File name:

install.exe

Full analysis: https://app.any.run/tasks/32796976-6e11-4ffe-a86b-b78079c6b834
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 22, 2025, 14:29:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

6971695B5893E9952C35F0653BB192C3

SHA1:

42F496F742BA2DADB49151CE9539D4F2EA99AA28

SHA256:

D15035A9341BEA4A659674B6E79B038B38F0CD1B01C537E82BE57B1035C5E5F0

SSDEEP:

6144:BTM6qtgn0I+4i5tucngwZXp+V44zPOfBOLzh:BdTcscgwQ44zWZwh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • seederexe.exe (PID: 6848)

    • Actions looks like stealing of personal data

      • seederexe.exe (PID: 6848)
      • lite_installer.exe (PID: 6696)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • install.exe (PID: 372)
      • lite_installer.exe (PID: 6696)
      • Yandex.exe (PID: 4500)
      • ybB307.tmp (PID: 7024)

    • Checks Windows Trust Settings

      • install.exe (PID: 372)
      • msiexec.exe (PID: 6420)
      • lite_installer.exe (PID: 6696)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)

    • Reads security settings of Internet Explorer

      • install.exe (PID: 372)
      • lite_installer.exe (PID: 6696)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)

    • Starts a Microsoft application from unusual location

      • YandexPackSetup.exe (PID: 6360)

    • Application launched itself

      • install.exe (PID: 372)
      • setup.exe (PID: 6356)

    • Reads Mozilla Firefox installation path

      • seederexe.exe (PID: 6848)

    • Potential Corporate Privacy Violation

      • install.exe (PID: 372)
      • lite_installer.exe (PID: 6696)

    • Changes the title of the Internet Explorer window

      • seederexe.exe (PID: 6848)

    • Changes the Home page of Internet Explorer

      • seederexe.exe (PID: 6848)

    • Starts application with an unusual extension

      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)

    • Starts itself from another location

      • Yandex.exe (PID: 4500)

  • INFO

    • The sample compiled with russian language support

      • install.exe (PID: 372)
      • msiexec.exe (PID: 6572)

    • Reads the computer name

      • install.exe (PID: 372)
      • msiexec.exe (PID: 6572)
      • YandexPackSetup.exe (PID: 6360)
      • msiexec.exe (PID: 6420)
      • lite_installer.exe (PID: 6696)
      • install.exe (PID: 6368)
      • seederexe.exe (PID: 6848)
      • Yandex.exe (PID: 4500)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)
      • sender.exe (PID: 3208)
      • explorer.exe (PID: 3680)
      • setup.exe (PID: 6356)

    • Create files in a temporary directory

      • install.exe (PID: 372)
      • YandexPackSetup.exe (PID: 6360)
      • lite_installer.exe (PID: 6696)
      • seederexe.exe (PID: 6848)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)

    • Checks proxy server information

      • install.exe (PID: 372)
      • lite_installer.exe (PID: 6696)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)

    • Reads the machine GUID from the registry

      • install.exe (PID: 372)
      • msiexec.exe (PID: 6420)
      • lite_installer.exe (PID: 6696)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)
      • seederexe.exe (PID: 6848)

    • Creates files or folders in the user directory

      • install.exe (PID: 372)
      • seederexe.exe (PID: 6848)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)
      • Yandex.exe (PID: 4500)

    • Process checks computer location settings

      • install.exe (PID: 372)
      • msiexec.exe (PID: 6572)
      • Yandex.exe (PID: 4500)
      • explorer.exe (PID: 3680)

    • Checks supported languages

      • install.exe (PID: 372)
      • msiexec.exe (PID: 6572)
      • lite_installer.exe (PID: 6696)
      • install.exe (PID: 6368)
      • YandexPackSetup.exe (PID: 6360)
      • msiexec.exe (PID: 6420)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)
      • seederexe.exe (PID: 6848)
      • Yandex.exe (PID: 4500)
      • explorer.exe (PID: 3680)
      • sender.exe (PID: 3208)
      • setup.exe (PID: 6356)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6420)
      • msiexec.exe (PID: 6572)

    • Reads the software policy settings

      • install.exe (PID: 372)
      • lite_installer.exe (PID: 6696)
      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)

    • Manual execution by a user

      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)

    • Yandex updater related mutex has been found

      • {D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe (PID: 7060)

    • Local mutex for internet shortcut management

      • Yandex.exe (PID: 4500)

    • The sample compiled with english language support

      • ybB307.tmp (PID: 7024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:19 13:34:48+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 143360
InitializedDataSize: 84992
UninitializedDataSize: -
EntryPoint: 0x74a6
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.1.0.33
ProductVersionNumber: 0.1.0.33
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Unicode
FileDescription: Setup Downloader
FileVersion: 0.1.0.33
InternalName: download
LegalCopyright: Copyright (C) 2015 Yandex LLC
OriginalFileName: downloader.exe
ProductName: Setup Downloader
ProductVersion: 0.1.0.33
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
14
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start install.exe yandexpacksetup.exe install.exe msiexec.exe msiexec.exe lite_installer.exe seederexe.exe {d906cf49-2af9-4ae3-99de-2466d0d26d84}.exe yandex.exe explorer.exe no specs sender.exe ybb307.tmp setup.exe setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372"C:\Users\admin\AppData\Local\Temp\install.exe" C:\Users\admin\AppData\Local\Temp\install.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.33
Modules
Images
c:\users\admin\appdata\local\temp\install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3208C:\Users\admin\AppData\Local\Temp\AC95D2F2-88E5-4D23-B364-A353C3199411\sender.exe --send "/status.xml?clid=9183476-678&uuid=7b384021-1ca9-40d9-b38a-ccb5ce7a0ddb&vnt=Windows 10x64&file-no=8%0A10%0A12%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A45%0A58%0A59%0A89%0A102%0A103%0A111%0A123%0A124%0A125%0A129%0A"C:\Users\admin\AppData\Local\Temp\AC95D2F2-88E5-4D23-B364-A353C3199411\sender.exe
seederexe.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
Yandex Statistics
Exit code:
0
Version:
0.0.2.14
Modules
Images
c:\users\admin\appdata\local\temp\ac95d2f2-88e5-4d23-b364-a353c3199411\sender.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3680C:\Users\admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /pin-path="C:\Users\admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinningC:\Users\admin\AppData\Local\Temp\pin\explorer.exe—Yandex.exe
User:
admin
Integrity Level:
MEDIUM
Description:
YandexPin
Exit code:
0
Version:
3.7.9.0
Modules
Images
c:\users\admin\appdata\local\temp\pin\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
4500C:\Users\admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=nC:\Users\admin\AppData\Local\Yandex\YaPin\Yandex.exe
seederexe.exe
User:
admin
Integrity Level:
MEDIUM
Description:
YandexPin
Exit code:
0
Version:
3.7.9.0
Modules
Images
c:\users\admin\appdata\local\yandex\yapin\yandex.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
6356"C:\Users\admin\AppData\Local\Temp\YB_804E1.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\YB_804E1.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\admin\AppData\Local\Temp\e6fdc3aa-663a-4509-b2dc-ec51a2f07482.tmp" --brand-name=yandex --brand-package="C:\Users\admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=1290891612 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{1E9B5500-404A-4A99-A0C7-267BF7A69816} --local-path="C:\Users\admin\AppData\Local\Temp\{D906CF49-2AF9-4AE3-99DE-2466D0D26D84}.exe" --partner-package="C:\Users\admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=9183405-678&ui={7b384021-1ca9-40d9-b38a-ccb5ce7a0ddb} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\admin\AppData\Local\Temp\fa5d7bdb-dfa8-4b68-9f52-3ba2fee27b24.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\admin\AppData\Local\Temp\website.ico"C:\Users\admin\AppData\Local\Temp\YB_804E1.tmp\setup.exe
ybB307.tmp
User:
admin
Company:
YANDEX LLC
Integrity Level:
MEDIUM
Description:
Yandex
Version:
24.12.3.780
Modules
Images
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
c:\windows\syswow64\rpcrt4.dll
c:\windows\syswow64\bcrypt.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\gdi32full.dll
c:\windows\syswow64\msvcp_win.dll
6360"C:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=678 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "C:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Software Installer
Exit code:
0
Version:
3.0.5419.0
Modules
Images
c:\users\admin\appdata\local\temp\7f4987fb1a6e43d69e3e94b29eb75926\yandexpacksetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6368C:\Users\admin\AppData\Local\Temp\install.exe --stat dwnldr/p=635487/cnt=0/dt=5/ct=0/rt=0 --dh 2404 --st 1737556211C:\Users\admin\AppData\Local\Temp\install.exe
install.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.33
Modules
Images
c:\users\admin\appdata\local\temp\install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6420C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6572C:\Windows\syswow64\MsiExec.exe -Embedding F989E2F57BE8D03ADB6B9EB388F0B9CCC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6696"C:\Users\admin\AppData\Local\Temp\B09B1B2C-4DE8-49FE-988C-2DFBD0622359\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSERC:\Users\admin\AppData\Local\Temp\B09B1B2C-4DE8-49FE-988C-2DFBD0622359\lite_installer.exe
msiexec.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
YandexBrowserDownloader
Exit code:
0
Version:
1.0.1.9
Modules
Images
c:\users\admin\appdata\local\temp\b09b1b2c-4de8-49fe-988c-2dfbd0622359\lite_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
18 570
Read events
18 436
Write events
113
Delete events
21

Modification events

(PID) Process:(372) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(372) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(372) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6420) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
14190000FCCB0126DA6CDB01
(PID) Process:(6420) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
F3917DF3442F46BFEC24F8CC75F1E82FAE4551D0C804B43EC3483484CF18AA56
(PID) Process:(6420) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6420) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(6420) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\1395ae.rbs
Value:
31157466
(PID) Process:(6420) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\1395ae.rbsLow
Value:
667308064
(PID) Process:(6420) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
Executable files
22
Suspicious files
98
Text files
92
Unknown types
3

Dropped files

PID
Process
Filename
Type
6360YandexPackSetup.exeC:\Users\admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi —
MD5:—
SHA256:—
6420msiexec.exeC:\Windows\Installer\1395ac.msi —
MD5:—
SHA256:—
6420msiexec.exeC:\Windows\Installer\MSI9BD9.tmpexecutable
MD5:0C80A997D37D930E7317D6DAC8BB7AE1
SHA256:A5DD2F97C6787C335B7807FF9B6966877E9DD811F9E26326837A7D2BD224DE86
372install.exeC:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exeexecutable
MD5:DE5CC8B280F3A924E2C3F269FE7618A0
SHA256:167398F1384B8322E60810EAA3CF147E2884580063CB12E19DAB484F63A4BBD6
6572msiexec.exeC:\Users\admin\AppData\Local\Temp\clids-yasearch.xmlxml
MD5:56F2D021C5BF8F4D4F828F7B7ADDA0F7
SHA256:469A2B59DCC1B8CE8F9298FDEF3A6FD79EAF85557CE4C1F25BAA3E32CF99B792
372install.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7binary
MD5:FCAD212CF08CD4E8A3BD93E1B55DD374
SHA256:A70BFE0953F66CDE550D088A09B5F4A4E2DE40FFA2B1A7396C90690F67E84994
6420msiexec.exeC:\Windows\Installer\MSI9B5B.tmpexecutable
MD5:E6FD0E66CF3BFD3CC04A05647C3C7C54
SHA256:669CC0AAE068CED3154ACAECB0C692C4C5E61BC2CA95B40395A3399E75FCB9B2
6420msiexec.exeC:\Windows\Installer\MSI9AEC.tmpexecutable
MD5:E6FD0E66CF3BFD3CC04A05647C3C7C54
SHA256:669CC0AAE068CED3154ACAECB0C692C4C5E61BC2CA95B40395A3399E75FCB9B2
6572msiexec.exeC:\Users\admin\AppData\Local\Temp\vendor00000.xmlxml
MD5:C528466BA6D4F66966AA31021AA339DC
SHA256:546E928B7127A4515B089F0B913078404B664A5DF33C928A281888C25B03760F
372install.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:27C71A3295D673345F3B8257D802F2A9
SHA256:03986BABEE893169A7C611E98EF045E24128CF6C7E0D87936BE87EFF4A0E8A55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
48
DNS requests
25
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
372
install.exe
GET
—
5.45.192.4:80
http://cachev2-rad-01.cdn.yandex.net/downloader.yandex.net/yandex-pack/635487/YandexPackSetup.exe?lid=309
unknown
—
—
whitelisted
372
install.exe
GET
302
5.45.205.243:80
http://downloader.yandex.net/yandex-pack/635487/YandexPackSetup.exe
unknown
—
—
whitelisted
372
install.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
372
install.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDG8SbJzCh95FjOiQ9g%3D%3D
unknown
—
—
whitelisted
6696
lite_installer.exe
GET
302
5.45.205.243:80
http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=9183405-678&ui={7b384021-1ca9-40d9-b38a-ccb5ce7a0ddb}
unknown
—
—
whitelisted
6696
lite_installer.exe
GET
200
77.88.21.14:80
http://clck.yandex.ru/click/dtype=stred/pid=198/cid=73002/path=0.winapi_download/ui=%7B7b384021-1ca9-40d9-b38a-ccb5ce7a0ddb%7D/clid1=9183405-678/dt=0/ds=0/bits=7_8_19041_3636/bver=0_0_0_0/prod_version=1_0_1_9/result=ok/*
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6368
install.exe
GET
200
77.88.21.14:80
http://clck.yandex.ru/click/dtype=stred/pid=12/cid=72435/path=dwnldr/p=635487/cnt=0/dt=5/ct=0/rt=6/imp=0/*
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6696
lite_installer.exe
GET
200
77.88.21.14:80
http://clck.yandex.ru/click/dtype=stred/pid=198/cid=73002/path=1.run_dist/ui=%7B7b384021-1ca9-40d9-b38a-ccb5ce7a0ddb%7D/clid1=9183405-678/dt=32272015/ds=9290672/bits=7_8_19041_3636/bver=24_12_3_780/prod_version=1_0_1_9/result=ok/*
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
372
install.exe
5.45.205.243:80
downloader.yandex.net
YANDEX LLC
RU
whitelisted
372
install.exe
5.45.192.4:80
cachev2-rad-01.cdn.yandex.net
YANDEX LLC
RU
whitelisted
372
install.exe
151.101.130.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
5064
SearchApp.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1076
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3160
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6696
lite_installer.exe
77.88.21.14:80
clck.yandex.ru
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
downloader.yandex.net
  • 5.45.205.243
  • 5.45.205.241
  • 5.45.205.244
  • 5.45.205.245
  • 5.45.205.242
whitelisted
cachev2-rad-01.cdn.yandex.net
  • 5.45.192.4
whitelisted
ocsp.globalsign.com
  • 151.101.130.133
  • 151.101.194.133
  • 151.101.66.133
  • 151.101.2.133
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.185
  • 104.126.37.178
  • 104.126.37.131
  • 104.126.37.144
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.146
  • 104.126.37.179
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.74
  • 20.190.160.17
  • 40.126.32.68
  • 40.126.32.76
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
clck.yandex.ru
  • 77.88.21.14
  • 87.250.250.14
  • 93.158.134.14
  • 213.180.204.14
  • 213.180.193.14
  • 87.250.251.14
whitelisted
cachev2-fra-02.cdn.yandex.net
  • 5.45.200.105
whitelisted
api.browser.yandex.ru
  • 213.180.193.234
whitelisted

Threats

PID
Process
Class
Message
372
install.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
372
install.exe
Misc activity
ET INFO Packed Executable Download
6696
lite_installer.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
6696
lite_installer.exe
Misc activity
ET INFO EXE - Served Attached HTTP
Process
Message
YandexPackSetup.exe
IsAlreadyRun() In
YandexPackSetup.exe
IsAlreadyRun() Out : ret (BOOL) = 0
YandexPackSetup.exe
IsMSISrvFree() In
YandexPackSetup.exe
IsMSISrvFree() : OpenMutex() err ret = 2
YandexPackSetup.exe
IsMSISrvFree() Out ret = 1
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 1
YandexPackSetup.exe
GetSidFromEnumSess(): LsaGetLogonSessionData(0) err = 5
YandexPackSetup.exe
GetSidFromEnumSess(): ProfileImagePath(1) = C:\Users\admin
YandexPackSetup.exe
GetSidFromEnumSess(): LsaEnumerateLogonSessions() lpszSid = S-1-5-21-1693682860-607145093-2874071422-1001
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 1
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
install.exe