778abcbc02f9e180a1dc4e162493fb224e51ff0c2092a79bd0ba03b244f5a18c

Analysis

max time kernel
166s
max time network
168s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_893ea17302c7c871e8a6fc78f6eb028e_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Size 519KB
Sample260806-btceeswsgz
SHA256 778abcbc02f9e180a1dc4e162493fb224e51ff0c2092a79bd0ba03b244f5a18c
MD5 893ea17302c7c871e8a6fc78f6eb028e
SHA1 fc8f349ac9eb843d895e8809c7372cbdeeeba117
SHA512 415ff6ee81b07345d87d4ca246a69042ec270c3accb62e525fa7b7b7284375a2d0dd6b8037d9ee4bc4f67cd958726ddc3b99d8d47a620d916219b9e594c2be81
SSDEEP 6144:o3ks54n6UHOKEBuhqdcvLxJfsGltYy4lry9wbv9EpDqF2TCWkdJydzMP82LEcKxU:oK8KhquJfvz7Wvype4TFkdn89JBvaAfQ
TLSH
T1D9B4AE55FC9180B2D18211B566B99B771F3CB9204B218EDBB3C449799E203F0AF3A67D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
28	5768	lite_installer.exe
51	2776	{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe

Executes dropped EXE 11 IoCs

pid	Process
3596	Yandex.exe
1760	YandexPackSetup.exe
4752	Yandex.exe
5768	lite_installer.exe
4292	seederexe.exe
4780	Yandex.exe
4628	explorer.exe
5264	sender.exe
2776	{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe
5392	yb10BA.tmp
2108	setup.exe

Loads dropped DLL 10 IoCs

pid	Process
5124	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC3AC.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC69C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9EBE55C216E5EBA2.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC117.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC582.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF66069B1FC368053B.TMP	msiexec.exe
File created	C:\Windows\Installer\e59bc32.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC03A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0C8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9F0D972426B4AA7B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC262.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bc32.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBFBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC156.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF250BBE6F7089B45C.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YandexPackSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lite_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seederexe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yandex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_893ea17302c7c871e8a6fc78f6eb028e_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yandex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yandex.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "d31a65b6-9135-11f1-98e5-66931b942088"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\FaviconURLFallback = "https://www.ya.ru/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\SuggestionsURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\YaCreationDate = "2026-26-06"	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\ShowSearchSuggestionsInAddressGlobal = "1"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\MINIE	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\URL = "https://yandex.ru/search/?win=762&clid=2765541-282&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\NTURL = "https://yandex.ru/search/?win=762&clid=2765545-282&text={searchTerms}"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\DisplayName = "Яндекс"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\d31a65b6-9135-11f1-98e5-66931b942088\NTTopResultURL	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\MINIE\LinksBandEnabled = "1"	seederexe.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.ya.ru/?win=762&clid=2765539-282"	seederexe.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\HomeButtonPage = "https://www.ya.ru/?win=762&clid=2765539-282"	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\HomeButtonEnabled = "1"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows	seederexe.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Yandex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Yandex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Yandex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	Yandex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Yandex.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1760	YandexPackSetup.exe
1760	YandexPackSetup.exe
1784	msiexec.exe
1784	msiexec.exe
5768	lite_installer.exe
5768	lite_installer.exe
4292	seederexe.exe
4292	seederexe.exe
4292	seederexe.exe
4292	seederexe.exe
4292	seederexe.exe
4292	seederexe.exe
4292	seederexe.exe
4292	seederexe.exe
4292	seederexe.exe
4292	seederexe.exe
5264	sender.exe
5264	sender.exe
5768	lite_installer.exe
5768	lite_installer.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1760	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	1760	YandexPackSetup.exe
Token: SeSecurityPrivilege	1784	msiexec.exe
Token: SeCreateTokenPrivilege	1760	YandexPackSetup.exe
Token: SeAssignPrimaryTokenPrivilege	1760	YandexPackSetup.exe
Token: SeLockMemoryPrivilege	1760	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	1760	YandexPackSetup.exe
Token: SeMachineAccountPrivilege	1760	YandexPackSetup.exe
Token: SeTcbPrivilege	1760	YandexPackSetup.exe
Token: SeSecurityPrivilege	1760	YandexPackSetup.exe
Token: SeTakeOwnershipPrivilege	1760	YandexPackSetup.exe
Token: SeLoadDriverPrivilege	1760	YandexPackSetup.exe
Token: SeSystemProfilePrivilege	1760	YandexPackSetup.exe
Token: SeSystemtimePrivilege	1760	YandexPackSetup.exe
Token: SeProfSingleProcessPrivilege	1760	YandexPackSetup.exe
Token: SeIncBasePriorityPrivilege	1760	YandexPackSetup.exe
Token: SeCreatePagefilePrivilege	1760	YandexPackSetup.exe
Token: SeCreatePermanentPrivilege	1760	YandexPackSetup.exe
Token: SeBackupPrivilege	1760	YandexPackSetup.exe
Token: SeRestorePrivilege	1760	YandexPackSetup.exe
Token: SeShutdownPrivilege	1760	YandexPackSetup.exe
Token: SeDebugPrivilege	1760	YandexPackSetup.exe
Token: SeAuditPrivilege	1760	YandexPackSetup.exe
Token: SeSystemEnvironmentPrivilege	1760	YandexPackSetup.exe
Token: SeChangeNotifyPrivilege	1760	YandexPackSetup.exe
Token: SeRemoteShutdownPrivilege	1760	YandexPackSetup.exe
Token: SeUndockPrivilege	1760	YandexPackSetup.exe
Token: SeSyncAgentPrivilege	1760	YandexPackSetup.exe
Token: SeEnableDelegationPrivilege	1760	YandexPackSetup.exe
Token: SeManageVolumePrivilege	1760	YandexPackSetup.exe
Token: SeImpersonatePrivilege	1760	YandexPackSetup.exe
Token: SeCreateGlobalPrivilege	1760	YandexPackSetup.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1784	msiexec.exe
5124	MsiExec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 3596	5776	2026-08-06_893ea17302c7c871e8a6fc78f6eb028e_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe	89
PID 3596 wrote to memory of 1760	3596	Yandex.exe	90
PID 3596 wrote to memory of 4752	3596	Yandex.exe	91
PID 1784 wrote to memory of 5124	1784	msiexec.exe	93
PID 5124 wrote to memory of 5768	5124	MsiExec.exe	94
PID 5124 wrote to memory of 4292	5124	MsiExec.exe	97
PID 4292 wrote to memory of 4780	4292	seederexe.exe	98
PID 4780 wrote to memory of 4628	4780	Yandex.exe	99
PID 4292 wrote to memory of 5264	4292	seederexe.exe	100
PID 2776 wrote to memory of 5392	2776	{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe	103
PID 5392 wrote to memory of 2108	5392	yb10BA.tmp	104

C:\Users\Admin\AppData\Local\Temp\2026-08-06_893ea17302c7c871e8a6fc78f6eb028e_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_893ea17302c7c871e8a6fc78f6eb028e_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Users\Admin\AppData\Local\Temp\Yandex.exe
  "C:\Users\Admin\AppData\Local\Temp\Yandex.exe" --partner 108498 --distr /quiet /msicl "YAHOMEPAGE=y YAQSEARCH=y YABROWSER=y VID=282"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YAHOMEPAGE=y YAQSEARCH=y YABROWSER=y VID=282"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Yandex.exe
    C:\Users\Admin\AppData\Local\Temp\Yandex.exe --stat dwnldr/p=108498/cnt=0/dt=2/ct=1/rt=0 --dh 2516 --st 1785979572
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 45D411EADA88A7741737F6C4C95BA628
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Users\Admin\AppData\Local\Temp\E1284BA4-10B4-409F-BC9D-579C064C29F0\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\E1284BA4-10B4-409F-BC9D-579C064C29F0\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\1F2F6DA7-1A49-4AA5-9A32-AFE102922BF0\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\1F2F6DA7-1A49-4AA5-9A32-AFE102922BF0\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\D955FD26-838E-4179-AE7C-A26FA1A86FA5\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
      C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
        
        C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\D955FD26-838E-4179-AE7C-A26FA1A86FA5\sender.exe
      C:\Users\Admin\AppData\Local\Temp\D955FD26-838E-4179-AE7C-A26FA1A86FA5\sender.exe --send "/status.xml?clid=2765538-282&uuid=a775a4b9-cd06-4600-aed5-7817229bc036&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A45%0A57%0A61%0A89%0A102%0A103%0A111%0A123%0A124%0A125%0A"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5264

C:\Users\Admin\AppData\Local\Temp\{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe
"C:\Users\Admin\AppData\Local\Temp\{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe" --job-name=yBrowserDownloader-{44DC7739-7352-4FE3-A637-4E36FD5EFB81} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2765520-282&ui={a775a4b9-cd06-4600-aed5-7817229bc036} --use-user-default-locale
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\yb10BA.tmp
  "C:\Users\Admin\AppData\Local\Temp\yb10BA.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\2b1a92a2-d0db-4339-bad5-9b80ff3c796a.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=633986739 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{44DC7739-7352-4FE3-A637-4E36FD5EFB81} --local-path="C:\Users\Admin\AppData\Local\Temp\{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2765520-282&ui={a775a4b9-cd06-4600-aed5-7817229bc036} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\a81378be-da9d-4f2b-aaa8-ceb2b6a3b705.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Users\Admin\AppData\Local\Temp\YB_4E045.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\YB_4E045.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_4E045.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\2b1a92a2-d0db-4339-bad5-9b80ff3c796a.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=633986739 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{44DC7739-7352-4FE3-A637-4E36FD5EFB81} --local-path="C:\Users\Admin\AppData\Local\Temp\{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2765520-282&ui={a775a4b9-cd06-4600-aed5-7817229bc036} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\a81378be-da9d-4f2b-aaa8-ceb2b6a3b705.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
    3⤵
    - Executes dropped EXE
    PID:2108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59bc35.rbs

Path C:\Config.Msi\e59bc35.rbs
Size 912B
SHA256 4b312cf2b75f8b24ae68e198f4cd73f4512f46e31c4bab4200bd34efd10cf06b
MD5 0c1a8199f39c0b32e0b70233074a19a9
SHA1 139476eef9c6e0d653ebfeb8f1d0d542e5a66b7b
SHA512 0300460903985dea25047fa41cfb43e825f060058bf3b09c992dca8ffd704c246619800c62c92b217bc931ff977908be1b4eaa343be55febf74db853535ce346
TLSH
T18B11EF4F577DD2C6C880C032AB966DD7A46BF5249B2B04D4D90B6D2D30AE2303F28287
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Size 1KB
SHA256 651905897fc11b51e2ce13a51ac0b85cc5cc20ceb05ace4f9626826eb4a10e08
MD5 b15486458f3c5955334a49ea9188c71f
SHA1 08de5f71d79742a6358424531acbd13f2435e96f
SHA512 eeab3cee1f64203f7afb87d227b51f329aef98d71fc59545ca33a39a84ef5e006953649f33458a0900fb17fc5dbbd170ea3ac7889566f1ecdfda88d0df3b69d9
TLSH
T11031984B095A394767C6DE390EC7AA2B2438D5C512F97426302F56923E353E32FE5438
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 cb5098bb12f23668bae0c9e97cb013e641f0052ed135cafc0eba8af4733c1f15
MD5 87ec520ebe253393b51efb71f0175a14
SHA1 938ea380cd06df988ad04c1b8a4dd670ef777ef0
SHA512 aa7b59b71348c469d5d152a161b17091466516ea4879e71f3ebfac297559795b36435e520bdfb4d71e86b9107898bfea997d7307bc9d2c8f238b1baf71fc7ae8
TLSH
T1E031D82B5F6C95205D12CD543BCDEA371970D9D06CAE25BE7028DA1B18447B31E1586F
MD5 SHA1 SHA512 TLSH

Submit Download

A90AB99B5CC057007BC33B2303FE2710

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A90AB99B5CC057007BC33B2303FE2710
Size 37KB
SHA256 0b6d69ddabd081e8505f8041cb0d7131cf8c50c517a0a7e3643ae3c82f97a8ff
MD5 a292472d33c6ed2c6b3f32b595619575
SHA1 9bdea892c521a8c9215c364992a1facd49bacb5d
SHA512 0031fdcdea573228c22d618e973ec867257572507be23387f546785525c3f7048747f0b411ee92b38ce5d46236f5fec22670fbad7c5c2cbfe881c07a4ecf7141
SSDEEP 768:jku7mM834ciFPw+JHofn1Q8SPVecaTEi3EaO/y:77mM8ItXsvSP4caN3Lz
TLSH
T1A103A860BE7C7A70E68DCE724C9DDB5BDFA264CA2612571A47649AD078036CFCF36840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Size 536B
SHA256 85df334522bc9d28fcb513becc2e44b83818618a8c834c4b327341ffccf172cc
MD5 b7f680cd4dd5d393b7cb26d3930e20da
SHA1 4a4a21f807589e2817d63cf74e0687a4999e4e22
SHA512 376b95c982f6305037e7a50a86a2186befe37918cb6e689472324fd02cc0cf1da32235af0a7619e97b00aad12fc75714353bb082ec8d7c74d003f4a4a6cd43c8
TLSH
T1A9F00E3050FA022FF032DE3906D09195EC21EA2618279A180EEA0306BD19F805C92A3D
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 84e95ff49049226880d7d28b4d3b50138b4af84e9b802ab5b873f19e75a59557
MD5 cacdd1953d23756941828089c2107506
SHA1 f36d912443171c66fdeeca2d7e34c77fa50b3dc6
SHA512 56d72a79af8d8d26cd05975d619ba90e4e2218f7b1367e35c3037de28166ebbdc6d64451b1da53c8f66b14a2a69695ff895d0b58f1fa3562d745c0af866b3501
TLSH
T1F8F0DC344AF8022EF07BCE3D4ED892679595F8036C168B650350CB595C36F118DB3429
MD5 SHA1 SHA512 TLSH

Submit Download

A90AB99B5CC057007BC33B2303FE2710

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A90AB99B5CC057007BC33B2303FE2710
Size 226B
SHA256 658348bb04064dcdf3f60b5737c4718e96945951f60e0975ec7bf7fbd478b92e
MD5 0dcb0c9d6c779661c45cbec9bf4f9ef4
SHA1 0376965f9aee966214c73a07f5ad8eaaa121a78c
SHA512 27bd22b1c00c26e656f75f7fa90947742da92267be9c409c508bb9ceeb69b2d81c3c8e0644fbb70537a06e0ac2e82b0fa2001f249056e24928d4c216ef373ea4
TLSH
T1F9D0C9256E54420AF1258A7F3ED05A525E62BD249822834D1F65020894ADF805C75A6A
MD5 SHA1 SHA512 TLSH

Submit Download

www.ya.ru.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\www.ya.ru.ico
Size 5KB
SHA256 6bb91f1d74389b18bce6e71772e4c5573648c1a4823338193f700afdf8216be5
MD5 a6f6261de61d910e0b828040414cee02
SHA1 d9df5043d0405b3f5ddaacb74db36623dd3969dc
SHA512 20cb7b646c160c942e379c6e7a1a8981a09f520361c0205052c1d66e2fdb76333ffaaf0ca1dfc779754f0e844b9946900fbd5690d01869e1607abc1fda6dffab
SSDEEP 24:ErelattlSx7HQyQzOhxWLn/gFx6VVG0GG8efv1olaLLDGdKo9SpxeHGzr31+o6sd:EilaV67H9PDyg9sala25HAn/t
TLSH
T178C103C971D510A9C0BC6BF022D37A15CD53ED6B84B01CA75531B41AADFA7162F0A2F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf94fd4bf87b506a4c70c091ec3d99de

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wg40zd9z.default-release\thumbnails\cf94fd4bf87b506a4c70c091ec3d99de
Size 15KB
SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
MD5 af80a936c10e18de168538a0722d6319
SHA1 9b1c84a1cf7330a698c89b9d7f33b17b4ba35536
SHA512 9a1325c8ce05806e5c161a4cf47239f62baad8f79650fbd713e74928fce8171ced10ba7f24fac46c548e1dbf3f64106270cb25ca88c836c870107f5dc1f97879
SSDEEP 384:XJ9H3UgBY5QpDWZoc94ukwZ8UI9wujvkJL:XJWn5SWNVnI2/t
TLSH
T14862AE03295E87F5984CD6DABD8307AA6F69392EE8E2722E465B0C8738507714F4E07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

seederexe.exe

Path C:\Users\Admin\AppData\Local\Temp\1F2F6DA7-1A49-4AA5-9A32-AFE102922BF0\seederexe.exe
Size 8.6MB
SHA256 35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
MD5 225ba20fa3edd13c9c72f600ff90e6cb
SHA1 5f1a9baa85c2afe29619e7cc848036d9174701e4
SHA512 97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3
SSDEEP 196608:44T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:4CoXrlAJ7N3pXW2uGzy
TLSH
T1F396D001B752C1B1EAC101B116BE6BBE497DCE148B718DC397C41E79D9322E2673BB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexPackSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
Size 10.1MB
SHA256 05e7c78141093b0ca5a02cfec727a5ba40002cc731a589a098f46b221c3240d4
MD5 51d5200e15ebda388c63a38a0d0105ff
SHA1 085e836dd0adb10f3cc7a80270ea729626c32076
SHA512 64154fc84557c4c1a7f2d764da56d5be3250ec6a9bb9ce2124301fb01fe1e5456b0628ea243775b9f1b1c091763a33fc0d4ed770eb1c61efbf8d5e28fbf5f9a9
SSDEEP 196608:kdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:AadCoXrlAJ7N3pXW2uGzy
TLSH
T12CB6D001B752C0B1EAD101B116BE9BBA487D9E144B3189C797C43E3DD9322E2673BF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sender.exe

Path C:\Users\Admin\AppData\Local\Temp\D955FD26-838E-4179-AE7C-A26FA1A86FA5\sender.exe
Size 260KB
SHA256 36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
MD5 f1a8f60c018647902e70cf3869e1563f
SHA1 3caf9c51dfd75206d944d4c536f5f5ff8e225ae9
SHA512 c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e
SSDEEP 6144:HivzZ4S0lBeFv/XSI/yhFrWLygHmWGYzZ/4hJOnN:CvzZ4SuBeFvPSnkygvGYzih8n
TLSH
T1E4449E217992C833E573053259B88A76693DBD310F3499CBA3D80B6D9E741C2A630F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\E1284BA4-10B4-409F-BC9D-579C064C29F0\lite_installer.exe
Size 419KB
SHA256 688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
MD5 aafdfaa7a989ddb216510fc9ae5b877f
SHA1 41cf94692968a7d511b6051b7fe2b15c784770cb
SHA512 6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
SSDEEP 6144:bahey96oZyvBupY5/af/l27Y547CaPWJTfnOMhym0Wk57YG2F89UUZEfk7:bry96RvBj0C7CaPWNPrHCt9UUZa6
TLSH
T1DC948D227982E032E46205705F7ECBBA287DBB310F6144CBBBD85A6D1E744C19635F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\YB_4E045.tmp\setup.exe
Size 1.0MB
SHA256 c3967afce7b772870c79067a4677a69db8fad2c2d4e20c614487522441826ac1
MD5 298ac31c0d17c3e961257c5265da9726
SHA1 f7859bbad73f1fbfa77a3032044c35d018a99ec0
SHA512 fa68ea9abcdead977ffe3995e144507e3d4ebfa786d092228462a3fbc2779369c2236aee0bf18f3576eb3f7941737c00d8b1575364fe26cb5a6d6aa6fa38c3cd
SSDEEP 12288:tdnDelt5fhWVKZZjhuFJU9YlFnU6xPz2mlchLX4nfT:qjh96l9U6x6AcB4L
TLSH
T13B2562E6A33122B9581FCCA49A3D28A2451C349F5235D3FE19FD0DB60671ACE6B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex.exe

Path C:\Users\Admin\AppData\Local\Temp\Yandex.exe
Size 203KB
SHA256 c60c3a7d20b575fdeeb723e12a11c2602e73329dc413fc6d88f72e6f87e38b49
MD5 b9314504e592d42cb36534415a62b3af
SHA1 059d2776f68bcc4d074619a3614a163d37df8b62
SHA512 e50adb690e2f6767001031e83f40cc067c9351d466051e45a40a9e7ff49049e35609f1e70dd7bb4a4721a112479f79090decca6896deac2680e7d107e3355dae
SSDEEP 3072:IWF1Sss2XaOvu+v7QC2mCAbtoJOBW0rArwrkut57cIrDjy6Hy2BKbY64IrHLzMxI:IWF0+XaOvuyycWNrwrk6y2ZJIrrzr
TLSH
T1DF147C2175C0C432D1B3193059F5E2B02ABCBA700F758A8FA3985B3D5FB45C26626BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch00000.log

Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
Size 1KB
SHA256 944ac895f4971601907252debeab10789e208e06d659bd2c8305aa612900227a
MD5 bd68bb3f6832a9ce4e42c6fb7c986db3
SHA1 cb8d526962c9a8f29909feac03f4c2e150e05a40
SHA512 bbbc716adb0611273d69ff913369c59046d4d3e8dc9dbc52cd03a18c6e83f0b6c4a773bf3fbb974ced390fbc9f7546d6948d19352b7f87b972b74afa9b1765b6
TLSH
T1FA41FB651FE90845B1B75707EFF7C0522AB3BDC56834DB0C13C58319066BD09A9647BA
MD5 SHA1 SHA512 TLSH

Submit Download

clids-yasearch.xml

Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
Size 711B
SHA256 545a841db1158e3f1fa7bc19794b4992b01bd20166fec5e106db8654baf5a731
MD5 caaacfd8fa9b6de9309aea2b182c4113
SHA1 6b18b5fd3745578e40eaa52e6e68a16d52e91440
SHA512 55a7440d886abdfb535034eab93a647541cb88f16e33ea4e1de677b0367de340de599665df6c6caed9a4a10b792f45701cb7cb38b63040c9ba373cc3bb5bb8b8
TLSH
T1DB014908538EFDD45B700BBF65BE15D4E3F43A8616522B3C3A457A83D79E9352186330
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 15KB
SHA256 55a88b8d403542b37fd1ffd1c40c6fe7986cf2fc006dbb0486852756de241cdb
MD5 f2fdded4f49d7e8bbd5b2a334b274503
SHA1 1c3bd91150d43c9fba00cd60269de606297a4fee
SHA512 27bc1c961caabf2b8cc1f301647a59d57a3fbd1d46249d65cec3668a1d70ad0fddc4f4aa64673f0fdf675ee7ec63469b13af038efc422b2f61c78a21e86ae365
SSDEEP 384:cfVVPM6Auv9IIDQvpMIiH4AD8qf1eYeFk0mWhai:CUlmdi
TLSH
T14962995C39EF75303F2A41EEE87D2D914C983546B42E45E1AADE0AC46FE34013F2E46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

master_preferences

Path C:\Users\Admin\AppData\Local\Temp\master_preferences
Size 542B
SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
MD5 eab7dbafdb0a88e2963d969906f76a4f
SHA1 c048162b14ae21361e6e4c3d665f19ef1719c49b
SHA512 9179bef77b1b8bce884558481b3e711cc3c08f15f236306298649c3d5b9665e0c3f222ec96349325c13b029a1d97c0b44e6cde56f88feeb45e160f101be1d4e8
TLSH
T1A8F0E917C152BCAB04F6B7E078791696E94187734051AC353CFE102D1F3EB581285E6D
MD5 SHA1 SHA512 TLSH

Submit Download

vendor00000.xml

Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
Size 510B
SHA256 1bd0f826e60de8c54b4becd496b5f7b642ec10a3a0c4b827479c7c6e0d50ae00
MD5 10cdb2ce3fe53937c8a0879033424135
SHA1 061e1fc38f7075d0e6b40b00004225f64f046cbd
SHA512 4539da3e183e4856614b5baa50f54a384edf3bea4bfebade45c019a046fc2bac94734e019ac3420905707e19907241452f6b72214a373ddfd6a684dd04f67ed7
TLSH
T129F0AE02498CF92477B10B1C853C56D5D5F83E8B06623E8D7359ABA0E7A7632078B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe

Path C:\Users\Admin\AppData\Local\Temp\{418BDD1B-0219-4BFE-9EEF-90F655305220}.exe
Size 12.0MB
SHA256 9a1c28f6c68a6f8cc969da152c792598f0cfdd225ecc2dc3bd77f35df8389cc4
MD5 5f733fdba2f16866365e225de643e61f
SHA1 34e40c90950b2db55dc67ffdc67d99b5a40c964b
SHA512 e15e11a7c18b726bd9289695ecb7f5f8a656ed11b6c52ae021d516ecf830cf8427c2e88d1088cbd7dc3b9f764be48bebb793a4d887e9b9f1482393c9eb589761
SSDEEP 196608:Fhm3pKXxFaItjFdN6ttOkNTx9Pe20/xciu6E4:K3pKXxFa016uqdCxcie
TLSH
T1B9C6D087DB823169DE2A2A71153C3CAB9215AEC94B704BDB97F67C9405706C31C36F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch.msi

Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
Size 9.8MB
SHA256 3274d31cd9e5ee72687e8fc0bd2d53e47cd61301a0a715a572b4c29fcb808ed4
MD5 a685e7710dfd278be21aad1d88f6037f
SHA1 c40bdb55e24180aeb3f94927f4ab857a10bae870
SHA512 fd77dc748bfbe53f871f18c3449a7ccc3c9b44a41aff4f2475f5c5a667cdfefd7231a23a723bb9599cdf884473abce42752067201d4aaf6245f65ffd4ebf3375
SSDEEP 196608:Odad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq0:CadCoXrlAJ7N3pXW2uGzy0
TLSH
T112A6D101B752C1B1EAC101B116BE5BBE487D9E148B318DC797C42E7DD9322E2673BB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex.exe

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
Size 397KB
SHA256 8c4be5f1bc4e2f73d4396af48a31bf10362006472e9b28f40aa91f73a3815f12
MD5 95828ee007d3586792d53ace50b2357e
SHA1 3501ccad7573fd467911f207155318db3a1a1554
SHA512 9896eccb178fd772fc92e5793340bdbc1bd6169465d9a739df06c1154edbce16f6db5dd50df426ccbc40d8410d4ef170c3fb0bc700e7778149ff2168409638e7
SSDEEP 6144:7QxmdQLSyrmXPU9ysfKTu9uf1aatAOE8l+1D3ra0npjdt32:cxmdQLSFsQQX9ktm8lkThnpjdtG
TLSH
T12D8439D1B591C171D1BE0531C4E8FBF245AEBD244B644ADB67843E2BBA303D1A931EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex.lnk

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
Size 2KB
SHA256 a09835a4331b5e7e94227f4bfb2fcfe7cb98aa72d87e681963a093568e473731
MD5 e8cef7cf641806ab675895a733bb148f
SHA1 abff5c62bbd88e2d24b8ed338d4d7304c132769b
SHA512 d377832fdaab3469415f98ad0211e247aaf172aeeee2625572afa600aed6980c33635b85a0fd4d9e21f46b21465df6415f1d88f2e2c02545e4401015f5cae1d9
TLSH
T1D8419911AACB0311DBFBC236D5FF2A64D63DBCA59B47190D028196441C62785AC04B3F
MD5 SHA1 SHA512 TLSH

Submit Download

Яндекс.website

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
Size 515B
SHA256 64a7cf4e8159270f5ad8bf39f395b4660f059bb71aeb95c588f462aa4bfaf410
MD5 eceb50e270618d38635840f941cd8038
SHA1 edc5c36cf2d0e42c70340178246bfadfa07867ca
SHA512 3ab368fddf57411be87099ce7eead7b8cea85f169aaf923157eb31113f8919d387685cfa329cee619b2799f50ce35897adcb9a16381464b3f4cfc4b2b4cc361f
TLSH
T11BF00E04C0AE4039E099C1473638FEC4480B34173EC6CA38829BC8ACFF8A0D88804A15
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tv3tgata.Admin\places.sqlite
Size 68KB
SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
MD5 314cb7ffb31e3cc676847e03108378ba
SHA1 3667d2ade77624e79d9efa08a2f1d33104ac6343
SHA512 dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
SSDEEP 48:TV6UcMtYJqqEgbEwq3hF+gBNxw2BAl7FdickdaxL5HoVQJlu:x6HkTBB2ljvoS0
TLSH
T19363DD5B1A343122D8EA90737EE2506E093CF13A8F6776513DF010A6CCA1D62E5799FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks
Size 1KB
SHA256 2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
MD5 3adec702d4472e3252ca8b58af62247c
SHA1 35d1d2f90b80dca80ad398f411c93fe8aef07435
SHA512 7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
TLSH
T1B43172ABF66398CF989C5DCF4174CBCBF98D083A95C01EDAB189352AC09480E127F756
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences
Size 318B
SHA256 6b526bd1e2dd871e60bb7cef11f683b0fdcc32470e9e3bdc5e3d41399a3ea165
MD5 37bcccfdd90a5ec52b99a59b2ca4150d
SHA1 103612008eeaf68b1c7adcfd308192eab5b01f6b
SHA512 6a0397f8a9f891565a6c308b6a833bc74f0e23b4652a15e6c604393db461734bcec5131106a2444fe1a07c841d3454d310156b0c3c6c761ddf5c8e87d2e60756
TLSH
T18BE07D17F4502EB50DB5427562947F3062290102B4A5619384EEB15843BD1DDC156853
MD5 SHA1 SHA512 TLSH

Submit Download

clids-yabrowser.xml

Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
Size 737B
SHA256 46d312ea04f239c729b9402b871032bd3977a6c9d5ea599a07dc75945ccb97e3
MD5 cf99418deaf925f01ed6ea2e1872885e
SHA1 ec835bec10ba02305d37d80043aa9baac659b0a7
SHA512 245ac7fac2d8e9ddc56833ea66d8d71f6b224ad346e04c85dc63f20872e22be18245177550f33c66f2e8f570de7ad1c9e24881530cc0e0c16bb3e390ab34b69f
TLSH
T1E50148085B8EEED44B6817AFA5BE18D8F3F43A5500401B383844BA43DBAEE752446370
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 52fb3253d8e9fd94b0d21a893b77e5945437adc1342ebc6bd8b0f722dab8b90d
MD5 62cd1070208c9e41955c3fad46e11b22
SHA1 a054670cdaf5f2fe1c58a796186e3a8bb0589a26
SHA512 d523c054e55e2bf552cfb38fc65d228e893816743d4deed17c8759e7031674c042f67ee773bd56a8272dffb3c3290635aee03603676b98482b5ea3a1ebffdd8e
MD5 SHA1 SHA512

Submit Download

MSIBFBC.tmp

Path C:\Windows\Installer\MSIBFBC.tmp
Size 181KB
SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
MD5 0c80a997d37d930e7317d6dac8bb7ae1
SHA1 018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA512 fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
SSDEEP 3072:LIgxsEwKIE4SaX1xQrlm4taQqPvvNCqv8bcDR0wYyMP3XrZ+bx0PWWX+xA6QpS:LIgxsEbIE45ArptaQqPtCG8SR0waB7Bo
TLSH
T1DE048D127180C075E6FB1A3C4578DAB65A3E79305B74C8DB63948E2B2E702C1AF35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC03A.tmp

Path C:\Windows\Installer\MSIC03A.tmp
Size 189KB
SHA256 669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
MD5 e6fd0e66cf3bfd3cc04a05647c3c7c54
SHA1 6a1b7f1a45fb578de6492af7e2fede15c866739f
SHA512 fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
SSDEEP 3072:iAJayVkvIkE3fqPDgvlevYwlv57GqosaJlpJKzhY9A3w9FtGJ2EYJxZi5V2O2M:ickvIDvWgvlevYwFVaJlp8z++bnYsX2Y
TLSH
T1A1149E107881C13AE2BF093995BAA6724D7CB5301FB8C8DF63949D351E706C1AB39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download