File name:

install.exe

Full analysis: https://app.any.run/tasks/054a6222-8086-47ec-bcbd-cef80e53d4d9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 28, 2024, 19:10:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B8031544DCC4E49442193362AE925A61

SHA1:

3390901A82CF8F533F80F6446AE63BE5C4219AB1

SHA256:

EFEA468D6F2D76009D14D42123D126CA2ACE1F2ADCD0C9DDB782B1E664FF0888

SSDEEP:

6144:BTM6qtgn0I+4i5tucngwZXp+V44zPOfBOLzh:BdTcscgwQ44zWZwh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • install.exe (PID: 4644)

    • Checks Windows Trust Settings

      • install.exe (PID: 4644)

    • Application launched itself

      • install.exe (PID: 4644)
      • setup.exe (PID: 2224)

    • Starts a Microsoft application from unusual location

      • YandexPackSetup.exe (PID: 5992)

    • Executable content was dropped or overwritten

      • install.exe (PID: 4644)
      • lite_installer.exe (PID: 4576)
      • Yandex.exe (PID: 5700)
      • yb7AAB.tmp (PID: 2964)

    • Potential Corporate Privacy Violation

      • install.exe (PID: 4644)
      • lite_installer.exe (PID: 4576)

    • Process drops legitimate windows executable

      • install.exe (PID: 4644)

    • Starts itself from another location

      • Yandex.exe (PID: 5700)

    • Starts application with an unusual extension

      • {A7B8FDF5-E5A3-42C9-8628-3A7225315D74}.exe (PID: 6216)

    • Process requests binary or script from the Internet

      • lite_installer.exe (PID: 4576)

  • INFO

    • Checks supported languages

      • install.exe (PID: 4644)

    • Reads the computer name

      • install.exe (PID: 4644)

    • Create files in a temporary directory

      • install.exe (PID: 4644)

    • Creates files or folders in the user directory

      • install.exe (PID: 4644)

    • Reads the machine GUID from the registry

      • install.exe (PID: 4644)

    • Checks proxy server information

      • install.exe (PID: 4644)

    • Reads the software policy settings

      • install.exe (PID: 4644)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6544)
      • msiexec.exe (PID: 1448)

    • Manual execution by a user

      • {A7B8FDF5-E5A3-42C9-8628-3A7225315D74}.exe (PID: 6216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:19 13:34:48+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 143360
InitializedDataSize: 84992
UninitializedDataSize: -
EntryPoint: 0x74a6
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.1.0.33
ProductVersionNumber: 0.1.0.33
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Unicode
FileDescription: Setup Downloader
FileVersion: 0.1.0.33
InternalName: download
LegalCopyright: Copyright (C) 2015 Yandex LLC
OriginalFileName: downloader.exe
ProductName: Setup Downloader
ProductVersion: 0.1.0.33
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
16
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start install.exe yandexpacksetup.exe install.exe msiexec.exe msiexec.exe lite_installer.exe seederexe.exe {a7b8fdf5-e5a3-42c9-8628-3a7225315d74}.exe yandex.exe explorer.exe no specs sender.exe sppextcomobj.exe no specs slui.exe no specs yb7aab.tmp setup.exe setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1448C:\Windows\syswow64\MsiExec.exe -Embedding F34E35718C2FF131FD8ACF9B2702728AC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2224"C:\Users\admin\AppData\Local\Temp\YB_AD154.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\YB_AD154.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\admin\AppData\Local\Temp\8534ab4b-99d8-4dff-8848-0ea938964eb8.tmp" --brand-name=yandex --brand-package="C:\Users\admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=4160155192 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{20A7F14E-F36F-45E8-BE1F-7384004ACF8B} --local-path="C:\Users\admin\AppData\Local\Temp\{A7B8FDF5-E5A3-42C9-8628-3A7225315D74}.exe" --partner-package="C:\Users\admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=9183405-263&ui=f53c1951-93C4-4DCA-A1B0-3790E2460fc1 --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\admin\AppData\Local\Temp\f1359324-acef-43ae-8dd3-aa77c0f85a78.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\admin\AppData\Local\Temp\website.ico"C:\Users\admin\AppData\Local\Temp\YB_AD154.tmp\setup.exe
yb7AAB.tmp
User:
admin
Company:
YANDEX LLC
Integrity Level:
MEDIUM
Description:
Yandex
Version:
24.7.3.1251
Modules
Images
c:\users\admin\appdata\local\temp\yb_ad154.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2964C:\Users\admin\AppData\Local\Temp\C63F8E2D-C020-427F-A43F-935CCB41C633\sender.exe --send "/status.xml?clid=9183476-263&uuid=f53c1951-93C4-4DCA-A1B0-3790E2460fc1&vnt=Windows 10x64&file-no=8%0A10%0A12%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A45%0A58%0A59%0A89%0A103%0A111%0A123%0A124%0A125%0A129%0A"C:\Users\admin\AppData\Local\Temp\C63F8E2D-C020-427F-A43F-935CCB41C633\sender.exe
seederexe.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
Yandex Statistics
Exit code:
0
Version:
0.0.2.14
Modules
Images
c:\users\admin\appdata\local\temp\c63f8e2d-c020-427f-a43f-935ccb41c633\sender.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2964"C:\Users\admin\AppData\Local\Temp\yb7AAB.tmp" --abt-config-resource-file="C:\Users\admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\admin\AppData\Local\Temp\8534ab4b-99d8-4dff-8848-0ea938964eb8.tmp" --brand-name=yandex --brand-package="C:\Users\admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=4160155192 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{20A7F14E-F36F-45E8-BE1F-7384004ACF8B} --local-path="C:\Users\admin\AppData\Local\Temp\{A7B8FDF5-E5A3-42C9-8628-3A7225315D74}.exe" --partner-package="C:\Users\admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=9183405-263&ui=f53c1951-93C4-4DCA-A1B0-3790E2460fc1 --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\admin\AppData\Local\Temp\f1359324-acef-43ae-8dd3-aa77c0f85a78.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\admin\AppData\Local\Temp\website.ico"C:\Users\admin\AppData\Local\Temp\yb7AAB.tmp
{A7B8FDF5-E5A3-42C9-8628-3A7225315D74}.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
MEDIUM
Description:
Yandex Installer
Version:
24.7.3.1251
Modules
Images
c:\users\admin\appdata\local\temp\yb7aab.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3580"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3920C:\Users\admin\AppData\Local\Temp\YB_AD154.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=97b7721c4994e2556ff6a439510f665d --annotation=main_process_pid=2224 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.7.3.1251 --initial-client-data=0x320,0x340,0x364,0x31c,0x368,0x8eed28,0x8eed34,0x8eed40C:\Users\admin\AppData\Local\Temp\YB_AD154.tmp\setup.exe—setup.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
MEDIUM
Description:
Yandex
Version:
24.7.3.1251
Modules
Images
c:\users\admin\appdata\local\temp\yb_ad154.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4016C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4216C:\Users\admin\AppData\Local\Temp\install.exe --stat dwnldr/p=635487/cnt=0/dt=3/ct=1/rt=0 --dh 2304 --st 1727550617C:\Users\admin\AppData\Local\Temp\install.exe
install.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.33
Modules
Images
c:\users\admin\appdata\local\temp\install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4576"C:\Users\admin\AppData\Local\Temp\E0DFB7A0-F55E-4A8E-A495-6A522D9596BE\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSERC:\Users\admin\AppData\Local\Temp\E0DFB7A0-F55E-4A8E-A495-6A522D9596BE\lite_installer.exe
msiexec.exe
User:
admin
Company:
Yandex
Integrity Level:
MEDIUM
Description:
YandexBrowserDownloader
Exit code:
0
Version:
1.0.1.9
Modules
Images
c:\users\admin\appdata\local\temp\e0dfb7a0-f55e-4a8e-a495-6a522d9596be\lite_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4644"C:\Users\admin\AppData\Local\Temp\install.exe" C:\Users\admin\AppData\Local\Temp\install.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.33
Modules
Images
c:\users\admin\appdata\local\temp\install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
19 400
Read events
19 265
Write events
114
Delete events
21

Modification events

(PID) Process:(4644) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4644) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4644) install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6544) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
9019000032A66E0EDA11DB01
(PID) Process:(6544) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
D2130F047D7902BA2322A105FFE1D559C6B63D70AA3CD5F55655056FA797C0BB
(PID) Process:(6544) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(4576) lite_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\AppDataLow\Yandex
Operation:writeName:UICreated_admin
Value:
1
(PID) Process:(4576) lite_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4576) lite_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4576) lite_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
22
Suspicious files
97
Text files
94
Unknown types
1

Dropped files

PID
Process
Filename
Type
5992YandexPackSetup.exeC:\Users\admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi —
MD5:—
SHA256:—
6544msiexec.exeC:\Windows\Installer\3f656e.msi —
MD5:—
SHA256:—
4644install.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7der
MD5:76AE6DCFB7DCB82BB37BE9939063DF46
SHA256:03EFE888FAAB22C86A27C22AA378A56580C104AA1F96E36BC2F6330AC454DCDB
4644install.exeC:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exeexecutable
MD5:DE5CC8B280F3A924E2C3F269FE7618A0
SHA256:167398F1384B8322E60810EAA3CF147E2884580063CB12E19DAB484F63A4BBD6
6544msiexec.exeC:\Windows\Installer\MSI682D.tmpexecutable
MD5:0C80A997D37D930E7317D6DAC8BB7AE1
SHA256:A5DD2F97C6787C335B7807FF9B6966877E9DD811F9E26326837A7D2BD224DE86
4644install.exeC:\Users\admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\seed.txttext
MD5:AB102F349D018649E5E5A7DB577F059A
SHA256:CC85C37CC89CA6E99038E1F8BC4201AB2CB7573D16D73E5D3DBC97789D16B856
1448msiexec.exeC:\Users\admin\AppData\Roaming\Yandex\clids-yabrowser.xmlxml
MD5:753C5B3FF2A0D7E11829B57718A32B97
SHA256:DED928E39837AD366DDB2F3C21591EED9DE978BB18821B8CCEDBE04F29B1B9AB
1448msiexec.exeC:\Users\admin\AppData\Local\Temp\vendor00000.xmlxml
MD5:C528466BA6D4F66966AA31021AA339DC
SHA256:546E928B7127A4515B089F0B913078404B664A5DF33C928A281888C25B03760F
6544msiexec.exeC:\Windows\Installer\MSI6919.tmpexecutable
MD5:E6FD0E66CF3BFD3CC04A05647C3C7C54
SHA256:669CC0AAE068CED3154ACAECB0C692C4C5E61BC2CA95B40395A3399E75FCB9B2
6544msiexec.exeC:\Windows\Installer\MSI68DA.tmpexecutable
MD5:E6FD0E66CF3BFD3CC04A05647C3C7C54
SHA256:669CC0AAE068CED3154ACAECB0C692C4C5E61BC2CA95B40395A3399E75FCB9B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
82
DNS requests
29
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6216
{A7B8FDF5-E5A3-42C9-8628-3A7225315D74}.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDA3dnOhPx5IoBNEilQ%3D%3D
unknown
—
—
whitelisted
4644
install.exe
GET
302
5.45.205.241:80
http://downloader.yandex.net/yandex-pack/635487/YandexPackSetup.exe
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4644
install.exe
GET
200
5.45.200.105:80
http://cachev2-fra-02.cdn.yandex.net/downloader.yandex.net/yandex-pack/635487/YandexPackSetup.exe?lid=299
unknown
—
—
whitelisted
4644
install.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
4644
install.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDG8SbJzCh95FjOiQ9g%3D%3D
unknown
—
—
whitelisted
4576
lite_installer.exe
GET
302
5.45.205.241:80
http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=9183405-263&ui=f53c1951-93C4-4DCA-A1B0-3790E2460fc1
unknown
—
—
whitelisted
4576
lite_installer.exe
GET
200
87.250.250.14:80
http://clck.yandex.ru/click/dtype=stred/pid=198/cid=73002/path=0.winapi_download/ui=f53c1951-93C4-4DCA-A1B0-3790E2460fc1/clid1=9183405-263/dt=0/ds=0/bits=7_8_19041_3636/bver=0_0_0_0/prod_version=1_0_1_9/result=ok/*
unknown
—
—
whitelisted
4216
install.exe
GET
—
87.250.250.14:80
http://clck.yandex.ru/click/dtype=stred/pid=12/cid=72435/path=dwnldr/p=635487/cnt=0/dt=3/ct=1/rt=5/imp=0/*
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3592
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4644
install.exe
5.45.205.241:80
downloader.yandex.net
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 172.217.16.206
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.76
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
downloader.yandex.net
  • 5.45.205.241
  • 5.45.205.245
  • 5.45.205.243
  • 5.45.205.242
  • 5.45.205.244
whitelisted
cachev2-fra-02.cdn.yandex.net
  • 5.45.200.105
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted

Threats

PID
Process
Class
Message
4644
install.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4576
lite_installer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4576
lite_installer.exe
Misc activity
ET INFO EXE - Served Attached HTTP
Process
Message
YandexPackSetup.exe
IsAlreadyRun() In
YandexPackSetup.exe
IsAlreadyRun() Out : ret (BOOL) = 0
YandexPackSetup.exe
IsMSISrvFree() In
YandexPackSetup.exe
IsMSISrvFree() : OpenMutex() err ret = 2
YandexPackSetup.exe
IsMSISrvFree() Out ret = 1
YandexPackSetup.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 1
YandexPackSetup.exe
GetSidFromEnumSess(): LsaGetLogonSessionData(0) err = 5
YandexPackSetup.exe
GetSidFromEnumSess(): i = 1 : szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 0
YandexPackSetup.exe
GetSidFromEnumSess(): i = 2 : szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 0
YandexPackSetup.exe
GetSidFromEnumSess(): LsaGetLogonSessionData(3) err = 5
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
install.exe