File name:

install.exe

Full analysis: https://app.any.run/tasks/e8dca9ac-5181-4daf-8786-567e71e9e28e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 14:50:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

8DDF3ABCAE25E81007239F9E6B312091

SHA1:

4A4EAC3DC408DA6B3EFF0D1FDA246E8EAEA886E7

SHA256:

31EA42E9252B2432331C7112CCE5ED327EC2250C7291EFFAE216F15311DA768C

SSDEEP:

6144:BTM6qtgn0I+4i5tucngwZXp+V44zPOfBOLzh:BdTcscgwQ44zWZwh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • seederexe.exe (PID: 7492)
      • browser.exe (PID: 3268)

    • Actions looks like stealing of personal data

      • lite_installer.exe (PID: 3192)
      • seederexe.exe (PID: 7492)
      • setup.exe (PID: 7328)
      • csrss.exe (PID: 5824)
      • browser.exe (PID: 3268)
      • browser.exe (PID: 8064)
      • browser.exe (PID: 6632)
      • browser.exe (PID: 732)
      • browser.exe (PID: 5064)
      • CompatTelRunner.exe (PID: 8692)
      • browser.exe (PID: 9096)
      • browser.exe (PID: 8396)
      • browser.exe (PID: 8792)
      • browser.exe (PID: 8548)
      • browser.exe (PID: 8464)
      • browser.exe (PID: 8536)
      • browser.exe (PID: 5892)
      • browser.exe (PID: 8224)
      • browser.exe (PID: 8980)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • install.exe (PID: 7700)

    • Reads security settings of Internet Explorer

      • install.exe (PID: 7700)
      • lite_installer.exe (PID: 3192)
      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • explorer.exe (PID: 7180)

    • Application launched itself

      • install.exe (PID: 7700)
      • setup.exe (PID: 7328)
      • browser.exe (PID: 3268)

    • Executable content was dropped or overwritten

      • install.exe (PID: 7700)
      • lite_installer.exe (PID: 3192)
      • Yandex.exe (PID: 4380)
      • yb20E3.tmp (PID: 8176)
      • setup.exe (PID: 7328)

    • Starts a Microsoft application from unusual location

      • YandexPackSetup.exe (PID: 7828)

    • Reads Mozilla Firefox installation path

      • seederexe.exe (PID: 7492)

    • Potential Corporate Privacy Violation

      • install.exe (PID: 7700)
      • lite_installer.exe (PID: 3192)

    • Starts itself from another location

      • Yandex.exe (PID: 4380)

    • Starts application with an unusual extension

      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)

    • Searches for installed software

      • CompatTelRunner.exe (PID: 8692)

  • INFO

    • The sample compiled with russian language support

      • install.exe (PID: 7700)
      • msiexec.exe (PID: 7980)
      • setup.exe (PID: 7328)

    • Checks proxy server information

      • install.exe (PID: 7700)
      • lite_installer.exe (PID: 3192)
      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • BackgroundTransferHost.exe (PID: 4336)
      • browser.exe (PID: 3268)

    • Checks supported languages

      • install.exe (PID: 7700)
      • msiexec.exe (PID: 7980)
      • lite_installer.exe (PID: 3192)
      • YandexPackSetup.exe (PID: 7828)
      • install.exe (PID: 7836)
      • msiexec.exe (PID: 7888)
      • seederexe.exe (PID: 7492)
      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • Yandex.exe (PID: 4380)
      • explorer.exe (PID: 7180)
      • sender.exe (PID: 5344)
      • browser.exe (PID: 8612)
      • browser.exe (PID: 8536)
      • browser.exe (PID: 8224)

    • Reads the computer name

      • install.exe (PID: 7700)
      • msiexec.exe (PID: 7980)
      • lite_installer.exe (PID: 3192)
      • YandexPackSetup.exe (PID: 7828)
      • msiexec.exe (PID: 7888)
      • install.exe (PID: 7836)
      • seederexe.exe (PID: 7492)
      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • Yandex.exe (PID: 4380)
      • sender.exe (PID: 5344)

    • The sample compiled with english language support

      • install.exe (PID: 7700)
      • lite_installer.exe (PID: 3192)
      • yb20E3.tmp (PID: 8176)
      • setup.exe (PID: 7328)

    • Reads the machine GUID from the registry

      • install.exe (PID: 7700)
      • msiexec.exe (PID: 7888)
      • lite_installer.exe (PID: 3192)
      • seederexe.exe (PID: 7492)
      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)

    • Creates files or folders in the user directory

      • install.exe (PID: 7700)
      • msiexec.exe (PID: 7980)
      • msiexec.exe (PID: 7888)
      • lite_installer.exe (PID: 3192)
      • seederexe.exe (PID: 7492)
      • Yandex.exe (PID: 4380)
      • BackgroundTransferHost.exe (PID: 4336)
      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • setup.exe (PID: 7328)
      • browser.exe (PID: 3268)
      • browser.exe (PID: 6632)

    • Reads the software policy settings

      • install.exe (PID: 7700)
      • msiexec.exe (PID: 7888)
      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • lite_installer.exe (PID: 3192)
      • BackgroundTransferHost.exe (PID: 4336)
      • CompatTelRunner.exe (PID: 8692)

    • Create files in a temporary directory

      • install.exe (PID: 7700)
      • install.exe (PID: 7836)
      • YandexPackSetup.exe (PID: 7828)
      • seederexe.exe (PID: 7492)
      • lite_installer.exe (PID: 3192)
      • msiexec.exe (PID: 7980)
      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • yb20E3.tmp (PID: 8176)
      • sender.exe (PID: 5344)
      • browser.exe (PID: 3268)

    • Process checks computer location settings

      • msiexec.exe (PID: 7980)
      • explorer.exe (PID: 7180)
      • browser.exe (PID: 8224)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7888)
      • msiexec.exe (PID: 7980)

    • Manual execution by a user

      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • firefox.exe (PID: 632)
      • browser.exe (PID: 3268)

    • Yandex updater related mutex has been found

      • {CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe (PID: 6944)
      • browser.exe (PID: 3268)

    • Local mutex for internet shortcut management

      • Yandex.exe (PID: 4380)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 4336)

    • Application launched itself

      • firefox.exe (PID: 6564)
      • firefox.exe (PID: 632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:19 13:34:48+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 143360
InitializedDataSize: 84992
UninitializedDataSize: -
EntryPoint: 0x74a6
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.1.0.33
ProductVersionNumber: 0.1.0.33
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Unicode
FileDescription: Setup Downloader
FileVersion: 0.1.0.33
InternalName: download
LegalCopyright: Copyright (C) 2015 Yandex LLC
OriginalFileName: downloader.exe
ProductName: Setup Downloader
ProductVersion: 0.1.0.33
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
69
Malicious processes
19
Suspicious processes
5

Behavior graph

Click at the process to see the details
start install.exe yandexpacksetup.exe no specs install.exe msiexec.exe msiexec.exe sppextcomobj.exe no specs slui.exe lite_installer.exe seederexe.exe {cf05af08-df73-4d42-ab96-b2b19c33d05f}.exe yandex.exe explorer.exe no specs sender.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs yb20e3.tmp setup.exe setup.exe no specs slui.exe shellexperiencehost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs clidmgr.exe no specs conhost.exe no specs clidmgr.exe no specs conhost.exe no specs browser.exe browser.exe no specs browser.exe browser.exe no specs browser.exe browser.exe no specs browser.exe browser.exe no specs browser.exe no specs browser.exe no specs browser.exe browser.exe browser.exe browser.exe browser.exe no specs browser.exe no specs browser.exe no specs browser.exe firefox.exe no specs firefox.exe no specs browser.exe browser.exe no specs compattelrunner.exe browser.exe browser.exe browser.exe browser.exe browser.exe no specs browser.exe no specs csrss.exe

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
732"C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e7453c37-80a4-4d70-8ff2-e6af224798a2 --brand-id=yandex --partner-id=pseudoportal-ru --string-annotations --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=2616,i,8602444827502861066,10103596277681217175,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
browser.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
LOW
Description:
Yandex with voice assistant Alice
Exit code:
0
Version:
25.2.3.808
Modules
Images
c:\users\admin\appdata\local\yandex\yandexbrowser\application\browser.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\users\admin\appdata\local\yandex\yandexbrowser\application\25.2.3.808\browser_elf.dll
c:\windows\syswow64\version.dll
1040"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6096 -childID 6 -isForBrowser -prefsHandle 6088 -prefMapHandle 6072 -prefsLen 31269 -prefMapSize 244583 -jsInitHandle 1440 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {591b2dd4-a19e-47a3-a995-07edd7e54acd} 6564 "\\.\pipe\gecko-crash-server-pipe.6564" 26b82ebfa10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
1240"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5100 -childID 4 -isForBrowser -prefsHandle 4684 -prefMapHandle 4680 -prefsLen 31219 -prefMapSize 244583 -jsInitHandle 1440 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {834753f4-e340-4002-918f-8760ecdf6f45} 6564 "\\.\pipe\gecko-crash-server-pipe.6564" 26b7fd0cbd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2092"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2856 -childID 1 -isForBrowser -prefsHandle 1420 -prefMapHandle 2592 -prefsLen 31382 -prefMapSize 244583 -jsInitHandle 1440 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e362372-9c2d-4eb0-bddc-a625337dbf45} 6564 "\\.\pipe\gecko-crash-server-pipe.6564" 26b7c39ef50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
2796\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—clidmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—clidmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3192"C:\Users\admin\AppData\Local\Temp\6569BB02-CD7C-43F4-B523-A641E17D292D\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSERC:\Users\admin\AppData\Local\Temp\6569BB02-CD7C-43F4-B523-A641E17D292D\lite_installer.exe
msiexec.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
YandexBrowserDownloader
Exit code:
0
Version:
1.0.1.9
Modules
Images
c:\users\admin\appdata\local\temp\6569bb02-cd7c-43f4-b523-a641e17d292d\lite_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3268"C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=990486025C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
explorer.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
MEDIUM
Description:
Yandex with voice assistant Alice
Exit code:
0
Version:
25.2.3.808
Modules
Images
c:\users\admin\appdata\local\yandex\yandexbrowser\application\browser.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\version.dll
3800"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5124 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 5108 -prefMapHandle 5152 -prefsLen 38084 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ca78e45-795d-4a95-8f0f-e3b526b1b4d1} 6564 "\\.\pipe\gecko-crash-server-pipe.6564" 26b7f97db10 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
Total events
95 987
Read events
95 226
Write events
675
Delete events
86

Modification events

(PID) Process:(7700) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7700) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7700) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7888) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
D01E000031346C1FCC9CDB01
(PID) Process:(7888) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
06CA64C77FDE0A1CA4CD48F5254EC4BFA0CF7AECE646812F292BD1A2C524B2BE
(PID) Process:(7888) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7492) seederexe.exeKey:HKEY_CURRENT_USER\SOFTWARE\AppDataLow\Yandex
Operation:writeName:UICreated_admin
Value:
1
(PID) Process:(7888) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Local\Yandex\YaPin\
Value:
(PID) Process:(7888) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Local\Yandex\
Value:
(PID) Process:(7888) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001_Classes\Local Settings\MuiCache\3c
Operation:delete keyName:(default)
Value:
Executable files
37
Suspicious files
1 010
Text files
284
Unknown types
0

Dropped files

PID
Process
Filename
Type
7828YandexPackSetup.exeC:\Users\admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi —
MD5:—
SHA256:—
7888msiexec.exeC:\Windows\Installer\10f2af.msi —
MD5:—
SHA256:—
7700install.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7binary
MD5:3AAAEA4E3E469A100CA5599DA63FEE1C
SHA256:C0A8FE33700D18352E9C0B6E41923C3A586EC95B0CE28E91E771A6F4D1BCAE4D
7700install.exeC:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\seed.txttext
MD5:9917C3B8AC1B209796960D2A2F0F7931
SHA256:22727E41215D215383C6B761B72F876A1EE3BEF0BC2FAC976227993C28D99121
7700install.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7binary
MD5:433AA6945C79311B1AF6D1261556D302
SHA256:6070F75D4CE4E40C2D3C5F9391D1A655ACD6AE04C1FD45395B5A2A2FC79C3F8D
7700install.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:9DB69F648943F63585853512957507BB
SHA256:D504866D353128AD79E985A0131EFE1C1385B17E84C5AA8CC220466C3E091576
7700install.exeC:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exeexecutable
MD5:DE5CC8B280F3A924E2C3F269FE7618A0
SHA256:167398F1384B8322E60810EAA3CF147E2884580063CB12E19DAB484F63A4BBD6
7700install.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\YandexPackSetup[1].exeexecutable
MD5:DE5CC8B280F3A924E2C3F269FE7618A0
SHA256:167398F1384B8322E60810EAA3CF147E2884580063CB12E19DAB484F63A4BBD6
7980msiexec.exeC:\Users\admin\AppData\Local\Temp\clids-yasearch.xmlxml
MD5:236B17FC72C43B70BEA734407A652872
SHA256:A6F8307DB13426324E96D737336369C4D69156DD2E34F5961680ABC875F74646
7888msiexec.exeC:\Windows\Installer\MSIF706.tmpexecutable
MD5:E6FD0E66CF3BFD3CC04A05647C3C7C54
SHA256:669CC0AAE068CED3154ACAECB0C692C4C5E61BC2CA95B40395A3399E75FCB9B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
47
DNS requests
28
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7700
install.exe
GET
302
5.45.205.242:80
http://downloader.yandex.net/yandex-pack/635487/YandexPackSetup.exe
unknown
—
—
whitelisted
7700
install.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDG8SbJzCh95FjOiQ9g%3D%3D
unknown
—
—
whitelisted
7700
install.exe
GET
200
5.45.192.140:80
http://cachev2-kiv-02.cdn.yandex.net/downloader.yandex.net/yandex-pack/635487/YandexPackSetup.exe?lid=321
unknown
—
—
whitelisted
7700
install.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
3192
lite_installer.exe
GET
302
5.45.205.242:80
http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=9183405-850&ui={e7453c37-80a4-4d70-8ff2-e6af224798a2}
unknown
—
—
whitelisted
3192
lite_installer.exe
GET
—
5.45.247.27:80
http://cachev2-ams22.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=9183405-850&ui={e7453c37-80a4-4d70-8ff2-e6af224798a2}&lid=294
unknown
—
—
whitelisted
7356
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6944
{CF05AF08-DF73-4D42-AB96-B2B19C33D05F}.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDBAlDXNDLcXSPOAesQ%3D%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7700
install.exe
5.45.205.242:80
downloader.yandex.net
YANDEX LLC
RU
whitelisted
7700
install.exe
5.45.192.140:80
cachev2-kiv-02.cdn.yandex.net
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.0
  • 40.126.31.69
  • 40.126.31.131
  • 20.190.159.64
  • 40.126.31.2
  • 20.190.159.128
  • 20.190.159.68
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
downloader.yandex.net
  • 5.45.205.242
  • 5.45.205.243
  • 5.45.205.244
  • 5.45.205.245
  • 5.45.205.241
whitelisted
cachev2-kiv-02.cdn.yandex.net
  • 5.45.192.140
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 4.231.128.59
whitelisted

Threats

PID
Process
Class
Message
7700
install.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7700
install.exe
Misc activity
ET INFO Packed Executable Download
3192
lite_installer.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3192
lite_installer.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
install.exe