7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe
Size

354KB
MD5

e1828ff619684f20535726edd51f4751
SHA1

991ad98c04141d10fc376f5f47d6f39218c7de8c
SHA256

7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0
SHA512

daaa5a81ce23d1f78e7ce80cbb300b8c8a5c959e4dbcb1d674420aeb2e3e245592287b35a4282ac5841d16c9b5650b74567fc3d23c153fca28c457b236ddc5c3
SSDEEP

6144:0fp18znPaTavhPvnenut3drPAFl3oAOYk22zVstTtsOkz:0fp18wihPvncK3iYmkXqhsO

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
1420	YandexPackSetup.exe
1836	lite_installer.exe
2004	seederexe.exe
10300	Yandex.exe
10476	Yandex.exe
10616	sender.exe
6688	lite_installer.exe

Loads dropped DLL 17 IoCs

pid	Process
1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
2004	seederexe.exe
10300	Yandex.exe
10476	Yandex.exe
2004	seederexe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	836	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f7617a6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7617a6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C18.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2072.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2043.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7617a9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1ACF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D15.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A22.tmp	msiexec.exe
File created	C:\Windows\Installer\f7617a9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C77.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\NTTopResultURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Яндекс"	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\SuggestionsURL	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\TopResultURLFallback = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IE11TR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\FaviconURLFallback = "http://www.bing.com/favicon.ico"	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\ShowSearchSuggestionsInAddressGlobal = "1"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\FaviconURLFallback = "https://www.ya.ru/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\YaCreationDate = "2024-14-09"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "https://yandex.ru/search/?win=645&clid=2382049-3&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "https://yandex.ru/search/?win=645&clid=2382051-3&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\URL = "https://yandex.ru/search/?win=645&clid=2382049-3&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconURLFallback = "http://www.bing.com/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "https://www.ya.ru/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\DisplayName = "Яндекс"	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\YaCreationDate = "2024-14-09"	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\TopResultURLFallback = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IE11TR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\NTURL = "https://yandex.ru/search/?win=645&clid=2382051-3&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\f3c0ed00-0e59-11ef-bde7-52fd63057c4c\DisplayName = "Bing"	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE\LinksBandEnabled = "1"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\DisplayName = "Bing"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE	seederexe.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.ya.ru/?win=645&clid=2382048-3"	seederexe.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1420	YandexPackSetup.exe
836	msiexec.exe
836	msiexec.exe
1836	lite_installer.exe
1836	lite_installer.exe
1836	lite_installer.exe
1836	lite_installer.exe
2004	seederexe.exe
2004	seederexe.exe
2004	seederexe.exe
2004	seederexe.exe
2004	seederexe.exe
10616	sender.exe
10616	sender.exe
6688	lite_installer.exe
6688	lite_installer.exe
6688	lite_installer.exe
6688	lite_installer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1420	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	1420	YandexPackSetup.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeSecurityPrivilege	836	msiexec.exe
Token: SeCreateTokenPrivilege	1420	YandexPackSetup.exe
Token: SeAssignPrimaryTokenPrivilege	1420	YandexPackSetup.exe
Token: SeLockMemoryPrivilege	1420	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	1420	YandexPackSetup.exe
Token: SeMachineAccountPrivilege	1420	YandexPackSetup.exe
Token: SeTcbPrivilege	1420	YandexPackSetup.exe
Token: SeSecurityPrivilege	1420	YandexPackSetup.exe
Token: SeTakeOwnershipPrivilege	1420	YandexPackSetup.exe
Token: SeLoadDriverPrivilege	1420	YandexPackSetup.exe
Token: SeSystemProfilePrivilege	1420	YandexPackSetup.exe
Token: SeSystemtimePrivilege	1420	YandexPackSetup.exe
Token: SeProfSingleProcessPrivilege	1420	YandexPackSetup.exe
Token: SeIncBasePriorityPrivilege	1420	YandexPackSetup.exe
Token: SeCreatePagefilePrivilege	1420	YandexPackSetup.exe
Token: SeCreatePermanentPrivilege	1420	YandexPackSetup.exe
Token: SeBackupPrivilege	1420	YandexPackSetup.exe
Token: SeRestorePrivilege	1420	YandexPackSetup.exe
Token: SeShutdownPrivilege	1420	YandexPackSetup.exe
Token: SeDebugPrivilege	1420	YandexPackSetup.exe
Token: SeAuditPrivilege	1420	YandexPackSetup.exe
Token: SeSystemEnvironmentPrivilege	1420	YandexPackSetup.exe
Token: SeChangeNotifyPrivilege	1420	YandexPackSetup.exe
Token: SeRemoteShutdownPrivilege	1420	YandexPackSetup.exe
Token: SeUndockPrivilege	1420	YandexPackSetup.exe
Token: SeSyncAgentPrivilege	1420	YandexPackSetup.exe
Token: SeEnableDelegationPrivilege	1420	YandexPackSetup.exe
Token: SeManageVolumePrivilege	1420	YandexPackSetup.exe
Token: SeImpersonatePrivilege	1420	YandexPackSetup.exe
Token: SeCreateGlobalPrivilege	1420	YandexPackSetup.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe
Token: SeRestorePrivilege	836	msiexec.exe
Token: SeTakeOwnershipPrivilege	836	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1420	YandexPackSetup.exe
1420	YandexPackSetup.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1420	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	29
PID 1680 wrote to memory of 1420	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	29
PID 1680 wrote to memory of 1420	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	29
PID 1680 wrote to memory of 1420	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	29
PID 1680 wrote to memory of 1420	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	29
PID 1680 wrote to memory of 1420	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	29
PID 1680 wrote to memory of 1420	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	29
PID 1680 wrote to memory of 1860	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	30
PID 1680 wrote to memory of 1860	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	30
PID 1680 wrote to memory of 1860	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	30
PID 1680 wrote to memory of 1860	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	30
PID 1680 wrote to memory of 1860	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	30
PID 1680 wrote to memory of 1860	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	30
PID 1680 wrote to memory of 1860	1680	7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe	30
PID 836 wrote to memory of 844	836	msiexec.exe	32
PID 836 wrote to memory of 844	836	msiexec.exe	32
PID 836 wrote to memory of 844	836	msiexec.exe	32
PID 836 wrote to memory of 844	836	msiexec.exe	32
PID 836 wrote to memory of 844	836	msiexec.exe	32
PID 836 wrote to memory of 844	836	msiexec.exe	32
PID 836 wrote to memory of 844	836	msiexec.exe	32
PID 844 wrote to memory of 1836	844	MsiExec.exe	33
PID 844 wrote to memory of 1836	844	MsiExec.exe	33
PID 844 wrote to memory of 1836	844	MsiExec.exe	33
PID 844 wrote to memory of 1836	844	MsiExec.exe	33
PID 844 wrote to memory of 1836	844	MsiExec.exe	33
PID 844 wrote to memory of 1836	844	MsiExec.exe	33
PID 844 wrote to memory of 1836	844	MsiExec.exe	33
PID 844 wrote to memory of 2004	844	MsiExec.exe	34
PID 844 wrote to memory of 2004	844	MsiExec.exe	34
PID 844 wrote to memory of 2004	844	MsiExec.exe	34
PID 844 wrote to memory of 2004	844	MsiExec.exe	34
PID 2004 wrote to memory of 10300	2004	seederexe.exe	36
PID 2004 wrote to memory of 10300	2004	seederexe.exe	36
PID 2004 wrote to memory of 10300	2004	seederexe.exe	36
PID 2004 wrote to memory of 10300	2004	seederexe.exe	36
PID 2004 wrote to memory of 10476	2004	seederexe.exe	37
PID 2004 wrote to memory of 10476	2004	seederexe.exe	37
PID 2004 wrote to memory of 10476	2004	seederexe.exe	37
PID 2004 wrote to memory of 10476	2004	seederexe.exe	37
PID 2004 wrote to memory of 10616	2004	seederexe.exe	38
PID 2004 wrote to memory of 10616	2004	seederexe.exe	38
PID 2004 wrote to memory of 10616	2004	seederexe.exe	38
PID 2004 wrote to memory of 10616	2004	seederexe.exe	38

C:\Users\Admin\AppData\Local\Temp\7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe
"C:\Users\Admin\AppData\Local\Temp\7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=3 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe
  C:\Users\Admin\AppData\Local\Temp\7a3596ed161aef538caafdb1f3f33c63a45731b3d396ccc3f4bb40924c2395e0.exe --stat dwnldr/p=18933/rid=616142a3-3c05-46e5-8406-c8ba6173c695/sbr=0-0/hrc=200-200/bd=267-10627744/gtpr=1-1-1-255-1/cdr=0-b7-b7-ff-b7/for=3-0/fole=255-0/fwle=255-0/vr=ff-800b0109/vle=ff-800b0109/hovr=ff-0/hovle=ff-0/shle=ff-0/vmajor=6/vminor=1/vbuild=7601/distr_type=landing/cnt=0/dt=2/ct=1/rt=0 --dh 1532 --st 1715296489
  2⤵
  PID:1860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24A024C72715D9FCA75C53C138D70ED9
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Users\Admin\AppData\Local\Temp\ADA97131-89FB-48DD-9115-04490C902441\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ADA97131-89FB-48DD-9115-04490C902441\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\6A72A3AE-FA62-4124-8C2A-DD29D8FBF72B\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\6A72A3AE-FA62-4124-8C2A-DD29D8FBF72B\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\FCA132C7-D1CE-4CA4-B2B7-A3A416E5B77E\sender.exe" "--is_elevated=yes" "--ui_level=3" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
      C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:10300
  - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
      C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /website-path="C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Taskbar\Яндекс Маркет.website" /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\MARKET~1.ICO" /site-id="2AE68B04.8A85F169"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:10476
  - - C:\Users\Admin\AppData\Local\Temp\FCA132C7-D1CE-4CA4-B2B7-A3A416E5B77E\sender.exe
      C:\Users\Admin\AppData\Local\Temp\FCA132C7-D1CE-4CA4-B2B7-A3A416E5B77E\sender.exe --send "/status.xml?clid=2382047-3&uuid=5cab1b5a-3A96-43B6-9643-7B7B8D584e9d&vnt=Windows 7x64&file-no=6%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A21%0A22%0A24%0A25%0A38%0A40%0A42%0A43%0A45%0A57%0A59%0A89%0A103%0A111%0A123%0A124%0A125%0A129%0A"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:10616

C:\Users\Admin\AppData\Local\Temp\ADA97131-89FB-48DD-9115-04490C902441\lite_installer.exe
"C:\Users\Admin\AppData\Local\Temp\ADA97131-89FB-48DD-9115-04490C902441\lite_installer.exe" --job-name=yBrowserDownloader-{7C9A0328-D5D9-4FAB-B1DE-C52D9EB63AC6} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{42A48C15-2FCD-4CF5-8961-3C37124BB45F}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2382027-3&ui=5cab1b5a-3A96-43B6-9643-7B7B8D584e9d --use-user-default-locale
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7617aa.rbs

Filesize
911B

MD5
5a6dc0e49028ae65feb98a8f6b0ab883

SHA1
9f0c2d8139d99659c679b4921dde7c5bbab3a557

SHA256
1e0647d9f185a978d63e54cf0eeda978368c6eda78aafd9f00802fff0fd06577

SHA512
d5a9feb9f9c91574e056ff61fee833d2c0d403f95495ec729028f532f144a2b18e91cefaf8f7686963f6d71341613bb9514562a5ac65294ce04507402f62d3fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Filesize
1KB

MD5
e94fb54871208c00df70f708ac47085b

SHA1
4efc31460c619ecae59c1bce2c008036d94c84b8

SHA256
7b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86

SHA512
2e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2a55f9f264aca5e9533779e35dfabb8

SHA1
01b537e34f2c49306a6ecb0ff7fd6ab2b501b036

SHA256
bd761d1a205d19a790e9d5765e9fa9b87e3614cf6b4c17f0cbe03532dc23cde1

SHA512
6e2b8d3319116d846284abf97f96095fe5c76085ac372a9ff5ee8207e31c64083f4bb3a8d2394d80d4f2b641e6ace88c12a1f8af64d1b7014ebb06b31b12d7ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0255c40a3e923861ff9d0c5afba52bea

SHA1
4e32eaa6bf7a67e0734abf6aab91973b447f8366

SHA256
7751f5986dff3343b777b92a6db15ba10b08d0e6eb9b77d47b4d552cb07e50cd

SHA512
a8017da835c1d08c90b207c3549a1f198e3c2cfce6225aa6fe2d41fb9f42dc635650f1fe870b64d0d33278cc7f504ce10a5f357283b2917b305105f1f9bbcd5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f80b61d7f4670405dcc13c4c26ee4a39

SHA1
a9a702b3e39cd7f0f9f349169bbfcaef737b22f4

SHA256
80fa4b973ef66f0b9950e28256122049a222e13fa933495e8eab037bab2a98f4

SHA512
f9e6930c2e930e973480b32edb0fdd69bd6e18f3927592d4d38a4c40eef4c2683a709c33cb6a2aa3f262b2e6330d1b00a340f55af457de3330b9b024dfb4f190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b4f55934859f0f01c23eb2b0b3a8753

SHA1
c33fdccc82cf2f530ccb681c11ee6f0afd24c955

SHA256
b0b45b16a0ba4576049d81b4f4a02887e30fe76bce52475a008bdd28873ac476

SHA512
caf42c93e2f92efd8862a35962ef0fc95f06e13741ea35e1736cdbf79b0f5c4311098388e648395b2fe4bfb20d3a74abd3e6e0d0bccd89f071b616ff7defa1f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Filesize
264B

MD5
fe7894d29d7de68978ab5a67348e46a0

SHA1
e1a9302579d572b401e17a23b316c4e318a7c9da

SHA256
64da1f51d2dd51498879ac85e377f830eee7d8b28142111d3f57f1b22b10d583

SHA512
833348e020fff4f611c0e7df4943b830d178764bebdd9e7e9c69ef64987323673aed6807fa9d61e46a366a087f70fb2d2b2ab8963a552db8dda68b796800954b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\market.yandex.ru.ico

Filesize
9KB

MD5
037dcb9f2d8c769d7b9e362fedd36e84

SHA1
8019da23adf7b4baa2b4a0e615b9167f8d2aa984

SHA256
ac03c5b69ffe00e7937efa6917d2a4212ddb2f6e911aeba54461fe8c59de53f2

SHA512
c219b4c9c8077fe028fe863046f528ef389953878ec111f8cb9b00aaef74efc0ec428c930bdc5298bd5439afac81de5c9ec09c57a659f7e8ba263e509daed718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\www.ya.ru.ico

Filesize
5KB

MD5
534409dface053e62660de921ddc600d

SHA1
bd3dcb399327b1d5a2d53ab24e0217d9f524ab62

SHA256
38a3749cdb839c84168f23a9ee46cfd73d482e923bf2c6b4339184b4c93f91fb

SHA512
f58d2192660472e7cfb3c139c145c37f52aba993e2035afebe729a4ba08cf000d18f58cf20d77239cfad3adc278843238307fd0fba96c387e3f4cbbe84cd6b95

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\thumbnails\56e3adc8d77742969ccf3514ed4ccbea

Filesize
15KB

MD5
af80a936c10e18de168538a0722d6319

SHA1
9b1c84a1cf7330a698c89b9d7f33b17b4ba35536

SHA256
2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3

SHA512
9a1325c8ce05806e5c161a4cf47239f62baad8f79650fbd713e74928fce8171ced10ba7f24fac46c548e1dbf3f64106270cb25ca88c836c870107f5dc1f97879

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\thumbnails\e230d30454b44fa65af9a5d2100d606e

Filesize
5KB

MD5
2d0a37bb716f9ad9fb916eb8b08d34c4

SHA1
48658fb5f716478bcfa239ba635589184edc33cf

SHA256
a08d93fef42579ebf000b3496ae50837ba14024fd07df04304534de480c72a1c

SHA512
15216319722cd68b7e0018cfd360a3ef3ba512a0686646677b51f4926ee8290f984e72fdd5a815dc5fdfc7170e8d9b2f207413574c96c7189291140475fe959b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe

Filesize
10.1MB

MD5
02a00171fcfb6ba82c87cbb6f0160408

SHA1
5206392ac9b9eeb01cf08e859fbee37afd663683

SHA256
e2f7a856638e493748539d29f1f30fce0c7ea47d5d30588bffb6ec540b040ada

SHA512
e46d55652e5b2268fa0079cf9c5a88a822310f9f68969e2b0b8b94fb5c73e1d35665f0f748b977ccdcc7b446d58104793fe21862c4d76fe7ba87fe55dccd9b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\FCA132C7-D1CE-4CA4-B2B7-A3A416E5B77E\sender.exe

Filesize
259KB

MD5
e3057443a704b797124507b9cefdece8

SHA1
3fdc3be05efc7038023fa93544d675a2d5b9cbae

SHA256
393f94297e3a2e4ffd771323bcaf8b59ebb57cb29a773a18917e7c0c9a9ecf50

SHA512
62e608324bfc7d05ccb6025d39c96ac9328accd465a11e7fb636fffe7f1fe89c6f9a956778fafc97b70165058fcf903de5ae09847cc286ddc58a7aed6b2c2291

Download Submit
C:\Users\Admin\AppData\Local\Temp\OMNIJA~1.ZIP

Filesize
41.3MB

MD5
1d6cfd7db58008d1b44328c5a3a4220c

SHA1
8e8304bfd7a73b9ae8415b6cbd273e612868a2b2

SHA256
915e46dcc29d6fee123c4b8e88d846ac95ffd4a6f4eb956dc882d305ee1b8256

SHA512
4c17160aa83abeff897462f981226902dd6694817ad95f246511fc63c637bdffa0989a3db00c4309fa673a13b4993c509df538ddad482d1be8b4058749ee93f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log

Filesize
2KB

MD5
bffbabc744d90ef76343a969de916c8f

SHA1
6c0e9a6f2ce2fe3288e0fc59ef2095882be0480e

SHA256
11ced27d3286111852ff6a02e2b0faabc89fe749409955770835b4ba8632fcaf

SHA512
4074ed3f7a6f73dbda8917060461bc99ce17de43b4563c1d37e9feb1b1627ba306d8d1e39d524666f22461c598df35a71068e1eccc8d01abdfae09d5467b2203

Download Submit
C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml

Filesize
674B

MD5
26ffc524c3cc71ad748dc49d7e57ec0f

SHA1
9b25d7bf7acad0bb07fc5eeab1cd6bf4922c2038

SHA256
6b53ced2b31ef79e9d8b14a36ee2bbf123ae5a0e1ad0bc572e7e7840631c4032

SHA512
c2b9aef5c0d2873437bb1a8e35ec3d9b34c99574d917ad37d106dbb79256d7ff5d743018660647a9c72c4d331433370fa402881f987088da34bd3834d55b6b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2004aaaaaa

Filesize
2.5MB

MD5
aaed13466cb69e9b847d6ac255d2d1ec

SHA1
279e10adbaad3a98baf12e63de46cefd8fccfd0c

SHA256
80fa7971efae9a149a7f0e1147626b1d418f7ce954c4f9488b910fcfee973ec2

SHA512
8a96d1067b6a81acf00cb984fb2a434a95d2f7efd1371c3b849d8470e4598fcd26407d175d95f26be6dcb896249d3778dd0ad816c5d13b50c98b488aee921508

Download Submit
C:\Users\Admin\AppData\Local\Temp\vendor00000.xml

Filesize
509B

MD5
281e659e73e029f83f4d70c3a4133593

SHA1
ed83fa8543310d058e038b78285396c534c743d0

SHA256
bb4f08a2684d5c9ea18b14f0febbaeef735aeee8c64c0bef827d8ea961930c25

SHA512
d0b414ba69460b2ed72a1a937bb3f599ee74816ddbb25e5d894530b42005e8f3faf662b237a26aef500f627685e95e4996d4ab5c64e39e4102c22e0f5b99682a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{42A48C15-2FCD-4CF5-8961-3C37124BB45F}.exe

Filesize
10.4MB

MD5
e193fa663b502e98cab56bc656447e8c

SHA1
5c3507601ba5592ace7929f6b62b95102399416d

SHA256
de8adc54741aae62b1de459ac266e0f00b0b80314813670b39fb013bf7cf21a5

SHA512
4f943f1c4def35950f5df4a2693a9152159bb31c330972f54e7e0f519fab4ccdef09a047685fb4dc45d6f2b4389d34d8e14152e1e707bed446b800fb778d8b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi

Filesize
9.8MB

MD5
bb52afbbef4848174e67c167fa8f4f37

SHA1
e03d651825ba202eba6cc712a5a0a35173b26f4e

SHA256
81d9decbfda0eff11a8d928256408296ed1cca594c9760465858a255d54216ee

SHA512
4db171921b2cc2d4d3cf4775da4f1a2e0dcb4cff2c393d27a3117707e525784855e418810781c8471639bb4fd4025127d421febfa92bef1c071f83fc81897b12

Download Submit
C:\Users\Admin\AppData\Local\Yandex\YaPin\2AE68B04.8A85F169\Яндекс Маркет.lnk

Filesize
2KB

MD5
d168206275b806b30c76b143ee8f3030

SHA1
73b87ee26ae7705d92be4a14d5154ad3b2ac6569

SHA256
a8876e7e93bafea16dc4d10761cadf1995217ed36eddbe22e03d1b5f8bb87830

SHA512
a6229f0283b1f960ecd3afa7f564465b309d66d3ae0b5e27447a359223d084690a184fe9697732eeec2cea848bc90a378f2c254a6c36701bf1eb5d297e13d0dc

Download Submit
C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk

Filesize
1KB

MD5
cfce2a6c80eaa56b958ef3470154325e

SHA1
29fe576b4e143e5aaf2e639529679a283eabc6e9

SHA256
b708eb219afe6487e24162e75403de335e7cda28d44470487c8ce8f146b97d07

SHA512
5535d5a4bb90df920ce3cf67111873efd0ed68f96c107776d60cfa8f5a64dce8055d28efff83ea13e27d4c05ce0d4f31beb06e88345d4e249e0122aa58f74088

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс Маркет.website

Filesize
540B

MD5
d25e43381099468b9a158b55777d43ba

SHA1
47ff6b76df2d1493c555250fa15a13a832b582b1

SHA256
1a1464ddba8c21da65a582123797f51b458716835969b6b25feebb1548ed06f9

SHA512
66ebd01f20fca77000bb19555f9883d788f25bae5dd9f497345d4222623729f5ce92735a1e45081c5f2ae1485c61395db42b32d32816002e282c08f8a5758975

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website

Filesize
513B

MD5
cdc32f8352e4dc7670514111c2aa2481

SHA1
746905d2c11ae72869d3ba2ec92890eb5621b0ee

SHA256
e92f85c6e46090fd3499da1a4a824d481c912f64cec9bcf229bd16ef14a2011f

SHA512
cf3cef7c3382462e16b3e8ba64c778c8eefb07dbdbdfcfda60a08c83c7feb991ccc7a5aa56a5d9b0532d027bc40661a0ca040539cb499d6fcf0ad3e0f09a3a6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.Admin\places.sqlite-20240509231455.432000.backup

Filesize
68KB

MD5
314cb7ffb31e3cc676847e03108378ba

SHA1
3667d2ade77624e79d9efa08a2f1d33104ac6343

SHA256
b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1

SHA512
dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\extensions\staged\[email protected]

Filesize
1KB

MD5
5a40649cf7f6923e1e00e67a8e5fc6c8

SHA1
fc849b64b31f2b3d955f0cb205db6921eacc1b53

SHA256
6d432ba7096090837f9533a33a686c846ad67aed8ecc43af7ce8af42649cd51a

SHA512
0fc42a2cc61528b14478f4b9ae098ea90e6b05ddbe10f3a6cdd6326d0d8e6185b49d2b8143b76a9f329bdc277cf02b54d98f374edd65df68a1ffc41e1c817786

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\extensions\staged\[email protected]

Filesize
688KB

MD5
ab6d42f949df8d7e6a48c07e9b0d86e0

SHA1
1830399574b1973e2272e5dcc368c4c10dbbe06b

SHA256
205ebf52c47b42fa0ad1a734a1d882d96b567e15a32b19bdb907562db8ea09e2

SHA512
6c4f9bb726384c87b6523e08339f7821ad4ec8717b26db902ca51df74eb89b46e4ded1504a131683b07b2bba3e6e911a549a8a83b2aad3971047c0fe315a1ad5

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20240509231457.631600.backup

Filesize
1KB

MD5
3adec702d4472e3252ca8b58af62247c

SHA1
35d1d2f90b80dca80ad398f411c93fe8aef07435

SHA256
2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

SHA512
7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences

Filesize
316B

MD5
64d54b1a84d55e68fd75e9c0bba894ba

SHA1
9a1fb79be8904aa92f06739e2d02c511f9f87af9

SHA256
f6a48d8bfd4b22ec9758a7886f6a0ba8954f521e5d5525b886536be355d122e8

SHA512
913aa5ff7feed2684a6b2f8cc05543b1e878a2b6e4e82206debbf18a182bbea9e7fe8ab1acb71907042a6faff702cdbc92d4dae2f1b4fe41b3255fbbf9e54f81

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20240509231457.631600.backup

Filesize
313B

MD5
af006f1bcc57b11c3478be8babc036a8

SHA1
c3bb4fa8c905565ca6a1f218e39fe7494910891e

SHA256
ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

SHA512
3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml

Filesize
620B

MD5
8a64682a179e77f3d1aac5af23f0de3a

SHA1
6ffa88fd23900f3ef44e059ae83bc92a24f17b9d

SHA256
8f8dd4f045fa1a2f508b79243729d02043d9c3fd823c4a54e01c576facfee53d

SHA512
0b002b59e7e2d5e0678f08b8d8af81f57521e41c46ceb590990f8a01ce34119a44959d32cc1ef3222b87d8100a4ad68c36bce1d50c1c1c2712184bdd6a8b574a

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
36B

MD5
57fcfec0a5ff9278a7621c6d04332e16

SHA1
e061df5c22f2873ea8e7b550875b8184b9182a1e

SHA256
1ca92347d292cbbcf6ebfa4ae8d85d28dba1ea25acba8185366bb93156b93e70

SHA512
311a2e73b908160668b6028543a0dfd3e378f296e5a7bd7e1577c80045eced95afb556bfcdec6688ef9c214b8c1cd9547ab10329c7e9a1bc47ab5064b14f032f

Download Submit
C:\Windows\Installer\MSI1A22.tmp

Filesize
181KB

MD5
b502c676e82cb196e20db36601a08ace

SHA1
391e219b99b9eccecfa8f866baa9bd09671c3a3e

SHA256
bca6f0bec828d4f1d9748e78de826c327a853bdceb3c432426f1d53994c0d88f

SHA512
7488451baccd548601a3c69105066842bf47e8e5dd2680b1a8caa50390a7fd6c8e666c603b7a9fef0ad5a0b41f8bd302f69c50f231e95c8ea6e8da98c3de7816

Download Submit
\Users\Admin\AppData\Local\Temp\6A72A3AE-FA62-4124-8C2A-DD29D8FBF72B\seederexe.exe

Filesize
8.6MB

MD5
fb78961f07684303b0aec02666df3e0b

SHA1
208a69979a7af92736cda71c5762bf62fe9c32c4

SHA256
cd80b890380b4c8658c2ee752574a7872f14f07ef107e9f53394d6fd912157ce

SHA512
fb3f27fdcd14a450f5043ac49c6520a451b5acc76be15c4c5e22f69dad1e6b852e7dd07fcb9509bdb138ce17bc032801642eb9727c524ff078379d1c7fc139c1

Download Submit
\Users\Admin\AppData\Local\Temp\ADA97131-89FB-48DD-9115-04490C902441\lite_installer.exe

Filesize
418KB

MD5
372dd1f1a276a02aa9fbc0435bc9081d

SHA1
258091e03a5eb6c10b242444aa9f8a449212861d

SHA256
5fe9db11665ab3877380a68e19b20e0567a8e2ce888f36c15c188d117ecdc59c

SHA512
640cd883835558a7dcd8c1d8eaf5b87f71341f9ddb2bae83c76d991a3d80b62782e454bf3db74cf16b3dd5952ced213202d8049d5a8efe860930eebd35de9ba9

Download Submit
\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe

Filesize
397KB

MD5
1e64bdf002fa6dcae92e0b9ae4283867

SHA1
8db18047e35e77ca365a1da1648918fb710979c6

SHA256
dec6ed68c43845defcc2031c8e8da56fd6e2a476e2d5a2ea204c92b82d559bab

SHA512
b3207a4d10e07d97041bb471ba3f80e46dd70f2037ebc1a012b74943de4e78c5a5a2f5fb4c0a86615db34280b0d9f39a3f98f7b7734a7bf9fc29f41dd1bca1e2

Download Submit
\Windows\Installer\MSI1A90.tmp

Filesize
188KB

MD5
748143dd96f1e6e67e14384d2edf4daf

SHA1
06928cf9e39b00b654adec334709559ad4e01110

SHA256
ea551d91b1ddb00a266831438b7b0ba4119d479a38bd5fdc254d47bb520a04b9

SHA512
7c9d15ea8ba34a7a6492a83139def07489c236cca1372a5d66eff50b77b38ba8927a305bd460c75676b36ba0ff0f85b841fc835d102ee13b000068fd14e8bc9b

Download Submit