Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SecurityScan_Release.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\mc-webview-cnt.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Windows\System32\drivers\etc\hosts
|
ASCII text, with CRLF, CR line terminators
|
modified
|
|
|
|
C:\ProgramData\McAfee Security Scan\ftstate.ini
|
Generic INItialization configuration [DataAnalytics]
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\aviary_client.js
|
ASCII text, with very long lines (1531), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\common.js
|
ASCII text, with very long lines (14337), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\config_manager.js
|
ASCII text, with very long lines (842), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\csp_client.js
|
ASCII text, with very long lines (3383), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\da_definitions.json
|
JSON data
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\data_collector.js
|
ASCII text, with very long lines (13754), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\data_items.json
|
JSON data
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\dataset.js
|
ASCII text, with very long lines (7140), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\dataset_da.js
|
ASCII text, with very long lines (6749), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\datasets_catalog.json
|
JSON data
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\dictionary.json
|
JSON data
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\emitter.js
|
ASCII text, with very long lines (4110), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\engine.js
|
ASCII text, with very long lines (11329), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\error_transmitter.js
|
ASCII text, with very long lines (2529), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\event_handler.js
|
ASCII text, with very long lines (6709), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\events.json
|
JSON data
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\hash128.js
|
ASCII text, with very long lines (4059), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\json2.js
|
ASCII text, with very long lines (3618), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\logging.js
|
ASCII text, with very long lines (3176), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\mappings.js
|
ASCII text, with very long lines (2160), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\mcutil.js
|
ASCII text, with very long lines (1832), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\observability_datasets.json
|
JSON data
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\observation_analytics.js
|
ASCII text, with very long lines (1151), with CRLF, LF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\operations.js
|
ASCII text, with very long lines (6532), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\preprocessors.js
|
ASCII text, with very long lines (825), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\profile.json
|
JSON data
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\registry.js
|
ASCII text, with very long lines (2785), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\rest_transport.js
|
ASCII text, with very long lines (6423), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\rules.js
|
ASCII text, with very long lines (3246), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\sha256.js
|
ASCII text, with very long lines (709), with CRLF, LF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\subdb.js
|
ASCII text, with very long lines (663), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transmitter_template.js
|
ASCII text, with very long lines (3717), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport.js
|
ASCII text, with very long lines (7089), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_api_endpoint.js
|
ASCII text, with very long lines (3250), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_aws_apigateway_v1.js
|
ASCII text, with very long lines (4753), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_da.js
|
ASCII text, with very long lines (2581), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_eng_observability.js
|
ASCII text, with very long lines (3274), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_event_hub.js
|
ASCII text, with very long lines (7985), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_ga.js
|
ASCII text, with very long lines (2200), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_mosaic_api_v2.js
|
ASCII text, with very long lines (4495), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_msgbus.js
|
ASCII text, with very long lines (3000), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\transport_template.js
|
ASCII text, with very long lines (1249), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\wa_settingsdb.js
|
ASCII text, with very long lines (814), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\Scripts\wmi.js
|
ASCII text, with very long lines (7401), with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\McAfee\MSSPlusClientAnalytics\dataConfig.cab
|
Microsoft Cabinet archive data, many, 68256 bytes, 44 files, at 0x44 +A "aviary_client.js" +A "common.js", flags 0x4, number
1, extra bytes 20 in head, 17 datablocks, 0x1503 compression
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\49b434c6-f349-4510-bf13-a106d882086a.tmp
|
PNG image data, 62 x 1, 8-bit colormap, non-interlaced
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\8dc6057b-3f5b-4953-ac94-f9c839cec9a3.tmp
|
PNG image data, 590 x 23, 8-bit colormap, non-interlaced
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\0bb75071-8faf-4920-ba0f-152ba6c716fe.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\292fc97d-90fa-4b02-860a-5ae1ae8f7039.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\319b4a06-297c-4545-bce3-3f1f7cb93364.tmp
|
JSON data
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\37d1dd6a-bd8e-499e-b432-b4f1ec581747.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\43e42eab-b009-423a-9b13-3b1bee00c322.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\817a63fe-de7c-46d2-8d0d-0cdb4d179274.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Crashpad\settings.dat
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Crashpad\throttle_store.dat
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\6701d20b-4faa-4a46-b021-cb5373b4327c.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\84eed6ac-c24a-45d5-97d6-cd3f93b14496.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\9e2579e3-3b1a-498f-9923-ae1b6b7e77d9.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8,
version-valid-for 1
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Cache\Cache_Data\data_1
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Cache\Cache_Data\index
|
FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Code Cache\js\index
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Code Cache\js\index-dir\temp-index
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Code Cache\js\index-dir\the-real-index (copy)
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (copy)
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\DIPS
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8,
version-valid-for 1
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\DawnCache\data_1
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\DawnCache\data_3
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\DawnCache\index
|
FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\EdgeEDrop\EdgeEDropSQLite.db
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8,
version-valid-for 14
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Extension Rules\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Extension Rules\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Extension Scripts\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Extension State\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Extension State\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\ExtensionActivityComp
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8,
version-valid-for 1
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\ExtensionActivityEdge
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8,
version-valid-for 2
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Favicons
|
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie
0x8, schema 4, UTF-8, version-valid-for 1
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\GPUCache\data_1
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\GPUCache\index
|
FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\History
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4,
UTF-8, version-valid-for 2
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Local Storage\leveldb\LOG
|
ASCII text
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Login Data
|
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 21, cookie
0xc, schema 4, UTF-8, version-valid-for 1
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network Action Predictor
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8,
version-valid-for 3
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\18bb1f98-87d8-466d-965f-54c5dc3ed76c.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\3de814c9-f32c-4d27-82b4-8fc2cd20a79e.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\6c6aac3d-6754-4750-8b55-6bced6676fb2.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\Cookies
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8,
version-valid-for 7
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\Network Persistent State (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\Network Persistent State~RF4bad2b.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\Reporting and NEL
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8,
version-valid-for 4
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\SCT Auditing Pending Reports (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\SCT Auditing Pending Reports~RF4a841c.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\Sdch Dictionaries (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\Trust Tokens
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8,
version-valid-for 3
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Network\da1f83ab-0a1d-4413-9bc1-e41d02be74c7.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Preferences (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Preferences~RF4adb64.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Preferences~RF4b20ba.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Preferences~RF4b7ec8.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Preferences~RF4bcd17.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\PreferredApps
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\README
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Secure Preferences (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Session Storage\000003.log
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Session Storage\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Site Characteristics Database\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Site Characteristics Database\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Sync Data\LevelDB\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Sync Data\LevelDB\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Top Sites
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8,
version-valid-for 1
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Visited Links
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\Web Data
|
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 87, cookie
0x36, schema 4, UTF-8, version-valid-for 3
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\cd796248-71bb-4eaa-8c9b-96f45bd22f3e.tmp
|
JSON data
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\cf6b7b05-c056-4028-ac3b-0b014d66a632.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\dc079ce6-f45e-4ddc-bae7-14599fa94dd6.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\heavy_ad_intervention_opt_out.db
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8,
version-valid-for 2
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\shared_proto_db\000001.dbtmp
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\shared_proto_db\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\shared_proto_db\CURRENT (copy)
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\shared_proto_db\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\shared_proto_db\MANIFEST-000001
|
OpenPGP Secret Key
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\shared_proto_db\metadata\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Default\shared_proto_db\metadata\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\GrShaderCache\data_0
|
FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\GrShaderCache\data_1
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\GrShaderCache\data_2
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\GrShaderCache\index
|
FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\GraphiteDawnCache\data_1
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\GraphiteDawnCache\index
|
FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Last Version
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Local State (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Local State~RF4a8276.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Local State~RF4a82d4.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Local State~RF4aa9d4.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Local State~RF4adb54.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Local State~RF4b32da.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Local State~RF4b8010.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Local State~RF4bcb13.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\ShaderCache\data_1
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\ShaderCache\index
|
FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\SmartScreen\RemoteData\customSynchronousLookupUris
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\SmartScreen\RemoteData\customSynchronousLookupUris_0
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\SmartScreen\RemoteData\edgeSettings
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\SmartScreen\RemoteData\edgeSettings_2.0-0
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\SmartScreen\RemoteData\synchronousLookupUris
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\Variations
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\b54ebfe8-022e-4a63-b50e-bdde9c420913.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSSPWebEB\EBWebView\fd16e3fe-62f7-4013-b7ff-f6253a35f7d9.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsdF56.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsdF57.tmp\InstallHelp\SecurityScanner32.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\InstallHelp\SecurityScanner32.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\Installer.ini
|
Generic INItialization configuration [UIFLOW]
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\McInstallerStartup.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\McUICnt.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\MicrosoftEdgeWebview2Setup.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\SecurityScan_Inner.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\UnInstaller.ini
|
Generic INItialization configuration [UIFLOW]
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\ftconfig.ini
|
Generic INItialization configuration [DataAnalytics]
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\MSSPResExtractor.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\McInstallerRes.dll
|
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\McInstallerRes_LD.dll
|
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\McInstallerStartup.dll
|
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\McUICnt.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\McUtil.dll
|
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\MicrosoftEdgeWebview2Setup.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\SecurityScan_Inner.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\WebView2Loader.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\installer.ini
|
Generic INItialization configuration [UIFLOW]
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\mc-webview-cnt.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\mcbrwsr2.dll
|
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsl3F93.tmp\x64\uninstaller.ini
|
Generic INItialization configuration [UIFLOW]
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsz6D3B.tmp\MSSPResExtractor.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsz6D3B.tmp\McInstallerRes.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsz6D3B.tmp\McInstallerRes_LD.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsz6D3B.tmp\McUtil.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsz6D3B.tmp\WebView2Loader.dll
|
PE32 executable (DLL) (console) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsz6D3B.tmp\mcbrwsr2.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\Install_complete.jpg
|
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop
CS3 Windows, datetime=2010:08:18 14:02:33], baseline, precision 8, 484x91, components 3
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\UninstallConfirm_wv.htm
|
HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\Uninstall_wv.htm
|
HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\Welcome_Install.jpg
|
PC bitmap, Windows 3.x format, 484 x 91 x 24, resolution 4724 x 4724 px/m, cbSize 132186, bits offset 54
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_bottom_left.png
|
PNG image data, 59 x 59, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_bottom_right.png
|
PNG image data, 59 x 59, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_bottom_x.png
|
PNG image data, 12 x 59, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_left_y.png
|
PNG image data, 53 x 1, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_progress.png
|
PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_progressbar.png
|
PNG image data, 1 x 25, 8-bit/color RGB, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_right_y.png
|
PNG image data, 62 x 1, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_status.png
|
PNG image data, 160 x 25, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_top_left.png
|
PNG image data, 347 x 79, 8-bit/color RGB, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_top_right.png
|
PNG image data, 30 x 76, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_top_x.png
|
PNG image data, 7 x 76, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\bg_warning.png
|
PNG image data, 1 x 52, 8-bit/color RGB, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_close.png
|
PNG image data, 17 x 17, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_min.png
|
PNG image data, 17 x 17, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_normal_disabled_left.png
|
PNG image data, 10 x 23, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_normal_disabled_right.png
|
PNG image data, 590 x 23, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_normal_left.png
|
PNG image data, 11 x 23, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_normal_right.png
|
PNG image data, 590 x 23, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_primary_left.png
|
PNG image data, 10 x 23, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_primary_right.png
|
PNG image data, 590 x 23, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_small_left.png
|
PNG image data, 11 x 17, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\btn_small_right.png
|
PNG image data, 252 x 17, 8-bit colormap, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\error-bgs.png
|
PNG image data, 66 x 164, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\error_wv.htm
|
HTML document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\first_wv.htm
|
HTML document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\icon_inprogress.png
|
PNG image data, 22 x 22, 8-bit/color RGBA, interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\install_wv.htm
|
HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\offer_background.png
|
PNG image data, 411 x 125, 8-bit/color RGB, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\status_wv.htm
|
HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\uninstallEnd_wv.htm
|
HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\warning.png
|
PNG image data, 65 x 53, 8-bit/color RGB, non-interlaced
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\warning_wv.htm
|
HTML document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\McAfee\MSSPRes\welcome_wv.htm
|
HTML document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
There are 214 hidden files, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
chrome.cloudflare-dns.com
|
162.159.61.3
|
||
|
mosaic-nova.apis.mcafee.com
|
44.231.153.113
|
||
|
analytics.apis.mcafee.com
|
unknown
|
||
|
sadownload.mcafee.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
44.231.153.113
|
mosaic-nova.apis.mcafee.com
|
United States
|
||
|
162.159.61.3
|
chrome.cloudflare-dns.com
|
United States
|
||
|
1.1.1.1
|
unknown
|
Australia
|
||
|
13.107.21.239
|
unknown
|
United States
|
||
|
52.35.229.208
|
unknown
|
United States
|
||
|
13.107.42.16
|
unknown
|
United States
|
||
|
2.16.168.115
|
unknown
|
European Union
|
||
|
172.64.41.3
|
unknown
|
United States
|
||
|
2.16.168.105
|
unknown
|
European Union
|