Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
YandexPackSetup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target YandexPackSetup.exe
- Size 10.1MB
- Sample260415-pfbgvsdv9m
- SHA256 ead7a779cabae642d09be07283cc99e53c84ecf90349444e0d0ac4bf9901fe47
- MD5 3fb846d3691f3d98a34e669e1b9b5bf6
- SHA1 4c90c2912aae3b8da4c44a4faa0b8df20525285f
- SHA512 e904ecfa7b1c9ba066272bf91b8341bf3877310613370defabee7db58ea825c52582353e97f9398d706d3f3890b3701a1c05fe202e8a87499fb9600f87176b3e
- SSDEEP 196608:Ddad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:xadCoXrlAJ7N3pXW2uGzy
- TLSH T10AB6D001B752C0B1EAD101B116BE9BBA487D9E144B3189C797C43E3DD9322E2673BF69
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1760 lite_installer.exe 4168 seederexe.exe 8040 sender.exe 9056 sender.exe - Loads dropped DLL 10 IoCs
pid Process 1552 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe 1552 MsiExec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 15 4092 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: YandexPackSetup.exe File opened (read-only) \??\L: YandexPackSetup.exe File opened (read-only) \??\N: YandexPackSetup.exe File opened (read-only) \??\Q: YandexPackSetup.exe File opened (read-only) \??\S: YandexPackSetup.exe File opened (read-only) \??\X: YandexPackSetup.exe File opened (read-only) \??\Y: YandexPackSetup.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: YandexPackSetup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: YandexPackSetup.exe File opened (read-only) \??\E: YandexPackSetup.exe File opened (read-only) \??\T: YandexPackSetup.exe File opened (read-only) \??\U: YandexPackSetup.exe File opened (read-only) \??\W: YandexPackSetup.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: YandexPackSetup.exe File opened (read-only) \??\M: YandexPackSetup.exe File opened (read-only) \??\Z: YandexPackSetup.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: YandexPackSetup.exe File opened (read-only) \??\P: YandexPackSetup.exe File opened (read-only) \??\R: YandexPackSetup.exe File opened (read-only) \??\V: YandexPackSetup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: YandexPackSetup.exe File opened (read-only) \??\H: YandexPackSetup.exe File opened (read-only) \??\J: YandexPackSetup.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DLL\iphlpapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\winnsi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\fwpuclnt.pdb sender.exe File opened for modification C:\Windows\SysWOW64\exe\stat_sender.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\advapi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wtsapi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\wsspicli.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wntdll.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wntdll.pdb sender.exe File opened for modification C:\Windows\SysWOW64\ucrtbase.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wuser32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\CLBCatQ.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\webio.pdb sender.exe File opened for modification C:\Windows\SysWOW64\bcrypt.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\winsta.pdb sender.exe File opened for modification C:\Windows\SysWOW64\WLDP.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\nsi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wkernel32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wuser32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wrpcrt4.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wgdi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\secur32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wimm32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\rasadhlp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\rasadhlp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\fwpuclnt.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\winhttp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\WLDP.pdb sender.exe File opened for modification C:\Windows\SysWOW64\shell32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wgdi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\winsta.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\rasadhlp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\bcrypt.pdb sender.exe File opened for modification C:\Windows\SysWOW64\advapi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wwin32u.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\version.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\WLDP.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wmswsock.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\wimm32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\ucrtbase.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wwin32u.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\ole32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\BitsProxy.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\dbghelp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\msvcp_win.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wgdi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\winsta.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wUxTheme.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\iphlpapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wrpcrt4.pdb sender.exe File opened for modification C:\Windows\SysWOW64\Kernel.Appcore.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\fwpuclnt.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\bcrypt.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wsspicli.pdb sender.exe File opened for modification C:\Windows\SysWOW64\nsi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\dnsapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\exe\stat_sender.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\shlwapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\userenv.pdb sender.exe File opened for modification C:\Windows\SysWOW64\Windows.Storage.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wmswsock.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wUxTheme.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\msvcp_win.pdb sender.exe File opened for modification C:\Windows\SysWOW64\userenv.pdb sender.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A} msiexec.exe File created C:\Windows\Installer\e58a0bf.msi msiexec.exe File opened for modification C:\Windows\Installer\e58a0bf.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA41C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA588.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA5E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA751.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA39E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA45B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA4E9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA539.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA626.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA4F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA695.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language seederexe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sender.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YandexPackSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lite_installer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\SearchScopes seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Main seederexe.exe - Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E YandexPackSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd YandexPackSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd YandexPackSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd YandexPackSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd YandexPackSetup.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3772 YandexPackSetup.exe 3772 YandexPackSetup.exe 4092 msiexec.exe 4092 msiexec.exe 1760 lite_installer.exe 1760 lite_installer.exe 4168 seederexe.exe 4168 seederexe.exe 8040 sender.exe 8040 sender.exe 1760 lite_installer.exe 1760 lite_installer.exe 9056 sender.exe 9056 sender.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 3772 YandexPackSetup.exe Token: SeIncreaseQuotaPrivilege 3772 YandexPackSetup.exe Token: SeSecurityPrivilege 4092 msiexec.exe Token: SeCreateTokenPrivilege 3772 YandexPackSetup.exe Token: SeAssignPrimaryTokenPrivilege 3772 YandexPackSetup.exe Token: SeLockMemoryPrivilege 3772 YandexPackSetup.exe Token: SeIncreaseQuotaPrivilege 3772 YandexPackSetup.exe Token: SeMachineAccountPrivilege 3772 YandexPackSetup.exe Token: SeTcbPrivilege 3772 YandexPackSetup.exe Token: SeSecurityPrivilege 3772 YandexPackSetup.exe Token: SeTakeOwnershipPrivilege 3772 YandexPackSetup.exe Token: SeLoadDriverPrivilege 3772 YandexPackSetup.exe Token: SeSystemProfilePrivilege 3772 YandexPackSetup.exe Token: SeSystemtimePrivilege 3772 YandexPackSetup.exe Token: SeProfSingleProcessPrivilege 3772 YandexPackSetup.exe Token: SeIncBasePriorityPrivilege 3772 YandexPackSetup.exe Token: SeCreatePagefilePrivilege 3772 YandexPackSetup.exe Token: SeCreatePermanentPrivilege 3772 YandexPackSetup.exe Token: SeBackupPrivilege 3772 YandexPackSetup.exe Token: SeRestorePrivilege 3772 YandexPackSetup.exe Token: SeShutdownPrivilege 3772 YandexPackSetup.exe Token: SeDebugPrivilege 3772 YandexPackSetup.exe Token: SeAuditPrivilege 3772 YandexPackSetup.exe Token: SeSystemEnvironmentPrivilege 3772 YandexPackSetup.exe Token: SeChangeNotifyPrivilege 3772 YandexPackSetup.exe Token: SeRemoteShutdownPrivilege 3772 YandexPackSetup.exe Token: SeUndockPrivilege 3772 YandexPackSetup.exe Token: SeSyncAgentPrivilege 3772 YandexPackSetup.exe Token: SeEnableDelegationPrivilege 3772 YandexPackSetup.exe Token: SeManageVolumePrivilege 3772 YandexPackSetup.exe Token: SeImpersonatePrivilege 3772 YandexPackSetup.exe Token: SeCreateGlobalPrivilege 3772 YandexPackSetup.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3772 YandexPackSetup.exe 3772 YandexPackSetup.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4092 wrote to memory of 1552 4092 msiexec.exe 89 PID 1552 wrote to memory of 1760 1552 MsiExec.exe 90 PID 1552 wrote to memory of 4168 1552 MsiExec.exe 92 PID 4168 wrote to memory of 8040 4168 seederexe.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\YandexPackSetup.exe"C:\Users\Admin\AppData\Local\Temp\YandexPackSetup.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3772
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C76C52C8B4962E2AC46C6FFDCF03A7B72⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\61C56737-8E3E-4B8F-8DBF-EF727FBDDCD0\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\61C56737-8E3E-4B8F-8DBF-EF727FBDDCD0\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1760
-
-
C:\Users\Admin\AppData\Local\Temp\B49C07E5-2FEA-475B-A4CF-E078E5BB3758\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\B49C07E5-2FEA-475B-A4CF-E078E5BB3758\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\CCABCAFB-BC0F-44D9-97BA-2FE9568C3915\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\CCABCAFB-BC0F-44D9-97BA-2FE9568C3915\sender.exeC:\Users\Admin\AppData\Local\Temp\CCABCAFB-BC0F-44D9-97BA-2FE9568C3915\sender.exe --send "/status.xml?clid=6035492&uuid=e0edc133-8932-4080-a064-abd4d166a697&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129%0A"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:8040
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CCABCAFB-BC0F-44D9-97BA-2FE9568C3915\sender.exe"C:\Users\Admin\AppData\Local\Temp\CCABCAFB-BC0F-44D9-97BA-2FE9568C3915\sender.exe" --job-name=ySenderExe-{BAFA083B-E739-4FD0-AD55-78B17803C8ED} --local-path=C:\Users\Admin\AppData\Local\Temp\yst.tmp --send="/status.xml?clid=6035492&uuid=e0edc133-8932-4080-a064-abd4d166a697&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:9056
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58a0c0.rbs
- Size 575B
- SHA256 a0eec60a4e5d5f3ec02aed49a5c424391e0d6d9308843f84e5acedaa51a5fd8a
- MD5 a8bf34ae29130b655879ae992f49d2f3
- SHA1 01319cec88e2a9375dfc0dbd9157028bc163b0b0
- SHA512 349108e5617a37ea5e10482b009a0cf23e8fc209527b6f8b9e067722688cf46d5113f9adf4cc6984da58f47dfbc9510e6644251f9fac30912155eb69b276f7ba
- TLSH T1A8F09E8F637D86C3C4C9C4301F4A4CE7985BF6345B5B44E09C2E2D5A6D092313F18087
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
- Size 1KB
- SHA256 7fe9b3c538fa6c1cac4a8cf7dfedd6ac4abd1c7532d720e32cabd7de6244af38
- MD5 b7d112e4a8df25f091a172c3690a0781
- SHA1 cdc172e7a70fc613affd93d71c71b048a646b556
- SHA512 7a587d599004906320fbe2c980625c612e35526630be6d79e0b8c9bdf19f97a6a1ac38f1d655a7472f032e1d05b2a95b3abe25f3ce65d3e11bc9e19b77e6f638
- TLSH T1D931FA9A099939C03786CC7C6EC50F2A3560E1E5577CA0027537832668A03B72FA6016
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
- Size 536B
- SHA256 0f116822e31bc5970089213954b8bf43a19006d5d7da9d63d6f33c2a58faea39
- MD5 612716852f64ee47075f0436fd1b62e2
- SHA1 9a90c1a509a0d6b88e34454f395992c746c74a38
- SHA512 f4e5b4b065ada44d75d349e1210b63fe42c2340f641f3998f97960d2feb014531a757e0f3b879f3014b2005c9edcc53ac01e4bdde5e81e2f8fd5a11b4f8cc004
- TLSH T104F0973060BA211FF072DE381BD2A985BC15FD2229324A446879070CBE26F801EA2A3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\61C56737-8E3E-4B8F-8DBF-EF727FBDDCD0\lite_installer.exe
- Size 419KB
- SHA256 688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
- MD5 aafdfaa7a989ddb216510fc9ae5b877f
- SHA1 41cf94692968a7d511b6051b7fe2b15c784770cb
- SHA512 6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
- SSDEEP 6144:bahey96oZyvBupY5/af/l27Y547CaPWJTfnOMhym0Wk57YG2F89UUZEfk7:bry96RvBj0C7CaPWNPrHCt9UUZa6
- TLSH T1DC948D227982E032E46205705F7ECBBA287DBB310F6144CBBBD85A6D1E744C19635F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\B49C07E5-2FEA-475B-A4CF-E078E5BB3758\seederexe.exe
- Size 8.6MB
- SHA256 35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
- MD5 225ba20fa3edd13c9c72f600ff90e6cb
- SHA1 5f1a9baa85c2afe29619e7cc848036d9174701e4
- SHA512 97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3
- SSDEEP 196608:44T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:4CoXrlAJ7N3pXW2uGzy
- TLSH T1F396D001B752C1B1EAC101B116BE6BBE497DCE148B718DC397C41E79D9322E2673BB68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CCABCAFB-BC0F-44D9-97BA-2FE9568C3915\sender.exe
- Size 260KB
- SHA256 36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
- MD5 f1a8f60c018647902e70cf3869e1563f
- SHA1 3caf9c51dfd75206d944d4c536f5f5ff8e225ae9
- SHA512 c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e
- SSDEEP 6144:HivzZ4S0lBeFv/XSI/yhFrWLygHmWGYzZ/4hJOnN:CvzZ4SuBeFvPSnkygvGYzih8n
- TLSH T1E4449E217992C833E573053259B88A76693DBD310F3499CBA3D80B6D9E741C2A630F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
- Size 34KB
- SHA256 3eaed34874a38c75ba36b42293d864b3124f31e204a1e8e3a0c1020bcc372486
- MD5 612dd36509503378bd6f898ef9c0faf7
- SHA1 872bc1932e48a69c4851601a8bcea35bc36f9787
- SHA512 dddd60985d63b6a823b1446c65f4a2926ff219ed6ed0cc1e13fe6e819f9b8c9b9696fbeaf70be69bb28e5afda2779722dc2dae3df3a049f0890aef43681a1d83
- SSDEEP 768:c2cTYaeBvxWf5vvPx6PlKn9LQbuobxkfz/YE10i0LMVEo5gua8RJGEcQqianRdx:jWJvylKn9LQbuKerAU09MCj8RJGEcQq9
- TLSH T134F27D296EF80104F67BAA878FF794215B73F9266D35DD0D2182C31D0566D09AA2C3BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
- Size 531B
- SHA256 081acaf053b713ef777e8d87a0760aeafb97a1e4b0fe8bd1cd631401ac90c7e1
- MD5 ed568a37db19803fc0ce627c71a53478
- SHA1 56826a10c0b9573cff1c1c46ad6527c4da2fed99
- SHA512 47b343ec6362498c814fe5da90429d0ff9a36be7be6fe4bdd67d54d07309c74df5580ba9a37946adac7959674d670b78cc72a8f848bc2c57417b5d8c15a1ae20
- TLSH T169F03600458CEEE16F7B4739C67D5AF5E6D43F0A0BA12F847145AB63F61223B11483A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\omnija-20261615.zip
- Size 45.1MB
- SHA256 7d5072b7fa0880c245cb54a627474b67df7b4f3f33a7ae828b39417f9621eef0
- MD5 e90fbef1ee0ca14a0e36139114dfdb03
- SHA1 eb9ea0e98fd72b7b049b193fb94ee8d864101305
- SHA512 eec962d4fdf6bdf8a236ef2bebc579e7815469b22e02d4362da865ce20c81b231e41d5d43b10c4f52f7d3d4651293f508d2babc6fea967cdee5dc5004fd27fa3
- SSDEEP 98304:GsHE6AKr4JCwEnjKq3EOriDGAIGPEJUgCmubWaJEc3yQBT90oBXborXmtYOJ5vsr:d4JCwsuqUOrFAIGPEJUvyarOsXXbi
- TLSH T1E4A74B1AA3F6117185936079AF5F6041F635801B2419FC58BEDC83AC2F8D53D82FABE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
- Size 510B
- SHA256 1a855972dc308e47d30d567e1b37fdad349bf555b971bc14ead76e17a8accccc
- MD5 a96e6071a17b74bbd309bf696496b8f7
- SHA1 63c1ecf860504d390b6f3a32982ddd8946b042c5
- SHA512 2c906e2f11d62d1336be482cc5ff784bf372cc7afb3263754e7810a1ae27e253aa9e22463456b62a25049d33ba1e69f129ed7e0a0273fe928dcaa216b7876449
- TLSH T134F06C01448CEA117FBB471DC23D5AF5E6D43E0607A02E8C7155E763F51223713183B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
- Size 9.8MB
- SHA256 b2fda5fb2d8e65fc0448d308647d8afd1e4ecd7bff0103ec3700e0798a7db0a3
- MD5 561f202d40eb1a21aa947b2b833f6928
- SHA1 b48e2f49a416847aa9420ed4b360841e8c28f67b
- SHA512 66d172f336ef0b4790e2141711f205682a0ba6ced8d03f26e33b54f6ea1e29be10d387e843df26d1110559888b09a3cdf9198ea40f17ca9d2ac1872c1da82063
- SSDEEP 196608:Odad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvqm:CadCoXrlAJ7N3pXW2uGzym
- TLSH T1A5A6D101B752C1B1EAC101B116BE5BBE487D9E148B318DC797C42E7DD9322E2673BB68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yst4f00o.Admin\places.sqlite-20260415121654.994719.backup
- Size 68KB
- SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
- MD5 314cb7ffb31e3cc676847e03108378ba
- SHA1 3667d2ade77624e79d9efa08a2f1d33104ac6343
- SHA512 dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
- SSDEEP 48:TV6UcMtYJqqEgbEwq3hF+gBNxw2BAl7FdickdaxL5HoVQJlu:x6HkTBB2ljvoS0
- TLSH T19363DD5B1A343122D8EA90737EE2506E093CF13A8F6776513DF010A6CCA1D62E5799FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20260415121655.072841.backup
- Size 1KB
- SHA256 2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
- MD5 3adec702d4472e3252ca8b58af62247c
- SHA1 35d1d2f90b80dca80ad398f411c93fe8aef07435
- SHA512 7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
- TLSH T1B43172ABF66398CF989C5DCF4174CBCBF98D083A95C01EDAB189352AC09480E127F756
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20260415121655.072841.backup
- Size 313B
- SHA256 ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
- MD5 af006f1bcc57b11c3478be8babc036a8
- SHA1 c3bb4fa8c905565ca6a1f218e39fe7494910891e
- SHA512 3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
- TLSH T1ACE07227F8202FF309F1117D11AA3F9462380041E0AA24DB08DFF9A8022C0D8CABAC27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Yandex\ui
- Size 38B
- SHA256 2963075e70bfd230d367e2833f6fa39750ab2a7da71572af9bcc4bf5b78b519a
- MD5 f9a24e2f96bda9e6bf29987e59121d60
- SHA1 757dec7719f0f2c8873a61dfc6764cae06c68969
- SHA512 75de85ce89a02f5b8ead61d7a3f5254b4cb866c0b804343651ba61c3943e86de300ff4ae9d88c095029aacd4cc3da092829e5f42d4f37714486a3ef551e92a9c
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIA39E.tmp
- Size 181KB
- SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
- MD5 0c80a997d37d930e7317d6dac8bb7ae1
- SHA1 018f13dfa43e103801a69a20b1fab0d609ace8a5
- SHA512 fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
- SSDEEP 3072:LIgxsEwKIE4SaX1xQrlm4taQqPvvNCqv8bcDR0wYyMP3XrZ+bx0PWWX+xA6QpS:LIgxsEbIE45ArptaQqPtCG8SR0waB7Bo
- TLSH T1DE048D127180C075E6FB1A3C4578DAB65A3E79305B74C8DB63948E2B2E702C1AF35B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA41C.tmp
- Size 189KB
- SHA256 669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
- MD5 e6fd0e66cf3bfd3cc04a05647c3c7c54
- SHA1 6a1b7f1a45fb578de6492af7e2fede15c866739f
- SHA512 fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
- SSDEEP 3072:iAJayVkvIkE3fqPDgvlevYwlv57GqosaJlpJKzhY9A3w9FtGJ2EYJxZi5V2O2M:ickvIDvWgvlevYwFVaJlp8z++bnYsX2Y
- TLSH T1A1149E107881C13AE2BF093995BAA6724D7CB5301FB8C8DF63949D351E706C1AB39B67
- MD5 SHA1 SHA512 SSDEEP TLSH