URL:

https://filebin.net/pkmzgmlzfydx559r

Full analysis: https://app.any.run/tasks/94e638a6-ca93-45bd-b4e7-75cebf578616
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 08, 2022, 12:28:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

469BDD0B7CE3825B995BB1E39DCA493C

SHA1:

E1D00D409E8B7CA227D33E98F4C62AE911C7BD3D

SHA256:

A0ECFB2BC89B723C326691784AC3737235F4DB7169038D8AABFAA9F612ACB75D

SSDEEP:

3:N8wLQeRJZ:2veN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • KLauncher-Installer-v4.0.exe (PID: 3020)
      • yadl.exe (PID: 3016)
      • YandexPackSetup.exe (PID: 3960)
      • yadl.exe (PID: 916)
      • {450C7503-9995-4277-A859-1B7172ACE36F}.exe (PID: 568)
      • sender.exe (PID: 3780)
      • lite_installer.exe (PID: 2472)
      • Yandex.exe (PID: 2836)
      • seederexe.exe (PID: 3508)

    • Changes settings of System certificates

      • yadl.exe (PID: 3016)

    • Drops executable file immediately after starts

      • MsiExec.exe (PID: 2608)
      • Yandex.exe (PID: 2836)

    • Actions looks like stealing of personal data

      • seederexe.exe (PID: 3508)
      • lite_installer.exe (PID: 2472)

    • Steals credentials from Web Browsers

      • seederexe.exe (PID: 3508)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2608)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3652)

    • Creates files in the user directory

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2288)
      • KLauncher-Installer-v4.0.exe (PID: 3020)
      • MsiExec.exe (PID: 2608)
      • seederexe.exe (PID: 3508)
      • Yandex.exe (PID: 2836)

    • Executed via COM

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2288)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3652)
      • iexplore.exe (PID: 3600)
      • KLauncher-Installer-v4.0.exe (PID: 3020)
      • yadl.exe (PID: 3016)
      • MsiExec.exe (PID: 2608)
      • msiexec.exe (PID: 2084)
      • Yandex.exe (PID: 2836)
      • lite_installer.exe (PID: 2472)

    • Checks supported languages

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2288)
      • jp2launcher.exe (PID: 2656)
      • javaw.exe (PID: 1028)
      • javaw.exe (PID: 3568)
      • javaw.exe (PID: 2520)
      • KLauncher-Installer-v4.0.exe (PID: 3020)
      • yadl.exe (PID: 3016)
      • YandexPackSetup.exe (PID: 3960)
      • yadl.exe (PID: 916)
      • lite_installer.exe (PID: 2472)
      • seederexe.exe (PID: 3508)
      • Yandex.exe (PID: 2836)
      • sender.exe (PID: 3780)
      • {450C7503-9995-4277-A859-1B7172ACE36F}.exe (PID: 568)

    • Reads the computer name

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2288)
      • javaw.exe (PID: 1028)
      • javaw.exe (PID: 3568)
      • javaw.exe (PID: 2520)
      • KLauncher-Installer-v4.0.exe (PID: 3020)
      • yadl.exe (PID: 3016)
      • YandexPackSetup.exe (PID: 3960)
      • seederexe.exe (PID: 3508)
      • yadl.exe (PID: 916)
      • Yandex.exe (PID: 2836)
      • lite_installer.exe (PID: 2472)
      • sender.exe (PID: 3780)
      • {450C7503-9995-4277-A859-1B7172ACE36F}.exe (PID: 568)

    • Executes JAVA applets

      • jp2launcher.exe (PID: 2656)

    • Check for Java to be installed

      • jp2launcher.exe (PID: 2656)
      • javaw.exe (PID: 1028)
      • javaw.exe (PID: 3568)
      • javaw.exe (PID: 2520)

    • Uses ICACLS.EXE to modify access control list

      • javaw.exe (PID: 1028)

    • Creates files in the program directory

      • javaw.exe (PID: 1028)

    • Drops a file with a compile date too recent

      • KLauncher-Installer-v4.0.exe (PID: 3020)
      • lite_installer.exe (PID: 2472)

    • Drops a file that was compiled in debug mode

      • KLauncher-Installer-v4.0.exe (PID: 3020)
      • yadl.exe (PID: 3016)
      • msiexec.exe (PID: 2084)
      • MsiExec.exe (PID: 2608)
      • lite_installer.exe (PID: 2472)
      • Yandex.exe (PID: 2836)

    • Application launched itself

      • yadl.exe (PID: 3016)
      • msiexec.exe (PID: 2084)

    • Executed as Windows Service

      • msiexec.exe (PID: 2084)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 2084)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2084)

    • Reads Environment values

      • MsiExec.exe (PID: 2608)

    • Searches for installed software

      • seederexe.exe (PID: 3508)

    • Reads default file associations for system extensions

      • Yandex.exe (PID: 2836)

    • Changes the started page of IE

      • seederexe.exe (PID: 3508)

    • Reads the date of Windows installation

      • Yandex.exe (PID: 2836)

    • Creates a software uninstall entry

      • Yandex.exe (PID: 2836)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3600)
      • iexplore.exe (PID: 3652)
      • icacls.exe (PID: 4032)
      • msiexec.exe (PID: 2084)
      • MsiExec.exe (PID: 2608)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3652)
      • iexplore.exe (PID: 3600)
      • yadl.exe (PID: 3016)
      • msiexec.exe (PID: 2084)
      • lite_installer.exe (PID: 2472)
      • {450C7503-9995-4277-A859-1B7172ACE36F}.exe (PID: 568)

    • Reads the computer name

      • iexplore.exe (PID: 3600)
      • iexplore.exe (PID: 3652)
      • icacls.exe (PID: 4032)
      • msiexec.exe (PID: 2084)
      • MsiExec.exe (PID: 2608)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3652)
      • iexplore.exe (PID: 3600)
      • yadl.exe (PID: 3016)
      • msiexec.exe (PID: 2084)
      • lite_installer.exe (PID: 2472)
      • {450C7503-9995-4277-A859-1B7172ACE36F}.exe (PID: 568)

    • Application launched itself

      • iexplore.exe (PID: 3600)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3652)

    • Reads CPU info

      • iexplore.exe (PID: 3652)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3600)

    • Changes internet zones settings

      • iexplore.exe (PID: 3600)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3600)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3600)

    • Check for Java to be installed

      • iexplore.exe (PID: 3652)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3600)

    • Creates files in the user directory

      • iexplore.exe (PID: 3600)

    • Manual execution by user

      • {450C7503-9995-4277-A859-1B7172ACE36F}.exe (PID: 568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
20
Malicious processes
10
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs jp2launcher.exe no specs jp2launcher.exe no specs javaw.exe no specs icacls.exe no specs javaw.exe no specs javaw.exe no specs klauncher-installer-v4.0.exe yadl.exe yandexpacksetup.exe yadl.exe msiexec.exe msiexec.exe lite_installer.exe seederexe.exe yandex.exe sender.exe {450c7503-9995-4277-a859-1b7172ace36f}.exe

Process information

PID
CMD
Path
Indicators
Parent process
568"C:\Users\admin\AppData\Local\Temp\{450C7503-9995-4277-A859-1B7172ACE36F}.exe" --job-name=yBrowserDownloader-{F6C11051-1160-4C15-8B49-177926ACA8FF} --send-statistics --local-path=C:\Users\admin\AppData\Local\Temp\{450C7503-9995-4277-A859-1B7172ACE36F}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2379694-908&ui={4d0ec6a8-2cd7-453d-9c6f-c4747ec70dd4} --use-user-default-localeC:\Users\admin\AppData\Local\Temp\{450C7503-9995-4277-A859-1B7172ACE36F}.exe
Explorer.EXE
User:
admin
Company:
YANDEX LLC
Integrity Level:
MEDIUM
Description:
Yandex
Exit code:
0
Version:
21.11.4.730
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\{450c7503-9995-4277-a859-1b7172ace36f}.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\shlwapi.dll
916C:\Users\admin\AppData\Local\Temp\yadl.exe --stat dwnldr/p=18417/cnt=0/dt=10/ct=1/rt=0 --dh 1460 --st 1641644948C:\Users\admin\AppData\Local\Temp\yadl.exe
yadl.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.33
Modules
Images
c:\users\admin\appdata\local\temp\yadl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1028"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_2\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.271.2" "later"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe—jp2launcher.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2084C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\msiexec.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2288C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe� Flash� Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2472"C:\Users\admin\AppData\Local\Temp\AD37ADCC-0614-41EE-A45A-3233AB9EAFB6\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSERC:\Users\admin\AppData\Local\Temp\AD37ADCC-0614-41EE-A45A-3233AB9EAFB6\lite_installer.exe
MsiExec.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
YandexBrowserDownloader
Exit code:
0
Version:
1.0.1.88
Modules
Images
c:\users\admin\appdata\local\temp\ad37adcc-0614-41ee-a45a-3233ab9eafb6\lite_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2512"C:\PROGRA~1\Java\JRE18~1.0_2\bin\jp2launcher.exe" -sjedC:\PROGRA~1\Java\JRE18~1.0_2\bin\jp2launcher.exe—iexplore.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
LOW
Description:
Java(TM) Web Launcher
Exit code:
0
Version:
11.271.2.09
Modules
Images
c:\program files\java\jre1.8.0_271\bin\jp2launcher.exe
c:\windows\system32\ntdll.dll
2520"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_2\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.271.2" "false"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe—jp2launcher.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2608C:\Windows\system32\MsiExec.exe -Embedding A41B43D9A381560EF85EAA85DC4C2B81C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2656"C:\PROGRA~1\Java\JRE18~1.0_2\bin\jp2launcher.exe" -sjedC:\PROGRA~1\Java\JRE18~1.0_2\bin\jp2launcher.exe—iexplore.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Web Launcher
Exit code:
3
Version:
11.271.2.09
Modules
Images
c:\program files\java\jre1.8.0_271\bin\jp2launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\java\jre1.8.0_271\bin\msvcp140.dll
c:\program files\java\jre1.8.0_271\bin\vcruntime140.dll
c:\program files\java\jre1.8.0_271\bin\api-ms-win-crt-runtime-l1-1-0.dll
c:\program files\java\jre1.8.0_271\bin\ucrtbase.dll
c:\program files\java\jre1.8.0_271\bin\api-ms-win-core-localization-l1-2-0.dll
c:\program files\java\jre1.8.0_271\bin\api-ms-win-core-processthreads-l1-1-1.dll
Total events
38 235
Read events
37 496
Write events
702
Delete events
37

Modification events

(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
872345120
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30934155
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30934155
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3600) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
24
Suspicious files
70
Text files
155
Unknown types
53

Dropped files

PID
Process
Filename
Type
3652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\pkmzgmlzfydx559r[1].htmhtml
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2BEEEE4F552B06CB5F4A6C4C1C2CD2C7der
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\pkmzgmlzfydx559r[1].pngimage
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2BEEEE4F552B06CB5F4A6C4C1C2CD2C7binary
MD5:—
SHA256:—
3652iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab2F79.tmpcompressed
MD5:ACAEDA60C79C6BCAC925EEB3653F45E0
SHA256:6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
3652iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:ACAEDA60C79C6BCAC925EEB3653F45E0
SHA256:6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
3652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\custom[1].csstext
MD5:B9963A5011B223C97C6A649F9E5F34C8
SHA256:7787E4BEEBC639C98DE0A40A0BDDC8C93B43E1E486C8E598D3111DEC5BBF94E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
49
DNS requests
26
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3020
KLauncher-Installer-v4.0.exe
GET
302
5.45.205.241:80
http://download.yandex.ru/yandex-pack/downloader/downloader.exe
RU
—
—
whitelisted
3016
yadl.exe
GET
302
5.45.205.241:80
http://download.yandex.ru/yandex-pack/downloader/info.rss
RU
—
—
whitelisted
3652
iexplore.exe
GET
200
2.16.186.35:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRku2Q8e3xPuC0gJGoPJnDqNA%3D%3D
unknown
der
503 b
shared
3600
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.68 Kb
whitelisted
3020
KLauncher-Installer-v4.0.exe
GET
200
141.94.96.109:80
http://repos.klaun.ch/launcher/klauncher/KLauncher_v2.2.4.exe
GB
executable
9.52 Mb
suspicious
3600
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3020
KLauncher-Installer-v4.0.exe
GET
200
141.94.96.109:80
http://api.klaun.ch/launcher?type=installer
GB
text
61 b
suspicious
3652
iexplore.exe
GET
200
2.16.186.35:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgS5zrNWNO4YIFBf991sJaKf%2Bg%3D%3D
unknown
der
503 b
shared
3652
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?54250d5b91e94eca
US
compressed
59.9 Kb
whitelisted
3652
iexplore.exe
GET
200
23.45.105.185:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2472
lite_installer.exe
5.45.205.221:80
cache-man01i.cdn.yandex.net
YANDEX LLC
RU
whitelisted
3652
iexplore.exe
185.47.40.36:443
filebin.net
Redpill Linpro AS
NO
malicious
3652
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3652
iexplore.exe
2.16.186.35:80
r3.o.lencr.org
Akamai International B.V.
—
whitelisted
3600
iexplore.exe
185.47.40.36:443
filebin.net
Redpill Linpro AS
NO
malicious
3652
iexplore.exe
23.45.105.185:80
x1.c.lencr.org
Akamai International B.V.
NL
unknown
3600
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3600
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3600
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3020
KLauncher-Installer-v4.0.exe
141.94.96.109:80
api.klaun.ch
—
GB
suspicious

DNS requests

Domain
IP
Reputation
filebin.net
  • 185.47.40.36
suspicious
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
r3.o.lencr.org
  • 2.16.186.35
  • 2.16.186.11
  • 2.16.186.10
  • 2.16.186.9
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
situla.bitbit.net
  • 87.238.33.8
  • 87.238.33.7
unknown
crl3.digicert.com
  • 93.184.220.29
whitelisted
api.klaun.ch
  • 141.94.96.109
suspicious

Threats

PID
Process
Class
Message
3020
KLauncher-Installer-v4.0.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3020
KLauncher-Installer-v4.0.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3016
yadl.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
916
yadl.exe
Attempted Information Leak
ET POLICY curl User-Agent Outbound
2472
lite_installer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2472
lite_installer.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2 ETPRO signatures available at the full report
Process
Message
YandexPackSetup.exe
IsAlreadyRun() In
YandexPackSetup.exe
IsAlreadyRun() Out : ret (BOOL) = 0
YandexPackSetup.exe
IsMSISrvFree() In
YandexPackSetup.exe
IsMSISrvFree() : OpenMutex() err ret = 2
YandexPackSetup.exe
IsMSISrvFree() Out ret = 1
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = USER-PC, dwSessionId = 1
YandexPackSetup.exe
GetSidFromEnumSess(): LsaGetLogonSessionData(0) err = 5
YandexPackSetup.exe
GetSidFromEnumSess(): ProfileImagePath(1) = C:\Users\admin
YandexPackSetup.exe
GetSidFromEnumSess(): LsaEnumerateLogonSessions() lpszSid = S-1-5-21-1302019708-1500728564-335382590-1000
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = USER-PC, dwSessionId = 1
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://filebin.net/pkmzgmlzfydx559r