238a39c75ddc870bec64d066c445079f6c4b026cc7c9ce5e8035c6db244b65e0

Analysis

max time kernel
178s
max time network
180s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 225KB
Sample260803-cvefvaaq2x
SHA256 238a39c75ddc870bec64d066c445079f6c4b026cc7c9ce5e8035c6db244b65e0
MD5 9d0030452201b4453d1e6cf529442191
SHA1 a76b9b71cbcd477fb58c626bdce16c73cb4ad737
SHA512 d6598d9d25ea4aee9784a031853f323f25ac96d16db197257d9a8e14bb236275056dd9437a8a7688d4eec47d89c8730a59ba62d1cd61cbf30e5925ed3af4e92f
SSDEEP 3072:E6GEtNEXN4wCq5/v46QC2mCm/lY9Kkj3c6QQaWAk0Ag5qAWKGETBKnF58it3kzMx:hGYk4wCq5x+9T3bQQaNlTwNt3kz
TLSH
T1E13459217C81C032C1B31934C9E5D2F06A7CBD708E658A8F63987F2F7A771926625E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
21	2796	2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Executes dropped EXE 7 IoCs

pid	Process
5264	YandexPackSetup.exe
5016	lite_installer.exe
5792	seederexe.exe
2200	Yandex.exe
2824	explorer.exe
2680	sender.exe
5612	sender.exe

Loads dropped DLL 10 IoCs

pid	Process
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wgdi32full.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\shlwapi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\secur32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\wsspicli.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\shcore.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\Kernel.Appcore.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\shell32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\wwin32u.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\shlwapi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\winsta.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\ws2_32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\wmswsock.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\rasadhlp.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\msvcrt.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\userenv.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\winsta.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\webio.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\CLBCatQ.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\BitsProxy.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\exe\stat_sender.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\advapi32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\advapi32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wgdi32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\version.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\bcryptprimitives.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\wuxtheme.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\winnsi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\wkernelbase.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\wtsapi32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\DLL\wsspicli.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\DLL\wimm32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\fwpuclnt.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\version.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\shell32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\winsta.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wuxtheme.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\BitsProxy.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\iphlpapi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\nsi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\ole32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\rasadhlp.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\wgdi32full.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\ole32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\ws2_32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\dbghelp.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\msvcp_win.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\shcore.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\DLL\iphlpapi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\nsi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\Kernel.Appcore.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\DLL\winnsi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wkernelbase.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\msvcp_win.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\secur32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\wsspicli.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\bcryptprimitives.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\dnsapi.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\apphelp.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\dll\wgdi32.pdb	sender.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\userenv.pdb	sender.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5b6f50.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4BE47629EC968B54.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI729F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI745A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE5BF8DFAF58D74E2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7611.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF76A8683ABDCE39BD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5D0370BD22309E06.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI73CC.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b6f50.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7164.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7231.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI735E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI730F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75C2.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YandexPackSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seederexe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yandex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lite_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sender.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\HomeButtonPage = "https://www.ya.ru/?win=762&clid=14237142-80"	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\HomeButtonEnabled = "1"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	seederexe.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F	2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f140000000100000014000000259dd0fc59098663c5ecf3b1133b571c039236116b0000000100000020000000cd0e144dd10bac221fe2fb901058d16450a0578b3c47c770908f2e9ada28ef120f0000000100000020000000d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe1900000001000000100000008050a1c09667687456bd1c63be8f6fcb5c0000000100000004000000001000001800000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b44b0000000100000044000000390043004200340033003700330041003400320035003200440045003800440032003200310032003900320039003800330036003300300034004500430035005f0000002000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5	2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5264	YandexPackSetup.exe
5264	YandexPackSetup.exe
5448	msiexec.exe
5448	msiexec.exe
5016	lite_installer.exe
5016	lite_installer.exe
5792	seederexe.exe
5792	seederexe.exe
5792	seederexe.exe
5792	seederexe.exe
5792	seederexe.exe
5792	seederexe.exe
5792	seederexe.exe
5792	seederexe.exe
5792	seederexe.exe
5792	seederexe.exe
2680	sender.exe
2680	sender.exe
5016	lite_installer.exe
5016	lite_installer.exe
5612	sender.exe
5612	sender.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5264	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	5264	YandexPackSetup.exe
Token: SeSecurityPrivilege	5448	msiexec.exe
Token: SeCreateTokenPrivilege	5264	YandexPackSetup.exe
Token: SeAssignPrimaryTokenPrivilege	5264	YandexPackSetup.exe
Token: SeLockMemoryPrivilege	5264	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	5264	YandexPackSetup.exe
Token: SeMachineAccountPrivilege	5264	YandexPackSetup.exe
Token: SeTcbPrivilege	5264	YandexPackSetup.exe
Token: SeSecurityPrivilege	5264	YandexPackSetup.exe
Token: SeTakeOwnershipPrivilege	5264	YandexPackSetup.exe
Token: SeLoadDriverPrivilege	5264	YandexPackSetup.exe
Token: SeSystemProfilePrivilege	5264	YandexPackSetup.exe
Token: SeSystemtimePrivilege	5264	YandexPackSetup.exe
Token: SeProfSingleProcessPrivilege	5264	YandexPackSetup.exe
Token: SeIncBasePriorityPrivilege	5264	YandexPackSetup.exe
Token: SeCreatePagefilePrivilege	5264	YandexPackSetup.exe
Token: SeCreatePermanentPrivilege	5264	YandexPackSetup.exe
Token: SeBackupPrivilege	5264	YandexPackSetup.exe
Token: SeRestorePrivilege	5264	YandexPackSetup.exe
Token: SeShutdownPrivilege	5264	YandexPackSetup.exe
Token: SeDebugPrivilege	5264	YandexPackSetup.exe
Token: SeAuditPrivilege	5264	YandexPackSetup.exe
Token: SeSystemEnvironmentPrivilege	5264	YandexPackSetup.exe
Token: SeChangeNotifyPrivilege	5264	YandexPackSetup.exe
Token: SeRemoteShutdownPrivilege	5264	YandexPackSetup.exe
Token: SeUndockPrivilege	5264	YandexPackSetup.exe
Token: SeSyncAgentPrivilege	5264	YandexPackSetup.exe
Token: SeEnableDelegationPrivilege	5264	YandexPackSetup.exe
Token: SeManageVolumePrivilege	5264	YandexPackSetup.exe
Token: SeImpersonatePrivilege	5264	YandexPackSetup.exe
Token: SeCreateGlobalPrivilege	5264	YandexPackSetup.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5448	msiexec.exe
2096	MsiExec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 5264	2796	2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 2796 wrote to memory of 5280	2796	2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 5448 wrote to memory of 2096	5448	msiexec.exe	93
PID 2096 wrote to memory of 5016	2096	MsiExec.exe	94
PID 2096 wrote to memory of 5792	2096	MsiExec.exe	97
PID 5792 wrote to memory of 2200	5792	seederexe.exe	98
PID 2200 wrote to memory of 2824	2200	Yandex.exe	99
PID 5792 wrote to memory of 2680	5792	seederexe.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=80 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5264
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-03_9d0030452201b4453d1e6cf529442191_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=1095462/cnt=4/dt=2/ct=16/rt=0 --dh 2272 --st 1785723960
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5280

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 68D5FEF729FC0AE3C0690CF3D2D29CCC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\D78F911C-0804-4AC6-AD47-9154839A7965\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\D78F911C-0804-4AC6-AD47-9154839A7965\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\B0D462D0-4580-4E17-A7DC-8D325F95919A\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\B0D462D0-4580-4E17-A7DC-8D325F95919A\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\55030BE6-874A-4A0B-BF78-6E4DDF3179D4\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
      C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
        
        C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\55030BE6-874A-4A0B-BF78-6E4DDF3179D4\sender.exe
      C:\Users\Admin\AppData\Local\Temp\55030BE6-874A-4A0B-BF78-6E4DDF3179D4\sender.exe --send "/status.xml?clid=14237140-80&uuid=8ad7b393-e0b8-4fae-a336-851ac831786f&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A36%0A40%0A42%0A45%0A57%0A61%0A102%0A103%0A111%0A123%0A124%0A125%0A"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2680

C:\Users\Admin\AppData\Local\Temp\55030BE6-874A-4A0B-BF78-6E4DDF3179D4\sender.exe
"C:\Users\Admin\AppData\Local\Temp\55030BE6-874A-4A0B-BF78-6E4DDF3179D4\sender.exe" --job-name=ySenderExe-9284F8D5-36D4-4E0E-A694-E0E2EBADB571 --local-path=C:\Users\Admin\AppData\Local\Temp\yst.tmp --send="/status.xml?clid=14237140-80&uuid=8ad7b393-e0b8-4fae-a336-851ac831786f&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A36%0A40%0A42%0A45%0A57%0A61%0A102%0A103%0A111%0A123%0A124%0A125"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b6f53.rbs

Path C:\Config.Msi\e5b6f53.rbs
Size 912B
SHA256 5aa14e75c7dbe47fe479988a39632fcfb2a0695e643020914c4ca840b166429c
MD5 74e53136086cc28b57d7eab8d68d83e5
SHA1 707fed396aaccb0054889f29093bd7489baea13b
SHA512 17b13c7603759ad2c96ae23281084381a1e5edb9792ab3482f110f727fecd1d616f6c91f5dd0c79e1163cca78e6dba80e821638fe6fd0ef0530c95c02c93a530
TLSH
T17211EF0F977D92C6C841C0329F966DDBA46BF524EB2F04D4EA0B6D29305D1303F18197
MD5 SHA1 SHA512 TLSH

Submit Download

A90AB99B5CC057007BC33B2303FE2710

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A90AB99B5CC057007BC33B2303FE2710
Size 37KB
SHA256 545790dd65d30de8ade33e60322e42c96d491939add308a9edf4efac4dc0b3e0
MD5 427a4f2c53f5367fe6ebbb2c7a0841b8
SHA1 16ee510370211971eab81bf8b1dbec85ac573058
SHA512 87be4eee2ea364c81834a337c5d9c4b3994cda51b7e9cf614cc49762b8ab881cfb946c2df8ef9a639da2417da41b41735937f66b9fbced498ae5ffab5a6f0c1a
SSDEEP 768:dku7mM834ciFPw+JHofn1Q8SPVecaTEi3Ea22P:57mM8ItXsvSP4caN3LR
TLSH
T13E03B760BE7C6A70E68DCE724C9DDB5BDFA264CA2612571A47649BD078036CFCF36840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BD92F95DED26541D3AF7F44DC7914843

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843
Size 721B
SHA256 5095bd2c84d29a158935f583d99f6c82d83f7d9af9fdc4a427f4e6c8d60c2f1e
MD5 d722d574c6be1b97eff7521129fe579f
SHA1 ae99a22f22b2acde4c0eb3b4c8fd2958c49d0b42
SHA512 aa36753395d4f5c6a73f0fbcf2bb14d27b368084f6c81403eb23a706b1cf4bc784f81ed85b60e009f62de76fa4db898bf847d3e4d8108347d8eb8fcade1e530d
TLSH
T1630144AB981C0540BDC14FA733C9F1C269F03B8145CAA86353464CAB31443EB4B245CE
MD5 SHA1 SHA512 TLSH

Submit Download

A90AB99B5CC057007BC33B2303FE2710

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A90AB99B5CC057007BC33B2303FE2710
Size 226B
SHA256 30f6071f92d2f9c833569bc55899c0b2d423584ca9d09925c6c874b7ce2158cf
MD5 19c339eb48886db8b40eae4c39f93280
SHA1 77d8047ce7849973a225096f5e85cb6e7090d70a
SHA512 8f223f9a77f71dc41d68dd6d1f8b889fb21a185c9beae26b182a785411290b173f4cb50ec591f59f3ea82c01f280e86a6f3d40ccad29bb5f3b192574131e1801
TLSH
T176D0129457A6061FF9314A7EACA04B419EE5AE909C73D3140F75070458BCE00DC35E2A
MD5 SHA1 SHA512 TLSH

Submit Download

BD92F95DED26541D3AF7F44DC7914843

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD92F95DED26541D3AF7F44DC7914843
Size 214B
SHA256 3ae30ef11925ad5e19ab6814bd8f3de56b0a86736a0f04efeb40d0a2fffdda06
MD5 de1d9957c2384210ccbebd36685c4349
SHA1 4b73e2eef5551fc214508ef53fa5a0c67e8a1092
SHA512 9e63e752d5ccabaac0ad902a151dfa79cfac4a88e1e09f30615e0074c70e38c2911dfdefeb6d9c65698c295e78db6ef9a388e8d24dcfc3f1d62da8c1bf6ebdc8
TLSH
T149D0124063F54249F1714A7F1E10159197759D04AA02C3100B14024C9478B400C72F23
MD5 SHA1 SHA512 TLSH

Submit Download

b67f658f8f418a7050a0c1f9947b162a

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\thumbnails\b67f658f8f418a7050a0c1f9947b162a
Size 15KB
SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
MD5 af80a936c10e18de168538a0722d6319
SHA1 9b1c84a1cf7330a698c89b9d7f33b17b4ba35536
SHA512 9a1325c8ce05806e5c161a4cf47239f62baad8f79650fbd713e74928fce8171ced10ba7f24fac46c548e1dbf3f64106270cb25ca88c836c870107f5dc1f97879
SSDEEP 384:XJ9H3UgBY5QpDWZoc94ukwZ8UI9wujvkJL:XJWn5SWNVnI2/t
TLSH
T14862AE03295E87F5984CD6DABD8307AA6F69392EE8E2722E465B0C8738507714F4E07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sender.exe

Path C:\Users\Admin\AppData\Local\Temp\55030BE6-874A-4A0B-BF78-6E4DDF3179D4\sender.exe
Size 260KB
SHA256 e249d09956aa2ef44db6a3cdab525abb73d01e7ad46bd83984e0d22d71c9dcc6
MD5 1dfca51cbbccb7bc6396fe0e4cb7428f
SHA1 f728e0b3c034b586fdfe20aa63d7e855645fd472
SHA512 2a6d6c86e0d69bc11a4fe7b88f8d3000013e37b814fab70ec26af50a58dd4b3fe0268a3539e3637f6762ddcc93733398c271143a750a01fc60eb78c88f850edf
SSDEEP 6144:dCD1AbclqCKv3v0Z3Ii+9T2F7QwnESA6iGx7BUz1Vv:dkAYlq3v3v0RdVM+ESAe7BY1Vv
TLSH
T176448D21B992C832E573053259B8CB76697CBD310F3489C7A3DC1A6D9E741C2A635F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexPackSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
Size 10.1MB
SHA256 d6622353f41b0e8f66a6c35e4efc1c122171f476c602b905223c584d3a4c08e5
MD5 6a631c33f6905fa535a1030710a71a91
SHA1 187c4f529d2c0d76c57b5e412bd566d166265ff6
SHA512 5f1b110780342002f3c2b8f9123d6065559c1ff063aa7261cd55f5d02f4819506340620890189c01fc02db0c37afb98f402f61e0e3a20b49290f0ad042e64994
SSDEEP 196608:ZV7wdiFsUCrGias6+sND6ZbHDLzl1vWrqufezv:rss+sND6ZbH/DvW2uGz
TLSH
T182B6D001B742C0B1EAD101B116BEABBA493D9E144B7189C7A7C43E7DDD312D2273BB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

seederexe.exe

Path C:\Users\Admin\AppData\Local\Temp\B0D462D0-4580-4E17-A7DC-8D325F95919A\seederexe.exe
Size 8.5MB
SHA256 a2f5780c9d334c42323ae2cf3328227e7d04a5f6983ff862dc73627f1e970431
MD5 a700ed49dff143167d75c8fc1d4cb2cc
SHA1 defed1bc20884f2d368f34911fc8c1a8c3a9f929
SHA512 9cc1058fbefe173afa45c4f9db10d1d12802d66b06530f241baa43f294232a2b90ff419c894cdbac6f77cba20f8022b43a76f24e68b67c8dc693fd9d491f7f2b
SSDEEP 196608:ZdiFsUCrGias6+sND6ZbHDLzl1vWrqufezvi:Zs+sND6ZbH/DvW2uGzq
TLSH
T1E696D101B752C1B1EEC151F116BA6BBE497D8E148B7189C3D7C01E79D9323E2263BB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\D78F911C-0804-4AC6-AD47-9154839A7965\lite_installer.exe
Size 420KB
SHA256 985d3c2eb69a9f681c876d7a3d28b53f177ebcde90af9ca9d1d8d8be79b03a31
MD5 181e732cddb8038d4c4809385a30c763
SHA1 663a5311f39a85be33eef795ef7b163a32a9633f
SHA512 5b8489da63787c6ae4e9e05394427363162a4948cccab336d7d9625e7158f46664450efc7579115368327792711c99cdd326816f8c1468943dc6b90c1010e93e
SSDEEP 6144:BfOp2iUyj02j+DUa1/MHexK3zXrBQWjEcNvFVwl9WWYjWCGck1DbH+Y:B02iN0heGqzXrBQqEcRP/8ZbH+Y
TLSH
T160948D227682D032E56206715F7ECB7B186CBB311F7148CBB7E81A6C6A744C19631F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch00000.log

Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
Size 1KB
SHA256 408c837f9b82c91e74f284e213cb94db6c2d520dce9ba9af82a8f6f96ef7c17c
MD5 b0a499b4f48b244a761ebd40c56c3070
SHA1 d7f14fb23a806a813ab722ae7402ac32fea6ca9f
SHA512 582412ee02fea9814b84bd9da839d49b808d228ac58ccd20498967bf9fcacb6be26611692a9b7b208b0ec1496aa9b707f9f9513f6dbb331d180d86e82171d410
TLSH
T166411B651FE51D02B2B75B47AEF3C063AA73FCD178388B0C13858319866BD049D947BA
MD5 SHA1 SHA512 TLSH

Submit Download

clids-yasearch.xml

Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
Size 712B
SHA256 e8a858ff41f5af316751476bd4f806032a9301ba6f060cb7cdc23aacc4470e1d
MD5 b4838bb25449393627493fbf4f5f0ebc
SHA1 885cccfe1a9f15fe0a23af4eb87d24ffc77347f5
SHA512 bed6e4bea51f61296cdc273a963b8b4707d8acbed536ea6013d7ea4902864f77c71e70732edb9cd7dc162bcdbbf296ce58e56b92f67e15fc15fac1f3f0e73792
TLSH
T12201494B738CDCEB5EAC073605B81594E3D63EC624501E7A798836E3952E6398ACC360
MD5 SHA1 SHA512 TLSH

Submit Download

vendor00000.xml

Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
Size 529B
SHA256 1e15adab0d9556fbf7067feccb3175c0788b8db0ab100a7c93394014f4b5a4b8
MD5 e868c066688555905251db7a1e77ccdc
SHA1 fcfd7470d081985164c3c6b056ef75f6bdd9acf9
SHA512 3bcfff250ff066976de1dc8ef9eed7176e0b7f5c12dda5844002253c625c4519887babedebdad25854740cc69f37782a8384a29dab92958f3ec67da2640ba107
TLSH
T1DCF0668355ACEE217FF50301853C6AD8F7E83CC814A06E8DB29CA2B19826376CF08370
MD5 SHA1 SHA512 TLSH

Submit Download

YandexSearch.msi

Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
Size 9.7MB
SHA256 a0093634c803116c31a1abe9ffd2189893245ec26362574c5905c5c1467f9a46
MD5 dea8b46313f6b449c21211c449a95269
SHA1 a76dbace4d3a5a97827a621a93e145774fbe8fdc
SHA512 ff6485c3843776095816a45eee10b1d38a8cbcd9cb1f9eb6a016458b00067fe8deef7ae697422c02fb72427825631b7f0e1ac187245462daa460105d60b464b0
SSDEEP 196608:gV7wdiFsUCrGias6+sND6ZbHDLzl1vWrqufezv/:Kss+sND6ZbH/DvW2uGzH
TLSH
T13FA6D001B742C0B1EED101B116BEABBE497D9E144B7189C3A7C42E7D9D312D2273BB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex.exe

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
Size 395KB
SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
MD5 2d28975e84027e1fac0eb563b7d300da
SHA1 bd8e7ead4957c14cedc4c56df5127f70bb746ded
SHA512 7ddbfa54807207b8408e26610cc85d844705e1815b14f1172f1c39a04aeecf1b0f3b14371d6c00ce55437830c00173b219edf1a6e391152615f9bc33bc659b6e
SSDEEP 6144:AqVM7FLycoeASFgYif5GvPahcSp/AOEUwu1j/ra0nNX2dp:/VM7FLyzba1eOPa/mUwULhnNX2dp
TLSH
T1CE843AD1B591C171D17E0531C8E8FAF255AEBD244B644ADB63843E2FBA303D1A931EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex.lnk

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
Size 2KB
SHA256 167f30c38b6d4b26d828826530c7c8ee572bb36ae70a5c3be4919f9196afc70e
MD5 f99f8fd26b51d9667bf855395ef8f4aa
SHA1 c88bb365bc96fc2b835712f11f97a4e9ea920b54
SHA512 f58c329c7c9878cdb99a3db1e0c08c1ca2b37097add074479b5556f3e1bdd05f6978b8f1a0aa3e3a65e088f5a22b838a8d0ab9eefbe134a930fc91fe2ade8042
TLSH
T14841CC0175C61F59D3AF85F792EF2E05DA3CF86887411E1E0155860A2CA1B816C04B3F
MD5 SHA1 SHA512 TLSH

Submit Download

Яндекс.website

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
Size 515B
SHA256 c5b060ae04f989438e45b0910e5f5f2367398302a2011a2d9831c1fe34331b67
MD5 74791dbf84e9c6bcf9c0ea06c65118f2
SHA1 2788d431d926b11f67b7de68103f0fd15d2f7dd5
SHA512 5a772792b5bd0c5cde048de5305cc1540bad2a3ffadc5a7db1a5f6b01787f54897760edc82583a3f4345e63423d239797a385678b6cfdc270e8824012d15b9f3
TLSH
T198F09E14C1AE4479D099D5473638FEC4590B34577EC5DA39869BC8ACFF8A494C804A15
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9xv10wby.Admin\places.sqlite
Size 68KB
SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
MD5 314cb7ffb31e3cc676847e03108378ba
SHA1 3667d2ade77624e79d9efa08a2f1d33104ac6343
SHA512 dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
SSDEEP 48:TV6UcMtYJqqEgbEwq3hF+gBNxw2BAl7FdickdaxL5HoVQJlu:x6HkTBB2ljvoS0
TLSH
T19363DD5B1A343122D8EA90737EE2506E093CF13A8F6776513DF010A6CCA1D62E5799FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clids-yabrowser.xml

Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
Size 738B
SHA256 22f7e466dd0c04f555fa8481d7aeb1b0275572d25fcb4d1a713c64e51e9ee02a
MD5 bfafa3f024859bd503388584ab1c4595
SHA1 85f0ec29892f53009f827f39027309359c913407
SHA512 63ee2069d68334275e21d963d6c20da18df61e333257bcd62ffde0d0cd84b1a069524e5a3614f7b2959cfb59653e381f0652d9ad66d3196a1b0ea91ea8661b25
TLSH
T1EB018C077B8CCEEE5E6C132545A825D4E3D23EC604401E3738887AE7891E6798ACC320
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 a3fea75be2b55f019aad755b930f4a636e0fd24e73393a3b86c20f8d9501e93a
MD5 ccbe0c36fc115edd8343a240e06ece6e
SHA1 e5a55424b30cea2bd047dc4912ca89f7ef62ee95
SHA512 43ae6aa6463df7ce6c6c70341458cd7da07a7b133034bcdf44e5510a12b72ffcf9241d8e329776e9cb65a6688bcc242a1ab2bfcfcf40ed7da3eaa63b587999f1
MD5 SHA1 SHA512

Submit Download

MSI7164.tmp

Path C:\Windows\Installer\MSI7164.tmp
Size 181KB
SHA256 1ad18330acc4f254d8a37ffdf6d14283e1617b1e163ee8d05c876bb41ac6f316
MD5 84d5435930d114587007a51fd8e74799
SHA1 6fa830add05231685c16911b9eca73a4914c35d0
SHA512 9c51450a4036fdb7de1fdadc8a08f264bd55c63a8e159fcafd03786b82a447bde99da756a12f6c1762066c863f7953e1e48a9bc79344588986fbf9b180eefc98
SSDEEP 3072:aQ//vtlwlXrVgrmqImWSUfkSspqkND1vvJWs3aZjBbby5ppL+kEx0PWjcmgd0nv2:aQ3vtlkX5gNNhUqpqkNDtJWZZjB6Wu0O
TLSH
T1F4048D127180C075E6BF163C4578DAB65A7E79301B74C8DF63948E2A2E702C1AB39B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI71D2.tmp

Path C:\Windows\Installer\MSI71D2.tmp
Size 197KB
SHA256 c149276c0b4427c1149fc5a85dc42b4c71c027c2b5fcbc73e6e659f7b3a75562
MD5 a3e005e83f177f7f24c173f8909bcf11
SHA1 fd45815f40f07f544129f1e8f881cdbb18af83ef
SHA512 2f5b250e3525715f5b1ebe629e8578613d9e0818cb3dc3c7776ff451b05c0e1e91ee123a9e5e4c6283ab0df66db3e738da4ac0503a86252ee247752ccf5124b7
SSDEEP 3072:ik7GJVXkOk//9Y74H6bCfnjnv3H73Y1ttJDRz2NvQbj6x1eZYxUoYLxZiEgZ9wRH:iDXJWm4H6bCfnjD3YjXRzXj+7lY6bQRH
TLSH
T10F148C01B881C03AE1BF1A30557ADB72597DB9301BB4CCDFA7849D681E706C2A739B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download