File name:

Google Chrome [157444].exe

Full analysis: https://app.any.run/tasks/22ccde9e-7643-41f6-aa9e-894c8c677288
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 29, 2020, 22:09:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
MD5:

B6C3D646A5892ADFA3ACA2D0059D3F64

SHA1:

D2185963A6566A70B84838D9C0E25502D915AAD1

SHA256:

0AC4E447E127685A25E496116A82E0ACAAC09B1854C33D262A16971F0EEB265E

SSDEEP:

6144:eCAX3vMvPQBgKLTTV6KVxU3yH49/6RcxE4cWl+254:eCUf8YBtThdTU3R9/c2/l+2O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Google Chrome [157444].exe (PID: 488)
      • y_advisor.tmp (PID: 2544)
      • lite_installer.exe (PID: 2776)
      • seederexe.exe (PID: 2420)

    • Loads dropped or rewritten executable

      • Google Chrome [157444].exe (PID: 488)
      • GoogleUpdate.exe (PID: 2648)
      • GoogleUpdate.exe (PID: 2676)
      • GoogleUpdate.exe (PID: 2536)
      • GoogleUpdate.exe (PID: 888)
      • GoogleUpdate.exe (PID: 2396)
      • GoogleUpdate.exe (PID: 3248)
      • YandexPackSetup.exe (PID: 2304)

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 3940)
      • GoogleUpdate.exe (PID: 2536)
      • y_installer.exe (PID: 1796)
      • y_advisor.exe (PID: 1676)
      • y_installer.exe (PID: 712)
      • YandexPackSetup.exe (PID: 3176)
      • lite_installer.exe (PID: 2776)
      • downloader.exe (PID: 2580)
      • seederexe.exe (PID: 2420)
      • sender.exe (PID: 1788)
      • YandexPackSetup.exe (PID: 2332)
      • downloader.exe (PID: 2996)
      • YandexPackSetup.exe (PID: 2304)
      • u2-ctrl.exe (PID: 3436)
      • Yandex.exe (PID: 1524)

    • Loads the Task Scheduler COM API

      • GoogleUpdate.exe (PID: 2536)

    • Downloads executable files from the Internet

      • Google Chrome [157444].exe (PID: 488)
      • y_installer.exe (PID: 1796)
      • downloader.exe (PID: 2580)

    • Changes settings of System certificates

      • GoogleUpdate.exe (PID: 888)
      • y_installer.exe (PID: 1796)
      • Google Chrome [157444].exe (PID: 488)

    • Changes the autorun value in the registry

      • YandexPackSetup.exe (PID: 2304)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Google Chrome [157444].exe (PID: 488)
      • setup.exe (PID: 3940)
      • GoogleUpdate.exe (PID: 2536)
      • y_advisor.exe (PID: 1676)
      • y_advisor.tmp (PID: 2544)
      • y_installer.exe (PID: 1796)
      • MsiExec.exe (PID: 2728)
      • Yandex.exe (PID: 1524)
      • downloader.exe (PID: 2580)
      • YandexPackSetup.exe (PID: 2332)
      • YandexPackSetup.exe (PID: 2304)

    • Reads Internet Cache Settings

      • Google Chrome [157444].exe (PID: 488)
      • y_installer.exe (PID: 1796)
      • lite_installer.exe (PID: 2776)
      • downloader.exe (PID: 2580)

    • Disables SEHOP

      • GoogleUpdate.exe (PID: 2536)

    • Creates files in the program directory

      • setup.exe (PID: 3940)
      • GoogleUpdate.exe (PID: 2536)

    • Creates COM task schedule object

      • GoogleUpdate.exe (PID: 2676)

    • Reads Windows owner or organization settings

      • y_advisor.tmp (PID: 2544)

    • Reads the Windows organization settings

      • y_advisor.tmp (PID: 2544)

    • Executed as Windows Service

      • GoogleUpdate.exe (PID: 3248)

    • Adds / modifies Windows certificates

      • GoogleUpdate.exe (PID: 888)
      • y_installer.exe (PID: 1796)
      • Google Chrome [157444].exe (PID: 488)

    • Creates files in the user directory

      • MsiExec.exe (PID: 2728)
      • lite_installer.exe (PID: 2776)
      • Yandex.exe (PID: 1524)
      • seederexe.exe (PID: 2420)

    • Reads Environment values

      • MsiExec.exe (PID: 2728)
      • MsiExec.exe (PID: 2232)

    • Changes the started page of IE

      • seederexe.exe (PID: 2420)

    • Creates a software uninstall entry

      • Yandex.exe (PID: 1524)
      • YandexPackSetup.exe (PID: 2304)

    • Application launched itself

      • downloader.exe (PID: 2580)
      • y_installer.exe (PID: 1796)

    • Uses TASKKILL.EXE to kill process

      • MsiExec.exe (PID: 2232)

    • Reads default file associations for system extensions

      • Yandex.exe (PID: 1524)

  • INFO

    • Reads settings of System Certificates

      • Google Chrome [157444].exe (PID: 488)

    • Creates files in the program directory

      • y_advisor.tmp (PID: 2544)

    • Application was dropped or rewritten from another process

      • y_advisor.tmp (PID: 2544)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2728)
      • MsiExec.exe (PID: 2232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:08:24 04:45:13+02:00
PEType: PE32
LinkerVersion: 2.56
CodeSize: 33280
InitializedDataSize: 15872
UninitializedDataSize: 175104
EntryPoint: 0x3a5d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 24-Aug-2016 02:45:13
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 24-Aug-2016 02:45:13
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000080BC
0x00008200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.32674
.data
0x0000A000
0x000000A0
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.35035
.rdata
0x0000B000
0x000010B8
0x00001200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.61913
.bss
0x0000D000
0x0002ABC8
0x00000000
IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00038000
0x00001444
0x00001600
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.13906
.ndata
0x0003A000
0x0002C000
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00066000
0x00006DF8
0x00006E00
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.84307

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.2958
1081
UNKNOWN
English - United States
RT_MANIFEST
2
5.61959
4264
UNKNOWN
English - United States
RT_ICON
3
4.84061
3752
UNKNOWN
English - United States
RT_ICON
4
6.16608
2216
UNKNOWN
English - United States
RT_ICON
5
3.91942
1640
UNKNOWN
English - United States
RT_ICON
6
5.42186
1384
UNKNOWN
English - United States
RT_ICON
7
5.58096
1128
UNKNOWN
English - United States
RT_ICON
8
3.74963
744
UNKNOWN
English - United States
RT_ICON
9
3.01957
296
UNKNOWN
English - United States
RT_ICON
103
2.73226
132
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.DLL
COMCTL32.DLL
GDI32.dll
KERNEL32.dll
OLE32.dll
SHELL32.DLL
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
27
Malicious processes
15
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start google chrome [157444].exe setup.exe googleupdate.exe googleupdate.exe no specs googleupdate.exe no specs y_installer.exe y_advisor.exe y_advisor.tmp googleupdate.exe googleupdate.exe no specs googleupdate.exe yandexpacksetup.exe y_installer.exe lite_installer.exe seederexe.exe downloader.exe msiexec.exe yandex.exe sender.exe yandexpacksetup.exe downloader.exe no specs yandexpacksetup.exe msiexec.exe taskkill.exe no specs taskkill.exe no specs u2-ctrl.exe no specs google chrome [157444].exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
488"C:\Users\admin\AppData\Local\Temp\Google Chrome [157444].exe" C:\Users\admin\AppData\Local\Temp\Google Chrome [157444].exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\google chrome [157444].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
712C:\Users\admin\AppData\Local\Temp\y_installer.exe --stat dwnldr/p=351634/cnt=0/dt=6/ct=0/rt=0 --dh 1296 --st 1590790195C:\Users\admin\AppData\Local\Temp\y_installer.exe
y_installer.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.32
Modules
Images
c:\users\admin\appdata\local\temp\y_installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
888"C:\Program Files\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNS40NDIiIHNoZWxsX3ZlcnNpb249IjEuMy4zMy4yMyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4MTUwOTFGQy1EMjEzLTRBRkYtOTgxNS02QzVDQTUwQjI5MTN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7Q0QyNkYwQzktNUNDNC00NzE3LThDOTctRTIwOURENzIzRTEyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIzIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing4NiIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzQuMTEiIG5leHR2ZXJzaW9uPSIxLjMuMzUuNDQyIiBsYW5nPSJydSIgYnJhbmQ9IiIgY2xpZW50PSIiIGlpZD0iezRGNUM4QzJGLUFCODctNDZBMi0xMEEzLTJFQTMxRDBFQjc4NH0iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjIwMyIvPjwvYXBwPjwvcmVxdWVzdD4C:\Program Files\Google\Update\GoogleUpdate.exe
GoogleUpdate.exe
User:
admin
Company:
Google Inc.
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
1.3.33.23
Modules
Images
c:\program files\google\update\googleupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1464"C:\Windows\\System32\taskkill.exe" /F /IM BrowserManagerShow.exeC:\Windows\System32\taskkill.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1524C:\Users\admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=nC:\Users\admin\AppData\Local\Yandex\YaPin\Yandex.exe
seederexe.exe
User:
admin
Integrity Level:
MEDIUM
Description:
YandexPin
Exit code:
1
Version:
2.2.0.53
Modules
Images
c:\users\admin\appdata\local\yandex\yapin\yandex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1676C:\Users\admin\AppData\Local\Temp\y_advisor.exe /SP- /VERYSILENT /NOICONS /NOCANCEL /NORESTART /SUPPRESSMSGBOXES /all=1 /affid=1667 /clid=2364050 /vid=001C:\Users\admin\AppData\Local\Temp\y_advisor.exe
Google Chrome [157444].exe
User:
admin
Company:
Yandex.Market LLC
Integrity Level:
HIGH
Description:
Yandex Sovetnik Setup
Exit code:
4
Version:
Modules
Images
c:\users\admin\appdata\local\temp\y_advisor.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1788C:\Users\admin\AppData\Local\Temp\28E241F0-6338-4369-AE4D-678F7E37B412\sender.exe --send "/status.xml?clid=2278730-142&uuid=3486c658-6A57-4E6D-97FB-E85BE284cf3b&vnt=Windows 7x32&file-no=6%0A10%0A11%0A12%0A13%0A15%0A16%0A17%0A18%0A20%0A21%0A22%0A24%0A25%0A38%0A40%0A42%0A43%0A45%0A57%0A61%0A89%0A103%0A106%0A108%0A111%0A121%0A123%0A124%0A125%0A129%0A"C:\Users\admin\AppData\Local\Temp\28E241F0-6338-4369-AE4D-678F7E37B412\sender.exe
seederexe.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
Yandex Statistics
Exit code:
0
Version:
0.0.2.14
Modules
Images
c:\users\admin\appdata\local\temp\28e241f0-6338-4369-ae4d-678f7e37b412\sender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1796C:\Users\admin\AppData\Local\Temp\y_installer.exe --partner 351634 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=142"C:\Users\admin\AppData\Local\Temp\y_installer.exe
Google Chrome [157444].exe
User:
admin
Integrity Level:
HIGH
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.32
Modules
Images
c:\users\admin\appdata\local\temp\y_installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2232C:\Windows\system32\MsiExec.exe -Embedding C1C9CF2915DDC4F1095F467442BB8420C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2304"C:\Users\admin\AppData\Local\Temp\{12531DCA-F3A6-4CA4-A207-DD346CA7BE9D}\.cr\YandexPackSetup.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" -burn.filehandle.attached=148 -burn.filehandle.self=156 /quietC:\Users\admin\AppData\Local\Temp\{12531DCA-F3A6-4CA4-A207-DD346CA7BE9D}\.cr\YandexPackSetup.exe
YandexPackSetup.exe
User:
admin
Company:
Яндекс
Integrity Level:
MEDIUM
Description:
Менеджер браузеров
Exit code:
0
Version:
3.0.7.830
Modules
Images
c:\users\admin\appdata\local\temp\{12531dca-f3a6-4ca4-a207-dd346ca7be9d}\.cr\yandexpacksetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 096
Read events
2 211
Write events
2 749
Delete events
136

Modification events

(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072
Operation:writeName:Blob
Value:
0F0000000100000014000000391BE92883D52509155BFEAE27B9BD340170B76B030000000100000014000000CDD4EEAE6000AC7F40C3802C171E30148030C0720B000000010000004A0000004D006900630072006F0073006F0066007400200052006F006F007400200043006500720074006900660069006300610074006500200041007500740068006F007200690074007900000069000000010000000E000000300C060A2B0601040182373C030220000000010000009D0500003082059930820381A003020102021079AD16A14AA0A5AD4C7358F407132E65300D06092A864886F70D0101050500305F31133011060A0992268993F22C6401191603636F6D31193017060A0992268993F22C64011916096D6963726F736F6674312D302B060355040313244D6963726F736F667420526F6F7420436572746966696361746520417574686F72697479301E170D3031303530393233313932325A170D3231303530393233323831335A305F31133011060A0992268993F22C6401191603636F6D31193017060A0992268993F22C64011916096D6963726F736F6674312D302B060355040313244D6963726F736F667420526F6F7420436572746966696361746520417574686F7269747930820222300D06092A864886F70D01010105000382020F003082020A0282020100F35DFA8067D45AA7A90C2C9020D035083C7584CDB707899C89DADECEC360FA91685A9E94712918767CC2E0C82576940E58FA043436E6DFAFF780BAE9580B2B93E59D05E3772291F734643C22911D5EE10990BC14FEFC755819E179B70792A3AE885908D89F07CA0358FC68296D32D7D2A8CB4BFCE10B48324FE6EBB8AD4FE45C6F139499DB95D575DBA81AB79491B4775BF5480C8F6A797D1470047D6DAF90F5DA70D847B7BF9B2F6CE705B7E11160AC7991147CC5D6A6E4E17ED5C37EE592D23C00B53682DE79E16DF3B56EF89F33C9CB527D739836DB8BA16BA295979BA3DEC24D26FF0696672506C8E7ACE4EE1233953199C835084E34CA7953D5B5BE6332594036C0A54E044D3DDB5B0733E458BFEF3F5364D842593557FD0F457C24044D9ED6387411972290CE684474926FD54B6FB086E3C73642A0D0FCC1C05AF9A361B9304771960A16B091C04295EF107F286AE32A1FB1E4CD033F777104C720FC490F1D4588A4D7CB7E88AD8E2DEC45DBC45104C92AFCEC869E9A11975BDECE5388E6E2B7FDAC95C22840DBEF0490DF813339D9B245A5238706A5558931BB062D600E41187D1F2EB597CB11EB15D524A594EF151489FD4B73FA325BFCD13300F95962700732EA2EAB402D7BCADD21671B30998F16AA23A841D1B06E119B36C4DE40749CE15865C1601E7A5B38C88FBB04267CD41640E5B66B6CAA86FD00BFCEC1350203010001A351304F300B0603551D0F0404030201C6300F0603551D130101FF040530030101FF301D0603551D0E041604140EAC826040562797E52513FC2AE10A539559E4A4301006092B06010401823715010403020100300D06092A864886F70D01010505000382020100C5114D033A60DD5D5211778FB2BB36C8B205BFB4B7A8D8209D5C1303B61C22FA061335B6C863D49A476F2657D255F104B1265FD6A95068A0BCD2B86ECCC3E9ACDF19CD78AC5974AC663436C41B3E6C384C330E30120DA326FE515300FFAF5A4E840D0F1FE46D052E4E854B8D6C336F54D264ABBF50AF7D7A39A037ED63030FFC1306CE1636D4543B951B51623AE54D17D40539929A27A85BAABDECBBBEE3208960716C56B3A513D06D0E237E9503ED683DF2D863B86B4DB6E830B5E1CA944BF7A2AA5D9930B23DA7C2516C28200124272B4B00B79D116B70BEB21082BC0C9B68D08D3B2487AA9928729D335F5990BDF5DE939E3A625A3439E288551DB906B0C1896B2DD769C319123684D0C9A0DAFF2F6978B2E57ADAEBD70CC0F7BD6317B8391338A2365B7BF285566A1D6462C138E2AABF5166A294F5129C6622106BF2B730922DF229F03D3B144368A2F19C2937CBCE3820256D7C67F37E24122403088147ECA59E97F518D7CFBBD5EF7696EFFDCEDB569D95A042F99758E1D73122D35F59E63E6E2200EA4384B625DBD9F3085668C0646B1D7CECB693A262576E2ED8E7588FC4314926DDDE293587F53071705B143C69BD89127DEB2EA3FED87F9E825A520A2BC1432BD930889FC810FB898DE6A18575337E6C9EDB7313646269A52F7DCA966D9FF8044D30923D6E211421C93DE0C3FD8A6B9D4AFDD1A19D9943773FB0DA
(PID) Process:(488) Google Chrome [157444].exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419
Operation:writeName:Blob
Value:
0F00000001000000100000008B3C3087B7056F5EC5DDBA91A1B901F069000000010000000E000000300C060A2B0601040182373C03020B00000001000000320000004D006900630072006F0073006F0066007400200052006F006F007400200041007500740068006F0072006900740079000000030000000100000014000000A43489159A520F0D93D032CCAF37E7FE20A8B41920000000010000001604000030820412308202FAA003020102020F00C1008B3C3C8811D13EF663ECDF40300D06092A864886F70D01010405003070312B3029060355040B1322436F70797269676874202863292031393937204D6963726F736F667420436F72702E311E301C060355040B13154D6963726F736F667420436F72706F726174696F6E3121301F060355040313184D6963726F736F667420526F6F7420417574686F72697479301E170D3937303131303037303030305A170D3230313233313037303030305A3070312B3029060355040B1322436F70797269676874202863292031393937204D6963726F736F667420436F72702E311E301C060355040B13154D6963726F736F667420436F72706F726174696F6E3121301F060355040313184D6963726F736F667420526F6F7420417574686F7269747930820122300D06092A864886F70D01010105000382010F003082010A0282010100A902BDC170E63BF24E1B289F97785E30EAA2A98D255FF8FE954CA3B7FE9DA2203E7C51A29BA28F60326BD1426479EEAC76C954DAF2EB9C861C8F9F8466B3C56B7A6223D61D3CDE0F0192E896C4BF2D669A9A682699D03A2CBF0CB55826C146E70A3E38962CA92839A8EC498342E3840FBB9A6C5561AC827CA1602D774CE999B4643B9A501C310824149FA9E7912B18E63D986314605805659F1D375287F7A7EF9402C61BD3BF5545B38980BF3AEC54944EAEFDA77A6D744EAF18CC96092821005790606937BB4B12073C56FF5BFBA4660A08A6D2815657EFB63B5E16817704DAF6BEAE8095FEB0CD7FD6A71A725C3CCABCF008A32230B30685C9B320771385DF0203010001A381A83081A53081A20603551D0104819A30819780105BD070EF69729E23517E14B24D8EFFCBA1723070312B3029060355040B1322436F70797269676874202863292031393937204D6963726F736F667420436F72702E311E301C060355040B13154D6963726F736F667420436F72706F726174696F6E3121301F060355040313184D6963726F736F667420526F6F7420417574686F72697479820F00C1008B3C3C8811D13EF663ECDF40300D06092A864886F70D0101040500038201010095E80BC08DF3971835EDB80124D87711F35C60329F9E0BCB3E0591888FC93AE621F2F057932CB5A047C862EFFCD7CC3B3B5AA9365469FE246D3FC9CCAADE057CDD318D3D9F10706ABBFE124F1869C0FCD043E3115A204FEA627BAFAA19C82B37252DBE65A1128A250F63A3F7541CF921C9D615F352AC6E433207FD8217F8E5676C0D51F6BDF152C7BDE7C430FC203109881D95291A4DD51D02A5F180E003B45BF4B1DDC857EE6549C75254B6B4032812FF90D6F0088F7EB897C5AB372CE47AE4A877E376A000D06A3FC1D2368AE04112A8356A1B6ADB35E1D41C04E4A84504C85A33386E4D1C0D62B70AA28CD3D5543F46CD1C55A670DB123A8793759FA7D2A0
Executable files
164
Suspicious files
15
Text files
139
Unknown types
18

Dropped files

PID
Process
Filename
Type
488Google Chrome [157444].exeC:\Users\admin\AppData\Local\Temp\CabCE7.tmp —
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\Local\Temp\TarCE8.tmp —
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\xtp_data[1].txttext
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9Dbinary
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\Local\Temp\xtp_data.txttext
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9Dder
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\launches[1].htmtext
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_501F9AF5159C576E2F02C36AD7EDD50Fder
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_BD2EED65930E4893271D485F7959C473der
MD5:—
SHA256:—
488Google Chrome [157444].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_501F9AF5159C576E2F02C36AD7EDD50Fbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
23
DNS requests
15
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1796
y_installer.exe
GET
302
5.45.205.244:80
http://downloader.yandex.net/yandex-pack/351634/YandexPackSetup.exe
RU
—
—
whitelisted
488
Google Chrome [157444].exe
GET
302
5.45.205.241:80
http://download.yandex.ru/yandex-pack/downloader/downloader.exe
RU
—
—
whitelisted
—
—
GET
—
74.125.173.170:80
http://r5---sn-1gieen7e.gvt1.com/edgedl/release2/chrome/Xicycbe890IhaaFYrq2RJQ_83.0.4103.61/83.0.4103.61_chrome_installer.exe?cms_redirect=yes&mh=jL&mip=185.230.125.140&mm=28&mn=sn-1gieen7e&ms=nvh&mt=1590790158&mv=m&mvi=4&pl=24&shardbypass=yes
US
—
—
whitelisted
1796
y_installer.exe
GET
302
5.45.205.244:80
http://downloader.yandex.net/yandex-pack/downloader/info.rss
RU
—
—
whitelisted
2580
downloader.exe
GET
302
5.45.205.244:80
http://downloader.yandex.net/yandex-pack/downloader/info.rss
RU
—
—
whitelisted
2580
downloader.exe
GET
302
5.45.205.244:80
http://downloader.yandex.net/yandex-pack/bm-partner-ru/YandexPackSetup.exe
RU
—
—
whitelisted
—
—
HEAD
200
74.125.173.170:80
http://r5---sn-1gieen7e.gvt1.com/edgedl/release2/chrome/Xicycbe890IhaaFYrq2RJQ_83.0.4103.61/83.0.4103.61_chrome_installer.exe?cms_redirect=yes&mh=jL&mip=185.230.125.140&mm=28&mn=sn-1gieen7e&ms=nvh&mt=1590790158&mv=m&mvi=4&pl=24&shardbypass=yes
US
—
—
whitelisted
2776
lite_installer.exe
GET
—
5.45.205.221:80
http://cache-man01i.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2278714-142&ui=3486c658-6A57-4E6D-97FB-E85BE284cf3b
RU
—
—
whitelisted
712
y_installer.exe
GET
—
213.180.193.14:80
http://clck.yandex.ru/click/dtype=stred/pid=12/cid=72435/path=dwnldr/p=351634/cnt=0/dt=6/ct=0/rt=3/imp=0/*
RU
—
—
whitelisted
—
—
HEAD
302
108.177.126.101:80
http://redirector.gvt1.com/edgedl/release2/chrome/Xicycbe890IhaaFYrq2RJQ_83.0.4103.61/83.0.4103.61_chrome_installer.exe
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
488
Google Chrome [157444].exe
62.212.73.121:443
windows-chrome.ru
LeaseWeb Netherlands B.V.
NL
suspicious
488
Google Chrome [157444].exe
5.45.205.221:80
cache-man01i.cdn.yandex.net
YANDEX LLC
RU
whitelisted
488
Google Chrome [157444].exe
5.45.205.241:80
download.yandex.ru
YANDEX LLC
RU
whitelisted
1796
y_installer.exe
5.45.205.221:80
cache-man01i.cdn.yandex.net
YANDEX LLC
RU
whitelisted
2544
y_advisor.tmp
87.250.250.41:443
sovetnik.market.yandex.ru
YANDEX LLC
RU
whitelisted
488
Google Chrome [157444].exe
151.139.128.14:80
ocsp.usertrust.com
Highwinds Network Group, Inc.
US
suspicious
888
GoogleUpdate.exe
108.177.119.94:443
update.googleapis.com
Google Inc.
US
whitelisted
3248
GoogleUpdate.exe
108.177.119.94:443
update.googleapis.com
Google Inc.
US
whitelisted
2776
lite_installer.exe
213.180.204.14:80
clck.yandex.ru
YANDEX LLC
RU
whitelisted
—
—
74.125.173.170:80
r5---sn-1gieen7e.gvt1.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
xetapp.com
  • 62.212.73.98
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
crl.usertrust.com
  • 151.139.128.14
whitelisted
windows-chrome.ru
  • 62.212.73.121
suspicious
download.yandex.ru
  • 5.45.205.241
  • 5.45.205.243
  • 5.45.205.244
  • 5.45.205.245
  • 5.45.205.242
whitelisted
cache-man01i.cdn.yandex.net
  • 5.45.205.221
whitelisted
downloader.yandex.net
  • 5.45.205.244
  • 5.45.205.243
  • 5.45.205.242
  • 5.45.205.245
  • 5.45.205.241
whitelisted
sovetnik.market.yandex.ru
  • 87.250.250.41
whitelisted
update.googleapis.com
  • 108.177.119.94
whitelisted
redirector.gvt1.com
  • 108.177.126.101
  • 108.177.126.100
  • 108.177.126.138
  • 108.177.126.102
  • 108.177.126.113
  • 108.177.126.139
whitelisted

Threats

PID
Process
Class
Message
488
Google Chrome [157444].exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
488
Google Chrome [157444].exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
488
Google Chrome [157444].exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
488
Google Chrome [157444].exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
488
Google Chrome [157444].exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1796
y_installer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2544
y_advisor.tmp
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
712
y_installer.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
3 ETPRO signatures available at the full report
Process
Message
YandexPackSetup.exe
IsAlreadyRun() Out : ret (BOOL) = 0
YandexPackSetup.exe
IsAlreadyRun() In
YandexPackSetup.exe
IsMSISrvFree() : OpenMutex() err ret = 2
YandexPackSetup.exe
IsMSISrvFree() In
YandexPackSetup.exe
IsMSISrvFree() Out ret = 1
YandexPackSetup.exe
GetSidFromEnumSess(): ProfileImagePath(1) = C:\Users\admin
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = USER-PC, dwSessionId = 1
YandexPackSetup.exe
GetSidFromEnumSess(): i = 0 : szUserName = Administrator, szDomain = USER-PC, dwSessionId = 0
YandexPackSetup.exe
GetSidFromEnumSess(): LsaEnumerateLogonSessions() lpszSid = S-1-5-21-1302019708-1500728564-335382590-1000
YandexPackSetup.exe
GetSidFromEnumSess(): i = 0 : szUserName = Administrator, szDomain = USER-PC, dwSessionId = 0
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Google Chrome [157444].exe