neshta | 9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
Size

1.6MB
MD5

447643ba5585ca6703920221de608b49
SHA1

bc6a562394b0f8c530ca12cd4628a227c7e76e98
SHA256

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db
SHA512

993b12fa5ab9c43297a20cbed0db2e3b66342927fe32d1e07e9e03a6c9cae4741d5bff179bc88e7fc79a1fd76748f097a3c51bd4e009136c67d43dba6dd054e7
SSDEEP

24576:TOr9XYbYfcZ892tQ5tBBJiUebUbJ/tuZwlKd6BAcjF9RnwgqYkmslV18tHloN:TyXYbWU8tBLebOJ1uuKd6aC3q2slVCU

Score

10^/10

neshta adware discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 2 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

2 812 msiexec.exe
4 812 msiexec.exe
6 812 msiexec.exe

flow	pid	process
2	812	msiexec.exe
4	812	msiexec.exe
6	812	msiexec.exe

Executes dropped EXE 7 IoCs

Processes:

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exeMSID6F9.tmpMSI2193.tmpWMStatusbarSync.exeMSI277D.tmpsvchost.comWMStatusbarSync.exe

pid	process
1932	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
320	MSID6F9.tmp
1328	MSI2193.tmp
828	WMStatusbarSync.exe
1480	MSI277D.tmp
1740	svchost.com
1372	WMStatusbarSync.exe

Loads dropped DLL 20 IoCs

Processes:

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exeMsiExec.exeIEXPLORE.EXE

pid	process
1376	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
1376	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
1324	MsiExec.exe
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

MsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ = "TBSB03374"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\NoExplorer = "1"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}	MsiExec.exe

Drops file in System32 directory 16 IoCs

Processes:

MsiExec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\update.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\anim.gif	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\basis.xml	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\favicon.ico	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\SecurityHelper.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\tbs_include_script_statusbar.js	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\16x16x32b.bmp	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\booble.html	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\favicon.png	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\uninstall.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\WMStatusbarSync.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\tbs_include_script_wmadvisor.js	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\version.txt	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\wmadvisor.crc	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\16x16x32b.bmp	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\info.txt	MsiExec.exe

Drops file in Program Files directory 64 IoCs

Processes:

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exemsiexec.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\favicon.ico	msiexec.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\anim.gif	msiexec.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\16x16x32b.bmp	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\basis.xml	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\favicon.png	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\statusbar_pluginU.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\tbs_include_script_wmadvisor.js	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\uninstall.exe	msiexec.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\info.txt	msiexec.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\tbcore3.dll	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\version.txt	msiexec.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\booble.html	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\tbs_include_script_statusbar.js	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\wmadvisor.crc	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe	msiexec.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe

Drops file in Windows directory 16 IoCs

Processes:

svchost.comDrvInst.exemsiexec.exe9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe

description	ioc	process
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\6cc7d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI277D.tmp	msiexec.exe
File created	C:\Windows\Installer\6cc7d6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6cc7d4.ipi	msiexec.exe
File opened for modification	C:\Windows\svchost.com	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSID6F9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\6cc7d2.msi	msiexec.exe
File created	C:\Windows\Installer\6cc7d4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2193.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2104.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	nsis_installer_1

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEMsiExec.exeiexplore.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\TBShow = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000000700005e010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\toolbar_id = "{1B373B0F-F7B1-4f4e-BF3E-A6260A28C313}"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94A85A11-67FC-11ED-B7DD-7E0305A911F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\KeepHistory = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100001001600000001000000000700005e01000006000000010300002c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7d7ff3a3dfd9d4c8f8303296a1a88400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\wmtransfer.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\UpdateAutomatically = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\TBShow = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\AuxLastTime = "1668857017"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\m_bWorking = "0"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A324D072-F118-4135-9F87-6ED60AFA7507}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07AFC698-4760-4d3f-8985-122D8EE1249F}\Policy = "3"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\wmtransfer.com\Total = "8"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\CurrentLayout = "0"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A324D072-F118-4135-9F87-6ED60AFA7507}\Policy = "3"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\HotIcon = "C:\\Program Files (x86)\\WebMoney Advisor\\favicon.ico"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bd117209fcd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\AutoComplete = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000001600000001000000000700005e01000006000000010300002c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7d7ff3a3dfd9d4c8f8303296a1a88400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\tb_items\feedbacklist = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\toolbar_version = "1.0.15"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\updateXML = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000001500000001000000000700005e010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000000700005e01000006000000090100007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7d7ff3a3dfd9d4c8f8303296a1a88400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A324D072-F118-4135-9F87-6ED60AFA7507}\AppPath = "C:\\Program Files (x86)\\WebMoney Advisor\\"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\MenuStatusBar = "WebMoney Advisor"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\Toolbar Path = "C:\\Users\\Admin\\AppData\\LocalLow\\Toolbar4\\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\\"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\TBPos = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07AFC698-4760-4d3f-8985-122D8EE1249F}\AppPath = "C:\\Program Files (x86)\\WebMoney Advisor"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\firstTime = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\MenuText = "WebMoney Advisor"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\TBShow = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\Height = "22"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\TBSB03374\Toolbar\Height = "22"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

MsiExec.exemsiexec.exeWMStatusbarSync.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl\CurVer	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{835CD9AE-BAB0-4BC3-BA17-BA7008754395}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.BandHoster.1	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.SyncClient	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\71702C0FA7AD94949B97C8FB75EE53D9\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB03374.1\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96456B75-E6F7-4E95-9A4D-6DCDA54CEEF1}\TypeLib\ = "{77AA25E8-6083-4949-A831-9CB11861DC10}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90BA1AE4-915B-4889-88BB-E0E203E28051}\ProgID\ = "WMStatusbarSync.WMStatusbarSyncObj.1"	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90BA1AE4-915B-4889-88BB-E0E203E28051}\AppID = "{67A93A36-F3D2-4BD3-8F45-894E88E16F4A}"	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.BandHoster\CurVer	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB03374.TBSB03374.3\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90BA1AE4-915B-4889-88BB-E0E203E28051}\TypeLib	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E6A3564-6F10-4CC1-ADFD-929AE8D8F58A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D180E85-C059-4322-8761-DDD07796CAEE}\TypeLib\ = "{0044D840-7B8D-4186-853C-82BE5D95FDD2}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23CC1657-F2E0-447B-9570-94BE33258999}\TypeLib\ = "{0044D840-7B8D-4186-853C-82BE5D95FDD2}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A7DD59035184bd24889CEF62B7334CCE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB03374.IEToolbar.1\ = "WebMoney Advisor - Toolbar"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96456B75-E6F7-4E95-9A4D-6DCDA54CEEF1}\ = "ICustomInternetSecurityImpl"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96456B75-E6F7-4E95-9A4D-6DCDA54CEEF1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0\0\win32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B6BF015A-21A5-48BA-BCCD-4BC3ED2DC510}\TypeLib\ = "{F3F6A4A3-4C1E-4983-8C21-7C9D4BCAC8D3}"	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A7DD59035184bd24889CEF62B7334CCE\71702C0FA7AD94949B97C8FB75EE53D9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib\ = "{4509D3CC-B642-4745-B030-645B79522C6D}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90BA1AE4-915B-4889-88BB-E0E203E28051}\VersionIndependentProgID	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90BA1AE4-915B-4889-88BB-E0E203E28051}\Programmable	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.BandHoster	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.SyncClient.1\ = "SyncClient Class"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}\ProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\71702C0FA7AD94949B97C8FB75EE53D9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB03374.TBSB03374\	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.SyncClient\CurVer\ = "statusbar.SyncClient.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\0\win32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4BB4C9A-567B-4A5B-82F7-15ABB832E97C}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3F6A4A3-4C1E-4983-8C21-7C9D4BCAC8D3}\1.0	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0044D840-7B8D-4186-853C-82BE5D95FDD2}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0044D840-7B8D-4186-853C-82BE5D95FDD2}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\WebMoney Advisor"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB03374\CLSID\ = "{FCBCCB87-9224-4B8D-B117-F56D924BEB18}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.SyncClient\CLSID\ = "{E27EE513-9327-425E-90C7-444AFDBAEB58}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E45787B-E6F5-41DE-A50F-F6823DFE38E8}\TypeLib\ = "{0044D840-7B8D-4186-853C-82BE5D95FDD2}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4BB4C9A-567B-4A5B-82F7-15ABB832E97C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{835CD9AE-BAB0-4BC3-BA17-BA7008754395}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1\CLSID\ = "{CA3EB689-8F09-4026-AA10-B9534C691CE0}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23CC1657-F2E0-447B-9570-94BE33258999}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\71702C0FA7AD94949B97C8FB75EE53D9\Version = "16777231"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ = "IToolbarURLSearchHook"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB03374.TBSB03374\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\TypeLib\ = "{77AA25E8-6083-4949-A831-9CB11861DC10}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB03374.1\ = "WebMoney Advisor - BHO Helper"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB03374.1\CLSID\ = "{FCBCCB87-9224-4B8D-B117-F56D924BEB18}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}\ProgID\ = "Toolbar3.CustomInternetSecurityImpl.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96456B75-E6F7-4E95-9A4D-6DCDA54CEEF1}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMStatusbarSync.WMStatusbarSyncObj\CLSID\ = "{90BA1AE4-915B-4889-88BB-E0E203E28051}"	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E45787B-E6F5-41DE-A50F-F6823DFE38E8}\ProxyStubClsid32	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

MSID6F9.tmpmsiexec.exe

pid process

320 MSID6F9.tmp
320 MSID6F9.tmp
320 MSID6F9.tmp
812 msiexec.exe
812 msiexec.exe

pid	process
320	MSID6F9.tmp
320	MSID6F9.tmp
320	MSID6F9.tmp
812	msiexec.exe
812	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeSecurityPrivilege	812	msiexec.exe
Token: SeCreateTokenPrivilege	1296	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1296	msiexec.exe
Token: SeLockMemoryPrivilege	1296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1296	msiexec.exe
Token: SeMachineAccountPrivilege	1296	msiexec.exe
Token: SeTcbPrivilege	1296	msiexec.exe
Token: SeSecurityPrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeLoadDriverPrivilege	1296	msiexec.exe
Token: SeSystemProfilePrivilege	1296	msiexec.exe
Token: SeSystemtimePrivilege	1296	msiexec.exe
Token: SeProfSingleProcessPrivilege	1296	msiexec.exe
Token: SeIncBasePriorityPrivilege	1296	msiexec.exe
Token: SeCreatePagefilePrivilege	1296	msiexec.exe
Token: SeCreatePermanentPrivilege	1296	msiexec.exe
Token: SeBackupPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeShutdownPrivilege	1296	msiexec.exe
Token: SeDebugPrivilege	1296	msiexec.exe
Token: SeAuditPrivilege	1296	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1296	msiexec.exe
Token: SeChangeNotifyPrivilege	1296	msiexec.exe
Token: SeRemoteShutdownPrivilege	1296	msiexec.exe
Token: SeUndockPrivilege	1296	msiexec.exe
Token: SeSyncAgentPrivilege	1296	msiexec.exe
Token: SeEnableDelegationPrivilege	1296	msiexec.exe
Token: SeManageVolumePrivilege	1296	msiexec.exe
Token: SeImpersonatePrivilege	1296	msiexec.exe
Token: SeCreateGlobalPrivilege	1296	msiexec.exe
Token: SeBackupPrivilege	1756	vssvc.exe
Token: SeRestorePrivilege	1756	vssvc.exe
Token: SeAuditPrivilege	1756	vssvc.exe
Token: SeBackupPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeRestorePrivilege	1900	DrvInst.exe
Token: SeRestorePrivilege	1900	DrvInst.exe
Token: SeRestorePrivilege	1900	DrvInst.exe
Token: SeRestorePrivilege	1900	DrvInst.exe
Token: SeRestorePrivilege	1900	DrvInst.exe
Token: SeRestorePrivilege	1900	DrvInst.exe
Token: SeRestorePrivilege	1900	DrvInst.exe
Token: SeLoadDriverPrivilege	1900	DrvInst.exe
Token: SeLoadDriverPrivilege	1900	DrvInst.exe
Token: SeLoadDriverPrivilege	1900	DrvInst.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeiexplore.exe

pid process

1296 msiexec.exe
1296 msiexec.exe
1808 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1808 iexplore.exe
1808 iexplore.exe
436 IEXPLORE.EXE
436 IEXPLORE.EXE
436 IEXPLORE.EXE
436 IEXPLORE.EXE
436 IEXPLORE.EXE

pid	process
1296	msiexec.exe
1296	msiexec.exe
1808	iexplore.exe

pid	process
1808	iexplore.exe
1808	iexplore.exe
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE
436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exemsiexec.exeMsiExec.exeMSI277D.tmpsvchost.comiexplore.exe

description	pid	process	target process
PID 1376 wrote to memory of 1932	1376	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
PID 1376 wrote to memory of 1932	1376	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
PID 1376 wrote to memory of 1932	1376	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
PID 1376 wrote to memory of 1932	1376	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
PID 1932 wrote to memory of 1296	1932	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 1932 wrote to memory of 1296	1932	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 1932 wrote to memory of 1296	1932	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 1932 wrote to memory of 1296	1932	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 1932 wrote to memory of 1296	1932	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 1932 wrote to memory of 1296	1932	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 1932 wrote to memory of 1296	1932	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 812 wrote to memory of 1964	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1964	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1964	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1964	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1964	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1964	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1964	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 320	812	msiexec.exe	MSID6F9.tmp
PID 812 wrote to memory of 320	812	msiexec.exe	MSID6F9.tmp
PID 812 wrote to memory of 320	812	msiexec.exe	MSID6F9.tmp
PID 812 wrote to memory of 320	812	msiexec.exe	MSID6F9.tmp
PID 812 wrote to memory of 1328	812	msiexec.exe	MSI2193.tmp
PID 812 wrote to memory of 1328	812	msiexec.exe	MSI2193.tmp
PID 812 wrote to memory of 1328	812	msiexec.exe	MSI2193.tmp
PID 812 wrote to memory of 1328	812	msiexec.exe	MSI2193.tmp
PID 812 wrote to memory of 1328	812	msiexec.exe	MSI2193.tmp
PID 812 wrote to memory of 1328	812	msiexec.exe	MSI2193.tmp
PID 812 wrote to memory of 1328	812	msiexec.exe	MSI2193.tmp
PID 812 wrote to memory of 1324	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1324	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1324	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1324	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1324	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1324	812	msiexec.exe	MsiExec.exe
PID 812 wrote to memory of 1324	812	msiexec.exe	MsiExec.exe
PID 1324 wrote to memory of 828	1324	MsiExec.exe	WMStatusbarSync.exe
PID 1324 wrote to memory of 828	1324	MsiExec.exe	WMStatusbarSync.exe
PID 1324 wrote to memory of 828	1324	MsiExec.exe	WMStatusbarSync.exe
PID 1324 wrote to memory of 828	1324	MsiExec.exe	WMStatusbarSync.exe
PID 812 wrote to memory of 1480	812	msiexec.exe	MSI277D.tmp
PID 812 wrote to memory of 1480	812	msiexec.exe	MSI277D.tmp
PID 812 wrote to memory of 1480	812	msiexec.exe	MSI277D.tmp
PID 812 wrote to memory of 1480	812	msiexec.exe	MSI277D.tmp
PID 812 wrote to memory of 1480	812	msiexec.exe	MSI277D.tmp
PID 812 wrote to memory of 1480	812	msiexec.exe	MSI277D.tmp
PID 812 wrote to memory of 1480	812	msiexec.exe	MSI277D.tmp
PID 1480 wrote to memory of 1740	1480	MSI277D.tmp	svchost.com
PID 1480 wrote to memory of 1740	1480	MSI277D.tmp	svchost.com
PID 1480 wrote to memory of 1740	1480	MSI277D.tmp	svchost.com
PID 1480 wrote to memory of 1740	1480	MSI277D.tmp	svchost.com
PID 1740 wrote to memory of 1808	1740	svchost.com	iexplore.exe
PID 1740 wrote to memory of 1808	1740	svchost.com	iexplore.exe
PID 1740 wrote to memory of 1808	1740	svchost.com	iexplore.exe
PID 1740 wrote to memory of 1808	1740	svchost.com	iexplore.exe
PID 1808 wrote to memory of 436	1808	iexplore.exe	IEXPLORE.EXE
PID 1808 wrote to memory of 436	1808	iexplore.exe	IEXPLORE.EXE
PID 1808 wrote to memory of 436	1808	iexplore.exe	IEXPLORE.EXE
PID 1808 wrote to memory of 436	1808	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
"C:\Users\Admin\AppData\Local\Temp\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1376

C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\msiexec.exe
msiexec /i "C:\Users\Admin\AppData\Local\Temp\tmp.msi" /passive
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8CA43146CF0E29C727339943B23CC108
2⤵
PID:1964

C:\Windows\Installer\MSID6F9.tmp
"C:\Windows\Installer\MSID6F9.tmp"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:320

C:\Windows\Installer\MSI2193.tmp
"C:\Windows\Installer\MSI2193.tmp"
2⤵
- Executes dropped EXE
PID:1328

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0305270E2218DC512EBD17BBB4DC7694 M Global\MSI0000
2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1324

C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
"C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe" -RegServer
3⤵
- Executes dropped EXE
- Modifies registry class
PID:828

C:\Windows\Installer\MSI277D.tmp
"C:\Windows\Installer\MSI277D.tmp" "http://advisor.wmtransfer.com/URLFirst.aspx"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\PROGRA~1\INTERN~1\iexplore.exe" "http://advisor.wmtransfer.com/URLFirst.aspx"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1740

C:\PROGRA~1\INTERN~1\iexplore.exe
C:\PROGRA~1\INTERN~1\iexplore.exe http://advisor.wmtransfer.com/URLFirst.aspx
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:2
5⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A4" "00000000000003BC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
"C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe" -Embedding
1⤵
- Executes dropped EXE
PID:1372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WebMoney Advisor\16x16x32b.bmp
Filesize
6KB

MD5
7a8de6b0d8983a55f028f88cfda3e9e5

SHA1
2a43a8ae608842b8d07c361d4c209883fc2bba23

SHA256
b4ebec9b044e74dc5de06281bfb0720bef5188af462466fa7309148136044e79

SHA512
3f6de9e7f51d22a2f55ad6562bf972ba397feb2b0ab45cb503ae8f794ce7db7ce6818a864cb359c8e9973f014ee32dc0e7738e0c06bf61d727a1fa6b729e24b4

Download Submit
C:\Program Files (x86)\WebMoney Advisor\SecurityHelper.exe
Filesize
97KB

MD5
3638420461901bd8c64349ae009296d9

SHA1
35924eb1a9e09d502c9de8811bea4018825030a5

SHA256
0bef429d6d611eb9a7d60d6ef503861d99553cec5ce16c315edd7e80ba78280e

SHA512
acee469a9ad80d3429719227bb38da65ffccaa0671dea59e9c1af58c9dff57ab5989e0e05ebb1ec6d2363ea45e4601e1797360eb68f739b4ae1cfa93f93f2b1a

Download Submit
C:\Program Files (x86)\WebMoney Advisor\WMPlugin.dll
Filesize
543KB

MD5
e03b3c6c6933d24eca867a7872f5c020

SHA1
e38bee2ef977aa14fda4fa485e1d0f1e78c7a99d

SHA256
b9e614f6deda3d97d255b160383946a100f4734f80ff8c8f8f81b2552524b1da

SHA512
5eca4a826c64d686d6b4f01a234fc43d982f9227a0c5be2f962498b9445090f360bd312dd384459519daf04802ddca671dbebb6e78d81e85fb80de3b2f4f4c6f

Download Submit
C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
Filesize
97KB

MD5
053cebd5a825d556e7d350309a9ddfbc

SHA1
3a48d230fe2a259332cc7c53ec54c8fcda728bd7

SHA256
e4f8763c5b1dab014aa23edfb37b93165cb936a3067dc6955390cb977fc1bb90

SHA512
225b97016b62eaa0f44525c8f85ea5601c2c7eab3583db6703ef7f0b47085abc2bf85eb65726645bef1793dc7f4e49dacea090ffa030a95c3b2b6bcfd3cfecf3

Download Submit
C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
Filesize
97KB

MD5
053cebd5a825d556e7d350309a9ddfbc

SHA1
3a48d230fe2a259332cc7c53ec54c8fcda728bd7

SHA256
e4f8763c5b1dab014aa23edfb37b93165cb936a3067dc6955390cb977fc1bb90

SHA512
225b97016b62eaa0f44525c8f85ea5601c2c7eab3583db6703ef7f0b47085abc2bf85eb65726645bef1793dc7f4e49dacea090ffa030a95c3b2b6bcfd3cfecf3

Download Submit
C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
Filesize
97KB

MD5
053cebd5a825d556e7d350309a9ddfbc

SHA1
3a48d230fe2a259332cc7c53ec54c8fcda728bd7

SHA256
e4f8763c5b1dab014aa23edfb37b93165cb936a3067dc6955390cb977fc1bb90

SHA512
225b97016b62eaa0f44525c8f85ea5601c2c7eab3583db6703ef7f0b47085abc2bf85eb65726645bef1793dc7f4e49dacea090ffa030a95c3b2b6bcfd3cfecf3

Download Submit
C:\Program Files (x86)\WebMoney Advisor\anim.gif
Filesize
673B

MD5
73e57937304d89f251e7e540a24b095a

SHA1
a3243ca6a628b77b3523a18aff6bafae85b45adc

SHA256
43a526a07a078d736e5c9d67d8479dd54072b7e5c6ddd2cd466f86a086e49ef5

SHA512
a77eace1fc8d0af1b3709d9ea390d5c899a87a75202d6ff754dd8fd2699d0638bbdbd95e0512f7916f8549e1b3501a18ee897c6610d5b077a85b9dd6a6d2b45d

Download Submit
C:\Program Files (x86)\WebMoney Advisor\basis.xml
Filesize
20KB

MD5
564a96462e01d45c60cf998ae3f589a4

SHA1
c5728d733e2301102a068274e64ff2de7bd768c8

SHA256
e7d62cbde4500b43a58ea3c5a0ecef61610b7a00dc6704184f44a72c8a08eef3

SHA512
ae039f9be817773b085fa99ee8d78d1e92106cd2ec3a4b94ec49496e9ec5993e58802fc4f6c0936141bc362f72f82fdccc769242904c19d57527fb282bcc5ecc

Download Submit
C:\Program Files (x86)\WebMoney Advisor\booble.html
Filesize
2KB

MD5
929f155c400e35a1c724399eff7505c9

SHA1
a141f924ed1eafd20849457e644300f77dfee7f3

SHA256
657dadceef1c84c95f6fffafa35a46b158d326c850affc136ee680266d99531b

SHA512
1a1776c29688d26e88db2f233fec928c80fb9aed713f713ddae7f249db325030394acd61ae73e752feb827a346854fb7c40f266be7756bfacf99b98fec88875a

Download Submit
C:\Program Files (x86)\WebMoney Advisor\favicon.ico
Filesize
12KB

MD5
90e868b0b175ce1f9164deb5fa6dbcad

SHA1
f9797cefe2fa02dbe277cb4fc3763bf096003b12

SHA256
21b7b57a0f5337ac5199352e7c7c8ae1f0ccef3dc682714b8be86abadeaa2678

SHA512
15da93c0c7069fe6a915248ee49d047b1f7c8c1a60d7d23b9a076d120ae1417e518ec4b5d58a1989666f09402c1434b836eead9d866b268b70596caa1db0f8da

Download Submit
C:\Program Files (x86)\WebMoney Advisor\favicon.png
Filesize
2KB

MD5
4970e807624d7fc5670a6b18e306f06d

SHA1
7cfffdb6f7a848632a270bab69f89b52592707fb

SHA256
3e5d1f206af5f5759b784908279a3ba0aa10e67c8b784ea840fb3967b175933e

SHA512
080e831e088eccb3dcb4a6a950b0c38f420839cf7789a30e828b6cadde69e2546eb294caeaad5f6403fcc97a93e8738593b9747074344efe86f686343ec39d77

Download Submit
C:\Program Files (x86)\WebMoney Advisor\info.txt
Filesize
716B

MD5
17afbc68437d9cb0f55bb1888edc2deb

SHA1
f18d0585167c3365e5d022a67072b356ca6ef3ea

SHA256
2e00a68210d45c89c191c99b2f85dc04dfc2cfad93576b1ffc439af59ac44f43

SHA512
05f0dd8a8b965ef56bd99e5b17adb18f51f1e4589c7321e0c2cba5a0f2af5b27a8964c162e5a4c2f5e3d004c0d5ec823b92e070e54aa69818b1604f28236425b

Download Submit
C:\Program Files (x86)\WebMoney Advisor\statusbar_pluginU.dll
Filesize
290KB

MD5
bafc912eecff410a8f063233f06bb77f

SHA1
f0941bd7a7088ddcdf7b152609007c36ca8ba99b

SHA256
f0e0459cb2441b1da99b38d3c5023065aa4863137846fc5847aa59941bf7f454

SHA512
7d0351278d80f3aab69321561e328412e703e9e4b44594db6a2dd08d40873abc025d1568a90f30b394745ce0525dce9753c35d91cfff8420ceeaef8943872dd3

Download Submit
C:\Program Files (x86)\WebMoney Advisor\tbcore3.dll
Filesize
2.4MB

MD5
3e348dd201e4a1b6b0f03eeaa387e2af

SHA1
a1aaeaa3dfc8ea471384a34c0c0c14bd5eb38506

SHA256
3e34b39a26f7f8480472bfeeea9643f6aca6b1252818cf0aee3b7fd0b8ffaea4

SHA512
bd2843c46e76ce6c204e91561d2281c3645a8edf27e7bf1b0cf1c573ec15e3fae5fe92b88b5bb64cb6accee0ef0b86d4ba4b093adf1f4ec79519ff131f29d65d

Download Submit
C:\Program Files (x86)\WebMoney Advisor\tbhelper.dll
Filesize
378KB

MD5
f4f5499d2f27148c42ccd8f930383762

SHA1
83cbd284da58727235ecba3034734f9299c73893

SHA256
bc3beda7bcfdd570557f7c0497159adbef16cf96005b2337bb807321ac8a80c9

SHA512
e149be4f7677056602804d2452d4ff50f1149dd72efc768df21617318ce2714eca6362a24599c3a69123c6475f4d577d6b6bec93e4aabc15a2facae492a3e9b0

Download Submit
C:\Program Files (x86)\WebMoney Advisor\tbs_include_script_statusbar.js
Filesize
1KB

MD5
a61a9151aa9d9a203c5b1e8135b36001

SHA1
5adea2404b14986ceb5256ba19c5499a4b0879f2

SHA256
561bf0c0ccb60c033b5a296ce148b2378a8ca5aa32f0d8efcbce8f09e9c49d12

SHA512
a55ecaf67a437ed7ae07fc6a0b6e6e1c7327eb696d1db778f5d60cd8b287b93dbd76da63f785191a826e6f9471b59c708dffb3cc8ead963d087a909798e135f1

Download Submit
C:\Program Files (x86)\WebMoney Advisor\tbs_include_script_wmadvisor.js
Filesize
77B

MD5
96936b3e30537d8541bbb78f72db95cc

SHA1
2cbc721a9f91673dafbc19b8b5ff589561988d9e

SHA256
87112382487e3612c003be1fdd37a1cc8685c6b9e45d6cc754fcf92219a3fb0e

SHA512
0585254589550acbba79e0d16e581a5a61bb719e9269eeca38bcbff230b4a7c80abb85adcd5537bbfcdc627b4cad701980f263f25069d2b572b561925b72cc84

Download Submit
C:\Program Files (x86)\WebMoney Advisor\uninstall.exe
Filesize
42KB

MD5
f803dd27100bb03bdd72b5635e86f537

SHA1
0397fbe79da7ebf9540d7950344de99ed6053674

SHA256
965548278f2d56f52968a86f9d7bed327add969d05189b67dd22f7c6f4295efb

SHA512
4cfb24893899886d669876c542f1c21af38bb94316f9d76f05111b6e08aca50fb2dfe79d0bc61c109425c2420a99d3117ecffee4975373d7bc0896297387b426

Download Submit
C:\Program Files (x86)\WebMoney Advisor\update.exe
Filesize
58KB

MD5
62f1a03824bfeba44f133d2caeb0b72d

SHA1
a115a461c2471ef4080a5ea244190e493945c712

SHA256
27fe78f886f9ebc7f9346a89f7b4a7a25a513882b5aab88efb124e85fdfaab5b

SHA512
f29a973a5a1ed76d051fc7cd571b87fb5ad82dc8c7ca96fe9f9c1ff0d6abc0a0be35388e3f1344f62762aeddce1ec3d238b4d29a6a73ca868feaac55dc85a3b7

Download Submit
C:\Program Files (x86)\WebMoney Advisor\version.txt
Filesize
53B

MD5
3369e0cd72cf86c7ab8d021703e23e78

SHA1
a921b3c1f7f1513aea0714869b227d92ab7ef310

SHA256
7a815e5cbde08710817a58c1ec7b8b2660e4371938e277311b63f831d45056d7

SHA512
2a3637937862dfa3f7497f9bb8ffff003e78e0870c138a3e06c4eece5e7ae268f84adcdfe9b5c21e0b46ad5ee666674a9669dd5b752c936a741ee075c6af5bbe

Download Submit
C:\Program Files (x86)\WebMoney Advisor\wmadvisor.dll
Filesize
45KB

MD5
1c3450ffea9150e3adb931124f18f44e

SHA1
fb78bc224de8014f4be0d1cd970fb3c1033f314c

SHA256
1648e3de5a5d2d79ed5c46aeccbddef8e3a8ee857f9607e7d296521b05d76428

SHA512
8b9055d1d1ad3b5291819502ef2095abe1e928645507c67677dab34f2ce0a7a065e7ea81e766d0553758abe57a2491de959206dbf5b04573b6a3b597012002d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8c565aba1486cc9432c892ef3766a87a

SHA1
469a8919da8e4eee0b08c7eaeca7826b9450be19

SHA256
fa99e92b7dba4016fc95eed77e7e59e2da62d36d5bc2b1d074e7043c66556347

SHA512
b68524c537fe036a0d7c2d9c414a85b74ff052e2609d61f2184120c2456791a4c76cca2588f0d601714718cfb6e6bdac8c820c708977f609d160e7eecc1cd134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d8555cbad2004fac511b9cae16728653

SHA1
c7995ba02d934f97aebbe50e3247e0b4b5cd4701

SHA256
61da46042b02a562612413224130df2ffa04f3ee3f5982672917f3480ee59834

SHA512
2c93847d24182bf942448047a9b313f3bb24271229ded63949e924892056a01ee0a99b7a08350f2e60616dd91329c90afa23eb28ec8664e4ec4402ac5e7e77be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
e0847accf34429b299ed2b92cccd397f

SHA1
6f6f888f5604cc3eb38b32bd1be24b57a5e7a9c5

SHA256
1e9a779b91e9df7cfe8925f0860d739b9f3c6584e3d2b4c570a8c858d65e1a59

SHA512
8bf1a8faa8f9e06efe9400dce6372396e44707270a60be6f51c89a38341453b81a2332ca06a92df2b498fc79b2e9172cbeeca5aa5427868f599c6e5ee054ed0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
5KB

MD5
64d691113d46e3fc33d674e9c23bb39d

SHA1
1972085d3b8298fa53a3a2a89b9da5073cfe17df

SHA256
f7ba4563ca2115c16b049542db48db29c0da433cc8122a3369e4006c235611e6

SHA512
2ae01d64288fa63c6c496d50426dd2569e35d955fbeeb1967429d71f8057f6b9c3f415ffd0607194f246b15d07db51ed0fa3d61ce0009d1f38ef5b6a099d3b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
Filesize
1.6MB

MD5
e00af2ea64380df0965cf1262e99885a

SHA1
f75989d956c67d70b5b900f1efdd4d51c4db126a

SHA256
964d4067cb3907b28e10eb01eb04a1368419e01e378f32ca6224ef532f8ccbfe

SHA512
e7de04430b56d6ce3a9446122fd8c06efe40b9ef6f0ad46f18c6cc1673fbcbf6d7abd1d06cd1367428704b482fd9e552e7e9edbdccbf1976c9471778249c46bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
Filesize
1.6MB

MD5
e00af2ea64380df0965cf1262e99885a

SHA1
f75989d956c67d70b5b900f1efdd4d51c4db126a

SHA256
964d4067cb3907b28e10eb01eb04a1368419e01e378f32ca6224ef532f8ccbfe

SHA512
e7de04430b56d6ce3a9446122fd8c06efe40b9ef6f0ad46f18c6cc1673fbcbf6d7abd1d06cd1367428704b482fd9e552e7e9edbdccbf1976c9471778249c46bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.msi
Filesize
2.2MB

MD5
1d64863471c297d63b27662a3b23c8eb

SHA1
a7053c2858b7d28d57f8d781e86dadd953099424

SHA256
561812f78ab05310e751b751036a2020acc46080cb832b5bd06ad57c9213a0b8

SHA512
86317e13610f4e7412a3fe0694e6212b28690f902d9e5f322aa6cbc71720135bd6609d70f4d107906728f2e1533e12caa6a5e89732b73322204990cac8b6b550

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
Filesize
8B

MD5
b66cccd51d74c11a71eb0fea156d31c4

SHA1
3455455444a58ad746fd0457d5edcc3346bf475f

SHA256
c4c53361c52fe464e4466468a5c944eb99b9ef7535644ca5e8571eca1d258a7f

SHA512
efd06ce21030030ad384af53855738864608458b52050ba5a04c22e9134654cc0368d637ec059e2fa8104fdf18727b53383e034fcc11582cdc2055d367bf02d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YWUID3JO.txt
Filesize
603B

MD5
0fb92087c36cfc109aa5f57ec4c517b0

SHA1
323a1f412130f183cb2a6a7afccdcfec2718ebfd

SHA256
1bd2a1a62af9f4975cb2597e0d0d62a1c92b4c8aeb7ff2920423002f3657929c

SHA512
5682e5d83abd8c44cb3d5ac1172d1d336399d4fa962cda2664c67f53b934bc8c7f07da11f660ed1cc172bbdadd0f93590467c093d5af3a767b28cfe26b8ddcf4

Download Submit
C:\Windows\Installer\MSI2193.tmp
Filesize
45KB

MD5
effd34ccfd3ade941419b76586ff325d

SHA1
dda92941e3d7af8f3e5f0b8114f1ec77e8c02497

SHA256
bab3adf64cfb1c1431e87b75eb8d4c9c2672ab5454689faa76cc51a5dbecf1f2

SHA512
8614305910e444f8e85737f55966f15a7b770780981da9c6cd63064bfe58d930a4b401f97bb574cf7ec7c8e6c7b29a73ac166ba3234332992352be0b7a44e56a

Download Submit
C:\Windows\Installer\MSI277D.tmp
Filesize
88KB

MD5
c01e7ca6162d0bbb6f6d637c4f860375

SHA1
51e234609bad8bb8ee260e19374c01fbf80d1a97

SHA256
3aa0dcf0b32b5286ef1f7d95a8b053c37a9cba8a95e97838b01ed61cacf404e2

SHA512
9fc75e66507af64e401cc6761ba66bae61f52b5442f7ff61a14af880ace82192fb7e2859486d11d8dc759d1e867da439ce67c4f4a350a4f9994aa8ea00d74f95

Download Submit
C:\Windows\Installer\MSID6F9.tmp
Filesize
93KB

MD5
d2cc539b80b7372def65f227b548b374

SHA1
58094e58f28c96cc6fe13735d85501984e74e0eb

SHA256
3b316c92c459585ed6f9883ef223e64c9e5976bce6d8e2969cfe9324bf2c8355

SHA512
5557561183d96f80b448f8bfe279f7d20103c3068b6787b71fa139aa52843326536a3dc05e569309daaae8030d206cd1b4f01046edad525c51424f2d31511292

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
ee0b17e662855f6830e926e15276a012

SHA1
0f92e31652db199b3a3882c8f2d96e25dc3d79a5

SHA256
8489aeef7b6309c71199112f97b1b8f9cd78a352b05936137b0d25de319effa0

SHA512
21eab0051e77d338c024ddc4cc3c5dc5b2df19fab43b6864422dbae9a3e6372eca5c708b11eae73fb72a293ccce55a91309374e8b2646df9d926e39ceb243641

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
ee0b17e662855f6830e926e15276a012

SHA1
0f92e31652db199b3a3882c8f2d96e25dc3d79a5

SHA256
8489aeef7b6309c71199112f97b1b8f9cd78a352b05936137b0d25de319effa0

SHA512
21eab0051e77d338c024ddc4cc3c5dc5b2df19fab43b6864422dbae9a3e6372eca5c708b11eae73fb72a293ccce55a91309374e8b2646df9d926e39ceb243641

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Program Files (x86)\WebMoney Advisor\WMPlugin.dll
Filesize
543KB

MD5
e03b3c6c6933d24eca867a7872f5c020

SHA1
e38bee2ef977aa14fda4fa485e1d0f1e78c7a99d

SHA256
b9e614f6deda3d97d255b160383946a100f4734f80ff8c8f8f81b2552524b1da

SHA512
5eca4a826c64d686d6b4f01a234fc43d982f9227a0c5be2f962498b9445090f360bd312dd384459519daf04802ddca671dbebb6e78d81e85fb80de3b2f4f4c6f

Download Submit
\Program Files (x86)\WebMoney Advisor\WMPlugin.dll
Filesize
543KB

MD5
e03b3c6c6933d24eca867a7872f5c020

SHA1
e38bee2ef977aa14fda4fa485e1d0f1e78c7a99d

SHA256
b9e614f6deda3d97d255b160383946a100f4734f80ff8c8f8f81b2552524b1da

SHA512
5eca4a826c64d686d6b4f01a234fc43d982f9227a0c5be2f962498b9445090f360bd312dd384459519daf04802ddca671dbebb6e78d81e85fb80de3b2f4f4c6f

Download Submit
\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
Filesize
97KB

MD5
053cebd5a825d556e7d350309a9ddfbc

SHA1
3a48d230fe2a259332cc7c53ec54c8fcda728bd7

SHA256
e4f8763c5b1dab014aa23edfb37b93165cb936a3067dc6955390cb977fc1bb90

SHA512
225b97016b62eaa0f44525c8f85ea5601c2c7eab3583db6703ef7f0b47085abc2bf85eb65726645bef1793dc7f4e49dacea090ffa030a95c3b2b6bcfd3cfecf3

Download Submit
\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
Filesize
97KB

MD5
053cebd5a825d556e7d350309a9ddfbc

SHA1
3a48d230fe2a259332cc7c53ec54c8fcda728bd7

SHA256
e4f8763c5b1dab014aa23edfb37b93165cb936a3067dc6955390cb977fc1bb90

SHA512
225b97016b62eaa0f44525c8f85ea5601c2c7eab3583db6703ef7f0b47085abc2bf85eb65726645bef1793dc7f4e49dacea090ffa030a95c3b2b6bcfd3cfecf3

Download Submit
\Program Files (x86)\WebMoney Advisor\statusbar_pluginU.dll
Filesize
290KB

MD5
bafc912eecff410a8f063233f06bb77f

SHA1
f0941bd7a7088ddcdf7b152609007c36ca8ba99b

SHA256
f0e0459cb2441b1da99b38d3c5023065aa4863137846fc5847aa59941bf7f454

SHA512
7d0351278d80f3aab69321561e328412e703e9e4b44594db6a2dd08d40873abc025d1568a90f30b394745ce0525dce9753c35d91cfff8420ceeaef8943872dd3

Download Submit
\Program Files (x86)\WebMoney Advisor\statusbar_pluginU.dll
Filesize
290KB

MD5
bafc912eecff410a8f063233f06bb77f

SHA1
f0941bd7a7088ddcdf7b152609007c36ca8ba99b

SHA256
f0e0459cb2441b1da99b38d3c5023065aa4863137846fc5847aa59941bf7f454

SHA512
7d0351278d80f3aab69321561e328412e703e9e4b44594db6a2dd08d40873abc025d1568a90f30b394745ce0525dce9753c35d91cfff8420ceeaef8943872dd3

Download Submit
\Program Files (x86)\WebMoney Advisor\tbcore3.dll
Filesize
2.4MB

MD5
3e348dd201e4a1b6b0f03eeaa387e2af

SHA1
a1aaeaa3dfc8ea471384a34c0c0c14bd5eb38506

SHA256
3e34b39a26f7f8480472bfeeea9643f6aca6b1252818cf0aee3b7fd0b8ffaea4

SHA512
bd2843c46e76ce6c204e91561d2281c3645a8edf27e7bf1b0cf1c573ec15e3fae5fe92b88b5bb64cb6accee0ef0b86d4ba4b093adf1f4ec79519ff131f29d65d

Download Submit
\Program Files (x86)\WebMoney Advisor\tbcore3.dll
Filesize
2.4MB

MD5
3e348dd201e4a1b6b0f03eeaa387e2af

SHA1
a1aaeaa3dfc8ea471384a34c0c0c14bd5eb38506

SHA256
3e34b39a26f7f8480472bfeeea9643f6aca6b1252818cf0aee3b7fd0b8ffaea4

SHA512
bd2843c46e76ce6c204e91561d2281c3645a8edf27e7bf1b0cf1c573ec15e3fae5fe92b88b5bb64cb6accee0ef0b86d4ba4b093adf1f4ec79519ff131f29d65d

Download Submit
\Program Files (x86)\WebMoney Advisor\tbcore3.dll
Filesize
2.4MB

MD5
3e348dd201e4a1b6b0f03eeaa387e2af

SHA1
a1aaeaa3dfc8ea471384a34c0c0c14bd5eb38506

SHA256
3e34b39a26f7f8480472bfeeea9643f6aca6b1252818cf0aee3b7fd0b8ffaea4

SHA512
bd2843c46e76ce6c204e91561d2281c3645a8edf27e7bf1b0cf1c573ec15e3fae5fe92b88b5bb64cb6accee0ef0b86d4ba4b093adf1f4ec79519ff131f29d65d

Download Submit
\Program Files (x86)\WebMoney Advisor\tbcore3.dll
Filesize
2.4MB

MD5
3e348dd201e4a1b6b0f03eeaa387e2af

SHA1
a1aaeaa3dfc8ea471384a34c0c0c14bd5eb38506

SHA256
3e34b39a26f7f8480472bfeeea9643f6aca6b1252818cf0aee3b7fd0b8ffaea4

SHA512
bd2843c46e76ce6c204e91561d2281c3645a8edf27e7bf1b0cf1c573ec15e3fae5fe92b88b5bb64cb6accee0ef0b86d4ba4b093adf1f4ec79519ff131f29d65d

Download Submit
\Program Files (x86)\WebMoney Advisor\tbcore3.dll
Filesize
2.4MB

MD5
3e348dd201e4a1b6b0f03eeaa387e2af

SHA1
a1aaeaa3dfc8ea471384a34c0c0c14bd5eb38506

SHA256
3e34b39a26f7f8480472bfeeea9643f6aca6b1252818cf0aee3b7fd0b8ffaea4

SHA512
bd2843c46e76ce6c204e91561d2281c3645a8edf27e7bf1b0cf1c573ec15e3fae5fe92b88b5bb64cb6accee0ef0b86d4ba4b093adf1f4ec79519ff131f29d65d

Download Submit
\Program Files (x86)\WebMoney Advisor\tbhelper.dll
Filesize
378KB

MD5
f4f5499d2f27148c42ccd8f930383762

SHA1
83cbd284da58727235ecba3034734f9299c73893

SHA256
bc3beda7bcfdd570557f7c0497159adbef16cf96005b2337bb807321ac8a80c9

SHA512
e149be4f7677056602804d2452d4ff50f1149dd72efc768df21617318ce2714eca6362a24599c3a69123c6475f4d577d6b6bec93e4aabc15a2facae492a3e9b0

Download Submit
\Program Files (x86)\WebMoney Advisor\tbhelper.dll
Filesize
378KB

MD5
f4f5499d2f27148c42ccd8f930383762

SHA1
83cbd284da58727235ecba3034734f9299c73893

SHA256
bc3beda7bcfdd570557f7c0497159adbef16cf96005b2337bb807321ac8a80c9

SHA512
e149be4f7677056602804d2452d4ff50f1149dd72efc768df21617318ce2714eca6362a24599c3a69123c6475f4d577d6b6bec93e4aabc15a2facae492a3e9b0

Download Submit
\Program Files (x86)\WebMoney Advisor\tbhelper.dll
Filesize
378KB

MD5
f4f5499d2f27148c42ccd8f930383762

SHA1
83cbd284da58727235ecba3034734f9299c73893

SHA256
bc3beda7bcfdd570557f7c0497159adbef16cf96005b2337bb807321ac8a80c9

SHA512
e149be4f7677056602804d2452d4ff50f1149dd72efc768df21617318ce2714eca6362a24599c3a69123c6475f4d577d6b6bec93e4aabc15a2facae492a3e9b0

Download Submit
\Program Files (x86)\WebMoney Advisor\wmadvisor.dll
Filesize
45KB

MD5
1c3450ffea9150e3adb931124f18f44e

SHA1
fb78bc224de8014f4be0d1cd970fb3c1033f314c

SHA256
1648e3de5a5d2d79ed5c46aeccbddef8e3a8ee857f9607e7d296521b05d76428

SHA512
8b9055d1d1ad3b5291819502ef2095abe1e928645507c67677dab34f2ce0a7a065e7ea81e766d0553758abe57a2491de959206dbf5b04573b6a3b597012002d7

Download Submit
\Program Files (x86)\WebMoney Advisor\wmadvisor.dll
Filesize
45KB

MD5
1c3450ffea9150e3adb931124f18f44e

SHA1
fb78bc224de8014f4be0d1cd970fb3c1033f314c

SHA256
1648e3de5a5d2d79ed5c46aeccbddef8e3a8ee857f9607e7d296521b05d76428

SHA512
8b9055d1d1ad3b5291819502ef2095abe1e928645507c67677dab34f2ce0a7a065e7ea81e766d0553758abe57a2491de959206dbf5b04573b6a3b597012002d7

Download Submit
\Program Files (x86)\WebMoney Advisor\wmadvisor.dll
Filesize
45KB

MD5
1c3450ffea9150e3adb931124f18f44e

SHA1
fb78bc224de8014f4be0d1cd970fb3c1033f314c

SHA256
1648e3de5a5d2d79ed5c46aeccbddef8e3a8ee857f9607e7d296521b05d76428

SHA512
8b9055d1d1ad3b5291819502ef2095abe1e928645507c67677dab34f2ce0a7a065e7ea81e766d0553758abe57a2491de959206dbf5b04573b6a3b597012002d7

Download Submit
\Program Files (x86)\WebMoney Advisor\wmadvisor.dll
Filesize
45KB

MD5
1c3450ffea9150e3adb931124f18f44e

SHA1
fb78bc224de8014f4be0d1cd970fb3c1033f314c

SHA256
1648e3de5a5d2d79ed5c46aeccbddef8e3a8ee857f9607e7d296521b05d76428

SHA512
8b9055d1d1ad3b5291819502ef2095abe1e928645507c67677dab34f2ce0a7a065e7ea81e766d0553758abe57a2491de959206dbf5b04573b6a3b597012002d7

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
Filesize
1.6MB

MD5
e00af2ea64380df0965cf1262e99885a

SHA1
f75989d956c67d70b5b900f1efdd4d51c4db126a

SHA256
964d4067cb3907b28e10eb01eb04a1368419e01e378f32ca6224ef532f8ccbfe

SHA512
e7de04430b56d6ce3a9446122fd8c06efe40b9ef6f0ad46f18c6cc1673fbcbf6d7abd1d06cd1367428704b482fd9e552e7e9edbdccbf1976c9471778249c46bc

Download Submit
memory/320-67-0x0000000000000000-mapping.dmp

Download
memory/812-64-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/828-97-0x0000000000000000-mapping.dmp

Download
memory/1296-60-0x0000000000000000-mapping.dmp

Download
memory/1324-106-0x0000000002470000-0x00000000024FC000-memory.dmp

Filesize
560KB

Download
memory/1324-71-0x0000000000000000-mapping.dmp

Download
memory/1328-69-0x0000000000000000-mapping.dmp

Download
memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1480-108-0x0000000000000000-mapping.dmp

Download
memory/1740-112-0x0000000000000000-mapping.dmp

Download
memory/1808-117-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1808-115-0x0000000000000000-mapping.dmp

Download
memory/1932-56-0x0000000000000000-mapping.dmp

Download
memory/1964-65-0x0000000000000000-mapping.dmp

Download