to allocate %d bytes$WinHttpCrackUrl failed (%d), url: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp$false$true
API String ID: 1579124236-1699437461
Opcode ID: 3ed67aafda0f82aec4aa7d599749d056c3eb951e9f88a2319e1877ff8c4eac2e
Instruction ID: c88b0da9d1ddcfad074fe34d92422c8cfa95e25e577b5a928f40e0e3c1ebe277
Opcode Fuzzy Hash: 3ed67aafda0f82aec4aa7d599749d056c3eb951e9f88a2319e1877ff8c4eac2e
Instruction Fuzzy Hash: 24C175F0A4071DAAEB209F10DC86BE9B768FF14704F404195F719B72C2D7B95A84CB6A

Function 007FBC60 Relevance: 33.8, APIs: 2, Strings: 17, Instructions: 570
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFindExtensionW.SHLWAPI(00000000,?,?,?,?,0089BFD0,00000000,4EB79311), ref: 007FBD7A
DeleteFileW.KERNEL32(00000000), ref: 007FBE57

Strings

Unable to create destination directory (%d), xrefs: 007FC2AF
Unable to verify MD5, deleting file: %s, xrefs: 007FBE2D
.exe, xrefs: 007FBD84
.cab, xrefs: 007FBD98
DestFile, xrefs: 007FC2D4
extra, xrefs: 007FC096
Unable to get substitute download variables, xrefs: 007FC312, 007FC346
MD5, xrefs: 007FC006
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DownloadCommand.cpp, xrefs: 007FBD50, 007FBE3C, 007FC2BB, 007FC352, 007FC38E
NWebAdvisor::NXmlUpdater::CDownloadCommand::DownloadCommand, xrefs: 007FBD4B, 007FBE37
DestDir, xrefs: 007FBFBE
invalid substitutor, xrefs: 007FBF6A, 007FC387
NWebAdvisor::NXmlUpdater::CDownloadCommand::Execute, xrefs: 007FC2B6, 007FC34D, 007FC389
Unable to download %s, xrefs: 007FBD44
Unable to verify signature, deleting file: %s, xrefs: 007FBDE1
Unable to read Location and/or DestDir attribute of DOWNLOAD command, xrefs: 007FC382
Location, xrefs: 007FBF76

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: DeleteExtensionFileFindPath
String ID: .cab$.exe$DestDir$DestFile$Location$MD5$NWebAdvisor::NXmlUpdater::CDownloadCommand::DownloadCommand$NWebAdvisor::NXmlUpdater::CDownloadCommand::Execute$Unable to create destination directory (%d)$Unable to download %s$Unable to get substitute download variables$Unable to read Location and/or DestDir attribute of DOWNLOAD command$Unable to verify MD5, deleting file: %s$Unable to verify signature, deleting file: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DownloadCommand.cpp$extra$invalid substitutor
API String ID: 3618814920-733304951
Opcode ID: f4815c1503ef2eda5c311cbbc34ee5d0a1c44671164d20f727f3eafcafce8459
Instruction ID: d18a073f398f49797fad775fc6457aeedc578d1cd977cc861506ba9d29aac311
Opcode Fuzzy Hash: f4815c1503ef2eda5c311cbbc34ee5d0a1c44671164d20f727f3eafcafce8459
Instruction Fuzzy Hash: 3D227B71E0020DDBDB14EFA4C995BEEB7B5FF18304F104119EA15A7382DB78AA48CB61

Function 007D0890 Relevance: 30.3, APIs: 13, Strings: 4, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,?,00000000), ref: 007D0903
LocalFree.KERNEL32(?,?), ref: 007D0A26
LocalFree.KERNEL32(?,?), ref: 007D0A43

Part of subcall function 007C2510: __EH_prolog3_catch.LIBCMT ref: 007C2517

std::_Lockit::_Lockit.LIBCPMT ref: 007D0B08
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 007D0B50
std::_Locinfo::~_Locinfo.LIBCPMT ref: 007D0B86
std::locale::_Init.LIBCPMT ref: 007D0B97
std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 007D0BA4
std::_Lockit::_Lockit.LIBCPMT ref: 007D0BC0
std::_Lockit::~_Lockit.LIBCPMT ref: 007D0BE1
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 007D0BF2
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D1017
__Mtx_unlock.LIBCPMT ref: 007D1020

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 007D08FE
ios_base::badbit set, xrefs: 007D0F6E, 007D1055, 007D1081
ios_base::eofbit set, xrefs: 007D1064
ios_base::failbit set, xrefs: 007D105F

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockitstd::locale::_$DescriptorFreeLocalLocimp::_Lockit::_Security$AddfacConvertH_prolog3_catchInitIos_base_dtorLocimpLocimp_LocinfoLocinfo::_Locinfo::~_Locinfo_ctorLockit::~_Mtx_unlockNew_Stringstd::ios_base::_
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4127577005-3388121372
Opcode ID: 6f229b01a3e011af2022e3233a43b0cf17a13aed73730b2c318cee8fc70e552f
Instruction ID: 15734370d076bbc63d13764a1bdb8d0e9a082017fa27d268dd677338ef0483fc
Opcode Fuzzy Hash: 6f229b01a3e011af2022e3233a43b0cf17a13aed73730b2c318cee8fc70e552f
Instruction Fuzzy Hash: 0B326070900258CFDB14DFA8D959BDDBBB4BF08304F14409AE949AB392DB75AE84CF91

Function 007F9400 Relevance: 25.4, APIs: 7, Strings: 7, Instructions: 871
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,4EB79311,?), ref: 007F947B
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 007F948B
GetCurrentProcess.KERNEL32(?), ref: 007F94A8
GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,0089A52C,0089A52A), ref: 007F97C1
GetLastError.KERNEL32(?,?,?,0089A52C,0089A52A), ref: 007F97CB
GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 007F987C
GetLastError.KERNEL32 ref: 007F989A

Strings

GetLongPathName failed (%d) for %s, xrefs: 007F98A2
GetModuleFileName failed (%d), xrefs: 007F97D2
NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetExtractDir, xrefs: 007F97DC, 007F98AC
1.1, xrefs: 007F9BCB
IsWow64Process, xrefs: 007F9485
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp, xrefs: 007F97E1, 007F98B1
kernel32, xrefs: 007F9472

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLastModuleName$AddressCurrentFileHandleLongPathProcProcess
String ID: 1.1$GetLongPathName failed (%d) for %s$GetModuleFileName failed (%d)$IsWow64Process$NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetExtractDir$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp$kernel32
API String ID: 891933594-2307011595
Opcode ID: bea9dea31be6c3033781b080520a2fffa378da74b40e8157e2d231639dd0c788
Instruction ID: 98defabb33d397654e29cc2fa37b0e849d02a3eaa4e58d73df1182d29aa32348
Opcode Fuzzy Hash: bea9dea31be6c3033781b080520a2fffa378da74b40e8157e2d231639dd0c788
Instruction Fuzzy Hash: 12727CB0A00218DBDB24DF64CC89BADB7B5AF49314F1041DCE709AB391DB79AA84CF55

Function 007E59AA Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007E6067
Concurrency::cancel_current_task.LIBCPMT ref: 007E6085
SysFreeString.OLEAUT32 ref: 007E610F
SysFreeString.OLEAUT32(00000000), ref: 007E615A

Strings

NO_REGKEY, xrefs: 007E5CDE
), xrefs: 007E6016
UUID, xrefs: 007E5AC8
IsWow64Process, xrefs: 007E5F95
orm, xrefs: 007E5FDD
kernel32, xrefs: 007E5F82
UUID, xrefs: 007E5C84

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_taskFreeString
String ID: )$IsWow64Process$NO_REGKEY$UUID$UUID$kernel32$orm
API String ID: 3597043392-3766208032
Opcode ID: 1263e392232614cccabd191a3830bebd4d144a10f27b5a1504ae6c1db3ef0577
Instruction ID: b61aaf9daf9d765de21862f426e97433da1cd917075e49f3f85036cd3919d7c1
Opcode Fuzzy Hash: 1263e392232614cccabd191a3830bebd4d144a10f27b5a1504ae6c1db3ef0577
Instruction Fuzzy Hash: BFE1E470901788DBEB24DF68C84879DBBB5FF59304F24461CE415AB3D2EB789984CB91

Function 007F6560 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 211
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFree.KERNEL32(?), ref: 007F6590
GlobalFree.KERNEL32(?), ref: 007F65A1
GlobalFree.KERNEL32(00000101), ref: 007F65B2
GlobalFree.KERNEL32(?), ref: 007F65E1
GlobalAlloc.KERNEL32(00000000,?), ref: 007F660D
GlobalFree.KERNEL32(00000101), ref: 007F6636
GlobalAlloc.KERNEL32(00000000,?), ref: 007F666A
GlobalFree.KERNEL32(?), ref: 007F6696
GlobalFree.KERNEL32(?), ref: 007F66A7
GlobalFree.KERNEL32(?), ref: 007F66B9
GlobalFree.KERNEL32(00000000), ref: 007F677C
GlobalFree.KERNEL32(00000000), ref: 007F678D
GlobalFree.KERNEL32(00000000), ref: 007F67BD
GlobalFree.KERNEL32(00000000), ref: 007F67CE

Strings

`avo, xrefs: 007F6763
Temp, xrefs: 007F6713

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Global$Free$Alloc
String ID: Temp$`avo
API String ID: 1780285237-1390802822
Opcode ID: 9513cb1ba728b69d6b6994396ff4d12163c746012a63917f0e60c5f6bd39c363
Instruction ID: fb14be4011ba2094bf1a3b09ec36c970b169015297fcfddceceb214339285456
Opcode Fuzzy Hash: 9513cb1ba728b69d6b6994396ff4d12163c746012a63917f0e60c5f6bd39c363
Instruction Fuzzy Hash: 5A712970A002199BDF10AFA5CC84BAEBBB8BF14704F158159EE05EB345E779D945CAA0

Function 007D4200 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,4EB79311,?,?), ref: 007D4257
GetLastError.KERNEL32(?,00000001,?,?), ref: 007D42BC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D42F2
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,00000000,?,00000104,00000000,?,?), ref: 007D4367
GetLastError.KERNEL32(?,?), ref: 007D4375
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D440A
CloseHandle.KERNEL32(00000000,?), ref: 007D455B

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Strings

Filename for process with id , xrefs: 007D44B0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$ErrorInitLastOnceProcess$BeginCloseCompleteFullHandleImageInitializeNameOpenQuery
String ID: Filename for process with id
API String ID: 563014942-4200337779
Opcode ID: b718f9b22c820ad9a8a852fce4556e317e96d626e15c14f08ae6114fce65612d
Instruction ID: e83f1737722a2a01e58b7bcc7f5a21cfb458c409f6ca063fe2fa9712d2e8443b
Opcode Fuzzy Hash: b718f9b22c820ad9a8a852fce4556e317e96d626e15c14f08ae6114fce65612d
Instruction Fuzzy Hash: 91D17EB0D10219DBDB20DFA4D849BEDB7B4FF54314F10466DE409A7681EB786A88CB91

Function 008600DE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085FE25: CreateFileW.KERNEL32(00000000,00000000,?,00860187,?,?,00000000,?,00860187,00000000,0000000C), ref: 0085FE42

GetLastError.KERNEL32 ref: 008601F2
__dosmaperr.LIBCMT ref: 008601F9
GetFileType.KERNEL32(00000000), ref: 00860205
GetLastError.KERNEL32 ref: 0086020F
__dosmaperr.LIBCMT ref: 00860218
CloseHandle.KERNEL32(00000000), ref: 00860238
CloseHandle.KERNEL32(00000000), ref: 00860385
GetLastError.KERNEL32 ref: 008603B7
__dosmaperr.LIBCMT ref: 008603BE

Strings

H, xrefs: 00860343

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 44cc84963de6c8d885ce802f4c23a39eef762da59a8fc27575cf82ced59f1311
Instruction ID: e98afd509f88abef24e368a0bb6a03e34a1735b9cc76894dabd7d25bbd5df57c
Opcode Fuzzy Hash: 44cc84963de6c8d885ce802f4c23a39eef762da59a8fc27575cf82ced59f1311
Instruction Fuzzy Hash: CDA12532A042488FCF199F68DC66BAE3BA1FF46325F15025DE811EF391DB359812CB56

Function 007DE380 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 271COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE4A1

Part of subcall function 007DDE80: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DDF0C

__Mtx_unlock.LIBCPMT ref: 007DE3DE

Part of subcall function 007DE0D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE161

__Mtx_unlock.LIBCPMT ref: 007DE4FB
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE665
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE6F8

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Strings

Querying AdhocTelemetryAzure value failed: , xrefs: 007DE614
Event string is empty, xrefs: 007DE477
AdhocTelemetryAzure, xrefs: 007DE5B3
], xrefs: 007DE605
SOFTWARE\McAfee\WebAdvisor, xrefs: 007DE57E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitMtx_unlockOnce$BeginCompleteInitialize
String ID: AdhocTelemetryAzure$Event string is empty$Querying AdhocTelemetryAzure value failed: $SOFTWARE\McAfee\WebAdvisor$]
API String ID: 1670716954-2879113573
Opcode ID: 5cef902f8110e7648a7650b61d59a48411166df7883dee4e866237331316e9b3
Instruction ID: 1f0d39fd7fe337fbaa2642b73972672eee68a3cc27450bf9798e3cd87eacb183
Opcode Fuzzy Hash: 5cef902f8110e7648a7650b61d59a48411166df7883dee4e866237331316e9b3
Instruction Fuzzy Hash: 1291C271900258DBDB14EF54DC4ABEEB7B8EF55310F1041AEE905A7381EB786A48CFA1

Function 007E5A23 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 265COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007E6085
SysFreeString.OLEAUT32 ref: 007E610F
SysFreeString.OLEAUT32(00000000), ref: 007E615A

Strings

NO_REGKEY, xrefs: 007E5CDE
), xrefs: 007E6016
UUID, xrefs: 007E5AC8
IsWow64Process, xrefs: 007E5F95
orm, xrefs: 007E5FDD
kernel32, xrefs: 007E5F82
UUID, xrefs: 007E5C84

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: FreeString$Concurrency::cancel_current_task
String ID: )$IsWow64Process$NO_REGKEY$UUID$UUID$kernel32$orm
API String ID: 2663709405-3766208032
Opcode ID: 479aeded0803b026c7835148d5b97523497c8cd04ca6e174d8a24e7f66b1d89a
Instruction ID: 1de843ebe8443232062dc4310b2264a87631e5c622f6f4a488f54b8e2b875910
Opcode Fuzzy Hash: 479aeded0803b026c7835148d5b97523497c8cd04ca6e174d8a24e7f66b1d89a
Instruction Fuzzy Hash: 5CB1C470901388DBEF14DFA8C94879DBBB1BF59308F24425CE404AB392EB799A84CB51

Function 007DCE00 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 545COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 007DD1E6

Part of subcall function 007CBBB0: std::locale::_Init.LIBCPMT ref: 007CBBFC

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DD6C4

Strings

.servicebus.windows.net/, xrefs: 007DD348
u, xrefs: 007DD666
/messages?timeout=60&api-version=2014-01, xrefs: 007DD368
AWS m_url_aws = , xrefs: 007DD675
Content-Type: application/atom+xml;type=entry;charset=utf-8, xrefs: 007DCF5D
https://, xrefs: 007DD334

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorMtx_init_in_situstd::ios_base::_std::locale::_
String ID: .servicebus.windows.net/$/messages?timeout=60&api-version=2014-01$AWS m_url_aws = $Content-Type: application/atom+xml;type=entry;charset=utf-8$https://$u
API String ID: 655687434-3999228595
Opcode ID: 8299c021909223770a3d7b2da2e1c2d946cc5a9f8425992ed0aa61d2be2d7f20
Instruction ID: e0e038e843e8e0baa23fc46e893e744bb7ef860044475fe070e5f70bc1d8a6f5
Opcode Fuzzy Hash: 8299c021909223770a3d7b2da2e1c2d946cc5a9f8425992ed0aa61d2be2d7f20
Instruction Fuzzy Hash: D3429B70900745CBDB24DF28DD45BA9BBB0FF54308F0486AEE548AB752EB74AA84CF51

Function 007D3D80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

WTSGetActiveConsoleSessionId.KERNEL32(0000003C,?), ref: 007D3E00
OutputDebugStringW.KERNEL32(WTSQuerySessionInformation failed to retrieve current user name for the log name.), ref: 007D3F9C
Concurrency::cancel_current_task.LIBCPMT ref: 007D3FCA

Strings

Error retrieving session id for generating log name., xrefs: 007D3E0B
WTSQuerySessionInformation failed to retrieve current user name for the log name., xrefs: 007D3F97
WTSQuerySessionInformation failed to retrieve the size of the current user name for the log name., xrefs: 007D3F81
UNKNOWN, xrefs: 007D3DD2

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ActiveConcurrency::cancel_current_taskConsoleDebugOutputSessionString
String ID: Error retrieving session id for generating log name.$UNKNOWN$WTSQuerySessionInformation failed to retrieve current user name for the log name.$WTSQuerySessionInformation failed to retrieve the size of the current user name for the log name.
API String ID: 1186403813-1860316991
Opcode ID: 9e7385ba6872b872c0a56790266f04d063be233ffe3ebfe47cbb0dde146c841a
Instruction ID: 8bb1a1927b92c024707cae3654e8e4c49e254c6033735899e00f919b5e614b1b
Opcode Fuzzy Hash: 9e7385ba6872b872c0a56790266f04d063be233ffe3ebfe47cbb0dde146c841a
Instruction Fuzzy Hash: 91518471E00615DBCB149FB4DC89AAEBBB4FF44310F14062AE526D7791E7789A40CBA2

Function 00839900 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,007E4AA5,007E4AA7,00000000,00000000,4EB79311,?,00000000,?,0083BE00,008ABF08,000000FE,?,007E4AA5,?), ref: 00839989
MultiByteToWideChar.KERNEL32(00000000,00000000,007E4AA5,?,00000000,00000000,?,0083BE00,008ABF08,000000FE,?,007E4AA5), ref: 00839A04
SysAllocString.OLEAUT32(00000000), ref: 00839A0F
_com_issue_error.COMSUPP ref: 00839A38
_com_issue_error.COMSUPP ref: 00839A42
GetLastError.KERNEL32(80070057,4EB79311,?,00000000,?,0083BE00,008ABF08,000000FE,?,007E4AA5,?), ref: 00839A47
_com_issue_error.COMSUPP ref: 00839A5A
GetLastError.KERNEL32(00000000,?,00000000,?,0083BE00,008ABF08,000000FE,?,007E4AA5,?), ref: 00839A70
_com_issue_error.COMSUPP ref: 00839A83

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 835cc8a62ebcfa8c81f7fccac4096f0f3cce78ffb7d4a32b76042fcba6e32cf5
Instruction ID: cf22fec10339ec73758ae017ab7bdf4690d24bfee8180800af2865fe10618514
Opcode Fuzzy Hash: 835cc8a62ebcfa8c81f7fccac4096f0f3cce78ffb7d4a32b76042fcba6e32cf5
Instruction Fuzzy Hash: AB41E571A00219DFDB10DF68DC45BAEBBA8FB89714F10422AF949E7281DB749800CBE1

Function 007C9C50 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 313COMMON

Download Yara Rule

APIs

Part of subcall function 007CE310: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 007CE36C

__Mtx_init_in_situ.LIBCPMT ref: 007C9DD4
Concurrency::cancel_current_task.LIBCPMT ref: 007CA06D

Strings

LogLevel, xrefs: 007C9FA8
LogRotationCount, xrefs: 007C9D76
log, xrefs: 007C9D8E
LogRotationFileSize, xrefs: 007C9D16
SOFTWARE\McAfee\WebAdvisor, xrefs: 007C9CF1, 007C9D51, 007C9F83

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: DescriptorSecurity$Concurrency::cancel_current_taskConvertMtx_init_in_situString
String ID: LogLevel$LogRotationCount$LogRotationFileSize$SOFTWARE\McAfee\WebAdvisor$log
API String ID: 239504998-2017128786
Opcode ID: 810efd92be0cf25b976cd652384cf135cd3fabdc62c2b6014454e54f38cf627a
Instruction ID: bd5c3ea2487dc036e6bb002ddb6ec1fd5fb6d216ca0516f8cb0ab700c242b0e5
Opcode Fuzzy Hash: 810efd92be0cf25b976cd652384cf135cd3fabdc62c2b6014454e54f38cf627a
Instruction Fuzzy Hash: CEC18971D00249DFDB04DFA4C949BEEBBB0FF58304F24422DE515A7291EB79AA44CB91

Function 007D6D24 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 007D6D7B
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D6F75
__Mtx_unlock.LIBCPMT ref: 007D6F88

Strings

event sender, xrefs: 007D6EB0, 007D6F4E
async, xrefs: 007D6E9A, 007D6F38
Failed to initialize , xrefs: 007D6F1C
=, xrefs: 007D6F10

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorMtx_init_in_situMtx_unlockstd::ios_base::_
String ID: event sender$=$Failed to initialize $async
API String ID: 3676452600-816272291
Opcode ID: 0b82c095c71585e93534c56822baa02c9227ced873f994370e1f056b71c96784
Instruction ID: 52117f70fd2a83161023e84c78fdd08eceb75ffb3e9551b044d0fc568fa899d8
Opcode Fuzzy Hash: 0b82c095c71585e93534c56822baa02c9227ced873f994370e1f056b71c96784
Instruction Fuzzy Hash: 4F6161B0900305CBDF44DFA4D859BAEBBB5FF44300F54409DE905AB382DB799A48CBA1

Function 007D928D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 007D8FB0: CoCreateGuid.OLE32(?), ref: 007D8FC8
Part of subcall function 007D8FB0: StringFromCLSID.OLE32(?,?), ref: 007D8FE0
Part of subcall function 007D8FB0: CoTaskMemFree.OLE32(?), ref: 007D9138

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D93D1

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Strings

Could not set registry value InstallerFlags, xrefs: 007D93AA
Could not set registry value , xrefs: 007D9338
UUID, xrefs: 007D92F6
Failed to create new UUID, xrefs: 007D92C8
InstallerFlags, xrefs: 007D9368
], xrefs: 007D939E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteCreateFreeFromGuidInitializeStringTask
String ID: Could not set registry value $Could not set registry value InstallerFlags$Failed to create new UUID$InstallerFlags$UUID$]
API String ID: 598746661-2174109026
Opcode ID: 97c9cb1cc10686b01ac6165f79445596a6d2b800a6c8a99628e604c951b6e5ee
Instruction ID: 3fd2b02987fd470b81fd3ec80df4e5aca76af91aff309d5e01452659dfbd2928
Opcode Fuzzy Hash: 97c9cb1cc10686b01ac6165f79445596a6d2b800a6c8a99628e604c951b6e5ee
Instruction Fuzzy Hash: 1C518E70900248DADF14EF60D85ABED7774FF55304F50805DFA4997281EB78AA48CBA6

Function 007D5790 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,NotComDllGetInterface), ref: 007D5808
FreeLibrary.KERNEL32(?), ref: 007D5828
GetLastError.KERNEL32 ref: 007D5830
FreeLibrary.KERNEL32(?), ref: 007D5839

Strings

mfeaaca.dll, xrefs: 007D57A9, 007D57B0
NotComDllGetInterface, xrefs: 007D5802

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: FreeLibrary$AddressErrorLastProc
String ID: NotComDllGetInterface$mfeaaca.dll
API String ID: 1092183831-2777911605
Opcode ID: 20c08d9745393873635ef7682f3fa9a8075251cce27d57013e151efef98806c2
Instruction ID: c91f1337cc1c30c8da2f1a80ba24d4a0757e6b8452577d3b69633397b5f116e3
Opcode Fuzzy Hash: 20c08d9745393873635ef7682f3fa9a8075251cce27d57013e151efef98806c2
Instruction Fuzzy Hash: 5C212532D006199BDB119FA8D84867EBBB8FF55361F4401AAEC05E3310EB39CD009BD1

Function 007C4D63 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 007C4C8E: GetCurrentProcessId.KERNEL32 ref: 007C4CA6
Part of subcall function 007C4C8E: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007C4CB8
Part of subcall function 007C4C8E: Process32FirstW.KERNEL32(00000000,?), ref: 007C4CD3
Part of subcall function 007C4C8E: Process32NextW.KERNEL32(00000000,0000022C), ref: 007C4CE9
Part of subcall function 007C4C8E: FindCloseChangeNotification.KERNEL32(00000000), ref: 007C4CFA

CreateMutexW.KERNEL32(00000000,00000000,Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}), ref: 007C4D88
GetLastError.KERNEL32 ref: 007C4DD0

Part of subcall function 007C136C: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C13A5

WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 007C4DFC
CloseHandle.KERNEL32 ref: 007C4E0D

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Strings

Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}, xrefs: 007C4D7F
SaBsi.cpp, xrefs: 007C4DA9
CreateMutex failed: , xrefs: 007C4DC2

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CloseCreateInitIos_base_dtorOnceProcess32std::ios_base::_$BeginChangeCompleteCurrentErrorFindFirstHandleInitializeLastMutexNextNotificationObjectProcessSingleSnapshotToolhelp32Wait
String ID: CreateMutex failed: $Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}$SaBsi.cpp
API String ID: 2189495138-1117126455
Opcode ID: faa9ce8285f032becd91f125677634b3257846413a6b3299ba95a52bb5fe5680
Instruction ID: fb1afdab0f725ccdaf55f05171f5da103ab2e3f37bf542fcc2ad12be7fe7dd59
Opcode Fuzzy Hash: faa9ce8285f032becd91f125677634b3257846413a6b3299ba95a52bb5fe5680
Instruction Fuzzy Hash: 9011BF30214342DBD720EF20D85AFAA77E4BF51711F40485CB99586192EB789448CAA6

Function 007DEEC0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 007DCCB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DCDBB

Concurrency::cancel_current_task.LIBCPMT ref: 007DF0FC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DF268
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DF307

Strings

Querying AdhocTelemetryAWS value failed: , xrefs: 007DF217
AdhocTelemetryAWS, xrefs: 007DF1B6
SOFTWARE\McAfee\WebAdvisor, xrefs: 007DF181

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$Concurrency::cancel_current_task
String ID: AdhocTelemetryAWS$Querying AdhocTelemetryAWS value failed: $SOFTWARE\McAfee\WebAdvisor
API String ID: 1722207485-3297656441
Opcode ID: 8b4937402fc9f63a6823de069a00aeb6659f312e502a14ab3db04da701af2ef9
Instruction ID: 60a3fc4f76283b2b4ab8ce7b1bcb1ec7de975010aa3a5d3e6fa3aeb8b1376d10
Opcode Fuzzy Hash: 8b4937402fc9f63a6823de069a00aeb6659f312e502a14ab3db04da701af2ef9
Instruction Fuzzy Hash: DFC17F71D00258DBDB14EF68CC49BAEB7B4FF45310F5042AEE416A7382EB786A45CB91

Function 007DE0D0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE161
GetLastError.KERNEL32(?,00000001), ref: 007DE278
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE351

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Strings

Event Sender already initialized for AWS, xrefs: 007DE137
Unable to open HTTP session for AWS, xrefs: 007DE327
WinHttpCrackUrl failed for AWS: , xrefs: 007DE268

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteErrorInitializeLast
String ID: Event Sender already initialized for AWS$Unable to open HTTP session for AWS$WinHttpCrackUrl failed for AWS:
API String ID: 2211357200-794796586
Opcode ID: e3207c90c9ca8892c95b27b2c327d1d4b905f96ac7c8115a7e7770789439ad1e
Instruction ID: 9d64865360c69f5cbee187b833368f6f54efc22b69d24ee6e2958a551b5d2c5f
Opcode Fuzzy Hash: e3207c90c9ca8892c95b27b2c327d1d4b905f96ac7c8115a7e7770789439ad1e
Instruction Fuzzy Hash: ED618E70900B08DBDB25EFA0DC49BEAB7B9FB44305F00056DE519A7381EB746A48CF95

Function 007DDE80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DDF0C
GetLastError.KERNEL32(?,00000001), ref: 007DDFD7
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE0A2

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Strings

WinHttpCrackUrl failed for Azure: , xrefs: 007DDFC7
Event Sender already initialized for Azure, xrefs: 007DDEE2
Unable to open HTTP session for Azure, xrefs: 007DE078

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteErrorInitializeLast
String ID: Event Sender already initialized for Azure$Unable to open HTTP session for Azure$WinHttpCrackUrl failed for Azure:
API String ID: 2211357200-3864554942
Opcode ID: 6e07c051863d255e4fd91212cab0b70d269a238c979293579051a71563ad774f
Instruction ID: 50b9f3940c30c36cb39e9e202eb7fcab8cf0b3f562999685ad5af39b71060377
Opcode Fuzzy Hash: 6e07c051863d255e4fd91212cab0b70d269a238c979293579051a71563ad774f
Instruction Fuzzy Hash: AB516F70900318DBDB25EF90C849BDEB7B8FB14304F10459DE545A7790EBB86A48CB95

Function 007C5A4F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007C5A59

Part of subcall function 007C5C1E: CoCreateInstance.OLE32(0088D808,00000000,00000017,0089B024,00000000,4EB79311,?,?,?,00000000,00000000,00000000,00868687,000000FF), ref: 007C5C7A
Part of subcall function 007C5C1E: OleRun.OLE32(00000000), ref: 007C5C89

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

_com_issue_error.COMSUPP ref: 007C5B97

Strings

Activation option is set successfuly, xrefs: 007C5B69
i, xrefs: 007C5B5D
Failed to set new option. Error , xrefs: 007C5B26
Failed to create Global Options object. Error , xrefs: 007C5AA9

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitOnce$BeginCompleteCreateH_prolog3_InitializeInstanceIos_base_dtor_com_issue_errorstd::ios_base::_
String ID: Activation option is set successfuly$Failed to create Global Options object. Error $Failed to set new option. Error $i
API String ID: 1362393928-3233122435
Opcode ID: 29773285625efdf3457ac16b43164dfdd3770e41eebaccade9f1f0df42cc77f0
Instruction ID: a61c09eb47d98dd1011200def5f43abc9a53c51f435d715d348064c4acdcf2eb
Opcode Fuzzy Hash: 29773285625efdf3457ac16b43164dfdd3770e41eebaccade9f1f0df42cc77f0
Instruction Fuzzy Hash: 30313C70911219CADF04EFA4CC5AFEDB774BF54300F40459CE605A7281EB786A49CFA2

Function 008422D9 Relevance: 9.3, APIs: 6, Instructions: 264COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00842461
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0084247D
__allrem.LIBCMT ref: 00842494
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008424B2
__allrem.LIBCMT ref: 008424C9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008424E7

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: f5f3a44ed8043a2ffd9b201dc5f07ecf71a3fa8d4abf09d185f58aaaf2be2bd1
Instruction ID: acbb17cd64df63dda27f94624ca2440dcfd8e16b092f33742fad1ec95632b505
Opcode Fuzzy Hash: f5f3a44ed8043a2ffd9b201dc5f07ecf71a3fa8d4abf09d185f58aaaf2be2bd1
Instruction Fuzzy Hash: 11811772A04B0AEBE7209E2CCC81B6AB3F9FF44364F648129F411D7391E774DA458795

Function 007D07C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 007D085F
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,?,00000000), ref: 007D0903
LocalFree.KERNEL32(?,?), ref: 007D0A26
__Mtx_unlock.LIBCPMT ref: 007D1020

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 007D08FE

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: DescriptorSecurity$ConvertFreeLocalMtx_destroy_in_situMtx_unlockString
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
API String ID: 4147401711-3078421892
Opcode ID: 533c081ebb553920ac78314f8d12264e89ea0c36a3b0d00b35c91334d717e559
Instruction ID: ade235cfd3768f6129cfbc6df35d44dc1938743846942af8a54144822c548616
Opcode Fuzzy Hash: 533c081ebb553920ac78314f8d12264e89ea0c36a3b0d00b35c91334d717e559
Instruction Fuzzy Hash: C06102719002549FDB14DF68CC89BDEBBB5FF44304F0041AEE44997792E778AA84CB91

Function 007FE580 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 007FE6B0

Strings

NWebAdvisor::XMLParser::ParseBuffer, xrefs: 007FE5AA, 007FE6C3
Unable to convert XML buffer into wide characters, xrefs: 007FE6BC
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XMLParser.cpp, xrefs: 007FE5AF, 007FE6C8
invalid input, xrefs: 007FE5A3

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: __cftoe
String ID: NWebAdvisor::XMLParser::ParseBuffer$Unable to convert XML buffer into wide characters$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XMLParser.cpp$invalid input
API String ID: 4189289331-3914853187
Opcode ID: c232eeec9cc974f35e990cea517e1d340edb247a859131548f8d58e697972515
Instruction ID: 49cddd36314ec5b0abd35735e1a309ff04d4ba3e46e9a12f8a8827c271675a56
Opcode Fuzzy Hash: c232eeec9cc974f35e990cea517e1d340edb247a859131548f8d58e697972515
Instruction Fuzzy Hash: 0741C4B1A01309ABCB24EF68D842B6FF7A4FF14710F41452DF90AD7381EBB8A9148795

Function 007C7F60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__Xtime_get_ticks.LIBCPMT ref: 007C7FAA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007C7FBC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007C7FD0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007C7FE2

Strings

[%Y%m%d %H:%M:%S., xrefs: 007C800C, 007C8019

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Xtime_get_ticks
String ID: [%Y%m%d %H:%M:%S.
API String ID: 3638035285-2843400524
Opcode ID: d8b5ec645cb1f8e3715b86d212d8d589d0a932ce09318e4472baa58c625fbf03
Instruction ID: fb51216628bbbd3dd43baa8e9b29794573356f654c6755fd42019972e4cd6906
Opcode Fuzzy Hash: d8b5ec645cb1f8e3715b86d212d8d589d0a932ce09318e4472baa58c625fbf03
Instruction Fuzzy Hash: 90316071E00214AFDB10EBA8CC46FAEB7B8FB44B10F15412DF504EB381DB78A9048796

Function 007DCCB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DCDBB

Strings

Querying AdhocAWSQAMode value failed: , xrefs: 007DCD76
SOFTWARE\McAfee\WebAdvisor, xrefs: 007DCCF8
AdhocAWSQAMode, xrefs: 007DCD24
5, xrefs: 007DCD6A

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitialize
String ID: 5$AdhocAWSQAMode$Querying AdhocAWSQAMode value failed: $SOFTWARE\McAfee\WebAdvisor
API String ID: 539357862-4010608570
Opcode ID: 786cb5281e11fc4bdc98e510dac7272a2f126ecd5f5b2122d1225607e0b75c81
Instruction ID: 6f4635b9ea8ffc909ea39b625c4503c65ac81a0785460c235d4850a898529cf3
Opcode Fuzzy Hash: 786cb5281e11fc4bdc98e510dac7272a2f126ecd5f5b2122d1225607e0b75c81
Instruction Fuzzy Hash: 0C318071D10249DADF14EFA4C856BEDB7B8FF08300F50456EE505B3281EB786A08CBA1

Function 007E4B40 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 562COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007E5182
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E521E

Strings

N, xrefs: 007E51EB
Invalid arguements passed to AddDimension, xrefs: 007E51F7

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_taskIos_base_dtorstd::ios_base::_
String ID: Invalid arguements passed to AddDimension$N
API String ID: 4106036149-286115907
Opcode ID: 71052c50cd3765c54b4e40b0bd44a18bb84cc1c39dab65b6c401c80832594baf
Instruction ID: 8df5d4769f38cdac5d96d22babce8ca715893c1b4d12c5069ab805ae5722e55c
Opcode Fuzzy Hash: 71052c50cd3765c54b4e40b0bd44a18bb84cc1c39dab65b6c401c80832594baf
Instruction Fuzzy Hash: 8932AE70D01398DFDB24CF69C844B9DBBF1FF49304F148299E459AB292D779A984CB81

Function 00864DB0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 352COMMON

Download Yara Rule

Strings

%s\%s, xrefs: 00864FEC, 0086507D
\\?\, xrefs: 00864F61, 008653C0, 008655DE
%s%s, xrefs: 00865044

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: %s%s$%s\%s$\\?\
API String ID: 0-2843747179
Opcode ID: f3a743f1fe6a5b02469ea9109b3637bd9eeafdef013d5fd8e3860370af1228e3
Instruction ID: 099c575bfcb913fc44f8ba25056a68279e20b61d9311b030ae24fc3659c644cf
Opcode Fuzzy Hash: f3a743f1fe6a5b02469ea9109b3637bd9eeafdef013d5fd8e3860370af1228e3
Instruction Fuzzy Hash: 8FD18C72D00218DBCF10DFA4C885AEEB7B8FF49314F65052AE815E7291E735AA45CBA1

Function 008039A0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 270registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\WATesting,00000000,00000001,?,4EB79311,00000000,00000001), ref: 008039FC

Part of subcall function 00802820: RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,4EB79311,?,?,?), ref: 008028AC

RegCloseKey.ADVAPI32(00000000,?,00000000,811C9DC5,path,00000004,?), ref: 00803D36

Strings

path, xrefs: 00803A22
SOFTWARE\WATesting, xrefs: 008039EB

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CloseInfoOpenQuery
String ID: SOFTWARE\WATesting$path
API String ID: 2142960691-1550987622
Opcode ID: 2a642f147d470c022cb8fcd448b667b145f3a0723d9940d1cbbcc7e0bc2c0438
Instruction ID: 747a14fa575a64f58f314984e6ff2675838a8eda7f5c33afc34111117f331821
Opcode Fuzzy Hash: 2a642f147d470c022cb8fcd448b667b145f3a0723d9940d1cbbcc7e0bc2c0438
Instruction Fuzzy Hash: E2B17E71A00258DFDB24DB64CC49BEEBBB9FF45304F140199E409EB291EB74AB88CB51

Function 007FFBE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0089BFD0,00000000,0089BFD0,00000000,?,0000001C,00000001,00000000,0000001C,?,?,00000014,0089BFD0,00000000,4EB79311), ref: 007FFC1D

Strings

Destination directory does not exist, xrefs: 007FFC8F
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp, xrefs: 007FFC9E
NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk, xrefs: 007FFC99

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AttributesFile
String ID: Destination directory does not exist$NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp
API String ID: 3188754299-3555079292
Opcode ID: 70e2432d50dd13d435a8c7ebe27e9b329da88ac14d583195bc80509acbe6ea3a
Instruction ID: f61018314b39cb0a07cc068afc176e2a9453a237f2f3e828367a00218d473648
Opcode Fuzzy Hash: 70e2432d50dd13d435a8c7ebe27e9b329da88ac14d583195bc80509acbe6ea3a
Instruction Fuzzy Hash: 4F212971A0021C9BCB00DFA8D842AEEB7F4FB48710F01426AFD15E7381EB789A41CB90

Function 007CDC20 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 553COMMON

Download Yara Rule

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 007CE367

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
API String ID: 0-3078421892
Opcode ID: 26db1cd9bdc63c547a09e3c7c3eb7e301f57069b248596452ba494f334849311
Instruction ID: 7f6102b9f66e776d756ea81bcbc82c69532578252bf271cc7fd63de7dd2cef36
Opcode Fuzzy Hash: 26db1cd9bdc63c547a09e3c7c3eb7e301f57069b248596452ba494f334849311
Instruction Fuzzy Hash: 09220971A00248DBDB24DF68DC89BDDB7B5FF84304F10469DE419A7791EB78AA84CB90

Function 007F8650 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 007F882F

Strings

Failed to create log message string. Error 0x, xrefs: 007F89CF
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XmlUpdaterLogger.cpp, xrefs: 007F8AF6

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Initstd::locale::_
String ID: Failed to create log message string. Error 0x$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XmlUpdaterLogger.cpp
API String ID: 1620887387-1553574442
Opcode ID: c78116a95c84e845c7b0dec747d55ae4f239d9e12913a7f248317f0a261412ce
Instruction ID: 513b486c51d1f8c185486f5c3602bcdb5799bcdf29cd8a588730f28b243252d7
Opcode Fuzzy Hash: c78116a95c84e845c7b0dec747d55ae4f239d9e12913a7f248317f0a261412ce
Instruction Fuzzy Hash: 69E12B71E00259DFDB24CF68C885BADB7B5FF48304F14819AE509A7381DB79AA84CF91

Function 007CE310 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 007CE36C

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 007CE367

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
API String ID: 3907675253-3078421892
Opcode ID: 5c55e98965cd1e9eb3720b0258c2b064af8eb33fde13621aded0e512dfb222d1
Instruction ID: 08235c55a9afaff0b12930cceb1f83c4edb8ed013988a0bad62d2e23c2f3e4aa
Opcode Fuzzy Hash: 5c55e98965cd1e9eb3720b0258c2b064af8eb33fde13621aded0e512dfb222d1
Instruction Fuzzy Hash: B5819C709012599BDB24DF28DD8DB9DB7B5EF85308F1042DDE008A7291EB79AB84CF54

Function 007ECC20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

GetLastError.KERNEL32(?,00000001), ref: 007ECCBB
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007ECCEC

Strings

Unable to set proxy option, error: , xrefs: 007ECCAB

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteErrorInitializeLast
String ID: Unable to set proxy option, error:
API String ID: 879576418-14943890
Opcode ID: c4c40d71a75740ccb8e23ddb20c52d0a0ae515de9f6b72d3d537068179781f30
Instruction ID: d314a8a321b6d073914d82283d3272b228751436435645d407b5b96908b67768
Opcode Fuzzy Hash: c4c40d71a75740ccb8e23ddb20c52d0a0ae515de9f6b72d3d537068179781f30
Instruction Fuzzy Hash: 7C318F75A00358DFEB20EFA0CC09FAEB7B9FB04710F00856DE905A3690EB756904CB61

Function 00855FD8 Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085576D: GetConsoleCP.KERNEL32(?,007F860A,00000000), ref: 008557B5

WriteFile.KERNEL32(?,00000000,008AC218,4EB79311,00000000,4EB79311,007F860A,007F860A,007F860A,4EB79311,00000000,?,0084591E,00000000,008AC218,00000010), ref: 00856129
GetLastError.KERNEL32(?,0084591E,00000000,008AC218,00000010,007F860A), ref: 00856133
__dosmaperr.LIBCMT ref: 00856178

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: 8c5f9cbe13e642e6c30fc698abca0d6176b1b40638fe7adcf94277cab4c86409
Instruction ID: c8b0bb5ab0e47621aad260a3f1db20045d6fe503f49716fb2d8a7548413fffbc
Opcode Fuzzy Hash: 8c5f9cbe13e642e6c30fc698abca0d6176b1b40638fe7adcf94277cab4c86409
Instruction Fuzzy Hash: 8651B271A00609AFDF109FA8CC45BEEBBB9FF49356F940051E800F7292E670DD598BA1

Function 007CE640 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,4EB79311,0000005C,?,?,?,?,00000000,0086952D,000000FF,?,007CE09D), ref: 007CE681
CreateDirectoryW.KERNEL32(00000000,?,?,?,?,?,00000000,0086952D,000000FF,?,007CE09D), ref: 007CE738
GetLastError.KERNEL32(?,?,?,?,00000000,0086952D,000000FF,?,007CE09D), ref: 007CE742

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID:
API String ID: 674977465-0
Opcode ID: df38f1419b092d06e2ed872c65c7191567106c59d96f9371bf888630f4b32005
Instruction ID: 22f20e858d57db140790c4ed076b678c15eda04d419d99123a70a94ed1feacc7
Opcode Fuzzy Hash: df38f1419b092d06e2ed872c65c7191567106c59d96f9371bf888630f4b32005
Instruction Fuzzy Hash: 39313731A00204DBDB24CFA8E989FAEF7B4FF49714F10462DE80593780E738A904CBA0

Function 00821F70 Relevance: 4.6, APIs: 3, Instructions: 104encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(00000000,?,?,?), ref: 0082206C
CertVerifyCertificateChainPolicy.CRYPT32(00000003,?,?,?), ref: 008220A4
CertFreeCertificateChain.CRYPT32(?), ref: 008220D0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CertCertificateChain$FreePolicyVerify
String ID:
API String ID: 1741975133-0
Opcode ID: 0a42faac79e0a9af1f8fb92d010a1485f4afa4eaf887ec4fa13e2b8044c938d2
Instruction ID: 16bb6b2f760e50a4faa4ce49f015846a689c8b3a9e0fc0fec41a1a82a0b67e23
Opcode Fuzzy Hash: 0a42faac79e0a9af1f8fb92d010a1485f4afa4eaf887ec4fa13e2b8044c938d2
Instruction Fuzzy Hash: B5418D715083859BD720CF54D884BABBBE8FF89704F04091DF988D7250E775E588CB62

Function 00856B6C Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,007F860A,?,00856A9A,007F860A,008AC5B8,0000000C,00856B4C,008AC218), ref: 00856BC2
GetLastError.KERNEL32(?,00856A9A,007F860A,008AC5B8,0000000C,00856B4C,008AC218), ref: 00856BCC
__dosmaperr.LIBCMT ref: 00856BF7

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 65df36aaf39e4beabce6a756dabf315f62e2d0bbaa1e9f2a5ab929e1d21ff85a
Instruction ID: b698f90203b8e9925673bd681f5b81b6fdd5afbff6a247b4ccc79abcc87b1e23
Opcode Fuzzy Hash: 65df36aaf39e4beabce6a756dabf315f62e2d0bbaa1e9f2a5ab929e1d21ff85a
Instruction Fuzzy Hash: 58012B3260915016C62463386846B7E2B49FF9673BFA90349EC1DDB1D2EE319C9C81A3

Function 008568F6 Relevance: 4.5, APIs: 3, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,00000000,0085F765,00000008,00000000,?,?,?,008569A3,00000000,00000000,?,0085F765), ref: 0085692F
GetLastError.KERNEL32(?,?,?,008569A3,00000000,00000000,?,0085F765,?,0085F765,?,00000000,00000000,00000001,?,00000008), ref: 00856939
__dosmaperr.LIBCMT ref: 00856940

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 7bb7e98efb20cda7dbdfd44d8694d23ea857283c23c4cef46cf9cb8767dd10f4
Instruction ID: 0e586e278efc89dbe5b1ca81eb02c242c25e79bff2ff7e470bf847b62038afad
Opcode Fuzzy Hash: 7bb7e98efb20cda7dbdfd44d8694d23ea857283c23c4cef46cf9cb8767dd10f4
Instruction Fuzzy Hash: 6F01D832610618ABCF059BA9DC468AE3F2AFBC5321B640248F811D7290FA71DD5197A0

Function 00814C8A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: 71f9c47ee025fa77cacf2bb4a04211983cd6e3451e59d604f9f0524a00c2851f
Instruction ID: a3a4056898a7ea7084e7eafe60575f9a54fabf6c1f79625ea5016248aed996eb
Opcode Fuzzy Hash: 71f9c47ee025fa77cacf2bb4a04211983cd6e3451e59d604f9f0524a00c2851f
Instruction Fuzzy Hash: FCB01282259511BD31446158AC02CB7011CF6C1B11B30841AF641C1780D4404CCA5032

Function 00814C9A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: 1ba99d6316cb33c1d621627a8bb3c8f226f74f88c1def1f0f81678d8cd6546d0
Instruction ID: 74d96b1abc877f6ccbe37fb420b596c6f0b201b16939f7e09ce88bbf96c3c771
Opcode Fuzzy Hash: 1ba99d6316cb33c1d621627a8bb3c8f226f74f88c1def1f0f81678d8cd6546d0
Instruction Fuzzy Hash: 95B0128225D6007D324462586C02CF7011CF6C1B11B30411AF641C1780D4404CCE5032

Function 00814CAA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: 2f867c2a4e8b9e7a2047e940ff8f436e5e95c6b882e91d296ac8d60d345762ba
Instruction ID: bb47a51ae55c2b87cd685710367d9f1b694dbc3d791fb1f0973bd606783f1b2e
Opcode Fuzzy Hash: 2f867c2a4e8b9e7a2047e940ff8f436e5e95c6b882e91d296ac8d60d345762ba
Instruction Fuzzy Hash: 38B012822595007D324461586D02DB7111CF7C1B11B30801AF341C17C0D4414CCB5032

Function 00814CBA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B, 00814CBA

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: b62a38e8ed5f376c1911332ba42f903a34482e12dea545d248d8b5a8b20f65da
Instruction ID: 9d0cd00de01085afb29fbe5301346c060fe12579835d12e8b2a4603c499ee135
Opcode Fuzzy Hash: b62a38e8ed5f376c1911332ba42f903a34482e12dea545d248d8b5a8b20f65da
Instruction Fuzzy Hash: 05B01282259510BD314461586C02CB7010CFAC1B21B30801AF541C0750D4514CC65072

Function 00814CCA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: ab9dfa080867b8c9d5557d9360cf9fb638d7c810baeeddedfbbcc9f5cf7345c3
Instruction ID: 214be04eb664bc06c0243fa7688af8bfa9e695811423e1c0b231f0d6ea6b3d59
Opcode Fuzzy Hash: ab9dfa080867b8c9d5557d9360cf9fb638d7c810baeeddedfbbcc9f5cf7345c3
Instruction Fuzzy Hash: 97B012C2259910FD3144615C6D02CB7010CF6C1B11B30801EF541C0740D4804CC65033

Function 00814CDA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: fada8209f258faee2b8a8a78a564ad389cedbd5bde152a44a6f61f7d751c7155
Instruction ID: a1e829088b09e7aed97d0aad66cf2aafca312f2bb282f26d718d369a4e319792
Opcode Fuzzy Hash: fada8209f258faee2b8a8a78a564ad389cedbd5bde152a44a6f61f7d751c7155
Instruction Fuzzy Hash: E4B0128225DA00BD324462586D02CF7010CF6C5B11F30411AF541C0750D4404CCA5033

Function 00814CEA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: 2faa565b77b0dab83f04107eba0ba7a8ff74960e68f3ae84d5c829a7645f7c06
Instruction ID: 6ffc4ba9fd388e10b430ef207fffd997ae953ec167f9c1e046a507f530b2f005
Opcode Fuzzy Hash: 2faa565b77b0dab83f04107eba0ba7a8ff74960e68f3ae84d5c829a7645f7c06
Instruction Fuzzy Hash: D3B01282259900BD324461586E02CB7110CF7C1B11B30801AF241C0740D4414CC75033

Function 00814CFA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: 94c1e7ccd5677b077a43f38e5be2a116955e86d6c24b0f0f3accdd1219bb493f
Instruction ID: 89148836d8dfdffdda60748236fbc3fc65be4fdc882992defd9d8ae9b0922c30
Opcode Fuzzy Hash: 94c1e7ccd5677b077a43f38e5be2a116955e86d6c24b0f0f3accdd1219bb493f
Instruction Fuzzy Hash: 84B01282259900BD314461586D02DB7011CF6C2B11B30401AF141C0740D4404CC69033

Function 00814C69 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814C81

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

yt, xrefs: 00814C7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: yt
API String ID: 1269201914-4251244651
Opcode ID: fe41b9a6860b382575c22f2228b7ffdcc3b7002c49dfaa3539e5152fe00a7359
Instruction ID: 11bb9f99332e4b281b71e2c00cb8151f4767cc258c9e6c63e175fc7e05cec4f9
Opcode Fuzzy Hash: fe41b9a6860b382575c22f2228b7ffdcc3b7002c49dfaa3539e5152fe00a7359
Instruction Fuzzy Hash: 83B0129625D600BD320422646D06CF7110CFAC1B21B30411AF541C064094514CCA50B2

Function 00814D89 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 57c94fa9f6acdfd9a93acf5472457ad8f42f9c95160b850ff410b2172dc8f6b5
Instruction ID: 58c911bc3196321a26033b8a5b89235de92dafc6da947db391ae8fce2b1bf664
Opcode Fuzzy Hash: 57c94fa9f6acdfd9a93acf5472457ad8f42f9c95160b850ff410b2172dc8f6b5
Instruction Fuzzy Hash: 2AB012812587007C3604A558BD02C77121CF6C1F10330902AF602C0740D4440CC79032

Function 00814D93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 4782c6307d78e7ac2b48f4b949f572c7c161cdcf1f827a6c1cbc4c4c3288636e
Instruction ID: f780560832b3c4a846834a8c7e5da7d0a28966fbe050ac419566ed22f13593c0
Opcode Fuzzy Hash: 4782c6307d78e7ac2b48f4b949f572c7c161cdcf1f827a6c1cbc4c4c3288636e
Instruction Fuzzy Hash: CBB0128125C7007C3A04A258BC02CB7021CF5C1F10330512AF902C0740D4440CCAD032

Function 00814D0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 995c3fc9d768a4628cc3d589093b70768cda723c74ca77d515d6d8980e897321
Instruction ID: 37e3f1816957aeb6113ac242e2674bccab0efc7422c99f6d784e44453b0b345e
Opcode Fuzzy Hash: 995c3fc9d768a4628cc3d589093b70768cda723c74ca77d515d6d8980e897321
Instruction Fuzzy Hash: 16B012813585017C36042154BD02C77161CF6C1F14330902AF602C0742D4440CC79032

Function 00814D25 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16, 00814D25

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 08603a6930acbdc717b8df88fa0fdef3c2ab00599d0b738849ab927a4211d1bd
Instruction ID: bd89a6dedfdaacfcf10546e4aee350262c8a0fe6dc5ff0619525c6114c79ad31
Opcode Fuzzy Hash: 08603a6930acbdc717b8df88fa0fdef3c2ab00599d0b738849ab927a4211d1bd
Instruction Fuzzy Hash: 1BB012813585007D35046158BC02DB7026CF5C2F10330502AF502C0741D4440CC6D032

Function 00814D2F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: cf6fa8f663c3054fa68390749af9a17ff6baeda6cd839416070d8f50654ee87a
Instruction ID: dd5b0dbb58d4a5c2ad1f73788529ec4c63193e3a598ba8e9bbd14bc42ca6d4de
Opcode Fuzzy Hash: cf6fa8f663c3054fa68390749af9a17ff6baeda6cd839416070d8f50654ee87a
Instruction Fuzzy Hash: BBB01281258510BC39046158FC02C77071CF5C5F20330912AF903C0740D4480CC69032

Function 00814D39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 9973bc0382df98cce592fdd1dd58dbc98b9f8efeda96bd93abc99be86e5689f0
Instruction ID: 89199b188281830776ccec1914e29b50f4ae98359cd14c199709cd3e0a03cecd
Opcode Fuzzy Hash: 9973bc0382df98cce592fdd1dd58dbc98b9f8efeda96bd93abc99be86e5689f0
Instruction Fuzzy Hash: 1DB0128125C6007C36046258FC02CB7061CF5C1F20330522AF903C0740D4480CCA9032

Function 00814D43 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 61a324c94eae2a05d4fcf8e97b4963db42ac43966c132bdf4e448872f45f57b0
Instruction ID: b0ac582e690e063847ef8fc26248dbeacc70e0940b5fa30dcae6085f8aaf36db
Opcode Fuzzy Hash: 61a324c94eae2a05d4fcf8e97b4963db42ac43966c132bdf4e448872f45f57b0
Instruction Fuzzy Hash: 38B012812585007C36046158FD02C77261DF6C1F20370922AF603C0740D4480CC79032

Function 00814D4D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: e38e0f64abb274e6329c626be8eeb0e104f09b3624e9ae61ce6f64bc8d8eb064
Instruction ID: bf0bc34e5dfdcd63bb059e4928cbd0e19fba5e7330473a00bc3cec5cf6308fa1
Opcode Fuzzy Hash: e38e0f64abb274e6329c626be8eeb0e104f09b3624e9ae61ce6f64bc8d8eb064
Instruction Fuzzy Hash: B9B01281358510BC3A046158BC02C77026CF5C1F10330902AF902C1781D4440CCA9032

Function 00814D57 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 5137474c45e64a29527b444283c2be75e6e1e9cd8a6d06468c001de74848f820
Instruction ID: ede325d70ebc49383004737c40108130a7460f9e475484ccedfcb1b28163ec35
Opcode Fuzzy Hash: 5137474c45e64a29527b444283c2be75e6e1e9cd8a6d06468c001de74848f820
Instruction Fuzzy Hash: EFB012812685007C35046158FC02D77062CF5C2F20330522BF503C0740D4480CC6D032

Function 00814D61 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: c73c0ce5aa07bcc4db79c6d78c637b202b2ace6b0f5fcc3fe3f11618fba88012
Instruction ID: 943fba724f9018a6fc84b4423bc27614e9184465cb4585fdd2cec2b22165f591
Opcode Fuzzy Hash: c73c0ce5aa07bcc4db79c6d78c637b202b2ace6b0f5fcc3fe3f11618fba88012
Instruction Fuzzy Hash: 97B01281258610BC3904A158BC02C77021CF5C1F10330902AFA02C0740D4440CC69032

Function 00814D6B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 6cd65de2e2220a38e297ba1cbac1599a433d146b0d09f22c92c0ca4dcc8a968d
Instruction ID: ecd073ab540c8e90d252feb67276cf54264df36cc9e3ac1e6d15def0e0bfbadc
Opcode Fuzzy Hash: 6cd65de2e2220a38e297ba1cbac1599a433d146b0d09f22c92c0ca4dcc8a968d
Instruction Fuzzy Hash: 8DB0128136C6007C36046258BC02CB7025CF5C1F10330512AF912C0741D4440CCA9032

Function 00814D75 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 1e6fc533f6b32b79a9c549058aba42eccc75e0a5ad8655ca11cbddb550dc78e2
Instruction ID: 91f6d2c31be61fe6c3b0cf53e63085092e8bd4051bde122388693279f44005fc
Opcode Fuzzy Hash: 1e6fc533f6b32b79a9c549058aba42eccc75e0a5ad8655ca11cbddb550dc78e2
Instruction Fuzzy Hash: A8B01281258510BC39046158BC02C77021CF5C1F10330D02AFA02C0740D4441CCA9132

Function 00814D7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814D1C

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Strings

`avo, xrefs: 00814D16

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `avo
API String ID: 1269201914-4146015153
Opcode ID: 6088ae16676063efd85bd96081dbea54b5d8a55c9917f4ecb8650e893d60ec22
Instruction ID: 18afd1da4d7e8254a2342838b7c8be42dcf3ba266cf695b811885282ff320701
Opcode Fuzzy Hash: 6088ae16676063efd85bd96081dbea54b5d8a55c9917f4ecb8650e893d60ec22
Instruction Fuzzy Hash: 68B012812986047C3504A159BC02D77022CF5C2F10330502AF502C0740D4440CC6D132

Function 007E4A40 Relevance: 3.1, APIs: 2, Instructions: 90COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 007E4AD2
SysFreeString.OLEAUT32(-00000001), ref: 007E4AFD

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: FreeString_com_issue_error
String ID:
API String ID: 709734423-0
Opcode ID: 8f3b1cee7ac9e98447057bdeea31a87c57d3d502b0aa7fd2537fbc4fff178f56
Instruction ID: 50c4514ade493ae3be859433ce3153637248176b209814ea6e40cd5330167ed0
Opcode Fuzzy Hash: 8f3b1cee7ac9e98447057bdeea31a87c57d3d502b0aa7fd2537fbc4fff178f56
Instruction Fuzzy Hash: 2F21B5B1901751DBD7209F59C805B56FBE8EF45B20F20462EF86597780E7B8A840C7D0

Function 00855BF0 Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,007F860A,00000000,?,0085610D,007F860A,007F860A,00000000,008AC218,4EB79311,007F860A), ref: 00855C8C
GetLastError.KERNEL32(?,0085610D,007F860A,007F860A,00000000,008AC218,4EB79311,007F860A,007F860A,007F860A,4EB79311,00000000,?,0084591E,00000000,008AC218), ref: 00855CB2

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 2e8cd5bb10faadafc4e65c3e83edb1710ff5709db1946fb9c5fee81df445d217
Instruction ID: cf154c1919f0755f52519bf67ca748944f0f5469d1cb3805437bc188f57549ce
Opcode Fuzzy Hash: 2e8cd5bb10faadafc4e65c3e83edb1710ff5709db1946fb9c5fee81df445d217
Instruction Fuzzy Hash: 86219F30A002189FCF19CF29DC909E9B7BAFB5C302F6440A9E946D7311D630DE86CBA0

Function 007C9BB0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize
String ID:
API String ID: 51270584-0
Opcode ID: 5d0f0049ebfac872c67ce7eeea46f3489233dbfb5ec5e22a2ac03b49ca7d3eaa
Instruction ID: b0aff18071c8bd05060bc645289a991b61709e9969b726cc48d8fb35a57c83c2
Opcode Fuzzy Hash: 5d0f0049ebfac872c67ce7eeea46f3489233dbfb5ec5e22a2ac03b49ca7d3eaa
Instruction Fuzzy Hash: 30016170A40649EBE750EFA4CC0ABAAB7B8FB04B04F10062DB615D67C0DB789908CA55

Function 008399E1 Relevance: 3.0, APIs: 2, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,007E4AA5,?,00000000,00000000,?,0083BE00,008ABF08,000000FE,?,007E4AA5), ref: 00839A04
SysAllocString.OLEAUT32(00000000), ref: 00839A0F

Part of subcall function 0083E960: _free.LIBCMT ref: 0083E973

_com_issue_error.COMSUPP ref: 00839A38
_com_issue_error.COMSUPP ref: 00839A42
GetLastError.KERNEL32(80070057,4EB79311,?,00000000,?,0083BE00,008ABF08,000000FE,?,007E4AA5,?), ref: 00839A47
_com_issue_error.COMSUPP ref: 00839A5A
GetLastError.KERNEL32(00000000,?,00000000,?,0083BE00,008ABF08,000000FE,?,007E4AA5,?), ref: 00839A70
_com_issue_error.COMSUPP ref: 00839A83

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _com_issue_error$ErrorLast$AllocByteCharMultiStringWide_free
String ID:
API String ID: 878839965-0
Opcode ID: 426d1b24ccfadf78a54fadc2355b0209573e3e1743c1f987fc877e9dcd7f1bc1
Instruction ID: a090a16ae994dd448638437b24072588f8ff0519916a7aedf7639255013a8f82
Opcode Fuzzy Hash: 426d1b24ccfadf78a54fadc2355b0209573e3e1743c1f987fc877e9dcd7f1bc1
Instruction Fuzzy Hash: E3016271F052689BDB208F949885B9EBBB4FF8C721F400229FD45A7391DB755850C7E1

Function 007EDEC0 Relevance: 3.0, APIs: 2, Instructions: 22registryCOMMON

Download Yara Rule

APIs

SHDeleteKeyW.SHLWAPI(?,0089BFD0,?,007EDE7B), ref: 007EDED6
RegCloseKey.KERNEL32(?,?,007EDE7B), ref: 007EDEE4

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CloseDelete
String ID:
API String ID: 453069226-0
Opcode ID: 59b5b3d62e643a4ae738860eb339b62592a211c0cdf65de5d6684da43b21ca55
Instruction ID: e8b54592b6b6cb9d30fab9ab9e3c38c5d3f10c968da3ec08c51db0232ce0bce5
Opcode Fuzzy Hash: 59b5b3d62e643a4ae738860eb339b62592a211c0cdf65de5d6684da43b21ca55
Instruction Fuzzy Hash: 59E0ED70505B518AD7309F29E80C7437BD8AB09714F04C84DA49AD6A54C7B8E880CB54

Function 007CDEB0 Relevance: 1.8, APIs: 1, Instructions: 298COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000023,00000001,4EB79311,?,?), ref: 007CDF08
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 007CE36C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: DescriptorSecurity$ConvertFolderPathSpecialString
String ID:
API String ID: 4077199523-0
Opcode ID: be59631f4c187d44b13104760896251df17a3b2556b0d0e17a421a5332dd9ae4
Instruction ID: 1c33364137cfbc0d0b458218fdf92ec33108dc4dba2f0ed1483d56cc0415e008
Opcode Fuzzy Hash: be59631f4c187d44b13104760896251df17a3b2556b0d0e17a421a5332dd9ae4
Instruction Fuzzy Hash: 55C125319002149BCB28DF68DD89B9DB7B2FF85304F10869DE44997791EB79AB84CF90

Function 0085627A Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec05e670af2af24ca183d3eef7450475ca601f533c4a222fb3719cf25083183
Instruction ID: 3122f5b8f693c25245c9da3f9f4f560de083a7db4a86383451c89932e17bd1e3
Opcode Fuzzy Hash: 8ec05e670af2af24ca183d3eef7450475ca601f533c4a222fb3719cf25083183
Instruction Fuzzy Hash: 4041F671A00208AFDB10DF5CC841AEDBBA2FB89365F68816CE848DB351E7329D59C791

Function 0085732A Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00857364

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 88223d009ecaac5c2e0253f7fc1b7aa79bc3588e15d62ac7c36fcccbaa11989c
Instruction ID: cc31af8a8350d5796e8c618355956d1d5be370d2db61bf719ed3eafd39034316
Opcode Fuzzy Hash: 88223d009ecaac5c2e0253f7fc1b7aa79bc3588e15d62ac7c36fcccbaa11989c
Instruction Fuzzy Hash: C11133B1A0420AAFCB05DF58E94599E7BF4FF48304F014069F809EB352D630EA15CBA5

Function 00845854 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738b2551a80a8a8d4bf8db57af4b31d13eda5225752eac16fda81814e4d2ac91
Instruction ID: 8ad3d20005a815c1949d94e76b8f727013b1c3fc80edc2b1464383b32bfdf290
Opcode Fuzzy Hash: 738b2551a80a8a8d4bf8db57af4b31d13eda5225752eac16fda81814e4d2ac91
Instruction Fuzzy Hash: C8F0D132501A2C5BDA21362D9C0565F3299FF92336F140725FC21E71D3DE74D80A8692

Function 007EDF10 Relevance: 1.5, APIs: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?), ref: 007EDF45

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8b653706399ab70903bf6c85f88c95882b78617d2716f19b5e3cedb92473df80
Instruction ID: ba2d27b827a7d0247a7cb2a8976bed6838224c5bc635c2b636f5fdc7884dbb61
Opcode Fuzzy Hash: 8b653706399ab70903bf6c85f88c95882b78617d2716f19b5e3cedb92473df80
Instruction Fuzzy Hash: AB017C35500209EBCB21CF45C804F9EBBB9FF99310F108099F80597350C774AA54DB90

Function 00806050 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?), ref: 00806061

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: ce6b4a6f18d106ca8a01795eb1513f74c8aabe21c934d0c98547fd1b37b86699
Instruction ID: 9a6666e7ec97d88553932ce3d63a5808c8917103ceed2afa781187a45a9d4199
Opcode Fuzzy Hash: ce6b4a6f18d106ca8a01795eb1513f74c8aabe21c934d0c98547fd1b37b86699
Instruction Fuzzy Hash: 10F0A9312002008BC7188F69D808B5BBBE9FF89700F00851CE549CB660E375EA51CBA0

Function 008555F5 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00852174: RtlAllocateHeap.NTDLL(00000000,?,?,?,0083872D,?,?,007CA1ED,0000002C,4EB79311), ref: 008521A6

_free.LIBCMT ref: 00855615

Part of subcall function 00852098: RtlFreeHeap.NTDLL(00000000,00000000,?,0085B729,?,00000000,?,?,?,0085B9CC,?,00000007,?,?,0085BDD6,?), ref: 008520AE
Part of subcall function 00852098: GetLastError.KERNEL32(?,?,0085B729,?,00000000,?,?,?,0085B9CC,?,00000007,?,?,0085BDD6,?,?), ref: 008520C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: b5b8453e045f53aab0fbf0b2073bbc59b012aa93847e0672f8b7c4c90855a5f8
Instruction ID: dcc0f661ea396557fa4196d8439ddd73ee853e2b12540d7b6056862070c37363
Opcode Fuzzy Hash: b5b8453e045f53aab0fbf0b2073bbc59b012aa93847e0672f8b7c4c90855a5f8
Instruction Fuzzy Hash: 74F0C2721017008FD7248F45D401B52F3F8FF80712F10842FE29AC7690DAB0A4498B54

Function 00852174 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0083872D,?,?,007CA1ED,0000002C,4EB79311), ref: 008521A6

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3070a921179365806477a6f57aeaf24d2155c0eda24eea6c55296aaa2060f1f3
Instruction ID: 1a243ecf8b8e3ec77de75910aac1e00bfc4fdfc9ff41ffddcb319d14b0b61b24
Opcode Fuzzy Hash: 3070a921179365806477a6f57aeaf24d2155c0eda24eea6c55296aaa2060f1f3
Instruction Fuzzy Hash: E8E0ED31280A2866EB3036299C04BAB375DFF533E3F114220AE05DA090CF20EC8C81E1

Function 007EE500 Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,?,?), ref: 007EE51F

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9b766f94447ca3726c7627f6dac0c4b130f7eb7bf8f85cb81410345f59fc64c5
Instruction ID: 88597c5dd1946fc2f68c0e1a5927081b152bdd99231826ea11f91b98ec0bdce6
Opcode Fuzzy Hash: 9b766f94447ca3726c7627f6dac0c4b130f7eb7bf8f85cb81410345f59fc64c5
Instruction Fuzzy Hash: 84F05E31601608ABDB248F0ADC08F5EBBA8FF99710F20849EF80997250D6B4AA108B94

Function 007C136C Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C13A5

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 323602529-0
Opcode ID: 6bf1c494e87735a8fc107e2cf30cbc72d352fae77a20acf0a7d07b0cd48815b6
Instruction ID: 4520f7638c0d19e52cf37c034324bcdeac93f95255f1693e95d0460c25316443
Opcode Fuzzy Hash: 6bf1c494e87735a8fc107e2cf30cbc72d352fae77a20acf0a7d07b0cd48815b6
Instruction Fuzzy Hash: 0BF06572904654EFD7159F48DC02F9AB3ECFB09B20F10462EF511D3781DB7969048A94

Function 00864D80 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,00864E6A,00000000,00000000,-00000002,4EB79311,00000028,00000000,?,00000000,extra,00000005,00000000,00000000,008844E4), ref: 00864D92

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 837a2f377753c5cfd3e8db119c2e7da61772494cadedc5315bb8e3173da65479
Instruction ID: 1d96d459450176cd7e0ad763b4794dc3fc8403cd85cbefa7b3006b7ff77d65d0
Opcode Fuzzy Hash: 837a2f377753c5cfd3e8db119c2e7da61772494cadedc5315bb8e3173da65479
Instruction Fuzzy Hash: 1CD0A7315102081DAF541E7CD4696BE334CF94176474D2650F41EC60E8E6B0ECC29310

Function 007EED10 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 007EED2F

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bc3e81368298767ab16f4642168e2ca7d1c5487ed5c5c2f8e572e5d913e0ddbe
Instruction ID: 068f80596b88114703917d741b7ae26cace4c61cc341d2c7d126456e103539f9
Opcode Fuzzy Hash: bc3e81368298767ab16f4642168e2ca7d1c5487ed5c5c2f8e572e5d913e0ddbe
Instruction Fuzzy Hash: C0E0123524014CEBDB00CE85EC44F677B2AFB98700F10C815F9084A195C373DC61ABA0

Function 0085FE25 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00860187,?,?,00000000,?,00860187,00000000,0000000C), ref: 0085FE42

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 61391132672f557d6d5520850bdc0d968d5eac830924ea5cae118e4d114fd910
Instruction ID: d90fc54d0894b656fe82cb07242126d94a143d7a0a26b276d14d202cb4e35914
Opcode Fuzzy Hash: 61391132672f557d6d5520850bdc0d968d5eac830924ea5cae118e4d114fd910
Instruction Fuzzy Hash: EBD06C3200010DBBDF028F84DD06EDA3BAAFB4C714F014040BA1856060C772E961AB91

Function 0082269D Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00822743: DloadGetSRWLockFunctionPointers.DELAYIMP ref: 00822743
Part of subcall function 00822743: AcquireSRWLockExclusive.KERNEL32(?,008228F1), ref: 00822760

DloadProtectSection.DELAYIMP ref: 008226C5

Part of subcall function 0082286C: DloadObtainSection.DELAYIMP ref: 0082287C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Dload$LockSection$AcquireExclusiveFunctionObtainPointersProtect
String ID:
API String ID: 1209458687-0
Opcode ID: a96b1a1076c1e64a6949796e1b904036c2ec742bc6812af6c7fdd6918f77ea38
Instruction ID: ecc3b9952ca97d0eb82b3b4ec0eec6882a8a075dd52825569c40677e0ad2bc36
Opcode Fuzzy Hash: a96b1a1076c1e64a6949796e1b904036c2ec742bc6812af6c7fdd6918f77ea38
Instruction Fuzzy Hash: D5D012315482717EC341BF59BC8A7742350F714300F504511BA15E53B5EFBE88D08B26

Function 007EE8C0 Relevance: 1.5, APIs: 1, Instructions: 11registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 007EE8D4

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e6ac4d2256a66919cb986e879d07dde05276ee0ca9990de23347ce21e842dd69
Instruction ID: 31738c807746a260c992117922ed5ae49920d8d39a3d98cf5c65d615868d98d1
Opcode Fuzzy Hash: e6ac4d2256a66919cb986e879d07dde05276ee0ca9990de23347ce21e842dd69
Instruction Fuzzy Hash: 5CD0EA3604020DBBDF025F81ED05E9A7F2AFB0A761F148455FA1918461C7B3D571ABA5

Function 0083E960 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0083E973

Part of subcall function 00852098: RtlFreeHeap.NTDLL(00000000,00000000,?,0085B729,?,00000000,?,?,?,0085B9CC,?,00000007,?,?,0085BDD6,?), ref: 008520AE
Part of subcall function 00852098: GetLastError.KERNEL32(?,?,0085B729,?,00000000,?,?,?,0085B9CC,?,00000007,?,?,0085BDD6,?,?), ref: 008520C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: fab4fa4e78e3bb56b6f0db2a41ca46f282b47d196b259d4a4af83b9d8bde8242
Instruction ID: 72bdfc2ec58fbf98c2638de530dee5453b06c4f5ced2b62b756b6e0e3f6346d1
Opcode Fuzzy Hash: fab4fa4e78e3bb56b6f0db2a41ca46f282b47d196b259d4a4af83b9d8bde8242
Instruction Fuzzy Hash: 0AC08C3100020CBBCB009B45C806A4E7BA9EB80364F200044F80157280CAB1EE089680

Function 00814D9D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814DAF

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f7c5602edd9f581910ed2ddbc16a62a108414b2b1937db39bbd343c3d75aa30f
Instruction ID: 1c7ffede2d4d254116fa0803a883e6d538328761b53f2550795d5eb599d548a9
Opcode Fuzzy Hash: f7c5602edd9f581910ed2ddbc16a62a108414b2b1937db39bbd343c3d75aa30f
Instruction Fuzzy Hash: 31B012C12995147C31042154BC02D77021CF9C3B207B0401AF182C465094804CC68032

Function 00814DB8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00814DAF

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a5005a91c0577a4944604e037d98c84d946097a232713ab942a856a4e9a66512
Instruction ID: 1c560c87f2629d0c7998d5ae25f85ec0d3b53b56a4875b1453a77a90334cd163
Opcode Fuzzy Hash: a5005a91c0577a4944604e037d98c84d946097a232713ab942a856a4e9a66512
Instruction Fuzzy Hash: E9B012C1298510BC3544616C7C02D77020CF5C5B10330802AF546C4750D4804CCA4032

Function 008214C6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008214D8

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bbebdc1a205faca3a1a3381ce4c253b8f7a0f0d448667e05a36b6296901f894f
Instruction ID: ad650fb31db6750452605c062f0078229e822a4c711610610aa7e3f6d41ddaa8
Opcode Fuzzy Hash: bbebdc1a205faca3a1a3381ce4c253b8f7a0f0d448667e05a36b6296901f894f
Instruction Fuzzy Hash: 86B012A12585217C370431657D06C37211DF2C1B14730C01EF601C1B40D4442CC75036

Function 008397AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008397C4

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 38f0473b7cae755013a6014156e5399cd26f62f8a485f27e32590a127d13ae3a
Instruction ID: e840ae9d735f90ad28ef22dcd3c4ac9ae717d79f01b3e54568081632ecc6524e
Opcode Fuzzy Hash: 38f0473b7cae755013a6014156e5399cd26f62f8a485f27e32590a127d13ae3a
Instruction Fuzzy Hash: 14B012912795107C3204356C6D02C37150CF2C1B10730C42EFA81D0681A4800CCB4032

Function 00839BF0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e59a0c892cd7a40b063f53f994f4d886a025280ce8c7136b2b4661a7d2d4b1a9
Instruction ID: 3ea312bea0d68c092ed9c5d9fc1c7b952479c0ca91759f5d1e3bbd08326a82c5
Opcode Fuzzy Hash: e59a0c892cd7a40b063f53f994f4d886a025280ce8c7136b2b4661a7d2d4b1a9
Instruction Fuzzy Hash: 71B0129126C5147C320461587D02C37610CF2C5B20730851BF241C0750E4C00CC75032

Function 00839BFA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0831d6ede3e0f325bfce23d0aca72af5fa953b904801e84f34c2ba0485e44841
Instruction ID: 4e4dfaf814c491f8d22613129b8a40356007efd98631c628f1586194ef3c2e30
Opcode Fuzzy Hash: 0831d6ede3e0f325bfce23d0aca72af5fa953b904801e84f34c2ba0485e44841
Instruction Fuzzy Hash: 71B0129126C524BC310461587C02C37521CF1C5B20730851BF541C0750D4C00CC65032

Function 00839C04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b7ad22b18419384ab8424364affac90f78403ee49882597cddfdba4ffeafede4
Instruction ID: 287e776d24ee888543867cdf2d329bd292fc44cd28dcc475f6a3a01f98185a15
Opcode Fuzzy Hash: b7ad22b18419384ab8424364affac90f78403ee49882597cddfdba4ffeafede4
Instruction Fuzzy Hash: F7B0129126C5147C310461587C12D37511CF2C6B20730451BF141C0750D4C00CC6D032

Function 00839C0E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: db144029686b565b701866fa1e739f1fedde2ff0975cef0d93d83e395a996a2c
Instruction ID: c14629264f9ed24da1fa1f9736c1984eaf396fbf22aef78948679fad88b3cd95
Opcode Fuzzy Hash: db144029686b565b701866fa1e739f1fedde2ff0975cef0d93d83e395a996a2c
Instruction Fuzzy Hash: B5B0128126C520BC310461687C02C3B614CF1C5B20730851BF541C0740D4C00CC65032

Function 00839C18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 68007ad72e79ad4572478cfe32d531bdea25f4e22b47a9fb97b2136d91d01f7b
Instruction ID: 47dc9affdac20d04b1e4018de18caec03cd142f66964a525e8ba63725f28ec3d
Opcode Fuzzy Hash: 68007ad72e79ad4572478cfe32d531bdea25f4e22b47a9fb97b2136d91d01f7b
Instruction Fuzzy Hash: 66B0128526C6107C320462587C02C7B614CF1C5B20730461BF541C0740D4C04CCA5032

Function 00839C22 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f8c17d4e852e67ce7eabc6cd6b41ca61612ef9fafa5ac53cd2a2584fd8a6ace1
Instruction ID: 9249a4b4c1821a3b546ec6597843cd045910d20df40c59d7d9ee3556a5af4478
Opcode Fuzzy Hash: f8c17d4e852e67ce7eabc6cd6b41ca61612ef9fafa5ac53cd2a2584fd8a6ace1
Instruction Fuzzy Hash: 85B0129126C5107C320461587D02C3B718CF2C5B20B30851BF241C0740D4C00CC75032

Function 00839C2C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b280ac77df6dee350dad46bb9361468c5a2f638eaa057e933dd749a7456224e0
Instruction ID: c0ceac948ea31f0bad84d827b918c2e4a29c092a718cf63f5d04a2e2c0490649
Opcode Fuzzy Hash: b280ac77df6dee350dad46bb9361468c5a2f638eaa057e933dd749a7456224e0
Instruction Fuzzy Hash: 2DB0128226C6147C310465587C02D3B615CF1C6B20730451BF141C0740D4C00CC69032

Function 00839C36 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 87ec64cd961e9a78175ef3fbce0c8e9197f00e1c611dccf96a29013510a60819
Instruction ID: d572da906c673be3d52c740caaabaee9a23976189a8cd9d6b8ad67fe68ab0ec3
Opcode Fuzzy Hash: 87ec64cd961e9a78175ef3fbce0c8e9197f00e1c611dccf96a29013510a60819
Instruction Fuzzy Hash: 0AB0128126C530FC310461597C02D37510CF1C5B20730851BF541C0740E4C04CC66032

Function 00839C40 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bb209176a0befab6da39ab124d1278cab3dfc46978f40b569333f074841d9fc2
Instruction ID: e2499b6b42315394cf658e318f5cec87efe7c12e46edbb272972aadf1ced4d5a
Opcode Fuzzy Hash: bb209176a0befab6da39ab124d1278cab3dfc46978f40b569333f074841d9fc2
Instruction Fuzzy Hash: 50B0128126C620BC320462587C02D77510CF1C5B20730461BF541C0740E4C00CCA6072

Function 00839C4A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 56122ce954fadbab7e571dd65f20d783c8f5e41251cd7e1a19d96c4094b3fd84
Instruction ID: 10515292ae954c1355fb6a3a249c4e1d29fa7d6cebe0afb64f99aca2e8353b92
Opcode Fuzzy Hash: 56122ce954fadbab7e571dd65f20d783c8f5e41251cd7e1a19d96c4094b3fd84
Instruction Fuzzy Hash: 59B0128126C520BC32046158BD02D37610CF2C5B20730851BF241C0750E4C00CC76032

Function 00839C54 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00839BE7

Part of subcall function 0082293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008229AF
Part of subcall function 0082293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008229C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2abf95334d8887e916ba5547e0f742584b6c80854127b1140deb14ddc4cd71a4
Instruction ID: 00a36cd8cb625dc1b111cb086416e6f7bbdf289d28e1ab8b5bcae3dfea23788d
Opcode Fuzzy Hash: 2abf95334d8887e916ba5547e0f742584b6c80854127b1140deb14ddc4cd71a4
Instruction Fuzzy Hash: 06B0128126C520BC310461587C03E37511CF1C6B20730491BF181C0780E4C00CC6A032

Function 007EECD0 Relevance: 1.3, APIs: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 007EECEE

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 47e7805848fae830bb9a31c99cfa28248f0c17f0fea7f290bd78990b83d68d12
Instruction ID: b3a1f27bb2d6f37986699d952ccb1fb2c3999993512af4aaf93f032173284591
Opcode Fuzzy Hash: 47e7805848fae830bb9a31c99cfa28248f0c17f0fea7f290bd78990b83d68d12
Instruction Fuzzy Hash: DFE0C036200519AB9B018B89EC44D9AF76DFBD5261714407BF90487120D671A815D7A0

Non-executed Functions

Function 007F0540 Relevance: 98.2, APIs: 29, Strings: 27, Instructions: 220libraryloaderCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,4EB79311), ref: 007F0571
FreeLibrary.KERNEL32(00000000), ref: 007F05B7
GetProcAddress.KERNEL32(?,SetEntriesInAclW), ref: 007F05DD
GetProcAddress.KERNEL32(?,GetFileSecurityW), ref: 007F05E9
GetProcAddress.KERNEL32(?,SetFileSecurityW), ref: 007F05F5
GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 007F0601
GetProcAddress.KERNEL32(?,GetExplicitEntriesFromAclW), ref: 007F060D
GetProcAddress.KERNEL32(?,RegGetKeySecurity), ref: 007F061C
GetProcAddress.KERNEL32(?,RegSetKeySecurity), ref: 007F0628
GetProcAddress.KERNEL32(?,InitializeSecurityDescriptor), ref: 007F0634
GetProcAddress.KERNEL32(?,SetSecurityDescriptorDacl), ref: 007F0640
GetProcAddress.KERNEL32(?,GetSecurityDescriptorDacl), ref: 007F064C
GetProcAddress.KERNEL32(?,AllocateAndInitializeSid), ref: 007F0658
GetProcAddress.KERNEL32(?,FreeSid), ref: 007F0664
GetProcAddress.KERNEL32(?,OpenThreadToken), ref: 007F0670
GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 007F067C
GetProcAddress.KERNEL32(?,InitializeAcl), ref: 007F0688
GetProcAddress.KERNEL32(?,InitializeSid), ref: 007F0694
GetProcAddress.KERNEL32(?,GetSidSubAuthority), ref: 007F06A0
GetProcAddress.KERNEL32(?,AddAccessAllowedAce), ref: 007F06AC
GetProcAddress.KERNEL32(?,GetSecurityInfo), ref: 007F06B8
GetProcAddress.KERNEL32(?,SetSecurityInfo), ref: 007F06C4
GetProcAddress.KERNEL32(?,QueryServiceStatusEx), ref: 007F06D0
GetProcAddress.KERNEL32(?,GetAce), ref: 007F06DC
GetProcAddress.KERNEL32(?,DeleteAce), ref: 007F06E8
GetProcAddress.KERNEL32(?,EqualSid), ref: 007F06F4
GetProcAddress.KERNEL32(?,GetAclInformation), ref: 007F0700
GetProcAddress.KERNEL32(?,SetSecurityDescriptorControl), ref: 007F070F
LeaveCriticalSection.KERNEL32(?), ref: 007F07DE

Strings

GetSecurityDescriptorDacl, xrefs: 007F0642
GetFileSecurityW, xrefs: 007F05DF
FreeSid, xrefs: 007F065A
RegSetKeySecurity, xrefs: 007F061E
EqualSid, xrefs: 007F06EA
SetSecurityDescriptorDacl, xrefs: 007F0636
GetAclInformation, xrefs: 007F06F6
InitializeSecurityDescriptor, xrefs: 007F062A
QueryServiceStatusEx, xrefs: 007F06C9
InitializeSid, xrefs: 007F068A
LookupAccountSidW, xrefs: 007F05F7
OpenThreadToken, xrefs: 007F0666
GetSecurityInfo, xrefs: 007F06AE
GetTokenInformation, xrefs: 007F0672
RegGetKeySecurity, xrefs: 007F060F
advapi32.dll, xrefs: 007F0595
SetFileSecurityW, xrefs: 007F05EB
DeleteAce, xrefs: 007F06DE
SetEntriesInAclW, xrefs: 007F05D6
InitializeAcl, xrefs: 007F067E
AddAccessAllowedAce, xrefs: 007F06A2
GetSidSubAuthority, xrefs: 007F0696
GetExplicitEntriesFromAclW, xrefs: 007F0603
AllocateAndInitializeSid, xrefs: 007F064E
SetSecurityDescriptorControl, xrefs: 007F0702
GetAce, xrefs: 007F06D2
SetSecurityInfo, xrefs: 007F06BA

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AddressProc$CriticalSection$EnterFreeLeaveLibrary
String ID: AddAccessAllowedAce$AllocateAndInitializeSid$DeleteAce$EqualSid$FreeSid$GetAce$GetAclInformation$GetExplicitEntriesFromAclW$GetFileSecurityW$GetSecurityDescriptorDacl$GetSecurityInfo$GetSidSubAuthority$GetTokenInformation$InitializeAcl$InitializeSecurityDescriptor$InitializeSid$LookupAccountSidW$OpenThreadToken$QueryServiceStatusEx$RegGetKeySecurity$RegSetKeySecurity$SetEntriesInAclW$SetFileSecurityW$SetSecurityDescriptorControl$SetSecurityDescriptorDacl$SetSecurityInfo$advapi32.dll
API String ID: 2701342527-838666417
Opcode ID: d53c77a7e82c2a04149b7f365e70a990e077bc1aea57cc94e300714dd7e2fc21
Instruction ID: 6ca76acb9397b18ec5fae577db14ce612d40a00128528cc425d9a654853d808a
Opcode Fuzzy Hash: d53c77a7e82c2a04149b7f365e70a990e077bc1aea57cc94e300714dd7e2fc21
Instruction Fuzzy Hash: C9814A30941B19FECF21AF61C84CBA5BFA4FF04315F000566E614A2BA1DB79A4A9CFD1

Function 00808190 Relevance: 41.9, APIs: 7, Strings: 16, Instructions: 1638timeCOMMON

Download Yara Rule

APIs

Part of subcall function 007C463F: GetProcessHeap.KERNEL32(?,?,?,007EC2E1,?,?,?,4EB79311,?,00000000), ref: 007C4676

VariantTimeToSystemTime.OLEAUT32 ref: 00808539
GetLastError.KERNEL32(4EB79311,?), ref: 0080867A

Part of subcall function 007E8690: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000), ref: 007E86D6
Part of subcall function 007E8690: LoadResource.KERNEL32(00000000,00000000), ref: 007E86E4
Part of subcall function 007E8690: LockResource.KERNEL32(00000000), ref: 007E86EF
Part of subcall function 007E8690: SizeofResource.KERNEL32(00000000,00000000), ref: 007E86FD
Part of subcall function 007E8690: FindResourceW.KERNEL32(00000000,?,00000006), ref: 007E8764
Part of subcall function 007E8690: LoadResource.KERNEL32(00000000,00000000), ref: 007E8776
Part of subcall function 007E8690: LockResource.KERNEL32(00000000), ref: 007E8785
Part of subcall function 007E8690: SizeofResource.KERNEL32(00000000,00000000), ref: 007E8797

__floor_pentium4.LIBCMT ref: 00808C83
__floor_pentium4.LIBCMT ref: 00808CDF
__floor_pentium4.LIBCMT ref: 00808D37

Strings

NWebAdvisor::NXmlUpdater::CDateSubstitution::Substitute, xrefs: 00809033, 008091D3, 00809283, 008092FB, 0080962A, 00809880, 008098B1, 008098E2
yyyy, xrefs: 00808EEB
Invalid DateTime, xrefs: 00808277, 00808300
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DateSubstitution.cpp, xrefs: 0080868D, 00809038, 008091D8, 00809288, 00809300, 0080962F, 00809885, 008098B6, 008098E7
failed to parse month: %s, xrefs: 008091C9
string %s does not have %d symbols starting index %d, xrefs: 00809279, 008098A7, 008098D8
epoch, xrefs: 00808500, 00808DBF
, xrefs: 0080883B
failed to parse year: %s, xrefs: 008092F1
NWebAdvisor::NXmlUpdater::CDateSubstitution::FormatDateTime, xrefs: 00808688
failed to convert epoch date: %s, xrefs: 00809029
failed to parse day: %s, xrefs: 00809620
GetAsSystemTime failed: %d, xrefs: 00808681
failed to convert date element(s) to int: year = %s, month = %s, day = %s, xrefs: 00809876
TOMORROW, xrefs: 00808BE2
YESTERDAY, xrefs: 00808C2C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Resource$__floor_pentium4$FindLoadLockSizeofTime$ErrorHeapLastProcessSystemVariant
String ID: $GetAsSystemTime failed: %d$Invalid DateTime$NWebAdvisor::NXmlUpdater::CDateSubstitution::FormatDateTime$NWebAdvisor::NXmlUpdater::CDateSubstitution::Substitute$TOMORROW$YESTERDAY$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DateSubstitution.cpp$epoch$failed to convert date element(s) to int: year = %s, month = %s, day = %s$failed to convert epoch date: %s$failed to parse day: %s$failed to parse month: %s$failed to parse year: %s$string %s does not have %d symbols starting index %d$yyyy
API String ID: 3108935575-1381540002
Opcode ID: 33d07f92f7cb24a1c013b38f3cb40355c732a62d3d956b721585ba17625a0412
Instruction ID: 40598d080c1a37101e5d3014d410050c67b653c4dd2789b40ab40804ac753622
Opcode Fuzzy Hash: 33d07f92f7cb24a1c013b38f3cb40355c732a62d3d956b721585ba17625a0412
Instruction Fuzzy Hash: 2FE2AD71A00219CBDB24DF68CC45BEDB7B5FF45304F20829DE459A7292EB34AA85CF91

Function 0080F3C0 Relevance: 33.7, APIs: 13, Strings: 6, Instructions: 463encryptionCOMMON

Download Yara Rule

APIs

CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 0080F442
CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 0080F488
CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 0080F4C6
CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 0080F527
CertGetNameStringW.CRYPT32(00000000,00000005,00000000,00000000,00000000,00000000), ref: 0080F5AD
CertGetNameStringW.CRYPT32(?,00000005,00000000,00000000,00000000,?), ref: 0080F602
CertGetCertificateChain.CRYPT32(00000000,?,?,00000000,00000010,00000000,00000000,?), ref: 0080F89C
CertFreeCertificateChain.CRYPT32(00000000), ref: 0080F8B1
CertFreeCertificateChain.CRYPT32(00000000), ref: 0080F8CB

Part of subcall function 0080E760: CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000000), ref: 0080E877

CertVerifyCertificateChainPolicy.CRYPT32(00000003,00000000,0000000C,00000014), ref: 0080F906
CertFreeCertificateChain.CRYPT32(00000000), ref: 0080F942
CertFreeCRLContext.CRYPT32(?), ref: 0080FA73
CertFreeCRLContext.CRYPT32(00000000), ref: 0080FAA6

Strings

McAfee, LLC, xrefs: 0080F61D
McAfee, LLC., xrefs: 0080F657
4, xrefs: 0080F9D1
Yahoo! Inc., xrefs: 0080F6CF
McAfee, Inc., xrefs: 0080F693
Intel Corporation, xrefs: 0080F705

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Cert$Certificate$ChainFree$ContextCryptParam$NameString$FromPolicyPropertyStoreSubjectVerify
String ID: 4$Intel Corporation$McAfee, Inc.$McAfee, LLC$McAfee, LLC.$Yahoo! Inc.
API String ID: 2452394995-549729705
Opcode ID: 26d355a9df5c1206e1743bde31e9c22b8b2fb806e41add908c64cf8e47b518a5
Instruction ID: 31b6ddaba232fbc9f2d878355d3a97444d9bc747a4c5639d6da142498bd9892e
Opcode Fuzzy Hash: 26d355a9df5c1206e1743bde31e9c22b8b2fb806e41add908c64cf8e47b518a5
Instruction Fuzzy Hash: 4B12A2719002299BDB709F24CC49BEAB7B4FF25714F0481E5EA09E7292E7369E84CF51

Function 0080EB60 Relevance: 27.5, APIs: 18, Instructions: 477encryptionCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,007FBDCE,00000400,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0080EBD2
CryptMsgClose.CRYPT32(00000000), ref: 0080EBE4
CertCloseStore.CRYPT32(00000000,00000001), ref: 0080EBF4
CryptMsgClose.CRYPT32(00000000), ref: 0080ECEE
CertCloseStore.CRYPT32(00000000,00000001), ref: 0080ECFE
CryptQueryObject.CRYPT32(00000002,?,00003FFE,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0080EDEE
CryptMsgClose.CRYPT32(00000000), ref: 0080EE0A
CertCloseStore.CRYPT32(00000000,00000001), ref: 0080EE1C
CryptMsgClose.CRYPT32(00000000), ref: 0080EEB6
CertCloseStore.CRYPT32(00000000,00000001), ref: 0080EEC2

Part of subcall function 0080F3C0: CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 0080F442
Part of subcall function 0080F3C0: CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 0080F488
Part of subcall function 0080F3C0: CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 0080F4C6
Part of subcall function 0080F3C0: CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 0080F527

CryptMsgClose.CRYPT32(00000000), ref: 0080EF02
CertCloseStore.CRYPT32(00000000,00000001), ref: 0080EF14
CryptMsgClose.CRYPT32(00000000), ref: 0080EFAE
CertCloseStore.CRYPT32(00000000,00000001), ref: 0080EFBA
CryptMsgClose.CRYPT32(00000000), ref: 0080EFDA
CertCloseStore.CRYPT32(00000000,00000001), ref: 0080EFEA
CryptMsgClose.CRYPT32(00000000), ref: 0080F0CB
CertCloseStore.CRYPT32(00000000,00000001), ref: 0080F0DB

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Close$Crypt$CertStore$Param$ObjectQuery$CertificateFromSubject
String ID:
API String ID: 2648890560-0
Opcode ID: cac6505ab9c8698fd70e2ac65f28c93bd586ffdae207d10e82e4ebdfe794be27
Instruction ID: 11f2b264c933b1bbc97011f80819c30997f919b2711decae936dfd8e1573dde7
Opcode Fuzzy Hash: cac6505ab9c8698fd70e2ac65f28c93bd586ffdae207d10e82e4ebdfe794be27
Instruction Fuzzy Hash: 2D022A71A002099BEF14DFA8CD99BAEBBB8FF48304F144559E501F72D1DB75AA04CBA0

Function 00802B30 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,4EB79311,00000000,?,00000000,?,00803AE3,00000000,00000000,?,00000000,811C9DC5,path,00000004,?), ref: 00802B73
GetProcAddress.KERNEL32(00000000,Dispatcher), ref: 00802B98
GetProcAddress.KERNEL32(00000000,Controller), ref: 00802BA7
GetProcAddress.KERNEL32(00000000,Release), ref: 00802BC8
FreeLibrary.KERNEL32(00000000), ref: 00802C46
FreeLibrary.KERNEL32(00000000), ref: 00802CC3
GetLastError.KERNEL32(?,00803AE3,00000000,00000000,?,00000000,811C9DC5,path,00000004), ref: 00802CCB

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.cpp, xrefs: 00802CE4
Release, xrefs: 00802BC2
Dispatcher, xrefs: 00802B92
Controller, xrefs: 00802B9E
NWebAdvisor::NXmlUpdater::InternalImpl::GetInstance, xrefs: 00802CDF
Failed to load library %s. Error 0x%08X, xrefs: 00802CD5

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AddressLibraryProc$Free$ErrorLastLoad
String ID: Controller$Dispatcher$Failed to load library %s. Error 0x%08X$NWebAdvisor::NXmlUpdater::InternalImpl::GetInstance$Release$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.cpp
API String ID: 2058215185-435243658
Opcode ID: d84159b5c15ddf0fb63069851a5221f269c8faf7ae51f1578f9db51e2795b9e5
Instruction ID: c25c6c6212e136ca42f79d4ff9261583f3ed790060fea3aafc8266b093a7900a
Opcode Fuzzy Hash: d84159b5c15ddf0fb63069851a5221f269c8faf7ae51f1578f9db51e2795b9e5
Instruction Fuzzy Hash: 6A4128B09003189FD7409FA9DD49B9EBBB4FF08714F15416AE409EB391D7B58940CBA5

Function 0081B4F0 Relevance: 22.2, Strings: 17, Instructions: 999COMMON

Download Yara Rule

Strings

$, xrefs: 0081C1EC
CRLF), xrefs: 0081B892
UTF), xrefs: 0081B654
Error text not found (please report), xrefs: 0081C3BA
NO_START_OPT), xrefs: 0081B6BA
LIMIT_RECURSION=, xrefs: 0081B790
BSR_UNICODE), xrefs: 0081B922
NO_AUTO_POSSESS), xrefs: 0081B698
UTF8), xrefs: 0081B632
LF), xrefs: 0081B869
CR), xrefs: 0081B840
LIMIT_MATCH=, xrefs: 0081B6DC
no error, xrefs: 0081C39A, 0081C3A3
UCP), xrefs: 0081B676
ANY), xrefs: 0081B8BB
BSR_ANYCRLF), xrefs: 0081B907
ANYCRLF), xrefs: 0081B8E1

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: $$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$Error text not found (please report)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF8)$no error
API String ID: 0-2110857069
Opcode ID: 5f0338c3b24e4a2e3951391793902fdb2c0d0b5da60ebef3a8562d17e65d88eb
Instruction ID: 5a69b6bb58085d6753832eb0d94aec02901877f1566b57b0ca934eb1397f7dfd
Opcode Fuzzy Hash: 5f0338c3b24e4a2e3951391793902fdb2c0d0b5da60ebef3a8562d17e65d88eb
Instruction Fuzzy Hash: 7E928D71E002289BDB288F18CC507E9BBB9FF59314F0441E9EA59E7281E7749EC58F91

Function 007D6220 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 428encryptionthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?), ref: 007D6268
GetCurrentThreadId.KERNEL32 ref: 007D6274
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?,?,?,?,?,?), ref: 007D63BF
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 007D63DF
CryptHashData.ADVAPI32(00000000,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 007D63FC

Strings

al exception rule %x:%x res %s, xrefs: 007D632E
3c224a00-5d51-11cf-b3ca-000000000001, xrefs: 007D671E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Crypt$CurrentHash$AcquireContextCreateDataProcessThread
String ID: 3c224a00-5d51-11cf-b3ca-000000000001$al exception rule %x:%x res %s
API String ID: 3004248768-911235813
Opcode ID: ed9e88ab8b42e6a978ee66da54c62d1eb382f4135d280d389ac3f2878d8ad45b
Instruction ID: ed6a06d35433c7cece166442d179509ef819e24c637d71d682623f75cc59d6a7
Opcode Fuzzy Hash: ed9e88ab8b42e6a978ee66da54c62d1eb382f4135d280d389ac3f2878d8ad45b
Instruction Fuzzy Hash: 95F11A35B012289FDB259F14CC95BADB7B5BF48714F1500D9EA0AAB390DB74AE81CF90

Function 007D67B0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 150encryptionthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 007D67F3
GetCurrentThreadId.KERNEL32 ref: 007D67FB
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 007D687F
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 007D689F
CryptHashData.ADVAPI32(00000000,?,00000000,00000000), ref: 007D68BC
CryptGetHashParam.ADVAPI32(00000000,00000002,?,00000010,00000000), ref: 007D68DE
CryptDestroyHash.ADVAPI32(00000000), ref: 007D68EF
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 007D6902
DeviceIoControl.KERNEL32(00000000,9EDBA51C,00000000,00000000,00000000,00000000,?,00000000), ref: 007D6951
DeviceIoControl.KERNEL32(?,9EDB651C,00000000,00000000,00000000,00000000,?,00000000), ref: 007D6980

Strings

Freeing access handle %p, xrefs: 007D67D0
al exception rule %x:%x res %s, xrefs: 007D6824

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Crypt$Hash$ContextControlCurrentDevice$AcquireCreateDataDestroyParamProcessReleaseThread
String ID: Freeing access handle %p$al exception rule %x:%x res %s
API String ID: 581428007-3582322424
Opcode ID: d0360ce8717774f2feb271c5c339311847fc34f77337c43c6223ffeb082ae3a4
Instruction ID: 890a473baef0e904deeb595b26200e69a1b15f1c71f407a1be278bb8e5afb5f1
Opcode Fuzzy Hash: d0360ce8717774f2feb271c5c339311847fc34f77337c43c6223ffeb082ae3a4
Instruction Fuzzy Hash: 6E516771A40218ABDF309B64DC49FDA77B8BB18710F144195FA18E62C5DBB4EE84CF61

Function 0080A540 Relevance: 15.8, Strings: 12, Instructions: 846COMMON

Download Yara Rule

Strings

Unable to substitute the arguments, xrefs: 0080B077
NWebAdvisor::NXmlUpdater::CDateDeltaPrecondition::IsPreconditionSatisfied, xrefs: 0080A9FF, 0080B07E
failed to parse date from name: %s, xrefs: 0080A5B2
invalid stol argument, xrefs: 0080A987
NWebAdvisor::NXmlUpdater::CDateDeltaPrecondition::CheckDateDelatImpl, xrefs: 0080A956
stol argument out of range, xrefs: 0080A991
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DateDeltaPrecondition.cpp, xrefs: 0080A95B, 0080AA04, 0080B083
[DATE:TODAY], xrefs: 0080AA28
failed to parse date from value: %s, xrefs: 0080A63C
invalid substitutor, xrefs: 0080A9F8
Unknown comparison operator: %s, xrefs: 0080A94F
NEQ, xrefs: 0080A8CD

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Time$SystemVariant
String ID: NEQ$NWebAdvisor::NXmlUpdater::CDateDeltaPrecondition::CheckDateDelatImpl$NWebAdvisor::NXmlUpdater::CDateDeltaPrecondition::IsPreconditionSatisfied$Unable to substitute the arguments$Unknown comparison operator: %s$[DATE:TODAY]$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DateDeltaPrecondition.cpp$failed to parse date from name: %s$failed to parse date from value: %s$invalid stol argument$invalid substitutor$stol argument out of range
API String ID: 352189841-3100175478
Opcode ID: 29fc26eb008b4713affd6bb78aefd21e9a6dab8a44a8962467fd64214b3850b4
Instruction ID: ded4c98c90f6a1dbdf0f095b2a32de78ef3eb5ffb14dae9707869ae82008211f
Opcode Fuzzy Hash: 29fc26eb008b4713affd6bb78aefd21e9a6dab8a44a8962467fd64214b3850b4
Instruction Fuzzy Hash: 03728B71D00208DADB69DFA8CC55BEEB7B4FF15304F10829DE41AAB291EB346A85CF51

Function 008128A0 Relevance: 13.0, Strings: 10, Instructions: 464COMMON

Download Yara Rule

Strings

Unable to substitute variables for the SEND_EVENT command, xrefs: 00812B56, 00812B98, 00812BDD, 00812C29, 00812C74, 00812CC2, 00812D10, 00812D5B, 00812E26, 00812E32
Encountered SEND_EVENT, but no event reporter was defined, xrefs: 008128E2
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SendEventCommand.cpp, xrefs: 00812B62, 00812BA4, 00812BE9, 00812C35, 00812C83, 00812CD1, 00812D1F, 00812D6A, 00812E03, 00812E39, 00812E79
Name, xrefs: 00812DB0
NWebAdvisor::NXmlUpdater::CSendEventCommand::Execute, xrefs: 00812B5D, 00812B9F, 00812BE4, 00812C30, 00812C7E, 00812CCC, 00812D1A, 00812D65, 00812DFE, 00812E34, 00812E74
default, xrefs: 00812C0B, 00812DA1
invalid substitutor, xrefs: 008128F6
Invalid, xrefs: 00812E63
Unexpected call to legacy SEND_EVENT command, xrefs: 00812DF7
Invalid arguments passed to SEND_EVENT command, xrefs: 00812E6D

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: Encountered SEND_EVENT, but no event reporter was defined$Invalid$Invalid arguments passed to SEND_EVENT command$NWebAdvisor::NXmlUpdater::CSendEventCommand::Execute$Name$Unable to substitute variables for the SEND_EVENT command$Unexpected call to legacy SEND_EVENT command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SendEventCommand.cpp$default$invalid substitutor
API String ID: 0-494503603
Opcode ID: 539306fcbbb4aa6b2cd638a541e39b806c49edd5db02080fa98dad888e0f627a
Instruction ID: 7ecac5755642d2c7a8571a9445a9c0bc94061c62d4691b2a92c15cdc04d02e19
Opcode Fuzzy Hash: 539306fcbbb4aa6b2cd638a541e39b806c49edd5db02080fa98dad888e0f627a
Instruction Fuzzy Hash: B4023D74A40208EBDB14EF90C95ABEE77B4FF54704F100158E511BB382DBB9AE58CBA1

Function 007B5400 Relevance: 11.4, APIs: 3, Strings: 3, Instructions: 918COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007B59C1
Concurrency::cancel_current_task.LIBCPMT ref: 007B59C6
Concurrency::cancel_current_task.LIBCPMT ref: 007B6066

Strings

/, xrefs: 007B5A6B
YSTEM, xrefs: 007B6080
), xrefs: 007B5A61

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: )$/$YSTEM
API String ID: 118556049-314724184
Opcode ID: 0758470be2b32d31cd8471886941392c17f93a62db6e7daf42aaea9d6b02d379
Instruction ID: 5852c2c539f3e8ea7528885ca9e75393b4be503888ca50b7c3fb73b081aaf4c6
Opcode Fuzzy Hash: 0758470be2b32d31cd8471886941392c17f93a62db6e7daf42aaea9d6b02d379
Instruction Fuzzy Hash: 4172D1B1E00354CFDB14CF68C8557AE77B5FB58314F60066DE42AEB291EB399A84CB41

Function 007BA610 Relevance: 11.4, APIs: 3, Strings: 3, Instructions: 886COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007BABD1
Concurrency::cancel_current_task.LIBCPMT ref: 007BABD6
Concurrency::cancel_current_task.LIBCPMT ref: 007BB256

Strings

YSTEM, xrefs: 007BB270
), xrefs: 007BAC51
/, xrefs: 007BAC5B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: )$/$YSTEM
API String ID: 118556049-314724184
Opcode ID: c8c21341d500c410a1ddd8c9336eb1d732817aa597516a66b194c55547ecdda7
Instruction ID: 60bd69cf297312740f53f3601dbbf263fb0e1f063d4bb80eda5a7579fae51298
Opcode Fuzzy Hash: c8c21341d500c410a1ddd8c9336eb1d732817aa597516a66b194c55547ecdda7
Instruction Fuzzy Hash: 5F7200B1D00254DFDB249F28C8557EEB7B5FB58304F20462DE42AE7391EB799A84CB42

Function 007B2B00 Relevance: 11.4, APIs: 3, Strings: 3, Instructions: 886COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007B30C1
Concurrency::cancel_current_task.LIBCPMT ref: 007B30C6
Concurrency::cancel_current_task.LIBCPMT ref: 007B3746

Strings

/, xrefs: 007B314B
YSTEM, xrefs: 007B3760
), xrefs: 007B3141

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: )$/$YSTEM
API String ID: 118556049-314724184
Opcode ID: b41543fd7a22ece77ad62bb9687303b54f82e3ab1e03dd1724b8df6af5cc2ed7
Instruction ID: 5df7abe5092602f457f05f8f0558dce9bf850d023cede228325e95e485e94cf3
Opcode Fuzzy Hash: b41543fd7a22ece77ad62bb9687303b54f82e3ab1e03dd1724b8df6af5cc2ed7
Instruction Fuzzy Hash: C272D3B1D00254DFEB24DF64C8557EE7BB5FB58314F20062DE42AE7292EB399A84CB41

Function 007BCF40 Relevance: 11.4, APIs: 3, Strings: 3, Instructions: 886COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007BD501
Concurrency::cancel_current_task.LIBCPMT ref: 007BD506
Concurrency::cancel_current_task.LIBCPMT ref: 007BDB86

Strings

/, xrefs: 007BD58B
), xrefs: 007BD581
YSTEM, xrefs: 007BDBA0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: )$/$YSTEM
API String ID: 118556049-314724184
Opcode ID: 7d4700aa6a5ac5cff2f4294c347e1f7b09b8ec7c5e49dd707774b82cdd64ad42
Instruction ID: 8fb12b08a7b284f0e2c5c6a4def84045eab40df7b3ad21abf4187ac2fe1af2af
Opcode Fuzzy Hash: 7d4700aa6a5ac5cff2f4294c347e1f7b09b8ec7c5e49dd707774b82cdd64ad42
Instruction Fuzzy Hash: 1572DFB1D00254CFDB249F68C8157EE77B5FB58314F20466DE42AE7291FB399A84CB81

Function 0080F150 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 342encryptionCOMMON

Download Yara Rule

APIs

CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 0080F442
CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 0080F488
CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 0080F4C6
CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 0080F527

Strings

1.3.6.1.4.1.311.2.4.1, xrefs: 0080F1A3

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CryptParam$CertCertificateFromStoreSubject
String ID: 1.3.6.1.4.1.311.2.4.1
API String ID: 738114118-146536318
Opcode ID: 7191380e03ebc046e9ea1d7508947cc39e7ba08b657fdad167465feba6dd446c
Instruction ID: 4a645523389a3a7e7bc8547b292920e526d5290afa20cadf5769f9c70eef0f32
Opcode Fuzzy Hash: 7191380e03ebc046e9ea1d7508947cc39e7ba08b657fdad167465feba6dd446c
Instruction Fuzzy Hash: 01D178719002199FCB65DF68CC85BAEBBB5FF49310F1081A9E919A7781D730AA44CFA1

Function 00816D43 Relevance: 10.7, Strings: 8, Instructions: 655COMMON

Download Yara Rule

Strings

\b(?=\w), xrefs: 00816D5B
@, xrefs: 008172CE
^, xrefs: 0081705F
Q\E, xrefs: 00816E11
[:>:]], xrefs: 00816D7A
\b(?<=\w), xrefs: 00816D8F
[:<:]], xrefs: 00816D45
alpha, xrefs: 00816F83, 00816F9C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: @$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$^$alpha
API String ID: 0-4118445655
Opcode ID: 778145afd09631e7c31de2b239f4e727736e2baec01062261d65a433b6b71aa6
Instruction ID: baa0aa5fcb439957a856c9293033a60793b0a7ed9d62648099b99e56b228ab57
Opcode Fuzzy Hash: 778145afd09631e7c31de2b239f4e727736e2baec01062261d65a433b6b71aa6
Instruction Fuzzy Hash: AA423974D082588BDF258F64C8907EDBBB9FF0A314F28419DD98AAB252D73099C6CB51

Function 0085CE06 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0085D124,00000002,00000000,?,?,?,0085D124,?,00000000), ref: 0085CE9F
GetLocaleInfoW.KERNEL32(?,20001004,0085D124,00000002,00000000,?,?,?,0085D124,?,00000000), ref: 0085CEC8
GetACP.KERNEL32(?,?,0085D124,?,00000000), ref: 0085CEDD

Strings

OCP, xrefs: 0085CE5A
ACP, xrefs: 0085CE24

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0f26e0bfe2dac2efead7f74fe953fdf729316e3b52bdd2624468d9b9db969f7c
Instruction ID: cd467545d26e5c097fadd01ea4d700d0b691a1042575d5a7c0801f10be17cd4b
Opcode Fuzzy Hash: 0f26e0bfe2dac2efead7f74fe953fdf729316e3b52bdd2624468d9b9db969f7c
Instruction Fuzzy Hash: C321B632600305AEDB30CF65C907AA773A6FB54B5AB564464ED0AD7204E732DE49CBA0

Function 007FD2C0 Relevance: 8.0, Strings: 6, Instructions: 504COMMON

Download Yara Rule

Strings

expected =, xrefs: 007FD9D8
invalid numeric character entity, xrefs: 007FD3A3
unexpected end of data, xrefs: 007FD551
expected ' or ", xrefs: 007FD9F1
expected element name, xrefs: 007FD7C8
expected >, xrefs: 007FD7E4, 007FD800

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: expected ' or "$expected =$expected >$expected element name$invalid numeric character entity$unexpected end of data
API String ID: 0-1758782166
Opcode ID: 4b881e269b88ac556b61fda23b763541bd4d36e0604da0b5a271297eae3b1d6d
Instruction ID: 81c5180df7f627efbd7ee7891507860ad8078a6d0085f42b4a7fe563686cf172
Opcode Fuzzy Hash: 4b881e269b88ac556b61fda23b763541bd4d36e0604da0b5a271297eae3b1d6d
Instruction Fuzzy Hash: 7C0200B06042088FC728CF28C495B75BBE2FF55304F28859DE699CB392E7B99D51CB91

Function 0085CFDB Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00851CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00854E01), ref: 00851CAE
Part of subcall function 00851CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00851D4C

Part of subcall function 00851CA9: _free.LIBCMT ref: 00851D0B
Part of subcall function 00851CA9: _free.LIBCMT ref: 00851D41

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0085D0E7
IsValidCodePage.KERNEL32(00000000), ref: 0085D130
IsValidLocale.KERNEL32(?,00000001), ref: 0085D13F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0085D187
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0085D1A6

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: bd1d0a26407be9400e7b0b427bd8b9aabac3cdd3ecb147d0ff636c40457626dd
Instruction ID: 4ff49e582e80d608a4b9762541c68e226b6e47a96c97674eea740bf5de4c72a9
Opcode Fuzzy Hash: bd1d0a26407be9400e7b0b427bd8b9aabac3cdd3ecb147d0ff636c40457626dd
Instruction Fuzzy Hash: 4D5161719007069FDF20EFA8CC45AAAB7B8FF09702F144469ED15EB190DB70D949CB61

Function 00820660 Relevance: 7.2, Strings: 5, Instructions: 986COMMON

Download Yara Rule

Strings

ERCP, xrefs: 008207DF
VUUU, xrefs: 00820B9E
VUUU, xrefs: 00820BD1
PCRE, xrefs: 008207E8
VUUU, xrefs: 00820C5C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU
API String ID: 0-663802839
Opcode ID: 1dcebbfced8c54513b23a53bb47d4b9c6d72c14f2c5cfac6a5bd872a477ce4f6
Instruction ID: 5d27911dca35d24884be02a060149bea5762a90988a0570721aaf403ef97dbf0
Opcode Fuzzy Hash: 1dcebbfced8c54513b23a53bb47d4b9c6d72c14f2c5cfac6a5bd872a477ce4f6
Instruction Fuzzy Hash: 67824A71A002698BDF24CF18E8847ADBBB1FF55314F2442AAD859EB282D7319EC5CF51

Function 008393F2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 008393FE
IsDebuggerPresent.KERNEL32 ref: 008394CA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008394EA
UnhandledExceptionFilter.KERNEL32(?), ref: 008394F4

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 362c89236748818e7736adec9616861a2de3ab3b9e314be5035690bf569e53b3
Instruction ID: 9785553ff98b8d224fc1d00e17e5ba0863f477727009cc85654750370a3ecff1
Opcode Fuzzy Hash: 362c89236748818e7736adec9616861a2de3ab3b9e314be5035690bf569e53b3
Instruction Fuzzy Hash: 6231F47590121CDBDB11DFA4D989BCDBBB8BF08300F1041EAE44DAB250EB709A858F45

Function 008183A0 Relevance: 5.5, Strings: 4, Instructions: 532COMMON

Download Yara Rule

Strings

), xrefs: 00819093
), xrefs: 0081844A
\b(?=\w), xrefs: 00818480
:, xrefs: 00818403

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: )$)$:$\b(?=\w)
API String ID: 0-1096454370
Opcode ID: efc16997f8cf55d66101203e1ae3db6575f551928740ec862a79ecb38e7cb4df
Instruction ID: eee17040ab9b47326bde025434a2095159372f1e7552637321bf790bdb268eb3
Opcode Fuzzy Hash: efc16997f8cf55d66101203e1ae3db6575f551928740ec862a79ecb38e7cb4df
Instruction Fuzzy Hash: 06321674E04229CFDB25CF68C8907E9BBB9FF09314F14819AD89AEB291C7749985CB50

Function 0085CA80 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00851CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00854E01), ref: 00851CAE
Part of subcall function 00851CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00851D4C

Part of subcall function 00851CA9: _free.LIBCMT ref: 00851D0B
Part of subcall function 00851CA9: _free.LIBCMT ref: 00851D41

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0085CAD4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0085CB1E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0085CBE4

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 81b2af2447930a861114e3c6f0af59da31d54f33eed3922fd02b156d50727e36
Instruction ID: cefbe10fea20c0ab8ca12d1bd005ecfc254697aa8957362cf4bdcca4a20a5f90
Opcode Fuzzy Hash: 81b2af2447930a861114e3c6f0af59da31d54f33eed3922fd02b156d50727e36
Instruction Fuzzy Hash: 24616C715002179FEB289F28CC82BBA7BA8FF04316F1440AAED09D6585E738DD88DF51

Function 0083D453 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,008B80CC), ref: 0083D54B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,008B80CC), ref: 0083D555
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,008B80CC), ref: 0083D562

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 7866b6085345463a8bc8adb5080f3cbf9e4c52903334efc7002f0b7791822589
Instruction ID: 4d03b3946aebff700ed6a24592cd305e3b4fd06f75d3b6f7a693dee0e88970a6
Opcode Fuzzy Hash: 7866b6085345463a8bc8adb5080f3cbf9e4c52903334efc7002f0b7791822589
Instruction Fuzzy Hash: 213194749112189BCB21DF68D98978DBBB8FF58310F5042DAE41CA6251EB709B858F85

Function 007E8EA0 Relevance: 3.6, APIs: 2, Instructions: 635COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007E91DE
Concurrency::cancel_current_task.LIBCPMT ref: 007E952E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 37e24794b02d0316e1528f0e96ea542d8d99ec99c968d42ba1f42eb175d8b0c8
Instruction ID: 32b43c40ea4553177f273907eb8e78fa660a3c1447c9af0362c48414e857407a
Opcode Fuzzy Hash: 37e24794b02d0316e1528f0e96ea542d8d99ec99c968d42ba1f42eb175d8b0c8
Instruction Fuzzy Hash: 3122D072D01258EBCF19DFA9DC40AAEB7B5FF48310F154229F915E7291EB38A9018B91

Function 0084B340 Relevance: 3.4, APIs: 2, Instructions: 450COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f91763730849d915511db82139adc0cf9be373c6b07c1b70189e3b8341c6ec
Instruction ID: 5646a4e6be40f31e802570406e9523f4ccad18313a7eef849021b6045a55f76e
Opcode Fuzzy Hash: 85f91763730849d915511db82139adc0cf9be373c6b07c1b70189e3b8341c6ec
Instruction Fuzzy Hash: ECF11C71E0121D9BDF14CFA8C8806AEBBB1FF98314F258269D919EB345D731AE01CB94

Function 008570B4 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,00845A30,?,Microsoft Visual C++ Runtime Library,00012012,?,00000240,?,00000003,?,?,?,00000000,00000480), ref: 0085703D
OutputDebugStringW.KERNEL32(?,?,00845A30,?,Microsoft Visual C++ Runtime Library,00012012,?,00000240,?,00000003,?,?,?,00000000,00000480,?), ref: 00857054

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: DebugDebuggerOutputPresentString
String ID:
API String ID: 4086329628-0
Opcode ID: 47a8d7ad1c1b3f3e3d4cd7324c7b535c5d738d10d449f39aba337b212555366f
Instruction ID: c754a8b83507972803c12d694effaed850ada284a12ba1bd12645c06e42f70dc
Opcode Fuzzy Hash: 47a8d7ad1c1b3f3e3d4cd7324c7b535c5d738d10d449f39aba337b212555366f
Instruction Fuzzy Hash: F3018F31148A29669F206A65BC4AB6F3BC9FF05367F288401FD09D6191DA21C84995B2

Function 008514AF Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,008514AA,?,?,00000008,?,?,00860D68,00000000), ref: 008516DC

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7c49ffed50408dc6a9c3d66badda07a30cd6a02428a8c64a93530a2fc2eb4185
Instruction ID: 09896465f3e69c157becf070faf683387deb12fcd048911676850c4083c972d2
Opcode Fuzzy Hash: 7c49ffed50408dc6a9c3d66badda07a30cd6a02428a8c64a93530a2fc2eb4185
Instruction Fuzzy Hash: CBB15C35210608DFDB15CF2CC48AB657BE0FF49366F298658E89ACF2A1C335E995CB40

Function 00839215 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0083922B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: df79854ac92f4fe2d4a2d563353c04a9ac5b1605e04c942fdc19371ad5b7256d
Instruction ID: b759e9c30ad2541bea07b96ed9b50c17330651a1968065cd4335e2e9046c1a4b
Opcode Fuzzy Hash: df79854ac92f4fe2d4a2d563353c04a9ac5b1605e04c942fdc19371ad5b7256d
Instruction Fuzzy Hash: 5751A9B1A116059FEB14CFA8D8957AABBF4FB88310F24816AC455EB3A0D3B49D00CB90

Function 0085CCE0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00851CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00854E01), ref: 00851CAE
Part of subcall function 00851CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00851D4C

Part of subcall function 00851CA9: _free.LIBCMT ref: 00851D0B
Part of subcall function 00851CA9: _free.LIBCMT ref: 00851D41

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0085CD34

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: da0b99046f6085b8a9a0bfaac7c107c8a253ab37b5cf5cafcded32850fbabd7e
Instruction ID: bb96d7be6c9ae9e622ed86cdde957dc5e473afe1811aaca4515de063eb5e3ae4
Opcode Fuzzy Hash: da0b99046f6085b8a9a0bfaac7c107c8a253ab37b5cf5cafcded32850fbabd7e
Instruction Fuzzy Hash: 3A218372610306AFDB289A29DC42ABA7BB8FF44316F14007AFD06D6141EB75DD488A51

Function 0085C952 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00851CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00854E01), ref: 00851CAE
Part of subcall function 00851CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00851D4C

EnumSystemLocalesW.KERNEL32(0085CA80,00000001,00000000,?,-00000050,?,0085D0BB,00000000,?,?,?,00000055,?), ref: 0085C9C4

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e89cf6cf5d80e9b52f2e8fc89f7be3fd202bbbce84c69ebeb3975b7626b3b7d4
Instruction ID: d57ee40160233f143b0588659b14a10ebca3f53c7d5ae206285233a6503dd07b
Opcode Fuzzy Hash: e89cf6cf5d80e9b52f2e8fc89f7be3fd202bbbce84c69ebeb3975b7626b3b7d4
Instruction Fuzzy Hash: 6811E53A2007059FDB189F39D8916BABB92FF8435AB18442DED87C7B40D771A946CB40

Function 0085CF0C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00851CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00854E01), ref: 00851CAE
Part of subcall function 00851CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00851D4C

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0085CC9C,00000000,00000000,?), ref: 0085CF38

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9e229f8ef32def7c2f7fdb736d4e7a08ab18c3b757ccef73ebc7ae9bb2f2aeaa
Instruction ID: 206c3a7ab14e6ea0f4c51b2ed32f3484c63760292ae02204b6016b7d249d3dce
Opcode Fuzzy Hash: 9e229f8ef32def7c2f7fdb736d4e7a08ab18c3b757ccef73ebc7ae9bb2f2aeaa
Instruction Fuzzy Hash: 12F0F936500315BFDF245724C806BBA7B99FB4075AF054424ED15E3180DEB0FE49CD90

Function 0085C9ED Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00851CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00854E01), ref: 00851CAE
Part of subcall function 00851CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00851D4C

EnumSystemLocalesW.KERNEL32(0085CCE0,00000001,?,?,-00000050,?,0085D07F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0085CA37

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b676d7a0aa81b3d9582cae0225c8f2060427b00797077429bf452ecad74185eb
Instruction ID: 1cd034e5b430325aa86988a19aaae8664eddf4e36b0987368d5087f33284b54d
Opcode Fuzzy Hash: b676d7a0aa81b3d9582cae0225c8f2060427b00797077429bf452ecad74185eb
Instruction Fuzzy Hash: E6F046762003085FDB169F39DC85A7A7F94FF81369F04402DFD05CB690C6719C01CA50

Function 0085C907 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00851CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00854E01), ref: 00851CAE
Part of subcall function 00851CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00851D4C

EnumSystemLocalesW.KERNEL32(0085C860,00000001,?,?,?,0085D0DD,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0085C93E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1e1baa390a7724397120d355e21f87f0d8954742b28a7f7e22aa355bb8793536
Instruction ID: c2406886fe2805f19b6d22a64241f42b603d3188b855918c2a7893efaf349c17
Opcode Fuzzy Hash: 1e1baa390a7724397120d355e21f87f0d8954742b28a7f7e22aa355bb8793536
Instruction Fuzzy Hash: AEF05C363003045BCB059F79DC4666ABF54FFC1752F464059FE05CB250C6359946CB50

Function 008545DA Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00850C61,?,20001004,00000000,00000002,?,?,0085024C), ref: 0085460E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9d0f430a815b4fd968ab4b24ecc94fc64006373759aebb1c26f2e404d0e68996
Instruction ID: 2a2f909cdba3472bd75cd5b26fec38e4e70742321c5fda4222386a00bcd88b26
Opcode Fuzzy Hash: 9d0f430a815b4fd968ab4b24ecc94fc64006373759aebb1c26f2e404d0e68996
Instruction Fuzzy Hash: F3E04F3150012CBBDF122F60EC09F9E3E59FF5976AF015010FD19A6261CB3189A0AAE5

Function 0080E610 Relevance: 1.5, APIs: 1, Instructions: 6encryptionCOMMON

Download Yara Rule

APIs

CryptMsgClose.CRYPT32 ref: 0080E617

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CloseCrypt
String ID:
API String ID: 1563465135-0
Opcode ID: 3b4fde0828d4046ab4daa9255d8e7965c148a0357a01fe1981fa169888498f0c
Instruction ID: d0e051b311a669297fe0bdaa13b4f93187698702a0ccc4da2682d4d6a63566a7
Opcode Fuzzy Hash: 3b4fde0828d4046ab4daa9255d8e7965c148a0357a01fe1981fa169888498f0c
Instruction Fuzzy Hash: DEB012706001004BDF409B729D0C8023358BB1030131804C4A100C1060D621C800C914

Function 00839586 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000895A0,00838A95), ref: 0083958B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5bfaab63a45301ea6f528483a561492f52cc5ea90c4763e43c2cdb30bf4ba498
Instruction ID: cd82d8e80bf19fa4460a9d2bd97d028a955e1fe95a37834638d8135b44574f3a
Opcode Fuzzy Hash: 5bfaab63a45301ea6f528483a561492f52cc5ea90c4763e43c2cdb30bf4ba498
Instruction Fuzzy Hash:

Function 00840B4B Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

0, xrefs: 00840CE3

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ca26d7f1b9eda46e5fdc937f9f6741a5983160b2daf2e136f08a8644a79ffd7d
Instruction ID: d03db6252b1564c7185eee2fb266c8bd5d397999cac2e0796b8d00040d4a74c7
Opcode Fuzzy Hash: ca26d7f1b9eda46e5fdc937f9f6741a5983160b2daf2e136f08a8644a79ffd7d
Instruction Fuzzy Hash: 70616970A0430CDADF389A6888C5B7F73A5FF91708F14062EE782DB281D6719D859F46

Function 008147C0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

:, xrefs: 0081484D

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 8bfd24a7322bb85e8f5156b666f92ffc2cc971be36ae851c89091285ad4f0f90
Instruction ID: d0f8042ab793f3477bee1dc24ebca04ea2974ec94c41329ce1c28614ce3b0c8e
Opcode Fuzzy Hash: 8bfd24a7322bb85e8f5156b666f92ffc2cc971be36ae851c89091285ad4f0f90
Instruction Fuzzy Hash: 89411CA6A05248EFEB018E9894937DFFBB8EF72710F445099D8006B383D565874BC7E2

Function 007C463F Relevance: 1.3, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008388FA: EnterCriticalSection.KERNEL32(008B742C,?,?,?,007D402B,008B827C,4EB79311,?,007D1171,?), ref: 00838905
Part of subcall function 008388FA: LeaveCriticalSection.KERNEL32(008B742C,?,?,?,007D402B,008B827C,4EB79311,?,007D1171,?), ref: 00838942

GetProcessHeap.KERNEL32(?,?,?,007EC2E1,?,?,?,4EB79311,?,00000000), ref: 007C4676

Part of subcall function 008388B0: EnterCriticalSection.KERNEL32(008B742C,?,?,007D4086,008B827C,008768E0,?), ref: 008388BA
Part of subcall function 008388B0: LeaveCriticalSection.KERNEL32(008B742C,?,?,007D4086,008B827C,008768E0,?), ref: 008388ED
Part of subcall function 008388B0: RtlWakeAllConditionVariable.NTDLL ref: 00838964

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID:
API String ID: 325507722-0
Opcode ID: 7187a4377250d19c6550262d2ef674601832890de09345e008c1658870717105
Instruction ID: d7f3bcf62d3614bf4056abed01679e01acd3062eeb087ba23e5d445c5110a73c
Opcode Fuzzy Hash: 7187a4377250d19c6550262d2ef674601832890de09345e008c1658870717105
Instruction Fuzzy Hash: 4C114932504F04DED750BB6CEC46B5637E8F7843A5F640229E618C62A2DF78684ECB65

Function 00854619 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00854629

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: 3470c58f592117b309de5670664b23fa765954f746d030b4f3cdc13c755053a3
Instruction ID: 6feae0b151ac90b548fafeafba6853c04ea3b5371388f4906563d5d7557890e9
Opcode Fuzzy Hash: 3470c58f592117b309de5670664b23fa765954f746d030b4f3cdc13c755053a3
Instruction Fuzzy Hash: 10E0CD3364023473862036956C05FAA7E45F750B72F480062FF18E53418565485086D9

Function 008668E0 Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93143074e084b5f39dec4510a6073ea415b1cfe3cb7f4e85a14ecd60ae03a41
Instruction ID: 376d7daca5838c92f07200c351ea84c3978355ed64f99302b4fe1e49387b4cd0
Opcode Fuzzy Hash: c93143074e084b5f39dec4510a6073ea415b1cfe3cb7f4e85a14ecd60ae03a41
Instruction Fuzzy Hash: 8B325FB3F515145BDB0CCE5DCC927ECB3E3AF98214B0E813DA81AD7345EA78D9158A84

Function 00858609 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f916558f861633a16888522ea5c0c42792ac3627f0049487534b23343c60d0b
Instruction ID: 193588b285ed8d8e8f23cba4d3f5c16493680047a5f1275ff1fab09d8cb66b60
Opcode Fuzzy Hash: 6f916558f861633a16888522ea5c0c42792ac3627f0049487534b23343c60d0b
Instruction Fuzzy Hash: C132F321D2AF058DD723A634CC223366299FFB73C6F19D727EC19B59A5EF2884874140

Function 00840DB0 Relevance: .2, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2d3e859f7bfaebb38631758a7e3fb6df11dfee78d56764cc0bf2798ac34d2f
Instruction ID: 6e78ea57807d6df97234e3072f56fea8ea606799f67dc98f161931632221ec17
Opcode Fuzzy Hash: 8c2d3e859f7bfaebb38631758a7e3fb6df11dfee78d56764cc0bf2798ac34d2f
Instruction Fuzzy Hash: 6B61467060020C56DF389B6C88957BFB3A5FB51704F54092EE742DB2C2EB719DA59F42

Function 00840919 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85963471340551fc1d65e6da54e869a27c505fde31b74a5488fce3f4256d08d
Instruction ID: 6a0d4680a816d13801d48a1d54010c1fc463c5dca1402cdd5d1b3983c909163a
Opcode Fuzzy Hash: b85963471340551fc1d65e6da54e869a27c505fde31b74a5488fce3f4256d08d
Instruction Fuzzy Hash: 08514871A0074C56EF38C92C85997BFAF9AFB41308F14051ADB86EB283D6319E858F52

Function 0084933A Relevance: .2, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4406a1fdde6bc6bac325aee5dd4238fab62e370ddbc8ac11956ba0301d4bd2
Instruction ID: 0d47ca1bf127a2c0d89fec5a2df787a3b1b11aa2afd7039a37948686ab6c7bdd
Opcode Fuzzy Hash: 3d4406a1fdde6bc6bac325aee5dd4238fab62e370ddbc8ac11956ba0301d4bd2
Instruction Fuzzy Hash: 7B516F71E00119AFDF14CF99C981AAEBBB2FF89304F1980A9E945EB241C7349E51DB94

Function 00860AB2 Relevance: .1, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f988c179ce749a6f2ab29b0b17f1ef9edf3e790e75dafaf70fe7951be3268b75
Instruction ID: ace2c345020cfe085b42d2b753e5dd76816d4c43171e59d7209c15894db3903d
Opcode Fuzzy Hash: f988c179ce749a6f2ab29b0b17f1ef9edf3e790e75dafaf70fe7951be3268b75
Instruction Fuzzy Hash: 1121B373F205394B7B0CC47E8C522BDB6E1D68C611745823AE8A6EA2C1D968D917E2E4

Function 00860992 Relevance: .1, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e898dbcd32b4b5a94aff527c3cec66853baaeff384b37eddd1708b0469ec628
Instruction ID: 793ffe7b87cca58c637feff5aad8cca4f98d2c5cacd970c7aae64b42c79ce2ea
Opcode Fuzzy Hash: 4e898dbcd32b4b5a94aff527c3cec66853baaeff384b37eddd1708b0469ec628
Instruction Fuzzy Hash: 07117323F30C295A775C816D8C172BAA6D6EBD825071F533AD826E7384E9A4DE13D290

Function 0083ADD0 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8dab1d3d71a32050777a8f521cb460af81048deb802944bd0569647a1c01f072
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E5117D7720004243D61C863DD4F45B7E395FBC5320F2C477AD1C2CB764D123E9419A82

Function 00826AB0 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00826AB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00826AC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00826AD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00826AE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00826AF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00826B08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00826B19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00826B2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00826B3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00826B4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00826B5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00826B6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00826B7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00826B90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00826BA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00826BB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00826BC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00826BD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00826BE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00826BF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00826C07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00826C18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00826C29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00826C3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00826C4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00826C5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00826C6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00826C7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00826C8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00826CA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00826CB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00826CC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00826CD3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00826CE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00826CF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00826D06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00826D17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00826D28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00826D39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00826D4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00826D5B

Strings

ReleaseSRWLockExclusive, xrefs: 00826CD9
GetSystemTimePreciseAsFileTime, xrefs: 00826C51
SleepConditionVariableCS, xrefs: 00826C95
CompareStringEx, xrefs: 00826D2E
SetThreadpoolTimer, xrefs: 00826B63
InitOnceExecuteOnce, xrefs: 00826B0E
SetFileInformationByHandle, xrefs: 00826C40
WakeAllConditionVariable, xrefs: 00826C84
CreateSymbolicLinkW, xrefs: 00826C01
CreateSemaphoreW, xrefs: 00826B30
FreeLibraryWhenCallbackReturns, xrefs: 00826BDA
WaitForThreadpoolTimerCallbacks, xrefs: 00826B74
SetThreadpoolWait, xrefs: 00826BA7
TryAcquireSRWLockExclusive, xrefs: 00826CC8
CreateThreadpoolWait, xrefs: 00826B96
FlsAlloc, xrefs: 00826ABE
GetFileInformationByHandleEx, xrefs: 00826C2F
GetTickCount64, xrefs: 00826C1E
CreateEventExW, xrefs: 00826B1F
CloseThreadpoolWait, xrefs: 00826BB8
GetLocaleInfoEx, xrefs: 00826D3F
FlsSetValue, xrefs: 00826AEC
GetCurrentPackageId, xrefs: 00826C0D
FlsGetValue, xrefs: 00826ADB
CreateSemaphoreExW, xrefs: 00826B41
FlsFree, xrefs: 00826ACA
GetCurrentProcessorNumber, xrefs: 00826BEB
InitializeConditionVariable, xrefs: 00826C62
LCMapStringEx, xrefs: 00826D50
CloseThreadpoolWork, xrefs: 00826D1D
CreateThreadpoolWork, xrefs: 00826CFB
SleepConditionVariableSRW, xrefs: 00826CEA
CloseThreadpoolTimer, xrefs: 00826B85
kernel32.dll, xrefs: 00826AB1
InitializeSRWLock, xrefs: 00826CA6
CreateThreadpoolTimer, xrefs: 00826B52
FlushProcessWriteBuffers, xrefs: 00826BC9
AcquireSRWLockExclusive, xrefs: 00826CB7
WakeConditionVariable, xrefs: 00826C73
SubmitThreadpoolWork, xrefs: 00826D0C
InitializeCriticalSectionEx, xrefs: 00826AFD

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 05020f9f54638f57bda6f50558ed55359f94b219cb9b24fd4a2d6d1bc1ddf588
Instruction ID: 0c84babf651954d1cee9895abcefb59cf3bbbcaef889fa6ab732281718a5134c
Opcode Fuzzy Hash: 05020f9f54638f57bda6f50558ed55359f94b219cb9b24fd4a2d6d1bc1ddf588
Instruction Fuzzy Hash: 9A613771996721ABD750BFB4AC4D99A3FA8FA5D7053040AAAF126D33B5D7F88080CF50

Function 0082E2B1 Relevance: 48.4, APIs: 32, Instructions: 449COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0082E2B8
ctype.LIBCPMT ref: 0082E2FF

Part of subcall function 007C3055: __Getctype.LIBCPMT ref: 007C3064

Part of subcall function 00827FAF: __EH_prolog3.LIBCMT ref: 00827FB6
Part of subcall function 00827FAF: std::_Lockit::_Lockit.LIBCPMT ref: 00827FC0
Part of subcall function 00827FAF: std::_Lockit::~_Lockit.LIBCPMT ref: 00828031

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E30D
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E324
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E36B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E39E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E3F0
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E405
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E424
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E443
collate.LIBCPMT ref: 0082E44D
__Getcoll.LIBCPMT ref: 0082E48F
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E4BA
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E4FB
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E510
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E559
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E58C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E5E7
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E643
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E696

Part of subcall function 00828203: __EH_prolog3.LIBCMT ref: 0082820A
Part of subcall function 00828203: std::_Lockit::_Lockit.LIBCPMT ref: 00828214
Part of subcall function 00828203: std::_Lockit::~_Lockit.LIBCPMT ref: 00828285

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E6B5
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E707
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E74C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E761

Part of subcall function 008287D5: __EH_prolog3.LIBCMT ref: 008287DC
Part of subcall function 008287D5: std::_Lockit::_Lockit.LIBCPMT ref: 008287E6
Part of subcall function 008287D5: std::_Lockit::~_Lockit.LIBCPMT ref: 00828857

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E780

Part of subcall function 00827C31: __EH_prolog3.LIBCMT ref: 00827C38
Part of subcall function 00827C31: std::_Lockit::_Lockit.LIBCPMT ref: 00827C42
Part of subcall function 00827C31: std::_Lockit::~_Lockit.LIBCPMT ref: 00827CB3

codecvt.LIBCPMT ref: 0082E7B5
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E7BF

Part of subcall function 008286AB: __EH_prolog3.LIBCMT ref: 008286B2
Part of subcall function 008286AB: std::_Lockit::_Lockit.LIBCPMT ref: 008286BC
Part of subcall function 008286AB: std::_Lockit::~_Lockit.LIBCPMT ref: 0082872D

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E677

Part of subcall function 00825688: Concurrency::cancel_current_task.LIBCPMT ref: 00825748
Part of subcall function 00825688: __EH_prolog3.LIBCMT ref: 00825755
Part of subcall function 00825688: std::locale::_Locimp::_Makeloc.LIBCPMT ref: 00825781
Part of subcall function 00825688: std::_Locinfo::~_Locinfo.LIBCPMT ref: 0082578C

Part of subcall function 00828298: __EH_prolog3.LIBCMT ref: 0082829F
Part of subcall function 00828298: std::_Lockit::_Lockit.LIBCPMT ref: 008282A9
Part of subcall function 00828298: std::_Lockit::~_Lockit.LIBCPMT ref: 0082831A

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E658

Part of subcall function 00825688: __EH_prolog3.LIBCMT ref: 0082568F
Part of subcall function 00825688: std::_Lockit::_Lockit.LIBCPMT ref: 00825699
Part of subcall function 00825688: std::_Lockit::~_Lockit.LIBCPMT ref: 0082573D

Part of subcall function 008280D9: __EH_prolog3.LIBCMT ref: 008280E0
Part of subcall function 008280D9: std::_Lockit::_Lockit.LIBCPMT ref: 008280EA
Part of subcall function 008280D9: std::_Lockit::~_Lockit.LIBCPMT ref: 0082815B

numpunct.LIBCPMT ref: 0082E6F7
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E4A3

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0082E7D4

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Locimp::_std::locale::_$AddfacLocimp_$std::_$Lockit$H_prolog3$Lockit::_Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypeLocinfoLocinfo::~_Makeloccodecvtcollatectypenumpunct
String ID:
API String ID: 3784148211-0
Opcode ID: 4d0a7f1fe552ea988001b7ef3724b7b27231e90e7790520bcf121fa65eaf4222
Instruction ID: cdc2249d51160c5dc66024bf58fe24915ed3eaa9f80933109171e5963b0fb0ee
Opcode Fuzzy Hash: 4d0a7f1fe552ea988001b7ef3724b7b27231e90e7790520bcf121fa65eaf4222
Instruction Fuzzy Hash: 7BE1D770D01225EEDB206F68A84AABF3AA4FF51364F14442CF905E7382EB744D8497E7

Function 00810780 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 250COMMON

Download Yara Rule

Strings

Unable to create destination directory (%d), xrefs: 0081099B
Unable to read Source and/or DestDir attribute of EXTRACT_CAB_LOCAL command, xrefs: 00810A3D, 00810A42
Unable to substitute variables for the EXTRACT_CAB_LOCAL command, xrefs: 00810A31
NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand, xrefs: 0081095D, 008109A2, 008109D9, 00810A14
Failed to extract cab (%s), xrefs: 008109D2
Failed to parse DeleteFile as a boolean - default to false, xrefs: 008108D9
DestDir, xrefs: 00810813
Failed to delete src cab (%d), xrefs: 00810A0D
Unable to verify signature for file: %s, xrefs: 00810956
Unable to substitute DeleteFile attribute, xrefs: 008108BC
DeleteFile, xrefs: 0081086B
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExtractCabLocalCommand.cpp, xrefs: 008108E5, 00810962, 008109A7, 008109DE, 00810A19, 00810A49
invalid substitutor, xrefs: 008107C5
Source, xrefs: 008107D1
NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::Execute, xrefs: 008108E0, 00810A44

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: DeleteFile$DestDir$Failed to delete src cab (%d)$Failed to extract cab (%s)$Failed to parse DeleteFile as a boolean - default to false$NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::Execute$NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand$Source$Unable to create destination directory (%d)$Unable to read Source and/or DestDir attribute of EXTRACT_CAB_LOCAL command$Unable to substitute DeleteFile attribute$Unable to substitute variables for the EXTRACT_CAB_LOCAL command$Unable to verify signature for file: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExtractCabLocalCommand.cpp$invalid substitutor
API String ID: 0-2605792675
Opcode ID: 12b06bd79594d64ef7c852ccf002226c87825e2460c5e54419c487cb9bc4a65f
Instruction ID: 26ee5a532e44651c24c75aa6a10b06d13a485c2235ca9424f05e2649fa6f77bd
Opcode Fuzzy Hash: 12b06bd79594d64ef7c852ccf002226c87825e2460c5e54419c487cb9bc4a65f
Instruction Fuzzy Hash: 8591DE71A40308ABDB10EB94DC56BFEBB69FF15705F040019F545E7382EBB9A984CBA1

Function 007DA118 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 007DDE80: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DDF0C

__Mtx_unlock.LIBCPMT ref: 007DA143
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DA1AA

Part of subcall function 007DE0D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE161

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 007DA1C1
CloseHandle.KERNEL32(?), ref: 007DA1DD
CreateSemaphoreW.KERNEL32(00000000,00000000,000003E8,00000000), ref: 007DA24C
CloseHandle.KERNEL32(?), ref: 007DA268
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,00000000), ref: 007DA410
GetLastError.KERNEL32(?,00000001), ref: 007DA46F

Strings

Failed to create stop event, xrefs: 007DA21D
Failed to release semaphore. Error: , xrefs: 007DA44F
Failed to initialize event sender, xrefs: 007DA180
V, xrefs: 007DA443
E, xrefs: 007DA29C
Failed to create event semaphore, xrefs: 007DA2A8

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$CloseCreateHandleSemaphore$ErrorEventLastMtx_unlockRelease
String ID: E$Failed to create event semaphore$Failed to create stop event$Failed to initialize event sender$Failed to release semaphore. Error: $V
API String ID: 1380281556-3274429967
Opcode ID: 460456286e48f4fcb1fd3fd27fced12dec7127a75f54eb8715847e244a2066c7
Instruction ID: 7e343660a0d0787cfa6e69d5b55cbc8905928e05caac38c059d649274baf34e3
Opcode Fuzzy Hash: 460456286e48f4fcb1fd3fd27fced12dec7127a75f54eb8715847e244a2066c7
Instruction Fuzzy Hash: BEB1C6B0A00209EBDB14EF64C85ABEDB7B5FF44310F50416DE519A7381EB796A48CF92

Function 00810FA0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 141filelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,4EB79311,000000FF,00000000,00000000,0086DF30,000000FF), ref: 00810FE8
GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 00810FF8
CreateFileW.KERNEL32(000000FF,00000001,00000001,00000000,00000003,00000080,00000000,4EB79311,000000FF,00000000,00000000,0086DF30,000000FF), ref: 00811037
GetLastError.KERNEL32 ref: 00811058
GetFileSize.KERNEL32(?,?), ref: 00811088
CreateFileMappingW.KERNEL32(?,00000000,00000002,?,00000000,00000000), ref: 0081109C
MapViewOfFileEx.KERNEL32(00000000,00000004,00000000,00000000,?,00000000), ref: 008110D9
CloseHandle.KERNEL32(?), ref: 008110F0

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileMemMap.h, xrefs: 0081106B, 0081110D
Failed to map file to memory, xrefs: 00811101
kernel32.dll, xrefs: 00810FE3
NWebAdvisor::CFileMemMap::Init, xrefs: 00811066, 00811108
CreateFileTransactedW, xrefs: 00810FF2
Failed to open the file: %d, xrefs: 0081105F

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: File$CreateHandle$AddressCloseErrorLastMappingModuleProcSizeView
String ID: CreateFileTransactedW$Failed to map file to memory$Failed to open the file: %d$NWebAdvisor::CFileMemMap::Init$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileMemMap.h$kernel32.dll
API String ID: 2423579280-2843467768
Opcode ID: c7237ae093d920431d55eb093292b67c3def30ab11a87e1376f3e383b33f5eea
Instruction ID: 4b7f72db24e660555bba6ae21c39f210eab1c32a725ee9b170217c88fdac55be
Opcode Fuzzy Hash: c7237ae093d920431d55eb093292b67c3def30ab11a87e1376f3e383b33f5eea
Instruction Fuzzy Hash: 0C418670A40705BBEF209F649C4AFA9B7A8FF08B14F104615F715E62C1D7B4A9C08B95

Function 00812FD0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 177registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,?,00000000,00000028,00000028,00000000,00000000,Name,00000004,00000000,00000000,Key,00000003,4EB79311), ref: 008130F1
RegCloseKey.ADVAPI32(00000008), ref: 0081317C

Strings

Invalid substitutor, xrefs: 00813005
Error (%d) deleting registry value (%s) in key: %s, xrefs: 0081319D
Name, xrefs: 00813055
Unable to substitute variables for the DEL_REG_VALUE command, xrefs: 008131BC
NWebAdvisor::NXmlUpdater::parse_and_execute, xrefs: 00813103, 0081315E, 008131A4, 008131CC
Error opening HKLM registry key: %d, xrefs: 008130FC
Unable to read Key or Name for DEL_REG_VALUE command, xrefs: 008131C5
Cannnot delete registry value. Key or value not found. Key: %s Value: %s, xrefs: 00813157
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_value_command.cpp, xrefs: 00813108, 00813163, 008131A9, 008131D1
Key, xrefs: 00813013

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CloseOpen
String ID: Cannnot delete registry value. Key or value not found. Key: %s Value: %s$Error (%d) deleting registry value (%s) in key: %s$Error opening HKLM registry key: %d$Invalid substitutor$Key$NWebAdvisor::NXmlUpdater::parse_and_execute$Name$Unable to read Key or Name for DEL_REG_VALUE command$Unable to substitute variables for the DEL_REG_VALUE command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_value_command.cpp
API String ID: 47109696-1081640057
Opcode ID: e099df7799bbe683b2bcb7dc65a4d9e79f50edf74abc8ae2a57320cc13e18c34
Instruction ID: f065b0defb490007db9e53ad849343bb9d02f8faa096c20f463b66278831e232
Opcode Fuzzy Hash: e099df7799bbe683b2bcb7dc65a4d9e79f50edf74abc8ae2a57320cc13e18c34
Instruction Fuzzy Hash: 3E516D70A41209BADB10EF90DC4ABEEB7B9FF45704F140518F515A7382DBB8AA44CBA5

Function 007F8400 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,008AF278,00000023,00000001,00000004,00000000,00000000), ref: 007F8462
CreateDirectoryW.KERNEL32(008AF278,00000000,008AF278,00000104,\McAfee\), ref: 007F8491
GetLastError.KERNEL32 ref: 007F849D
CreateDirectoryW.KERNEL32(008AF278,00000000,008AF278,00000104,008AF070), ref: 007F84C5
GetLastError.KERNEL32 ref: 007F84CB
GetModuleFileNameW.KERNEL32(?,00000104), ref: 007F84FC
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 007F8511
CreateDirectoryW.KERNEL32(008AF278,00000000,008AF278,00000104,00000000), ref: 007F852E
GetLastError.KERNEL32 ref: 007F8534
GetTickCount.KERNEL32 ref: 007F85B9

Strings

%uFile:%sFunction:%sLine:%d, xrefs: 007F85C5
\McAfee\, xrefs: 007F8470
\log.txt, xrefs: 007F8556

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CreateDirectoryErrorLast$CountFileFolderModuleNamePathSpecialTick
String ID: %uFile:%sFunction:%sLine:%d$\McAfee\$\log.txt
API String ID: 922589859-3713371193
Opcode ID: 707096943519203797b4ff07b71b2e3cf89f68b9c65fb6c612fe2203a671bf7e
Instruction ID: cf7d562958c9bde6a6de02488ba7911d0e85f301b88c1ea6d61d6bc172f4739b
Opcode Fuzzy Hash: 707096943519203797b4ff07b71b2e3cf89f68b9c65fb6c612fe2203a671bf7e
Instruction Fuzzy Hash: E551ED75A8031CABEF109BA4DC4AFE97764FB55700F1001A5F718F7393DAB499908BA2

Function 0084CE60 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0084CECF
_free.LIBCMT ref: 0084CEE5
_free.LIBCMT ref: 0084CEF8
_free.LIBCMT ref: 0084CF0D
_free.LIBCMT ref: 0084CF22
GetCPInfo.KERNEL32(?,?), ref: 0084CF6C

Part of subcall function 0085826E: _free.LIBCMT ref: 008582D9

_free.LIBCMT ref: 0084D1D7
_free.LIBCMT ref: 0084D1EA
_free.LIBCMT ref: 0084D1F8
_free.LIBCMT ref: 0084D203
_free.LIBCMT ref: 0084D245
_free.LIBCMT ref: 0084D24D
_free.LIBCMT ref: 0084D253
_free.LIBCMT ref: 0084D25B
_free.LIBCMT ref: 0084D269

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: a2fca7a6e2ea4f14587bbf9838deabf39d045d2a6ced048bf45d12d2d45d1496
Instruction ID: 9431e056236c5d8ad56d090d0a04db056e26d7c5b9e1078d436ca0df8d25bd20
Opcode Fuzzy Hash: a2fca7a6e2ea4f14587bbf9838deabf39d045d2a6ced048bf45d12d2d45d1496
Instruction Fuzzy Hash: 26D18C719017099FDB21DFB8C881BEEBBB5FF09300F144069E895EB282DB75A949CB50

Function 007DE843 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 319COMMON

Download Yara Rule

APIs

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DE8A8

Strings

HTTP send request failed for Azure: , xrefs: 007DEB62
`avo, xrefs: 007DED4B, 007DEDF6
HTTP status error for Azure: , xrefs: 007DEA71
HTTP receive response failed for Azure: , xrefs: 007DEAE7
Failed to create access token, xrefs: 007DE881
Authorization: , xrefs: 007DE8EB

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitialize
String ID: Authorization: $Failed to create access token$HTTP receive response failed for Azure: $HTTP send request failed for Azure: $HTTP status error for Azure: $`avo
API String ID: 539357862-728912343
Opcode ID: b7d96a6702ac6ab9c2f53dfb081bd0f85ab0aa4b0452c6fc4db9403874c41a59
Instruction ID: bd976d973510359df5539ad453f4b1635d33fb3ed1367933800ce1e60c010eb3
Opcode Fuzzy Hash: b7d96a6702ac6ab9c2f53dfb081bd0f85ab0aa4b0452c6fc4db9403874c41a59
Instruction Fuzzy Hash: E0D19170A00219DBDB25EF60CD49BEDB374BF45304F4045DDE509AB281DB78AA88CFA1

Function 00813300 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 217registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00813545

Strings

Unable to substitute variables for the DEL_REG_TREE command, xrefs: 00813494
Invalid substitutor, xrefs: 00813335
NWebAdvisor::NXmlUpdater::parse_and_execute, xrefs: 0081333C, 00813469, 0081349B, 008134E6, 00813527, 0081357E
Error opening HKLM registry key: %d, xrefs: 008134DF
Key, xrefs: 00813359
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_tree_command.cpp, xrefs: 00813341, 0081346E, 008134A0, 008134EB, 0081352C, 00813583
Error (%d) deleting registry key tree: %s, xrefs: 00813577
Cannnot delete registry key. Not found: %s, xrefs: 00813520
Unable to read Key for DEL_REG_TREE command, xrefs: 00813462

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Close
String ID: Cannnot delete registry key. Not found: %s$Error (%d) deleting registry key tree: %s$Error opening HKLM registry key: %d$Invalid substitutor$Key$NWebAdvisor::NXmlUpdater::parse_and_execute$Unable to read Key for DEL_REG_TREE command$Unable to substitute variables for the DEL_REG_TREE command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_tree_command.cpp
API String ID: 3535843008-3762851336
Opcode ID: f466c670feebb28a658cf7cf99ba5cd8e0f5cc44d6d8dd64c07637551c6416bb
Instruction ID: 84b00df54dc4b20774709dd5e6ec647816bafd1325675a124eb41cbf617187fe
Opcode Fuzzy Hash: f466c670feebb28a658cf7cf99ba5cd8e0f5cc44d6d8dd64c07637551c6416bb
Instruction Fuzzy Hash: 7A71DF71A40208ABDF10AF54C846BE9B7B9FF54B04F544118E925FB382DB74AA80CBA5

Function 008387E7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(008B742C,00000FA0,?,?,008387C5), ref: 008387F3
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,008387C5), ref: 008387FE
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,008387C5), ref: 0083880F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00838821
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0083882F
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,008387C5), ref: 00838852
DeleteCriticalSection.KERNEL32(008B742C,00000007,?,?,008387C5), ref: 00838875
CloseHandle.KERNEL32(00000000,?,?,008387C5), ref: 00838885

Strings

SleepConditionVariableCS, xrefs: 0083881B
api-ms-win-core-synch-l1-2-0.dll, xrefs: 008387F9
WakeAllConditionVariable, xrefs: 00838827
kernel32.dll, xrefs: 0083880A

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 516f639d779a34c0bc31b41386c01426ddd194f573cebe3d56df380c85464897
Instruction ID: e4c30a6e359755d3a907ce192558c3471f3028b1f0e6e972242975f0e395f9e3
Opcode Fuzzy Hash: 516f639d779a34c0bc31b41386c01426ddd194f573cebe3d56df380c85464897
Instruction Fuzzy Hash: E5018471A44711ABD7206B78AC0DA5A3F58FBC8B52F440970F91DE33A4DEB4C84087A5

Function 00800950 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 244fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00800490: CreateDirectoryW.KERNEL32(?,00000000,?), ref: 008004AA
Part of subcall function 00800490: GetLastError.KERNEL32 ref: 008004B8

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000000,00000000,00000000,0000005C,00000001,00000000), ref: 00800BB5
GetLastError.KERNEL32 ref: 00800BC2

Strings

WriteFile failed: %d, xrefs: 00800C31
\, xrefs: 00800AF1
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileUtils.cpp, xrefs: 008009A3, 00800BE4, 00800C40
NWebAdvisor::NUtils::StoreBufferInFile, xrefs: 0080099E, 00800BDF, 00800C3B
CreateFile failed for %s: %d, xrefs: 00800BD5
CreateDir failed for %s, xrefs: 00800994

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFile
String ID: CreateDir failed for %s$CreateFile failed for %s: %d$NWebAdvisor::NUtils::StoreBufferInFile$WriteFile failed: %d$\$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileUtils.cpp
API String ID: 1552088572-2321083101
Opcode ID: 2cea442b9347c73ffb2b690675398cbf2697d440bbbbd2d8102f5fe4a9c346bf
Instruction ID: b0627f89ef065e7839960a55bbd3ded78066252941435ca923703ddfaedd75ce
Opcode Fuzzy Hash: 2cea442b9347c73ffb2b690675398cbf2697d440bbbbd2d8102f5fe4a9c346bf
Instruction Fuzzy Hash: 60A18B71E00249DADF00DFA4CC59BEEBBB4FF58318F144219E505BB291EB746A85CBA1

Function 0085B0D0 Relevance: 18.4, APIs: 12, Instructions: 374COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0085B118
_free.LIBCMT ref: 0085B13C
_free.LIBCMT ref: 0085B149
_free.LIBCMT ref: 0085B16E
_free.LIBCMT ref: 0085B17B
_free.LIBCMT ref: 0085B184
_free.LIBCMT ref: 0085B45F
_free.LIBCMT ref: 0085B467

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 962f8485352e68335f51fa0e40cad4142c95b7a360cb5eee4cf1c91a9733ca34
Instruction ID: 7a1fcf060f242bcd195f737e358a5b4a3ed2d270162837830cef92e344c3ad07
Opcode Fuzzy Hash: 962f8485352e68335f51fa0e40cad4142c95b7a360cb5eee4cf1c91a9733ca34
Instruction Fuzzy Hash: 6AC12276940608AFDB20DBA8CC82FEE7BE8FF19701F544165FE45FB282DA7099448791

Function 007F91A0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0089A536,00000003), ref: 007F91C9
FindResourceW.KERNEL32(00000000,00000001,00000010), ref: 007F91DE
LoadResource.KERNEL32(00000000,00000000), ref: 007F91EE
LockResource.KERNEL32(00000000), ref: 007F91FD

Strings

Failed to retrieve kernel verison, xrefs: 007F932C
NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetOsVersion, xrefs: 007F927F, 007F9336
%d.%d.%d.%d, xrefs: 007F925E
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp, xrefs: 007F9284, 007F933B
kernel32.dll, xrefs: 007F91B8
Failed to format version, xrefs: 007F9275

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Resource$FindHandleLoadLockModule
String ID: %d.%d.%d.%d$Failed to format version$Failed to retrieve kernel verison$NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetOsVersion$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp$kernel32.dll
API String ID: 3968257194-3470154288
Opcode ID: 25dde6179990ec0c38c2b4727875850b91076457fa0afaed0295a463ae6e2896
Instruction ID: 44d3037976b9f3bc8fdb905868028e8ed86b8aaa887921fc43c4105e050ec46b
Opcode Fuzzy Hash: 25dde6179990ec0c38c2b4727875850b91076457fa0afaed0295a463ae6e2896
Instruction Fuzzy Hash: 3351E7706003149BDB24AF24DC49BBBB7B4FF08704F40059DEA09EB782D7799A41CB91

Function 0083C338 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0083C435
type_info::operator==.LIBVCRUNTIME ref: 0083C457
___TypeMatch.LIBVCRUNTIME ref: 0083C566
IsInExceptionSpec.LIBVCRUNTIME ref: 0083C638
_UnwindNestedFrames.LIBCMT ref: 0083C6BC
CallUnexpected.LIBVCRUNTIME ref: 0083C6D7

Strings

csm, xrefs: 0083C375
csm, xrefs: 0083C3E2
csm, xrefs: 0083C48E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: d4c355aaaa0ee4603e603bdc9be3e0f1c2687ece5ac34768e2517a7a06785814
Instruction ID: d324e019467b5d04d78af96046bb62b12396efaec67d9efb91743280b82a638d
Opcode Fuzzy Hash: d4c355aaaa0ee4603e603bdc9be3e0f1c2687ece5ac34768e2517a7a06785814
Instruction Fuzzy Hash: 87B135B1800209AFCF19DFA8C9819AEBBB5FF94310F144559E815BB212D731EA51CFD6

Function 007D69A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(4EB79311,9EDBA51C,00000000,00000000,00000000,00000000,?,00000000), ref: 007D69E9
CloseHandle.KERNEL32(4EB79311,?,?,00000000), ref: 007D69FB
DeviceIoControl.KERNEL32(00000000,9EDB651C,00000000,00000000,00000000,00000000,?,00000000), ref: 007D6A2A
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 007D6A3D
GetModuleHandleExW.KERNEL32(00000000,mfeaaca.dll,?), ref: 007D6A8B
GetProcAddress.KERNEL32(?,NotComDllUnload), ref: 007D6A9E
FreeLibrary.KERNEL32(00000000), ref: 007D6AB8

Strings

mfeaaca.dll, xrefs: 007D6A84
NotComDllUnload, xrefs: 007D6A95

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Handle$CloseControlDevice$AddressFreeLibraryModuleProc
String ID: NotComDllUnload$mfeaaca.dll
API String ID: 2321898493-1077453148
Opcode ID: df47459bded71a377c2fec869fbcd8e249ce8ee8ee56303932763419afc443ee
Instruction ID: 98a3bc9869d1bfdf2792236c4351016e4af036e326fe58a808d1e383813d1483
Opcode Fuzzy Hash: df47459bded71a377c2fec869fbcd8e249ce8ee8ee56303932763419afc443ee
Instruction Fuzzy Hash: D23173712003019BDB209F24DC89B2A77A4BF88B10F148659F959EB3D4DB74EC44CA52

Function 00814280 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 133COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0081431B
GetLastError.KERNEL32 ref: 0081437E
GetLastError.KERNEL32 ref: 008143CB

Strings

NWebAdvisor::CHttpTransaction::Connect, xrefs: 008143D8
# SetAutoProxy: Can't get proxy. Err: %d, xrefs: 0081431E
NWebAdvisor::CHttpTransaction::SetAutoProxyUrl, xrefs: 00814388
NWebAdvisor::CHttpTransaction::SetAutoProxy, xrefs: 00814325
# SetAutoProxyUrl: Can't get proxy. Err: %d, xrefs: 00814381
Unable to set proxy option, error: %d, xrefs: 008143CE
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpTransaction_sacore.cpp, xrefs: 0081432A, 0081438D, 008143DD

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast
String ID: # SetAutoProxy: Can't get proxy. Err: %d$# SetAutoProxyUrl: Can't get proxy. Err: %d$NWebAdvisor::CHttpTransaction::Connect$NWebAdvisor::CHttpTransaction::SetAutoProxy$NWebAdvisor::CHttpTransaction::SetAutoProxyUrl$Unable to set proxy option, error: %d$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpTransaction_sacore.cpp
API String ID: 1452528299-2881327693
Opcode ID: 0208ccd0538a23d07f930ba5165361517b577f78eb4e085e0d9644b4da198015
Instruction ID: 0cb49fba35e9daaef249c8d3ee9c69c801990d40ca648d5f1458ee3130798373
Opcode Fuzzy Hash: 0208ccd0538a23d07f930ba5165361517b577f78eb4e085e0d9644b4da198015
Instruction Fuzzy Hash: 6B414C71A40209AFEB10DFA4CC45FEEBBB8FF58704F048119E924E6381E7B599448BA5

Function 0083E00A Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 496COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0083E3E7

Strings

p, xrefs: 0083E0FC
f, xrefs: 0083E0F5
p, xrefs: 0083E15E
p, xrefs: 0083E118
f, xrefs: 0083E157
f, xrefs: 0083E111
:, xrefs: 0083E0CC

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: __aulldvrm
String ID: :$f$f$f$p$p$p
API String ID: 1302938615-1434680307
Opcode ID: cea7733dabf86bc5c6ea0c60d40b02c71f29b3b5f468f1def6264aa648266a2d
Instruction ID: 002098f5b8d987f8564bc4f0e0017591b2cfd042cb0e0e520d24646311676009
Opcode Fuzzy Hash: cea7733dabf86bc5c6ea0c60d40b02c71f29b3b5f468f1def6264aa648266a2d
Instruction Fuzzy Hash: BD02AE75A0021DDADF308FA4D4856EDB7B6FB84B18FA44115E425FB2C0E7709E88CB96

Function 00836940 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00836947

Part of subcall function 007EC960: std::_Lockit::_Lockit.LIBCPMT ref: 007EC995
Part of subcall function 007EC960: std::_Lockit::_Lockit.LIBCPMT ref: 007EC9B7
Part of subcall function 007EC960: std::_Lockit::~_Lockit.LIBCPMT ref: 007EC9D7
Part of subcall function 007EC960: std::_Lockit::~_Lockit.LIBCPMT ref: 007ECAB1

Strings

%H : %M : %S, xrefs: 00836AE0
%m / %d / %y, xrefs: 00836A3E
%H : %M, xrefs: 00836A86
%d / %m / %y, xrefs: 00836C7D
:AM:am:PM:pm, xrefs: 00836CAD
%I : %M : %S %p, xrefs: 00836CA2
%b %d %H : %M : %S %Y, xrefs: 00836BD5

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: d32c7643b593fa3782453dad08c36132302c4b5aea3aedb61a8884600e8e4e51
Instruction ID: 483d78903fc5d5674f944ae5a701249dd2037f4529d8905ce5ea378c5ebe0526
Opcode Fuzzy Hash: d32c7643b593fa3782453dad08c36132302c4b5aea3aedb61a8884600e8e4e51
Instruction Fuzzy Hash: 0DB1BB7150010EBBCF19DF6CC955DBE7BB9FB85314F048119FA42E6251E6319A21DBA0

Function 00810C80 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 244fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00000000,?,?,4EB79311,00000000), ref: 00810E20
GetLastError.KERNEL32 ref: 00810E2E

Part of subcall function 00810FA0: GetModuleHandleW.KERNEL32(kernel32.dll,4EB79311,000000FF,00000000,00000000,0086DF30,000000FF), ref: 00810FE8
Part of subcall function 00810FA0: GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 00810FF8
Part of subcall function 00810FA0: GetLastError.KERNEL32 ref: 00811058

Part of subcall function 007F8650: std::locale::_Init.LIBCPMT ref: 007F882F

Strings

Unable to create destination directory (%d), xrefs: 00810D94
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 00810DA0, 00810E41, 00810F11
NWebAdvisor::CCabParser::LoadCabFile, xrefs: 00810F0C
CreateFile failed: %d, xrefs: 00810E35
NWebAdvisor::CCabParser::GetContentFile, xrefs: 00810D9B, 00810E3C
Failed to load cab %s, xrefs: 00810F05

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorLast$AddressCreateFileHandleInitModuleProcstd::locale::_
String ID: CreateFile failed: %d$Failed to load cab %s$NWebAdvisor::CCabParser::GetContentFile$NWebAdvisor::CCabParser::LoadCabFile$Unable to create destination directory (%d)$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
API String ID: 1808632809-3418505487
Opcode ID: d1872b4e4b544efd399cfb42083649dbdcf975519417e40c577f81e28e6466c2
Instruction ID: 351309a4601ae0157c00f86191ec2014c14f3757f0ef024da8d8cdb3b723dccc
Opcode Fuzzy Hash: d1872b4e4b544efd399cfb42083649dbdcf975519417e40c577f81e28e6466c2
Instruction Fuzzy Hash: 1F915C71A00208EBDB14DFA8DC96BEEB7B8FF04704F20851DE515A7281DB75AA45CFA1

Function 0085F5F9 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba7e5b1fad37de0399ecd637a029ef22df09dcd00f9a9937bf7be705f53aad0
Instruction ID: 7a547ff009ee9ff6336ef39b4eb7ee854b7c91702e65730658b8a25d3fcab320
Opcode Fuzzy Hash: eba7e5b1fad37de0399ecd637a029ef22df09dcd00f9a9937bf7be705f53aad0
Instruction Fuzzy Hash: 97C1D171A04349AFDF15CFA8D881BADBBB0FF49302F044169EA54EB292C7319949CB61

Function 0080C600 Relevance: 13.7, APIs: 9, Instructions: 240COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 0080C641

Part of subcall function 00823084: __EH_prolog3.LIBCMT ref: 0082308B
Part of subcall function 00823084: std::_Lockit::_Lockit.LIBCPMT ref: 00823096
Part of subcall function 00823084: std::locale::_Setgloballocale.LIBCPMT ref: 008230B1
Part of subcall function 00823084: std::_Lockit::~_Lockit.LIBCPMT ref: 00823107

std::_Lockit::_Lockit.LIBCPMT ref: 0080C6CB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0080C713
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0080C748
std::_Lockit::~_Lockit.LIBCPMT ref: 0080C7DD

Part of subcall function 0083E960: _free.LIBCMT ref: 0083E973

std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 0080C807
std::_Lockit::_Lockit.LIBCPMT ref: 0080C82B
std::_Lockit::~_Lockit.LIBCPMT ref: 0080C84C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0080C85B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$std::locale::_$Lockit::_Lockit::~_$Locimp::_Locinfo::_$AddfacH_prolog3InitLocimpLocimp_Locinfo_ctorLocinfo_dtorNew_Setgloballocale_free
String ID:
API String ID: 3142054045-0
Opcode ID: 483b255a2a433d5ed31446bf75751588b9c898e7e0e0684727501a50a97d5560
Instruction ID: 42b70f268ce0a5988f9863ed6da2890adf9028a08457a72a0873dbe19edda21d
Opcode Fuzzy Hash: 483b255a2a433d5ed31446bf75751588b9c898e7e0e0684727501a50a97d5560
Instruction Fuzzy Hash: 54A149B0D006449FEB10DFA9D845B9EBBF4FF44304F144629E805E7792EB79AA44CB92

Function 0085B4F0 Relevance: 13.7, APIs: 9, Instructions: 200COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0085B55E
_free.LIBCMT ref: 0085B56A
_free.LIBCMT ref: 0085B693
_free.LIBCMT ref: 0085B69E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8f346b12be55324cae6db8ed8a57d263e436430d38dbaa7baf7f78f0d061f9a0
Instruction ID: ff47d0fc26a46846eafa647d1f3bcae45a4355a9e61e6eaa7f6a8a82f6890752
Opcode Fuzzy Hash: 8f346b12be55324cae6db8ed8a57d263e436430d38dbaa7baf7f78f0d061f9a0
Instruction Fuzzy Hash: 8F61C1719007049FDB20DFB8D841BAAB7E9FF65312F20456AED56EB281EB709D08CB51

Function 0080E760 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 191encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000000), ref: 0080E877
CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000014), ref: 0080E8A9

Strings

1.2.840.10045.4.3.4, xrefs: 0080E807
1.2.840.10045.4.3, xrefs: 0080E81B
1.2.840.10045.4.3.3, xrefs: 0080E7F3
1.2.840.10045.4.3.2, xrefs: 0080E7DF
1.2.840.10045.4.1, xrefs: 0080E7CB

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CertCertificateContextProperty
String ID: 1.2.840.10045.4.1$1.2.840.10045.4.3$1.2.840.10045.4.3.2$1.2.840.10045.4.3.3$1.2.840.10045.4.3.4
API String ID: 665277682-3196566809
Opcode ID: 213ad4f3ff0a6fdb21def3f742f6c545e8596aa7ca873ca11000ebbff1097505
Instruction ID: 8973a52449c599a7c295a21d0cb087ac1e2d08c03e921d2c774441b63daa83b5
Opcode Fuzzy Hash: 213ad4f3ff0a6fdb21def3f742f6c545e8596aa7ca873ca11000ebbff1097505
Instruction Fuzzy Hash: A251E671A002059BCBA49E68DC91BABBBA5FF51320F1886B9DC55D73D2D731ED00C791

Function 007EE2C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

z, xrefs: 007EE369

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: d2b4ab9acc0ed9d6bcbe423eb8f85b3e004cc4550d693566734bd637242b2011
Instruction ID: 7679deb1dfc962e7bbe794a657f60abc4e8a9f24f5e1a26e72cd3e0549c3a1fb
Opcode Fuzzy Hash: d2b4ab9acc0ed9d6bcbe423eb8f85b3e004cc4550d693566734bd637242b2011
Instruction Fuzzy Hash: CC519571A01289DBEB20DB95CC45FEEB7B8FB49314F100569FA05A7381E7789E44CBA0

Function 007D7107 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D7D3D
__Mtx_unlock.LIBCPMT ref: 007D7DC8

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Concurrency::cancel_current_task.LIBCPMT ref: 007D7DFC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D7EBB

Part of subcall function 007E4B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E521E

Strings

Failed to add event category (, xrefs: 007D71F0
V, xrefs: 007D71E4
Service has not been initialized, xrefs: 007D7E88

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitializeMtx_unlock
String ID: Failed to add event category ($Service has not been initialized$V
API String ID: 342047005-375236208
Opcode ID: 26a281c35675212f3b1fcbbdb3fef7d844206b2ab08b6d36ca5e2487201dd9da
Instruction ID: c69586c11363427774353f63d1c9ac9b1a31dcb439436d78bfa49fa405e20ada
Opcode Fuzzy Hash: 26a281c35675212f3b1fcbbdb3fef7d844206b2ab08b6d36ca5e2487201dd9da
Instruction Fuzzy Hash: C1519F71904248DFDB18EFA4D85ABDE77B4FF44310F5041ADE90697381EB39AA08CB62

Function 0085A764 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0085A78E
_free.LIBCMT ref: 0085A867
_free.LIBCMT ref: 0085A894

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: e4041bbecd07db1fad0e951f4c826f3c0e0a440a959a550b842b887656dbf977
Instruction ID: ef35f9541730b3a836649bd7862d5a43c6ba5c25e5d6193847fca2b9abcdb33a
Opcode Fuzzy Hash: e4041bbecd07db1fad0e951f4c826f3c0e0a440a959a550b842b887656dbf977
Instruction Fuzzy Hash: 3A51E671904316AEDB29AF7898C1A6D7FA4FF01312F054369ED61D7281EA318949CB53

Function 007E8690 Relevance: 12.2, APIs: 8, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 0083987E: EnterCriticalSection.KERNEL32(008B77A0,?,00000101,?,007E86A7,00000000,?,00000101,?,00000000,?,?,007EC338,-00000010), ref: 00839889
Part of subcall function 0083987E: LeaveCriticalSection.KERNEL32(008B77A0,?,007E86A7,00000000,?,00000101,?,00000000,?,?,007EC338,-00000010,?,?,?,4EB79311), ref: 008398B5

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000), ref: 007E86D6
LoadResource.KERNEL32(00000000,00000000), ref: 007E86E4
LockResource.KERNEL32(00000000), ref: 007E86EF
SizeofResource.KERNEL32(00000000,00000000), ref: 007E86FD
FindResourceW.KERNEL32(00000000,?,00000006), ref: 007E8764
LoadResource.KERNEL32(00000000,00000000), ref: 007E8776
LockResource.KERNEL32(00000000), ref: 007E8785
SizeofResource.KERNEL32(00000000,00000000), ref: 007E8797

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Resource$CriticalFindLoadLockSectionSizeof$EnterLeave
String ID:
API String ID: 506522749-0
Opcode ID: a9c946b0c14017b294bed1cfffe0539e65b04ab6986a7e3dcce5634be241194c
Instruction ID: 2415487fb2b58eb0bbeecea2477fa7cfddd952c1570eb06b1811e6b02f4e15fd
Opcode Fuzzy Hash: a9c946b0c14017b294bed1cfffe0539e65b04ab6986a7e3dcce5634be241194c
Instruction Fuzzy Hash: 324106715012519BD720AF599888A3BB3E8FF98301F10092DFD59D7241FF38DC0586A2

Function 0085087D Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00851CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00854E01), ref: 00851CAE
Part of subcall function 00851CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00851D4C

_free.LIBCMT ref: 00850B8A
_free.LIBCMT ref: 00850BA3
_free.LIBCMT ref: 00850BE1
_free.LIBCMT ref: 00850BEA
_free.LIBCMT ref: 00850BF6

Strings

C, xrefs: 008509D9

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: cdc982a28d900581be22f32facd3da231d3aacd3266796231719c71a58363839
Instruction ID: b79c951b4a98fda382e18bc703ca156be420f8b04dc587b7abbca1aec0dcde3f
Opcode Fuzzy Hash: cdc982a28d900581be22f32facd3da231d3aacd3266796231719c71a58363839
Instruction Fuzzy Hash: 55B16C75A0162A9FDB24DF18C884AADB7B4FF09315F5045EAE849E7351E730AE84CF41

Function 007E1230 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(008B823C,00000000,?,00000000,?,?,?,?,00000000,00000000,?,4EB79311,?,?), ref: 007E125A
InitOnceComplete.KERNEL32(008B823C,00000000,00000000), ref: 007E1278

Strings

C:\non_system\Code\McCryptoLib\src\windows\win_hmac.cpp, xrefs: 007E12F3, 007E13DE
[%S:(%d)][%S] Error trying to BCryptOpenAlgorithmProvider: %ls, xrefs: 007E13E3
McCryptoLib::CMcCryptoHMACWin::Initialize, xrefs: 007E12EC, 007E13D7
[%S:(%d)][%S] Failed to create HMAC traits., xrefs: 007E12F8

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize
String ID: C:\non_system\Code\McCryptoLib\src\windows\win_hmac.cpp$McCryptoLib::CMcCryptoHMACWin::Initialize$[%S:(%d)][%S] Error trying to BCryptOpenAlgorithmProvider: %ls$[%S:(%d)][%S] Failed to create HMAC traits.
API String ID: 51270584-3897904871
Opcode ID: 46708ebf549cec91434ef1f507eda9307e9b5f7ae79ae208bcc1ea95cd20178f
Instruction ID: 2cbaf839e482fc7a7c40000bea60a770a04a2262bc46a516f98b54ee6a98eb96
Opcode Fuzzy Hash: 46708ebf549cec91434ef1f507eda9307e9b5f7ae79ae208bcc1ea95cd20178f
Instruction Fuzzy Hash: E9518A717043469BDB14EF29DC46B6EB7A8FF98700F440529FA09DB281DA38E904CA92

Function 007E52D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 173COMMON

Download Yara Rule

Strings

Version, xrefs: 007E5911
0.0.0.0, xrefs: 007E5816
UUID, xrefs: 007E5AC8
kernel32.dll, xrefs: 007E57A8
UUID, xrefs: 007E5ADA, 007E5AE2

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: 0.0.0.0$UUID$UUID$Version$kernel32.dll
API String ID: 0-1483847951
Opcode ID: fd42cc1c4f8448b25531c1501d11e2b23560b482fff9152727774abede23a60c
Instruction ID: 22dda523ae2c7cbfd7e7c503ff054fcef8aeaedbebb11e46972d038d1a142a3f
Opcode Fuzzy Hash: fd42cc1c4f8448b25531c1501d11e2b23560b482fff9152727774abede23a60c
Instruction Fuzzy Hash: 87818870905388CFEB24DFA8C9487DEBFB2BF49318F248219D464AB392D7784A44CB51

Function 007DA6B6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,4EB79311,?,?), ref: 007DA531
__Mtx_unlock.LIBCPMT ref: 007DA73D
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DA7AC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DA989

Strings

Unexpected return value: , xrefs: 007DA8CC
Event string is empty, xrefs: 007DA77C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$Mtx_unlockMultipleObjectsWait
String ID: Event string is empty$Unexpected return value:
API String ID: 1703231451-1331613497
Opcode ID: 4bfac0942a0bc381099a9e25f85c00d5b6b9ac5a5d4f0c6b64eaea32fd39b604
Instruction ID: 8c0167b9ba64af297385c898ab2cefdc3037d4044178a5a911d4f76e4f435682
Opcode Fuzzy Hash: 4bfac0942a0bc381099a9e25f85c00d5b6b9ac5a5d4f0c6b64eaea32fd39b604
Instruction Fuzzy Hash: 1851AE70900218EBDB18EFA4D889BDCB775FF50310F144299E5159B3C2DB78AA84CB52

Function 007EC960 Relevance: 10.6, APIs: 7, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007EC995
std::_Lockit::_Lockit.LIBCPMT ref: 007EC9B7
std::_Lockit::~_Lockit.LIBCPMT ref: 007EC9D7
__Getctype.LIBCPMT ref: 007ECA70
std::_Locinfo::~_Locinfo.LIBCPMT ref: 007ECA82
std::_Facet_Register.LIBCPMT ref: 007ECA8F
std::_Lockit::~_Lockit.LIBCPMT ref: 007ECAB1

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfoLocinfo::~_Register
String ID:
API String ID: 3947131827-0
Opcode ID: 3028a48a0c8e633b02d16cde39bb7de28072b4e311160cc2e82199a0d8fca38c
Instruction ID: 0caaf01961d9f11558e226f70a9e813c75ab882f24ed575bc00374fb97710209
Opcode Fuzzy Hash: 3028a48a0c8e633b02d16cde39bb7de28072b4e311160cc2e82199a0d8fca38c
Instruction Fuzzy Hash: FA41D175900258DFCB11DF59D841AAEB7B4FF58310F148169E819AB392EB38FE46CB81

Function 007DA550 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,4EB79311,?,?), ref: 007DA531
__Mtx_unlock.LIBCPMT ref: 007DA58B
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DA989
__Mtx_unlock.LIBCPMT ref: 007DA99D

Strings

Thread signalled when event queue is empty, xrefs: 007DA614
Unexpected return value: , xrefs: 007DA8CC

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorMtx_unlockOncestd::ios_base::_$BeginCompleteInitializeMultipleObjectsWait
String ID: Thread signalled when event queue is empty$Unexpected return value:
API String ID: 3324347728-3645029203
Opcode ID: a354cf3571080875e3cb2a1f5eb66ae631a52968fc5b852790c1f1952040dba2
Instruction ID: 7b8b87ee97260040c6aabfad4517afa19374dd22a4ed3a62dc29a418d37ff760
Opcode Fuzzy Hash: a354cf3571080875e3cb2a1f5eb66ae631a52968fc5b852790c1f1952040dba2
Instruction Fuzzy Hash: 8D418BB0D00218EADF14EFA4D859BDDB779FF10310F5041ADE515A62C2EB78AA89CB52

Function 0085416A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 008541D5
api-ms-, xrefs: 008541C1

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 1ba9178a04df51bfd0eefbcfcbde2cf220c4114c370b6178fcc2ec3f12674520
Instruction ID: cec2a69ac939cb80955fab12276e2db249f803d9bd9f70a35224462c7bc72cea
Opcode Fuzzy Hash: 1ba9178a04df51bfd0eefbcfcbde2cf220c4114c370b6178fcc2ec3f12674520
Instruction Fuzzy Hash: 23212771A41625BBCB318B24DC44A1A37A8FB157AEF252150FC26E72D1D730DC88C5E0

Function 0083809D Relevance: 9.2, APIs: 6, Instructions: 224COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00838128
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 008381B6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00838228
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00838242
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 008382A5
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 008382C2

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 04d9baae6ea9e07cd8abc44f641dab37277c028475f8be40a40caaca7747990b
Instruction ID: 681ecd4601e0ea259e27a0cbc0efd0edf4b6bd95d9e34cd8c7be11eecb59cd6a
Opcode Fuzzy Hash: 04d9baae6ea9e07cd8abc44f641dab37277c028475f8be40a40caaca7747990b
Instruction Fuzzy Hash: 7D71697290070AEBDF218FA4CC45AAF7BBAFF89314F280159F855E6250DF758845CBA0

Function 008268B8 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00826901
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0082696C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00826989
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 008269C8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00826A27
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00826A4A

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: d3f825abd4ac9209e510925e042135b2a869d7bccd29858c19a3aca479c91996
Instruction ID: d175dedcddc7d66b4019a4302eda45ea022d34def45ef0e53815b1d652f2a14e
Opcode Fuzzy Hash: d3f825abd4ac9209e510925e042135b2a869d7bccd29858c19a3aca479c91996
Instruction Fuzzy Hash: 5251807290022AABDF209F64EC45FAA7BA9FF44754F248425F915E6150EB30DDA0DB60

Function 007CE790 Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000001,?,00000000), ref: 007CE7D7
GetSecurityDescriptorDacl.ADVAPI32(00000000,00000000,00000000,?), ref: 007CE811
SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000004,00000000,00000000,00000000,00000000,?), ref: 007CE86D
LocalFree.KERNEL32(00000000), ref: 007CE8C7
LocalFree.KERNEL32(00000000), ref: 007CE8DC
LocalFree.KERNEL32(00000000), ref: 007CE917

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Security$DescriptorFreeLocal$ConvertDaclInfoNamedString
String ID:
API String ID: 2792426717-0
Opcode ID: 6bbbb819196b2a997dda87ff0d442ca1e8255f3d8cb78abc82de994f459f303b
Instruction ID: 68ba2ede9c35be373ad6daea3cd92c707185d958ec35ec72a9cad8fc615a9986
Opcode Fuzzy Hash: 6bbbb819196b2a997dda87ff0d442ca1e8255f3d8cb78abc82de994f459f303b
Instruction Fuzzy Hash: 2E415C71901258ABEF10DFA4DD49FDEBBB9FF08704F20012DF905A6290D779AA44CBA1

Function 007C8D10 Relevance: 9.1, APIs: 6, Instructions: 128COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007C8D46
std::_Lockit::_Lockit.LIBCPMT ref: 007C8D66
std::_Lockit::~_Lockit.LIBCPMT ref: 007C8D86
std::_Locinfo::~_Locinfo.LIBCPMT ref: 007C8E57
std::_Facet_Register.LIBCPMT ref: 007C8E64
std::_Lockit::~_Lockit.LIBCPMT ref: 007C8E86

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
String ID:
API String ID: 2966223926-0
Opcode ID: 430037638c018ee7b090c6cb4976e9125ca77548723148eb9388800d4720ed0f
Instruction ID: 2b32debf97a50050187027fba16d2151aa7e62469c5735764aa967df3400c0d6
Opcode Fuzzy Hash: 430037638c018ee7b090c6cb4976e9125ca77548723148eb9388800d4720ed0f
Instruction Fuzzy Hash: F7418D71900215DBCB55EF58D881BAEBBB5FF54310F14425DE406AB392DF38AE05CB92

Function 007D3400 Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007D3435
std::_Lockit::_Lockit.LIBCPMT ref: 007D3457
std::_Lockit::~_Lockit.LIBCPMT ref: 007D3477
std::_Locinfo::~_Locinfo.LIBCPMT ref: 007D353A
std::_Facet_Register.LIBCPMT ref: 007D3547
std::_Lockit::~_Lockit.LIBCPMT ref: 007D3569

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
String ID:
API String ID: 2966223926-0
Opcode ID: 29a1967b07757d79f4e47c6e27f68a77df978f4943759295edb5d7e39e9a38be
Instruction ID: f0a073bb34578a7a6edeffa1f1ec8de993cc6d3275b369b3452368219f1c89d0
Opcode Fuzzy Hash: 29a1967b07757d79f4e47c6e27f68a77df978f4943759295edb5d7e39e9a38be
Instruction Fuzzy Hash: 50419E71900255DFCB01DF68D851ABEB7B4FF54310F14825AE809AB352EB38EB45CB92

Function 007C32DE Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007C32E5
std::_Lockit::_Lockit.LIBCPMT ref: 007C32F2

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 007C3340
std::_Lockit::~_Lockit.LIBCPMT ref: 007C3360
Concurrency::cancel_current_task.LIBCPMT ref: 007C336D
__Towlower.LIBCPMT ref: 007C3388

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_RegisterTowlower
String ID:
API String ID: 2111902878-0
Opcode ID: 5d613873a5b27347c67a661c416bdf8849dd58b93c0effc05c4fd2d96733c4e5
Instruction ID: 26328bc09b7e96bff7658aaf3a271954a7f545b83084d7c9658b6977a4067f37
Opcode Fuzzy Hash: 5d613873a5b27347c67a661c416bdf8849dd58b93c0effc05c4fd2d96733c4e5
Instruction Fuzzy Hash: B211C171900509DFCB05EB68E445E6D77A4FF94310F24410DF50597392DF389F468792

Function 00828298 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0082829F
std::_Lockit::_Lockit.LIBCPMT ref: 008282A9

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

moneypunct.LIBCPMT ref: 008282E3
std::_Facet_Register.LIBCPMT ref: 008282FA
std::_Lockit::~_Lockit.LIBCPMT ref: 0082831A
Concurrency::cancel_current_task.LIBCPMT ref: 00828327

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 04690060b76f8589e3528d6336749c8e8a5484668ee4ddf6f10a274c0565c019
Instruction ID: 6147611ca878cb4ffb5afac64852c6cf1baa4c9b021fe9a72662168d23e1a077
Opcode Fuzzy Hash: 04690060b76f8589e3528d6336749c8e8a5484668ee4ddf6f10a274c0565c019
Instruction Fuzzy Hash: 5D018B31900229DBCB04EBA8A809AAEB7A1FF84714F280509E811EB3D1CF749E458B91

Function 00828203 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0082820A
std::_Lockit::_Lockit.LIBCPMT ref: 00828214

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

moneypunct.LIBCPMT ref: 0082824E
std::_Facet_Register.LIBCPMT ref: 00828265
std::_Lockit::~_Lockit.LIBCPMT ref: 00828285
Concurrency::cancel_current_task.LIBCPMT ref: 00828292

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 477d3d377d9b243881962c2f46ba11175eff156290b5c8c7de2247a3e5fcc999
Instruction ID: 11cdfcdb86019abccd9c2b29fa1ce680957f6f470ff7e85c9d51363df102e34d
Opcode Fuzzy Hash: 477d3d377d9b243881962c2f46ba11175eff156290b5c8c7de2247a3e5fcc999
Instruction Fuzzy Hash: 6F01C031900629DBCF04EBA8E859AAEB7B1FF84310F24050CF911EB381CF749E458BA1

Function 008283C2 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008283C9
std::_Lockit::_Lockit.LIBCPMT ref: 008283D3

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

moneypunct.LIBCPMT ref: 0082840D
std::_Facet_Register.LIBCPMT ref: 00828424
std::_Lockit::~_Lockit.LIBCPMT ref: 00828444
Concurrency::cancel_current_task.LIBCPMT ref: 00828451

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 0b87fb22bbcb6f5f5b54f9274c091bb7be6e3850884194639177af025a2452df
Instruction ID: 0912319161ae2c762d8c543c266caba995c450d02aad4b94e03ead6b2904d9c1
Opcode Fuzzy Hash: 0b87fb22bbcb6f5f5b54f9274c091bb7be6e3850884194639177af025a2452df
Instruction Fuzzy Hash: B301A131900229DBCF04EB68E819AAE77B5FF84310F14050CF411EB381DF749E458B92

Function 0082832D Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00828334
std::_Lockit::_Lockit.LIBCPMT ref: 0082833E

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

moneypunct.LIBCPMT ref: 00828378
std::_Facet_Register.LIBCPMT ref: 0082838F
std::_Lockit::~_Lockit.LIBCPMT ref: 008283AF
Concurrency::cancel_current_task.LIBCPMT ref: 008283BC

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: f983079ca81876317425dc1a966df0f4d9d22c9b25881586494898e2fa64b756
Instruction ID: 972a3f630936a895a1fe4b5ffec32299171f93620cadab9a7188745ffefa1488
Opcode Fuzzy Hash: f983079ca81876317425dc1a966df0f4d9d22c9b25881586494898e2fa64b756
Instruction Fuzzy Hash: 7201AD75900229DBCF04EBA8E809AAE77B1FF84710F24010CE811EB392CF749E459B92

Function 0082435B Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00824362
std::_Lockit::_Lockit.LIBCPMT ref: 0082436C

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

codecvt.LIBCPMT ref: 008243A6
std::_Facet_Register.LIBCPMT ref: 008243BD
std::_Lockit::~_Lockit.LIBCPMT ref: 008243DD
Concurrency::cancel_current_task.LIBCPMT ref: 008243EA

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 2d6ec2692303f3f6bbd44017c17d86c3f9322f1357f6fda05956af581f786a4a
Instruction ID: 965dc571bc9192b368ce8ca24ae8309e26b8dabc307d0789e5564fb6c67b41c0
Opcode Fuzzy Hash: 2d6ec2692303f3f6bbd44017c17d86c3f9322f1357f6fda05956af581f786a4a
Instruction Fuzzy Hash: B401AD75900629DBCB04FBA8E819AAE77B1FF94314F240509F415EB381CF789A458BA1

Function 00834475 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0083447C
std::_Lockit::_Lockit.LIBCPMT ref: 00834486

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

collate.LIBCPMT ref: 008344C0
std::_Facet_Register.LIBCPMT ref: 008344D7
std::_Lockit::~_Lockit.LIBCPMT ref: 008344F7
Concurrency::cancel_current_task.LIBCPMT ref: 00834504

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
String ID:
API String ID: 1767075461-0
Opcode ID: 7647a7aff279d9f871a3caf883d44c94320859c4af0f26344adccc65d908e60a
Instruction ID: 258761a62e4f85259008b1f77ba4307836d552ec7828f73bff42bf43e530afd5
Opcode Fuzzy Hash: 7647a7aff279d9f871a3caf883d44c94320859c4af0f26344adccc65d908e60a
Instruction Fuzzy Hash: 3801C075904229DBCB04EBA8D859AAE77B1FFD4310F24050DF811EB382CF78AA058BD1

Function 0083450A Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00834511
std::_Lockit::_Lockit.LIBCPMT ref: 0083451B

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

messages.LIBCPMT ref: 00834555
std::_Facet_Register.LIBCPMT ref: 0083456C
std::_Lockit::~_Lockit.LIBCPMT ref: 0083458C
Concurrency::cancel_current_task.LIBCPMT ref: 00834599

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
String ID:
API String ID: 958335874-0
Opcode ID: 48e154449432127a2a839f9544fe44a0927d10cebc3072d50c10b0d78a28d212
Instruction ID: a3f33a3ce53d2426b48400bc5c343ae0d5487c2167d82abf1514241b2fa54fc8
Opcode Fuzzy Hash: 48e154449432127a2a839f9544fe44a0927d10cebc3072d50c10b0d78a28d212
Instruction Fuzzy Hash: EA01C475900225DBCB04EBA8D855AAE77B5FFC8310F14050DF421EB381CF74AA058BD1

Function 008346C9 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008346D0
std::_Lockit::_Lockit.LIBCPMT ref: 008346DA

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

moneypunct.LIBCPMT ref: 00834714
std::_Facet_Register.LIBCPMT ref: 0083472B
std::_Lockit::~_Lockit.LIBCPMT ref: 0083474B
Concurrency::cancel_current_task.LIBCPMT ref: 00834758

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 5db00835465fd89f485d0107268e12d8faaa092055958b0e535e228372df2b77
Instruction ID: bcd42866595766c8ff549ed18e647ae857d762caa6850678be40db7cb95cf16a
Opcode Fuzzy Hash: 5db00835465fd89f485d0107268e12d8faaa092055958b0e535e228372df2b77
Instruction Fuzzy Hash: E501C0359002299BCB04EBA8D849ABE77B5FFC4310F25054CF821EB391CF74AE058B91

Function 00828616 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0082861D
std::_Lockit::_Lockit.LIBCPMT ref: 00828627

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

numpunct.LIBCPMT ref: 00828661
std::_Facet_Register.LIBCPMT ref: 00828678
std::_Lockit::~_Lockit.LIBCPMT ref: 00828698
Concurrency::cancel_current_task.LIBCPMT ref: 008286A5

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registernumpunct
String ID:
API String ID: 3064348918-0
Opcode ID: f610268a3c24316a4ef143886fcfe02fdfa91103bff0a081a3250452d7c73604
Instruction ID: 2a53810b108a56194b035e141f168acd7cc4a8d074df23d2dd8432546809d48f
Opcode Fuzzy Hash: f610268a3c24316a4ef143886fcfe02fdfa91103bff0a081a3250452d7c73604
Instruction Fuzzy Hash: 7801A171900225DBCF04EBA8E819AAE77B1FF94714F240508E415EB381DF749A458B91

Function 0083475E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00834765
std::_Lockit::_Lockit.LIBCPMT ref: 0083476F

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

moneypunct.LIBCPMT ref: 008347A9
std::_Facet_Register.LIBCPMT ref: 008347C0
std::_Lockit::~_Lockit.LIBCPMT ref: 008347E0
Concurrency::cancel_current_task.LIBCPMT ref: 008347ED

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: be85e07f91c5162894e3a8a77b16c8eb366b6e98af44492b30d71f7ca31761ec
Instruction ID: 025f899a9a1540bbde8e6e82a323407e097a4d86f281714672ae0324e056e549
Opcode Fuzzy Hash: be85e07f91c5162894e3a8a77b16c8eb366b6e98af44492b30d71f7ca31761ec
Instruction Fuzzy Hash: 8401AD35900229DBCB04EBA8D809AAE77B1FFC4724F240508F411EB391CFB4AA058BD1

Function 007EC410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007EC546
Concurrency::cancel_current_task.LIBCPMT ref: 007EC54B
Concurrency::cancel_current_task.LIBCPMT ref: 007EC550

Part of subcall function 0083E960: _free.LIBCMT ref: 0083E973

Strings

false, xrefs: 007EBF85, 007EC4D9
true, xrefs: 007EBFAB, 007EC503

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_free
String ID: false$true
API String ID: 149343396-2658103896
Opcode ID: 2cfbbbfea349b6b95bd74fc9db0a745e37ab215828513a734577ba35f8d7658f
Instruction ID: 748cd9370fb6b98e186950924fffbf098e64fec0342ae18a48f78fdf41dac196
Opcode Fuzzy Hash: 2cfbbbfea349b6b95bd74fc9db0a745e37ab215828513a734577ba35f8d7658f
Instruction Fuzzy Hash: 314148799013449FCB21DF69D841B6ABBB4FF05300F18855EF806DB742D77AA905CBA2

Function 0083D1B7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0083D278,?,?,008B77FC,00000000,?,0083D3A3,00000004,InitializeCriticalSectionEx,0089013C,00890144,00000000), ref: 0083D247

Strings

api-ms-, xrefs: 0083D207

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 97e31d87499ef4bb8169a4c5c134dd38344c1ca5a8074b69e307248cb11042e5
Instruction ID: 6d5695be21ec0805ff73ccb48f772cc5b4290e7ddc9c4fef53318b9becf5cf28
Opcode Fuzzy Hash: 97e31d87499ef4bb8169a4c5c134dd38344c1ca5a8074b69e307248cb11042e5
Instruction Fuzzy Hash: C511A032A41725ABDF229B68BC45B5A77A4FF85760F250260FD15E72C4D670FD008AD1

Function 007EE150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 007EE172
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 007EE182
RegDeleteKeyW.ADVAPI32(00000000,?), ref: 007EE1C2

Strings

Advapi32.dll, xrefs: 007EE16D
RegDeleteKeyExW, xrefs: 007EE17C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW
API String ID: 588496660-2191092095
Opcode ID: a0dfc41b83160fa65ab186afc806d6f44b2ebc4652589dcab0ace582a1486520
Instruction ID: 16d94c5b163cb2ebdc23455ddd9a70b4b32c186a0d38ee38fc2594385f4b68a6
Opcode Fuzzy Hash: a0dfc41b83160fa65ab186afc806d6f44b2ebc4652589dcab0ace582a1486520
Instruction Fuzzy Hash: 3B01AC75204744DBD7205B9BFC08B627BA9F798B61F14453AF108C2160D7FAE4D1DB20

Function 008111F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00811210
GetLastError.KERNEL32 ref: 0081121A

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 0081122D
NWebAdvisor::CCabParser::Write, xrefs: 00811228
WriteFile failed: %d, xrefs: 00811221

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: NWebAdvisor::CCabParser::Write$WriteFile failed: %d$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
API String ID: 442123175-2264278858
Opcode ID: 083ddba7283617a10ae4277f0c55d177925d68cd621fc607a340f582cc5dacc4
Instruction ID: 70a2490ed636214f2973041e0dd350f766b712e6124c88e8dd10f5a5fa3d03f3
Opcode Fuzzy Hash: 083ddba7283617a10ae4277f0c55d177925d68cd621fc607a340f582cc5dacc4
Instruction Fuzzy Hash: 77F08C31600208AFDB40EFA8DC46E7DB7A4FB58B04F800198BA09EA282E9759A54D791

Function 007F08A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 007F08A9
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 007F08C0
GetCurrentProcess.KERNEL32(?), ref: 007F08D7

Strings

IsWow64Process, xrefs: 007F08BA
kernel32, xrefs: 007F08A4

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 17f3357694e1784781e35d1d51497cf743c2766c96100be24bc6f4b76cabb846
Instruction ID: 385d59d85396b08b5173b75a88c93e82a34fd2e41e4966742b74396ac6a846d0
Opcode Fuzzy Hash: 17f3357694e1784781e35d1d51497cf743c2766c96100be24bc6f4b76cabb846
Instruction Fuzzy Hash: BFF0827294131DABDE209AA46C0DAEA7B9CFB05765B0045D5EC0893301E679CD5496D1

Function 0084E940 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0084E935,?,?,0084E8FD,00000002,00000002,?), ref: 0084E955
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0084E968
FreeLibrary.KERNEL32(00000000,?,?,0084E935,?,?,0084E8FD,00000002,00000002,?), ref: 0084E98B

Strings

mscoree.dll, xrefs: 0084E94E
CorExitProcess, xrefs: 0084E960

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8bdc27d255f378d173ad3e3b843e9667c5cee63be720d4e590c8aa8fbf43863e
Instruction ID: 6ee1e8378d96c2c1f8d8a6b42b4230b5211f321eff47543cc4c0e6a72514f254
Opcode Fuzzy Hash: 8bdc27d255f378d173ad3e3b843e9667c5cee63be720d4e590c8aa8fbf43863e
Instruction Fuzzy Hash: 04F0F831A65619BBDF11AB51DD0DB9DBE79FB04B59F1401A4E409E22A0CBB48E80EA90

Function 008503F2 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00852174: RtlAllocateHeap.NTDLL(00000000,?,?,?,0083872D,?,?,007CA1ED,0000002C,4EB79311), ref: 008521A6

_free.LIBCMT ref: 00850501
_free.LIBCMT ref: 00850518
_free.LIBCMT ref: 00850535
_free.LIBCMT ref: 00850550
_free.LIBCMT ref: 00850567

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: d79e964c8b8e18608e5450278d98138495efe26f448cac53cbfe804d3ffc3cc1
Instruction ID: 389c251060ed976f758c63eac1e86098a146a20ed399d5635f3e3abae295a201
Opcode Fuzzy Hash: d79e964c8b8e18608e5450278d98138495efe26f448cac53cbfe804d3ffc3cc1
Instruction Fuzzy Hash: FA51C032A00709AFDB21DF69C841A6A77F5FF44726F140569EC49E7290E731EA09CF80

Function 008243F0 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008243F7
std::_Lockit::_Lockit.LIBCPMT ref: 00824401

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 00824452
std::_Lockit::~_Lockit.LIBCPMT ref: 00824472
Concurrency::cancel_current_task.LIBCPMT ref: 0082447F

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 16c773e898c688bbae6925c83292d7379ba57a18fdce6a5622d96d19d4d95839
Instruction ID: a7fff83642ca409bdfd3a1fdc927474bd4f81bd08346ababff6e6fac5b29c896
Opcode Fuzzy Hash: 16c773e898c688bbae6925c83292d7379ba57a18fdce6a5622d96d19d4d95839
Instruction Fuzzy Hash: 2C11D3315042299BCB04FBA8A805BAEB7A5FF84710F24410EF905EB3C2DF749A458BA5

Function 008280D9 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008280E0
std::_Lockit::_Lockit.LIBCPMT ref: 008280EA

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 0082813B
std::_Lockit::~_Lockit.LIBCPMT ref: 0082815B
Concurrency::cancel_current_task.LIBCPMT ref: 00828168

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 17a2e8958d86c67560334b2fab66c5c5eb2b64376ed52b3ddd565754090b1ce4
Instruction ID: 2de53e4419b5e701a628893f74f6e9eeac4c39ee7b8460827a1b994f9032d3de
Opcode Fuzzy Hash: 17a2e8958d86c67560334b2fab66c5c5eb2b64376ed52b3ddd565754090b1ce4
Instruction Fuzzy Hash: 2001AD31900229DFCF05EBA8E85AAAE77B1FF94710F24050DE411EB3C1CF789A858B91

Function 00828044 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0082804B
std::_Lockit::_Lockit.LIBCPMT ref: 00828055

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 008280A6
std::_Lockit::~_Lockit.LIBCPMT ref: 008280C6
Concurrency::cancel_current_task.LIBCPMT ref: 008280D3

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 6db515e536316a93479ca54cec185c08ae017c48cc414760a05abd2b633e76d2
Instruction ID: e6f079f168631768873548cdcf441cbd5083631ca859e18f9f52c44981e6c0f8
Opcode Fuzzy Hash: 6db515e536316a93479ca54cec185c08ae017c48cc414760a05abd2b633e76d2
Instruction Fuzzy Hash: 6201C431900629DBCF05EB68E855AAE77B1FF84714F29010CF811EB381CF749E898B91

Function 0082816E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00828175
std::_Lockit::_Lockit.LIBCPMT ref: 0082817F

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 008281D0
std::_Lockit::~_Lockit.LIBCPMT ref: 008281F0
Concurrency::cancel_current_task.LIBCPMT ref: 008281FD

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 34561c171a872aefa956a5fe80feb25037c848b860ede37737eefb136eed4e95
Instruction ID: 7681440838f678e68794ce4d414b5cc810f4593e66ee8041ddcddaf91a2ff80e
Opcode Fuzzy Hash: 34561c171a872aefa956a5fe80feb25037c848b860ede37737eefb136eed4e95
Instruction Fuzzy Hash: 0401A171900225DBCF04EB68E805AAD77B5FF94314F64050DE411EB3D1CF749E458B91

Function 008284EC Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008284F3
std::_Lockit::_Lockit.LIBCPMT ref: 008284FD

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 0082854E
std::_Lockit::~_Lockit.LIBCPMT ref: 0082856E
Concurrency::cancel_current_task.LIBCPMT ref: 0082857B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 0c1972dea06281aaf5ce11da8d53d058f4102b4cac1e70eefe78c334c34f6052
Instruction ID: 2e78c892b7ee2e7e66b5411572a14219e232c83108cdeb5f119a8da070bc71f3
Opcode Fuzzy Hash: 0c1972dea06281aaf5ce11da8d53d058f4102b4cac1e70eefe78c334c34f6052
Instruction Fuzzy Hash: 7901A171900625DBCF04EB68E815AAEB7B1FF84320F24050DE411EB391CF749A458B92

Function 00828457 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0082845E
std::_Lockit::_Lockit.LIBCPMT ref: 00828468

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 008284B9
std::_Lockit::~_Lockit.LIBCPMT ref: 008284D9
Concurrency::cancel_current_task.LIBCPMT ref: 008284E6

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 11ee1af924c3a6532087f47b8308ec6746265511778f07ba3aca168104e81ce6
Instruction ID: e803542a9c8f017cfe8da7f1f44033d89b5493f1352391a470497b3dbc4125cb
Opcode Fuzzy Hash: 11ee1af924c3a6532087f47b8308ec6746265511778f07ba3aca168104e81ce6
Instruction Fuzzy Hash: D7018E3190022ADBCF05EB68A809AAE77A1FF84710F14054CF415EB382DF749A458B91

Function 00828581 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00828588
std::_Lockit::_Lockit.LIBCPMT ref: 00828592

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 008285E3
std::_Lockit::~_Lockit.LIBCPMT ref: 00828603
Concurrency::cancel_current_task.LIBCPMT ref: 00828610

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: c02c71dcf76b9b09ebc75b035c74b3b3cff20286a7323399ef291b1f963775d0
Instruction ID: 24f586082a2bd4e43043dbe2a8616ad6faee1117b77efd5afab38d54d6467303
Opcode Fuzzy Hash: c02c71dcf76b9b09ebc75b035c74b3b3cff20286a7323399ef291b1f963775d0
Instruction Fuzzy Hash: 0B01C031900229DBCF04EBA8E819AAEB7B5FF94710F24054DF815EB381CF749A458B92

Function 0083459F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008345A6
std::_Lockit::_Lockit.LIBCPMT ref: 008345B0

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 00834601
std::_Lockit::~_Lockit.LIBCPMT ref: 00834621
Concurrency::cancel_current_task.LIBCPMT ref: 0083462E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: f4d609a54c5d3c9dc7abfebcb63df5cc3e9a3afe1da49561a35f086f35e87f78
Instruction ID: aed807199a74a96f2c3fdbc6f9d2a1d5ffadf97b7185ed0e94b111e8eb66ee6f
Opcode Fuzzy Hash: f4d609a54c5d3c9dc7abfebcb63df5cc3e9a3afe1da49561a35f086f35e87f78
Instruction Fuzzy Hash: 2701AD359002299BCB04EBA8D85AAAEB7B1FF94720F240509E411EB391DF74AA45CB91

Function 008286AB Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008286B2
std::_Lockit::_Lockit.LIBCPMT ref: 008286BC

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 0082870D
std::_Lockit::~_Lockit.LIBCPMT ref: 0082872D
Concurrency::cancel_current_task.LIBCPMT ref: 0082873A

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: d71d6dbbbcaec47bf8d2175c6d5a03e883fc3aa64d33cd05ca12d48bd108a0df
Instruction ID: f1e489ae9b1cde541d4f1b985d37c3cf71c1306ed8d76b4f6c9926a16d94ad70
Opcode Fuzzy Hash: d71d6dbbbcaec47bf8d2175c6d5a03e883fc3aa64d33cd05ca12d48bd108a0df
Instruction Fuzzy Hash: 4B01C075904229DBCF05EBA8E819AAEB7B1FF94310F24014DF911EB381DF749A458B92

Function 00834634 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0083463B
std::_Lockit::_Lockit.LIBCPMT ref: 00834645

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 00834696
std::_Lockit::~_Lockit.LIBCPMT ref: 008346B6
Concurrency::cancel_current_task.LIBCPMT ref: 008346C3

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 452016fb00dbb99c17b7879f25dd09a1737c4173ae8cd12923bcf0b0306d8763
Instruction ID: 8d694860f37069305ee75797e9a85f52bb3fd27998ae60cda993e1cea13f2cc1
Opcode Fuzzy Hash: 452016fb00dbb99c17b7879f25dd09a1737c4173ae8cd12923bcf0b0306d8763
Instruction Fuzzy Hash: 1001A1719002159BCB04EBA8D856AAEB7B5FFD4310F240509E811EB3D1DF74AE498B91

Function 008287D5 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008287DC
std::_Lockit::_Lockit.LIBCPMT ref: 008287E6

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 00828837
std::_Lockit::~_Lockit.LIBCPMT ref: 00828857
Concurrency::cancel_current_task.LIBCPMT ref: 00828864

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: d3b1e088645640140a158e271b870f394b36f057c30585c06e0b9f7a3e56e905
Instruction ID: 8828ca8dd86c832732823ecdae30f41147bfbbdf58445ad154b4150bee86be70
Opcode Fuzzy Hash: d3b1e088645640140a158e271b870f394b36f057c30585c06e0b9f7a3e56e905
Instruction Fuzzy Hash: 3F01A171900225DBCF04EBA8E805AAD77B1FF88714F64451DE511EB381CF789A458B91

Function 008347F3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008347FA
std::_Lockit::_Lockit.LIBCPMT ref: 00834804

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 00834855
std::_Lockit::~_Lockit.LIBCPMT ref: 00834875
Concurrency::cancel_current_task.LIBCPMT ref: 00834882

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 95617fd2357e2f2c096ad1c091bcbc85c25a0db5f53337f9bf442e688aefaa4d
Instruction ID: d2e8c3892de58ec9466715133ea78f0d292e671f904b6e176dbad9fd2cccd3b6
Opcode Fuzzy Hash: 95617fd2357e2f2c096ad1c091bcbc85c25a0db5f53337f9bf442e688aefaa4d
Instruction Fuzzy Hash: EA01A1359002199BCB04EB68D815AAE77B5FFC4714F24011CE511EB381CF74AE458BD1

Function 00828740 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00828747
std::_Lockit::_Lockit.LIBCPMT ref: 00828751

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 008287A2
std::_Lockit::~_Lockit.LIBCPMT ref: 008287C2
Concurrency::cancel_current_task.LIBCPMT ref: 008287CF

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 11f2fc92076ee91d1fb96f0f39e4e18bede6c0b0c7c69a8250619379a2aced87
Instruction ID: 1d3b28be78e2adb920079d11b3e767770dc7b3bb6e91715bdea24bd8ea94d3ab
Opcode Fuzzy Hash: 11f2fc92076ee91d1fb96f0f39e4e18bede6c0b0c7c69a8250619379a2aced87
Instruction Fuzzy Hash: 53018E75910225DBCF04EB68A845AAD77A1FF84710F240509E815EB381DF749E459B91

Function 00834888 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0083488F
std::_Lockit::_Lockit.LIBCPMT ref: 00834899

Part of subcall function 007C2D14: std::_Lockit::_Lockit.LIBCPMT ref: 007C2D30
Part of subcall function 007C2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 007C2D4C

std::_Facet_Register.LIBCPMT ref: 008348EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0083490A
Concurrency::cancel_current_task.LIBCPMT ref: 00834917

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 7a939e828da603c0b560458f4267975f3e4c5a7a429d11acf959e625f42ee1ac
Instruction ID: 1ebf2d6f0e506ffc792a11a7516156e648b565124f3751c14ae844fb95dca5a0
Opcode Fuzzy Hash: 7a939e828da603c0b560458f4267975f3e4c5a7a429d11acf959e625f42ee1ac
Instruction Fuzzy Hash: 0901A1319002199BCB04EBA8D805AAEB7B1FF84720F140549E811EB3D1CF74AE058B91

Function 0085B487 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0085B49F

Part of subcall function 00852098: RtlFreeHeap.NTDLL(00000000,00000000,?,0085B729,?,00000000,?,?,?,0085B9CC,?,00000007,?,?,0085BDD6,?), ref: 008520AE
Part of subcall function 00852098: GetLastError.KERNEL32(?,?,0085B729,?,00000000,?,?,?,0085B9CC,?,00000007,?,?,0085BDD6,?,?), ref: 008520C0

_free.LIBCMT ref: 0085B4B1
_free.LIBCMT ref: 0085B4C3
_free.LIBCMT ref: 0085B4D5
_free.LIBCMT ref: 0085B4E7

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5386c50fb905689e5afc5fdc9579bfa9dd88de64fc0cb8663be855a07d80bb64
Instruction ID: e5564a7d92722df1f38bbfadeefd636b5f0b3f7a5ecef4a87c7d94a6a00ac025
Opcode Fuzzy Hash: 5386c50fb905689e5afc5fdc9579bfa9dd88de64fc0cb8663be855a07d80bb64
Instruction Fuzzy Hash: E1F09632501B44ABD630DBA8F482C1A73DEFF017117944805F909D7A42CB34FC88C659

Function 008388B0 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(008B742C,?,?,007D4086,008B827C,008768E0,?), ref: 008388BA
LeaveCriticalSection.KERNEL32(008B742C,?,?,007D4086,008B827C,008768E0,?), ref: 008388ED
RtlWakeAllConditionVariable.NTDLL ref: 00838964
SetEvent.KERNEL32(?,007D4086,008B827C,008768E0,?), ref: 0083896E
ResetEvent.KERNEL32(?,007D4086,008B827C,008768E0,?), ref: 0083897A

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 80473c9945223f23c6b94d44348acec7d99cf13c4e728a8d6b3336d2bd1c0561
Instruction ID: f634239a17d4a1165e13c6965a4109f294cb4bb2d953677f6f2095b1e7ac7f49
Opcode Fuzzy Hash: 80473c9945223f23c6b94d44348acec7d99cf13c4e728a8d6b3336d2bd1c0561
Instruction Fuzzy Hash: D1014671618220DFC700AF68FC48A997FA8FB8D71270041AAF905D3325CB309841CBA4

Function 00810720 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00810726
GetLastError.KERNEL32 ref: 00810730

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 00810743
NWebAdvisor::CCabParser::Close, xrefs: 0081073E
CloseHandle failed: %d, xrefs: 00810737

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: CloseHandle failed: %d$NWebAdvisor::CCabParser::Close$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
API String ID: 918212764-1823807987
Opcode ID: edb67c47c5b9043e2548a127e0984eeb0d534371c25b8aa866bf27b649e2961c
Instruction ID: 7c0cd5893202733e7b02d78a486e4ea8ebe8295a59687c714aa1cf5100b1f314
Opcode Fuzzy Hash: edb67c47c5b9043e2548a127e0984eeb0d534371c25b8aa866bf27b649e2961c
Instruction Fuzzy Hash: F1D05B313403206EEB603B68AC0FF763658FB05729F440E58F6A5D52E2D5E6E8914755

Function 00843207 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 375COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 0084338D
__freea.LIBCMT ref: 008433A9

Strings

am/pm, xrefs: 0084340D
a/p, xrefs: 00843471

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: e5d5ca148571ea429be449b8f96d4ddecb90fe08ac7629c57e93e83adf48577f
Instruction ID: 85e1c6a4c55d522c308964260ec5ad73636306acc2d9ed5f86438311c51a6a41
Opcode Fuzzy Hash: e5d5ca148571ea429be449b8f96d4ddecb90fe08ac7629c57e93e83adf48577f
Instruction Fuzzy Hash: F5C1013590021EDBCB24DF68C885ABABBB0FF25714F2A4149E501EB350E7359F41DBA1

Function 008651F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

\\?\, xrefs: 008653C0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: \\?\
API String ID: 0-4282027825
Opcode ID: 48e2483c87f2038dcf55dfa95372bfc3bb3dd4641929703b0711db3cfca737be
Instruction ID: 357096b60e6471113fab88277d5d7723f2bf0a906fafdcd95be66524bdc504c4
Opcode Fuzzy Hash: 48e2483c87f2038dcf55dfa95372bfc3bb3dd4641929703b0711db3cfca737be
Instruction Fuzzy Hash: F3717C71D00619DBCF14DFA8C888AAEB7B9FF59314F15462EE41AE7290E7349940CBA1

Function 007CB420 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007CB64C

Strings

ios_base::badbit set, xrefs: 007CB5CF, 007CB5F8, 007CB621
ios_base::eofbit set, xrefs: 007CB5DE
ios_base::failbit set, xrefs: 007CB5D9

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 323602529-1866435925
Opcode ID: 3e8895cd5d13fb20959a31f74a8b6dcaff97c63ad53b24d5d7e71d24eb4a2524
Instruction ID: f4723d61e6a1be16bd6af9205dd98115325e1d3fe29da58aeedce4298a441ca6
Opcode Fuzzy Hash: 3e8895cd5d13fb20959a31f74a8b6dcaff97c63ad53b24d5d7e71d24eb4a2524
Instruction Fuzzy Hash: 19719BB1A00649DFDB14CF58C985B99FBF8FF48314F14816DEA189B381DB79A919CB80

Function 00864620 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

WritePrivateProfileStructW.KERNEL32(?,00000000,4752434D,00000024,00000000), ref: 008646E4
GetLastError.KERNEL32 ref: 00864728
WritePrivateProfileStructW.KERNEL32(?,00000000,?,00000004,00000000), ref: 00864768

Strings

MCRG, xrefs: 0086466F

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: PrivateProfileStructWrite$ErrorLast
String ID: MCRG
API String ID: 3778923442-1523812224
Opcode ID: 863a99daad9c51fbc0955dade9ded20f28ae49e128e3f36bcff392faf66c631f
Instruction ID: 0292ad47dbf1e645c7f5985d4a833865b6e8aba19c9a7cdfce964695b66b8029
Opcode Fuzzy Hash: 863a99daad9c51fbc0955dade9ded20f28ae49e128e3f36bcff392faf66c631f
Instruction Fuzzy Hash: 1C518D75900249EFDB10CFA8D845B9EBBF8FF49324F148259F815EB2A1DB749904CB90

Function 007D0490 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00823D98: FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,?,007D04D5,?,?,4EB79311), ref: 00823DAE

LocalFree.KERNEL32(00000000), ref: 007D05CC
Concurrency::cancel_current_task.LIBCPMT ref: 007D05F6

Strings

generic, xrefs: 007D0610
unknown error, xrefs: 007D04FE

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_taskFormatFreeLocalMessage
String ID: generic$unknown error
API String ID: 3868770561-3628847473
Opcode ID: f4e5ded730e083785f71a4463280080feb26c14e6924aaad7a66a3a89702ae3e
Instruction ID: fcc1b246477d27f4983121f52127a91795d9a2b5943bcc530af01b4e35333d02
Opcode Fuzzy Hash: f4e5ded730e083785f71a4463280080feb26c14e6924aaad7a66a3a89702ae3e
Instruction Fuzzy Hash: 1441ACB09003059FDB249F68D845BAFBBF8FB44310F10062EE866D7381D77999148BA2

Function 0084EA12 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe, xrefs: 0084EA50, 0084EA57, 0084EA8B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\is-BGV4J.tmp\component1_extract\saBSI.exe
API String ID: 0-1809518215
Opcode ID: 6f95229aa9b7235470f46925761700bcc09b279f5a8ed18bba9ca87b485b2e35
Instruction ID: 0ebac338d937ff613f669eecb5ddff817a826fdad52e2a3b7face4de8c06ce6d
Opcode Fuzzy Hash: 6f95229aa9b7235470f46925761700bcc09b279f5a8ed18bba9ca87b485b2e35
Instruction Fuzzy Hash: FF319E71A0061DEFCB21EF9DDC85DAEBBBCFB94310B144166E405E7250E6709A44CB91

Function 007C4A4A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007C4A51

Strings

affid, xrefs: 007C4AEE, 007C4B44
MSAD_Subinfo, xrefs: 007C4AF3
/affid, xrefs: 007C4A7B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: H_prolog3_
String ID: /affid$MSAD_Subinfo$affid
API String ID: 2427045233-3897642808
Opcode ID: fe08861b69873690072e6bea4b9bf25941ccf22ec825b3d2b0558e16f349e634
Instruction ID: 2b378de4ce9c7c2ff862201b767156f0e6b8022df0eccc838bfb9e028c3e5cd6
Opcode Fuzzy Hash: fe08861b69873690072e6bea4b9bf25941ccf22ec825b3d2b0558e16f349e634
Instruction Fuzzy Hash: 72415FB0904208DFCF18DFA8D8A5AEDBBB4FF09314F54406DE415A7281D7389A4ACB65

Function 00832F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00832F57

Part of subcall function 00827DF0: __EH_prolog3.LIBCMT ref: 00827DF7
Part of subcall function 00827DF0: std::_Lockit::_Lockit.LIBCPMT ref: 00827E01
Part of subcall function 00827DF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00827E72

_Find_elem.LIBCPMT ref: 00832FF3

Strings

0123456789-, xrefs: 00832FA3
%.0Lf, xrefs: 00832F9E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2544715827-3094241602
Opcode ID: 93e894f75e04d9f07a1a226a8ba1b276cab5a085a463d2d358af6ddc1d408b4d
Instruction ID: b5b9ae6948f6b2dd9f46e67654a910891b33c826f5b3ae9cb8b8611691e3d8c7
Opcode Fuzzy Hash: 93e894f75e04d9f07a1a226a8ba1b276cab5a085a463d2d358af6ddc1d408b4d
Instruction Fuzzy Hash: 80415B71900218DFCF15EFA8D880AEDBBB5FF58314F100159E911EB255DB70DA96CBA2

Function 00833200 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00833207

Part of subcall function 007C32DE: __EH_prolog3_GS.LIBCMT ref: 007C32E5
Part of subcall function 007C32DE: std::_Lockit::_Lockit.LIBCPMT ref: 007C32F2
Part of subcall function 007C32DE: std::_Lockit::~_Lockit.LIBCPMT ref: 007C3360

_Find_elem.LIBCPMT ref: 008332A3

Strings

0123456789-, xrefs: 0083324E
0123456789-, xrefs: 00833253

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: H_prolog3_Lockitstd::_$Find_elemLockit::_Lockit::~_
String ID: 0123456789-$0123456789-
API String ID: 3328206922-2494171821
Opcode ID: 59012cc2c9e5f095f1a7d432da77d4cc9edb5b7892eda5468b4e69774d319d47
Instruction ID: bc6220e882075d29611d2f07687342ca6d2d816dd57a53855d4851dc4ea8dd96
Opcode Fuzzy Hash: 59012cc2c9e5f095f1a7d432da77d4cc9edb5b7892eda5468b4e69774d319d47
Instruction Fuzzy Hash: 04414771900218DFCF05EFA8D884AEEBBB5FF48315F10016DE911EB256DB349A56CBA1

Function 00837470 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00837477

Part of subcall function 007EC960: std::_Lockit::_Lockit.LIBCPMT ref: 007EC995
Part of subcall function 007EC960: std::_Lockit::_Lockit.LIBCPMT ref: 007EC9B7
Part of subcall function 007EC960: std::_Lockit::~_Lockit.LIBCPMT ref: 007EC9D7
Part of subcall function 007EC960: std::_Lockit::~_Lockit.LIBCPMT ref: 007ECAB1

_Find_elem.LIBCPMT ref: 00837511

Strings

0123456789-, xrefs: 008374C3
0123456789-, xrefs: 008374BE

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 87564e48873b5f89fb4c3b53e94f612ab56a9b639fc37c0d609ba4fc09525b42
Instruction ID: 45b15783bcb7d25d3c2ca639491ba7101adc146d17cfaa23a9d18ed2969327b7
Opcode Fuzzy Hash: 87564e48873b5f89fb4c3b53e94f612ab56a9b639fc37c0d609ba4fc09525b42
Instruction Fuzzy Hash: A3416D71900209DFCF15EFA8D881AAEBBB5FF44310F10405AF911EB252DB35EA56CB95

Function 007D7156 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 007E4B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007E521E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D7D3D
__Mtx_unlock.LIBCPMT ref: 007D7DC8

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

Strings

Failed to add event category (, xrefs: 007D71F0
V, xrefs: 007D71E4

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitializeMtx_unlock
String ID: Failed to add event category ($V
API String ID: 2287862619-1647955383
Opcode ID: 2ed742c12744a908d52af86757a05676de6ac93dce42bf801fbedde6421fe6c4
Instruction ID: 42b24743b34501e3fdf6d30ccc7c36e0ac8bbf82321a860bd68e069daeff62f8
Opcode Fuzzy Hash: 2ed742c12744a908d52af86757a05676de6ac93dce42bf801fbedde6421fe6c4
Instruction Fuzzy Hash: 2C316F70904248DFDB08EF64D85ABDD77B4FF55304F50409DE9465B342EB79AA08CBA2

Function 007DA7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,4EB79311,?,?), ref: 007DA531
__Mtx_unlock.LIBCPMT ref: 007DA7EC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DA989

Part of subcall function 007DF110: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007DF268

Strings

Unexpected return value: , xrefs: 007DA8CC

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$Mtx_unlockMultipleObjectsWait
String ID: Unexpected return value:
API String ID: 1703231451-3613193034
Opcode ID: 021f81bace661ba5d4821c6264974b32f66b4e9421ede9529d734a6981e9454a
Instruction ID: dcfc6ece894cab5d402e08d43b2e9a08910c0c01a79059ef479c2d96d5f3fe0c
Opcode Fuzzy Hash: 021f81bace661ba5d4821c6264974b32f66b4e9421ede9529d734a6981e9454a
Instruction Fuzzy Hash: 9321AD70900219EBDF15EFA4DC8DBECB735BF45310F504259E516AB3C2DB38AA85CA12

Function 007D7052 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 007C9BB0: InitOnceBeginInitialize.KERNEL32(008B80C4,00000000,4EB79311,00000000,4EB79311,007CA219,008B80CC,?,?,?,?,?,?,007CA219,?,?), ref: 007C9BE5
Part of subcall function 007C9BB0: InitOnceComplete.KERNEL32(008B80C4,00000000,00000000), ref: 007C9C1D

Part of subcall function 007C9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007C9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 007D7D3D
__Mtx_unlock.LIBCPMT ref: 007D7DC8

Strings

P, xrefs: 007D7077
Service has not been initialized, xrefs: 007D7083

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitializeMtx_unlock
String ID: P$Service has not been initialized
API String ID: 920826028-2917841385
Opcode ID: 9bf14d4a7b62823db9e24ce73d8108a410ffacd2dd564685a382f93bf49ac9b4
Instruction ID: 75c8060edd1e9e3c527fa00e0800820f449710f8e4c96f8e409b50aebdba40ec
Opcode Fuzzy Hash: 9bf14d4a7b62823db9e24ce73d8108a410ffacd2dd564685a382f93bf49ac9b4
Instruction Fuzzy Hash: 710171B1A04248DADF04EF90D45ABEDB7B4FF55310F90806EF90657281EB39AA0CCA56

Function 007C308E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007C3095
std::_Lockit::_Lockit.LIBCPMT ref: 007C30A2
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 007C30DF

Strings

bad locale name, xrefs: 007C30F0

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: std::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 4089677319-1405518554
Opcode ID: 51ff4c093c8e7122beac645fe0c48979de041b3f297ff352d26ede9fcfe0cbda
Instruction ID: 35930c0107592b893b2303c922daee7e79058685139db4e334a67b8e13f62d29
Opcode Fuzzy Hash: 51ff4c093c8e7122beac645fe0c48979de041b3f297ff352d26ede9fcfe0cbda
Instruction Fuzzy Hash: 4A014F71405B80DEC7209F7D948154AFAE0BF28300B548A2EE08DC3B41CB74A644CB9A

Function 008524F8 Relevance: 6.3, APIs: 4, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0085257F

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 2052368595d85d8921707e714fa8cf7e39a0871388d90fe44b2f9a70ca8f8144
Instruction ID: b5220be245e00035087b632794ac028e01a7f1af198f9177cb47fc40c43dc4fe
Opcode Fuzzy Hash: 2052368595d85d8921707e714fa8cf7e39a0871388d90fe44b2f9a70ca8f8144
Instruction Fuzzy Hash: 45B179329042969FDB11CF28C8917AEBBF5FF5A351F2441A9DC41DB241DA349D09CB61

Function 00862AF0 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 007C463F: GetProcessHeap.KERNEL32(?,?,?,007EC2E1,?,?,?,4EB79311,?,00000000), ref: 007C4676

WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,0086FB28,000000FF), ref: 00862BF4

Part of subcall function 007E75F0: FindResourceExW.KERNEL32(00000000,00000006,00000000,?,00000000,?,?,?,?,?,00862B5D,?,00000000), ref: 007E7628
Part of subcall function 007E75F0: LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,00862B5D,?,00000000,?,?,?,?,?,0086FB28), ref: 007E7636
Part of subcall function 007E75F0: LockResource.KERNEL32(00000000,?,?,?,?,?,00862B5D,?,00000000,?,?,?,?,?,0086FB28,000000FF), ref: 007E7641
Part of subcall function 007E75F0: SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,00862B5D,?,00000000,?,?,?,?,?,0086FB28), ref: 007E764F

FindResourceW.KERNEL32(00000000,?,00000006), ref: 00862B74

Part of subcall function 007E7580: LoadResource.KERNEL32(00000101,00000101,00000000,80070057,8007000E,80004005,007E8806,00000000,?,00000000,00000002,00000000), ref: 007E7589
Part of subcall function 007E7580: LockResource.KERNEL32(00000000,?,00000000,00000002,00000000), ref: 007E7594
Part of subcall function 007E7580: SizeofResource.KERNEL32(00000101,00000101,?,00000000,00000002,00000000), ref: 007E75A8

WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 00862BAB
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,0086FB28,000000FF), ref: 00862C2E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Resource$ByteCharMultiWide$FindLoadLockSizeof$HeapProcess
String ID:
API String ID: 2838002939-0
Opcode ID: c0ca47ccc791df69ef0039c19334f9d201969aba8527805f93ea85875206ccc0
Instruction ID: 7ea1c791663bf3e610506f025e4ece18103a2b20dbdf4e1f7b71d10ff73de160
Opcode Fuzzy Hash: c0ca47ccc791df69ef0039c19334f9d201969aba8527805f93ea85875206ccc0
Instruction Fuzzy Hash: 0551BD31200A41AFE7248F18CC4AF2AB7E9FB55714F2246ADF655DB2D1DBB4A840CB61

Function 0083C0E1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0083C1A8
___AdjustPointer.LIBCMT ref: 0083C1CB
___AdjustPointer.LIBCMT ref: 0083C267

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2c96803f0785e813f409513f9a91e81271a084dd3620a1c696cd074f680a469c
Instruction ID: a5319476f2df8776b492e43144cfe0352050f566be27acb0861a837dec9e15f8
Opcode Fuzzy Hash: 2c96803f0785e813f409513f9a91e81271a084dd3620a1c696cd074f680a469c
Instruction Fuzzy Hash: 4751D072600606DFEB289F99C841B7A77A4FF84714F14452DE816E7292E731EC80D7D1

Function 00853531 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a0d07a40d29df13b5acbe89838ac8d0eb69eeeb9ef63ebe6f752bd66e9f272
Instruction ID: bd8fbc9bfd59171275314b38887a1f40e77a5fb04e305f26a40c1e66ea1e8347
Opcode Fuzzy Hash: c0a0d07a40d29df13b5acbe89838ac8d0eb69eeeb9ef63ebe6f752bd66e9f272
Instruction Fuzzy Hash: 0D41E6B2A00704BFDB249F7CC841B5ABBE9FB84755F108629F512DB681E2719A4987C1

Function 007EEBA0 Relevance: 6.1, APIs: 4, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegSetKeySecurity.ADVAPI32(00000000,00000000,00000000,00000000), ref: 007EEBCB
RegEnumKeyExW.ADVAPI32(00000000,00000000,?,00000100,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 007EEC28
RegOpenKeyExW.ADVAPI32(00000000,?,00000000,000F003F,?,?,00000000,00000000), ref: 007EEC4F

Part of subcall function 007EEBA0: RegCloseKey.ADVAPI32(?,?,00000000,00000000), ref: 007EEC7E

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CloseEnumOpenSecurity
String ID:
API String ID: 611561417-0
Opcode ID: 919fc7c3e0137ea639fe356d2aed6dbf11577de31b21270bb10a071f71aadaf7
Instruction ID: 768f96e6f451928604c4d5e4246e5361384d37b5b7c79fc824824df37642fca3
Opcode Fuzzy Hash: 919fc7c3e0137ea639fe356d2aed6dbf11577de31b21270bb10a071f71aadaf7
Instruction Fuzzy Hash: DD318472A0121CABDB20DF55DD49FEAB7B8FB4C700F1009A5F919E6191DA749E90CBA0

Function 0084E0E7 Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48f413a165baee1953c255dd9c5f0844a663c6a9348353fb2e1239b7e221df7
Instruction ID: eea873afa9e6fb4fef73946d2940fb190907cda46d4e19645e4a45131a15181b
Opcode Fuzzy Hash: b48f413a165baee1953c255dd9c5f0844a663c6a9348353fb2e1239b7e221df7
Instruction Fuzzy Hash: F5219D7264430DAFEB20AF69DC8197B77ADFF4436AB108625F925D6190E730EC4087A1

Function 007E75F0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 0083987E: EnterCriticalSection.KERNEL32(008B77A0,?,00000101,?,007E86A7,00000000,?,00000101,?,00000000,?,?,007EC338,-00000010), ref: 00839889
Part of subcall function 0083987E: LeaveCriticalSection.KERNEL32(008B77A0,?,007E86A7,00000000,?,00000101,?,00000000,?,?,007EC338,-00000010,?,?,?,4EB79311), ref: 008398B5

FindResourceExW.KERNEL32(00000000,00000006,00000000,?,00000000,?,?,?,?,?,00862B5D,?,00000000), ref: 007E7628
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,00862B5D,?,00000000,?,?,?,?,?,0086FB28), ref: 007E7636
LockResource.KERNEL32(00000000,?,?,?,?,?,00862B5D,?,00000000,?,?,?,?,?,0086FB28,000000FF), ref: 007E7641
SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,00862B5D,?,00000000,?,?,?,?,?,0086FB28), ref: 007E764F

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Resource$CriticalSection$EnterFindLeaveLoadLockSizeof
String ID:
API String ID: 529824247-0
Opcode ID: 0578d3042f804d15793c1d295e83f6d4495e7ac5f483f1fcedc8bdeb9dd60817
Instruction ID: 67c5a65b7712c9a6aa58afb3b2a1d4af5087e4af5dac2d330bc223bb1fbdb035
Opcode Fuzzy Hash: 0578d3042f804d15793c1d295e83f6d4495e7ac5f483f1fcedc8bdeb9dd60817
Instruction Fuzzy Hash: 23117B32609B524BD7395F5E9C44A37B3A8FBC8399F10093DF956C7250EB64CC00C250

Function 00838982 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,0083891F,00000064), ref: 008389A5
LeaveCriticalSection.KERNEL32(008B742C,007D1171,?,0083891F,00000064,?,?,?,007D402B,008B827C,4EB79311,?,007D1171,?), ref: 008389AF
WaitForSingleObjectEx.KERNEL32(007D1171,00000000,?,0083891F,00000064,?,?,?,007D402B,008B827C,4EB79311,?,007D1171,?), ref: 008389C0
EnterCriticalSection.KERNEL32(008B742C,?,0083891F,00000064,?,?,?,007D402B,008B827C,4EB79311,?,007D1171,?), ref: 008389C7

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: a526bbcb20c97f3ac575f5203c231b92d0cb815bb22ae0643ea8a96583bc7a0d
Instruction ID: 5604b0eb0718750c082d7b0b6bcf8911571c444608cbba814ea58980af03cf7c
Opcode Fuzzy Hash: a526bbcb20c97f3ac575f5203c231b92d0cb815bb22ae0643ea8a96583bc7a0d
Instruction Fuzzy Hash: A7E09232518324EBC7012B50EC0CA9E3F2DFB8CB12B000090F90DA6261CB6188508BDA

Function 008252EC Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 008252F3

Part of subcall function 007EBDF0: std::_Lockit::_Lockit.LIBCPMT ref: 007EBE2F
Part of subcall function 007EBDF0: std::_Lockit::_Lockit.LIBCPMT ref: 007EBE51
Part of subcall function 007EBDF0: std::_Lockit::~_Lockit.LIBCPMT ref: 007EBE71
Part of subcall function 007EBDF0: std::_Lockit::~_Lockit.LIBCPMT ref: 007EBFFC

_Find_elem.LIBCPMT ref: 008254EF

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0082535B

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3042121994-2799312399
Opcode ID: 67b26ba3423817b2f26e0144b0ed9d9c525fe5ca5016dd762a41fdfedaaaea27
Instruction ID: 5952f478700ba93408bbd072ef03acd899314e43d8e78575a4a99bfce2cd1056
Opcode Fuzzy Hash: 67b26ba3423817b2f26e0144b0ed9d9c525fe5ca5016dd762a41fdfedaaaea27
Instruction Fuzzy Hash: 33C1C270D446A88BDF21DFA8E590BECBBB2FF15300F644059D885AB282D7749DC5CB51

Function 00864440 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00862AF0: FindResourceW.KERNEL32(00000000,?,00000006), ref: 00862B74
Part of subcall function 00862AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 00862BAB
Part of subcall function 00862AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,0086FB28,000000FF), ref: 00862C2E

WritePrivateProfileStructW.KERNEL32(?,00000000,4752434D,00000024,00000002), ref: 0086453C
WritePrivateProfileStructW.KERNEL32(?,?,00000000,?,00000002), ref: 00864598

Strings

MCRG, xrefs: 00864480

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: ByteCharMultiPrivateProfileStructWideWrite$FindResource
String ID: MCRG
API String ID: 2178413835-1523812224
Opcode ID: 1740774d4ea132e068a5bf6c319d2f4c751bf38d7155da9ba5f49ac0f5204c20
Instruction ID: 69a1cbcd3c0093a308e8a2aa2ea7cd2b43392596e2b459ea30e097204c3bc153
Opcode Fuzzy Hash: 1740774d4ea132e068a5bf6c319d2f4c751bf38d7155da9ba5f49ac0f5204c20
Instruction Fuzzy Hash: C2617971901248EFDB01CFA8C849B9EFBB5FF49320F158259F815AB3A1DB75A905CB90

Function 007E71C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007E7362
Concurrency::cancel_current_task.LIBCPMT ref: 007E7367

Strings

'm~, xrefs: 007E71EC, 007E728C

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 'm~
API String ID: 118556049-2779627686
Opcode ID: 581fca35f307165560e33ad3ea9871cf263587182534e5706bcf565ab6bd5b36
Instruction ID: 2337c6f323945059c33ca4adc619792c1f9f3c2b15ad067ecd8c009cecfb8571
Opcode Fuzzy Hash: 581fca35f307165560e33ad3ea9871cf263587182534e5706bcf565ab6bd5b36
Instruction Fuzzy Hash: 9551D1B1905281CFDB28CF69C841B6AB7F9FB48300F110A2EE45697791EB38A944CB91

Function 0083C6E2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0083C707

Strings

MOC, xrefs: 0083C719
RCC, xrefs: 0083C721

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4d5f55b027039f477e43e9e0cbad049694d436e23a91ca91839cee872dd387d5
Instruction ID: 57df5d61010e57095ba38b61c4737cdccde3bd768b528668c1f5d957893f5daa
Opcode Fuzzy Hash: 4d5f55b027039f477e43e9e0cbad049694d436e23a91ca91839cee872dd387d5
Instruction Fuzzy Hash: 46412872900209AFCF16DF98CD81AAEBBB5FF88304F148169F914B7251D3359A60DF91

Function 007EE5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

CLSIDFromString.OLE32(0000007B,?), ref: 007EE650

Strings

@, xrefs: 007EE608
{, xrefs: 007EE627

Memory Dump Source

Source File: 00000006.00000002.2499304659.00000000007B1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000006.00000002.2499250148.00000000007B0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499426343.000000000087E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499496606.00000000008AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499553309.00000000008B4000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499607810.00000000008B6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2499662832.00000000008B9000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b0000_saBSI.jbxd

Similarity

API ID: FromString
String ID: @${
API String ID: 1694596556-3118734784
Opcode ID: 8dfc239a074c6d5ff8acffef4b018293f22a4272b9a3a2c4bbc44fe97c9547fd
Instruction ID: ae6f0c032d1f7b6113967cdebd66d80f8949be76df74130f81c02bef0a71be33
Opcode Fuzzy Hash: 8dfc239a074c6d5ff8acffef4b018293f22a4272b9a3a2c4bbc44fe97c9547fd
Instruction Fuzzy Hash: 100169316002189BDB10DF6DD944B9EB3B8FF99710F40819EB949E7250DE74AA84CB90

Description:	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).
Tactics:	Reconnaissance
Data Sources:	Internet Scan: Response Content
Platforms:	PRE
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wechat-3.9.7-installer_ae-GFz1.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\McAfee\Temp3475153614\analyticsmanager.cab

C:\Program Files\McAfee\Temp3475153614\analyticstelemetry.cab

C:\Program Files\McAfee\Temp3475153614\balloon_safe_annotation.png

C:\Program Files\McAfee\Temp3475153614\browserhost.cab

C:\Program Files\McAfee\Temp3475153614\browserplugin.cab

C:\Program Files\McAfee\Temp3475153614\downloadscan.cab

C:\Program Files\McAfee\Temp3475153614\eventmanager.cab

C:\Program Files\McAfee\Temp3475153614\icon_complete.png

C:\Program Files\McAfee\Temp3475153614\icon_failed.png

C:\Program Files\McAfee\Temp3475153614\icon_laptop.png

Windows Analysis Report
wechat-3.9.7-installer_ae-GFz1.exe

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre