23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T422,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 43ba23cf5e24… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 43ba23cf5e24…. Threat score 100/100. 2/29 AV engines flagged this file. 9 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8"],"about":{"@type":"SoftwareApplication","name":"Yandex.exe","applicationCategory":["peexe","executable"],"identifier":"43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":2,"total":29},"behavioralIndicators":{"malicious":9,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T61f,SetUnhandledExceptionFilter@KERNEL32.dll at 43179-1195-0042FC13 SetUnhandledExceptionFilter@KERNEL32.DLL at 00015063-00002636-50403-20-0113FCB6 SetUnhandledExceptionFilter@KERNEL32.DLL at 00015063-00002636-50403-75-01146C34 SetUnhandledExceptionFilter@KERNEL32.DLL at 00015063-00002636-50403-1212-0113FC13 SetUnhandledExceptionFilter@KERNEL32.DLL at 00015063-00002636-50403-1096-0113FAC4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00015310-00003368-64636-8-00D1FC69 SetUnhandledExceptionFilter@KERNEL32.DLL at 00015310-00003368-64636-74-00D26C34 SetUnhandledExceptionFilter@KERNEL32.DLL at 00015310-00003368-64636-1225-00D1FC13 SetUnhandledExceptionFilter@KERNEL32.DLL at 00015310-00003368-64636-1109-00D1FAC4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00018456-00001208-20285-20-00D1FCB6 SetUnhandledExceptionFilter@KERNEL32.DLL at 00018456-00001208-20285-75-00D26C34 SetUnhandledExceptionFilter@KERNEL32.DLL at 00018456-00001208-20285-1096-00D1FAC4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00018456-00001208-20285-1212-00D1FC13 SetUnhandledExceptionFilter@KERNEL32.DLL at 00019402-00002680-32526-107-0138DA0B SetUnhandledExceptionFilter@KERNEL32.DLL at 00019402-00002680-32526-129-01386808 SetUnhandledExceptionFilter@KERNEL32.DLL at 00019402-00002680-32526-374-013862B5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00019402-00002680-32526-1033-0138699B SetUnhandledExceptionFilter@KERNEL32.dll at 39021-925-1000EE8B SetUnhandledExceptionFilter@KERNEL32.dll at 37868-488-0040161A SetUnhandledExceptionFilter@KERNEL32.dll at 37868-421-00401D6125:T65a,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")26:T64e,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7D7F4414CCEF168ADF6BF40753B5BECD78375931"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB")27:T6db,"GET /browser/newcmp_clang/browser-setup.arc HTTP/1.1Accept: */*User-Agent: Yandex.Browser lite installerHost: download.cdn.yandex.netCache-Control: no-cache" "GET /download.cdn.yandex.net/browser/newcmp_clang/browser-setup.arc HTTP/1.1Accept: */*User-Agent: Yandex.Browser lite installerHost: cache-ams01.cdn.yandex.netCache-Control: no-cacheConnection: Keep-Alive" "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w%2FsCEQCTkoVAAWVxX5R%2FKI%2FvyZso HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: subca.ocsp-certum.com" "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: subca.ocsp-certum.com" "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CED7RsBDrSNCY%2F9y36lXia8Q%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: yandex.ocsp-responder.com" "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEDW%2B4oHUybRMPxusv%2FiNIYI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: yandex.ocsp-responder.com" "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEGdor8MNwaMcK9ynWHzW2Mc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: yandex.ocsp-responder.com" "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEAznbZRyGgcQAP7QS0XLajM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: yandex.ocsp-responder.com"28:T601,"dllyupdate.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "yupdate-exec.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "widevinecdm.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "browser_watcher.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "nacl64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "winrt_helper.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "7z.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "clidmgr.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "ph.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "d3dcompiler_47.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libglesv2.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "service_update.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "eventlog_provider.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libegl.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "fbpinlauncher.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "show-dlg.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "natives_blob.bin" has type "data" "widevinecdmadapter.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"29:T645,"" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "" touched file "C:\Windows\System32\en-US\user32.dll.mui" "" touched file "C:\Users\WTGJ3U0\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" touched file "C:\Windows\Fonts\StaticCache.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\msxml3r.dll" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\browser-setup[1].arc" "" touched file "C:\Windows\System32\en-US\crypt32.dll.mui"2a:T1d00,Pattern match: "https://download.cdn.yandex.net/browser/" Pattern match: "https://download.cdn.yandex.net/browser-partners/_xp_builds/browser-setup.arc" Pattern match: "https://download.cdn.yandex.net/browser/installer/" Pattern match: "https://browser.yandex" Pattern match: "https://yandex" Pattern match: "https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=" Pattern match: "https://legal.yandex.ru/browser_agreement/" Pattern match: "https://legal.yandex.ru/confidential/" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://ocsp.globalsign.com/rootr103" Pattern match: "http://crl.globalsign.com/root.crl0Y" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "secure.globalsign.com/cacert/gscodesigng3ocsp.crt04" Pattern match: "http://ocsp2.globalsign.com/gscodesigng30V" Pattern match: "http://crl.globalsign.com/gs/gscodesigng3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0" Pattern match: "crl.globalsign.com/gs/gstimestampingg2.crl0T" Pattern match: "secure.globalsign.com/cacert/gstimestampingg2.crt0" Pattern match: "https://yandex.ru0" Pattern match: "http://ocsp2.globalsign.com/rootr306" Pattern match: "http://crl.globalsign.com/root-r3.crl0c" Pattern match: "http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08" Pattern match: "http://ocsp2.globalsign.com/gscodesignsha2g30V" Pattern match: "http://crl.globalsign.com/gscodesignsha2g3.crl0" Pattern match: "https://www.globalsign.com/repository/06" Pattern match: "http://crl.globalsign.net/root-r3.crl0" Pattern match: "crl.globalsign.com/gs/gstimestampingsha2g2.crl0" Pattern match: "http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0" Pattern match: "ocsp2.globalsign.com/gstimestampingsha2g20" Pattern match: "https://yandex.ru0/" Pattern match: "https://storage.ape.yandex.net/get/browser/install" Pattern match: "https://clck.yandex.ru/redir/dtype=stred/pid=457/cid=72696/path=yabrowser_reinstall_dialog&dialog_window=liteinstall&" Heuristic match: "com.tr" Pattern match: "http://cache-ams01.cdn.yandex.net/download.cdn.yandex.net/browser/newcmp_clang/browser-setup.arc" Pattern match: "download.cdn.yandex.net/browser/newcmp_clang/browser-setup.arc" Pattern match: "http://crls.yandex.net/certum/ycasha2.crl0-" Pattern match: "http://yandex.crl.certum.pl/ycasha2.crl0q" Pattern match: "http://yandex.ocsp-responder.com03" Pattern match: "http://repository.certum.pl/ycasha2.cer0" Pattern match: "https://www.certum.pl/repository.0" Heuristic match: "api.browser.yandex.ru" Heuristic match: "api.browser.yandex.com" Heuristic match: "api.browser.yandex.com.tr" Heuristic match: "api.browser.yandex.ua" Heuristic match: "api.browser.yandex.kz" Heuristic match: "api.browser.yandex.net" Pattern match: "http://crl.certum.pl/ctnca.crl0k" Pattern match: "http://subca.ocsp-certum.com01" Pattern match: "http://repository.certum.pl/ctnca.cer09" Pattern match: "http://www.certum.pl/CPS0" Pattern match: "http://crl.certum.pl/ca.crl0h" Pattern match: "http://subca.ocsp-certum.com0" Pattern match: "http://repository.certum.pl/ca.cer09" Heuristic match: "1(jZ\ine/.IE" Pattern match: "ndex.ru/redir/dtype=stred/pid=457/cid=72696/path=yabrowser_reinstall_dialog&dialog_window=liteinstall&" Pattern match: "i.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=" Heuristic match: "]8I>_x.MC" Heuristic match: "matrixnet.fs.info" Pattern match: "crl.globalsign.com/gs/gstimestampingg2" Heuristic match: "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w%2FsCEQCTkoVAAWVxX5R%2FKI%2FvyZso HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: subca.ocsp-certum.com" Heuristic match: "storage.ape.yandex.net" Heuristic match: "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: subca.ocsp-certum.com" Heuristic match: "clck.yandex.ru" Pattern match: "https://www.certum.pl/CPS0" Heuristic match: "lck.yandex.com.tr" Heuristic match: "clck.yandex.kz" Heuristic match: "clck.yandex.com" Heuristic match: "clck.yandex.by" Heuristic match: "download.cdn.yandex.net" Heuristic match: "cdn.yandex.net" Heuristic match: "sba.cdn.yandex.net" Heuristic match: "%internetometr.download.cdn.yandex.net" Heuristic match: "crls.yandex.ru" Heuristic match: "downloader.yandex.net" Heuristic match: "kp.cdn.yandex.net" Heuristic match: "download.yandex.ru" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CED7RsBDrSNCY%2F9y36lXia8Q%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: yandex.ocsp-responder.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEDW%2B4oHUybRMPxusv%2FiNIYI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: yandex.ocsp-responder.com" Heuristic match: "cache-ams04.cdn.yandex.net" Heuristic match: "*.cdn.yandex.net" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEGdor8MNwaMcK9ynWHzW2Mc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: yandex.ocsp-responder.com" Heuristic match: "cache-ams01.cdn.yandex.net" Heuristic match: "GET /rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkfDD%2F78IrsoD5b%2Bp1JR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.globalsign.com" Heuristic match: "cache-ams02.cdn.yandex.net" Heuristic match: "GET /gscodesigng3/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTHTu2Y6Nr%2FMkfa3PrlxnwonnIpxQQUs9Pm1XFWfTlYs3jSK7j3oR%2F9S5sCDGUxOJI7m%2BYpSWV%2FXQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp2.globalsign.com" Heuristic match: "cache-ams05.cdn.yandex.net" Heuristic match: "GET /root.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.globalsign.net" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEAznbZRyGgcQAP7QS0XLajM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: yandex.ocsp-responder.com" Heuristic match: "cache-ams06.cdn.yandex.net" Heuristic match: "GET /gs/gstimestampingg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.globalsign.com" Heuristic match: "subca.ocsp-certum.com" Heuristic match: "yandex.ocsp-responder.com" Pattern match: "http://download.cdn.yandex.net/browser/newcmp_clang/browser-setup" Pattern match: "http://download.cdn.yandex.net/browser/newcmp_clang/b" Pattern match: "http://tr-tr.facebook.com" Pattern match: "http://soft.export.yandex.ru/status.xml" Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" Pattern match: "http://www.w3.org/1999/XSL/Transform" Heuristic match: "../../win8/winrt_helper/importer_win8_util.cc" Heuristic match: "../../base/metrics/persistent_memory_allocator.cc"2b:T4b8,"Yandex.exe.bin" was detected as "VC8 -> Microsoft Corporation" "dllyupdate.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "yupdate-exec.exe" was detected as "VC8 -> Microsoft Corporation" "widevinecdm.dll" was detected as "Borland Delphi 3.0 (???)" "browser_watcher.dll" was detected as "Borland Delphi 3.0 (???)" "winrt_helper.dll" was detected as "Borland Delphi 3.0 (???)" "7z.dll" was detected as "Borland Delphi 3.0 (???)" "clidmgr.exe" was detected as "VC8 -> Microsoft Corporation" "ph.dll" was detected as "Borland Delphi 3.0 (???)" "d3dcompiler_47.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "libglesv2.dll" was detected as "Borland Delphi 3.0 (???)" "service_update.exe" was detected as "VC8 -> Microsoft Corporation" "eventlog_provider.dll" was detected as "Microsoft visual C++ vx.x DLL" "libegl.dll" was detected as "Borland Delphi 3.0 (???)" "setup.exe" was detected as "VC8 -> Microsoft Corporation" "fbpinlauncher.exe" was detected as "VC8 -> Microsoft Corporation" "show-dlg.exe" was detected as "VC8 -> Microsoft Corporation" "widevinecdmadapter.dll" was detected as "Borland Delphi 3.0 (???)" "unpacki.dll" was detected as "Borland Delphi 3.0 (???)"2c:T544,FindResourceW@KERNEL32.dll at 43179-1118-0041B442 LockResource@KERNEL32.DLL at 00015063-00002636-50403-388-0111DA18 FindResourceW@KERNEL32.DLL at 00015063-00002636-50403-772-0112B442 FindResourceW@KERNEL32.DLL at 00015063-00002636-50403-1251-011392A7 FindResourceW@KERNEL32.DLL at 00015063-00002636-50403-1393-01119FC0 FindResourceW@KERNEL32.DLL at 00015063-00002636-50403-1025-0111DBFD FindResourceW@KERNEL32.DLL at 00015063-00002636-50403-928-0111DAD7 LockResource@KERNEL32.DLL at 00015310-00003368-64636-387-00CFDA18 FindResourceW@KERNEL32.DLL at 00015310-00003368-64636-782-00D0B442 FindResourceW@KERNEL32.DLL at 00015310-00003368-64636-939-00CFDAD7 FindResourceW@KERNEL32.DLL at 00015310-00003368-64636-1255-00D192A7 FindResourceW@KERNEL32.DLL at 00015310-00003368-64636-1036-00CFDBFD FindResourceW@KERNEL32.DLL at 00015310-00003368-64636-1398-00CF9FC0 LockResource@KERNEL32.DLL at 00018456-00001208-20285-388-00CFDA18 FindResourceW@KERNEL32.DLL at 00018456-00001208-20285-772-00D0B442 FindResourceW@KERNEL32.DLL at 00018456-00001208-20285-928-00CFDAD7 FindResourceW@KERNEL32.DLL at 00018456-00001208-20285-1025-00CFDBFD FindResourceW@KERNEL32.DLL at 00018456-00001208-20285-1393-00CF9FC0 FindResourceW@KERNEL32.DLL at 00018456-00001208-20285-1251-00D192A7 SizeofResource@KERNEL32.DLL at 00019402-00002680-32526-429-013824EA2d:T62e,"dllyupdate.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "yupdate-exec.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "widevinecdm.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "browser_watcher.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "nacl64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "winrt_helper.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "7z.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "clidmgr.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "ph.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "d3dcompiler_47.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libglesv2.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "service_update.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "eventlog_provider.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libegl.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "fbpinlauncher.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "show-dlg.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "widevinecdmadapter.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "unpacki.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2e:Td0c,"%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\yb5FDD.tmp" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\indexv2[1].php" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\k[1].htm" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\meversion[1]" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\favicon[1].ico" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QRW5BOH4\dlc-down-arrow[1].png" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADO3AVS6\Windows6.1-KB2670838-x86[1].cab" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QIJSVQWS\2017022714175786396[1].jpg" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QRW5BOH4\lu_hot_word[1].png" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\bs-components[1].css" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\jslibraries[1]" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\2017022715465019764[1].jpg" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADO3AVS6\IE11-Windows6.1-KB2841134-x86[1].cab" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\latest[3].eot" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CQF567AQ\2017022715480832400[1].jpg" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CQF567AQ\2[1].js" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\2017022714084022703[1].jpg" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\MemMDL2.1.95[1].eot" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\favicon[1].ico" for deletion "%TEMP%\2636_23716\Yandex.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\2017022714062735365[1].jpg" for deletion2f:Tbd9,"" opened "C:\Users\WTGJ3U0\AppData\Local\Temp\2636_23716\Yandex.exe" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Temp\2636_23716" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Temp\yb5FDD.tmp" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\indexv2[1].php" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\k[1].htm" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\meversion[1]" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\favicon[1].ico" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QRW5BOH4\dlc-down-arrow[1].png" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADO3AVS6\Windows6.1-KB2670838-x86[1].cab" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QIJSVQWS\2017022714175786396[1].jpg" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QRW5BOH4\lu_hot_word[1].png" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\bs-components[1].css" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\jslibraries[1]" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\2017022715465019764[1].jpg" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADO3AVS6\IE11-Windows6.1-KB2841134-x86[1].cab" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\latest[3].eot" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CQF567AQ\2017022715480832400[1].jpg" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CQF567AQ\2[1].js" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\2017022714084022703[1].jpg" with delete access "" opened "C:\Users\WTGJ3U0\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\MemMDL2.1.95[1].eot" with delete access30:T73a,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")31:T559,"Yandex.exe.bin" claimed CRC 1024854 while the actual is CRC 1049152 "yupdate-exec.exe" claimed CRC 517402 while the actual is CRC 451490 "widevinecdm.dll" claimed CRC 242412 while the actual is CRC 517402 "browser_watcher.dll" claimed CRC 602466 while the actual is CRC 242412 "nacl64.exe" claimed CRC 3303633 while the actual is CRC 602466 "winrt_helper.dll" claimed CRC 315217 while the actual is CRC 3303633 "7z.dll" claimed CRC 1577621 while the actual is CRC 315217 "clidmgr.exe" claimed CRC 154463 while the actual is CRC 1577621 "ph.dll" claimed CRC 185292 while the actual is CRC 154463 "d3dcompiler_47.dll" claimed CRC 3723572 while the actual is CRC 185292 "libglesv2.dll" claimed CRC 2306873 while the actual is CRC 3723572 "service_update.exe" claimed CRC 1206607 while the actual is CRC 2306873 "eventlog_provider.dll" claimed CRC 50101 while the actual is CRC 1206607 "libegl.dll" claimed CRC 142023 while the actual is CRC 50101 "libglesv2.dll" claimed CRC 3755855 while the actual is CRC 142023 "setup.exe" claimed CRC 2031471 while the actual is CRC 3755855 "fbpinlauncher.exe" claimed CRC 144027 while the actual is CRC 2031471 "show-dlg.exe" claimed CRC 458339 while the actual is CRC 144027 "widevinecdmadapter.dll" claimed CRC 273501 while the actual is CRC 458339 "unpacki.dll" claimed CRC 773079 while the actual is CRC 27350132:T6c0,GetFileAttributesW FindResourceExW CopyFileW OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExA UnhandledExceptionFilter LoadLibraryExW CreateThread ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot GetVersionExW GetTickCount VirtualProtect GetFileSize OpenProcess GetStartupInfoW CreateDirectoryW DeleteFileW GetTempFileNameW CreateFileMappingW WriteFile FindNextFileW FindFirstFileW FindFirstFileExW GetProcAddress CreateFileW FindResourceW Process32NextW LockResource GetCommandLineW GetCommandLineA Process32FirstW MapViewOfFile GetModuleHandleA GetModuleHandleW GetTempPathW CreateProcessW RegCreateKeyExW RegDeleteValueW RegCloseKey OpenProcessToken GetUserNameW RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW GetModuleFileNameA LoadLibraryW LoadLibraryA GetStartupInfoA GetFileSizeEx CreateFileA Sleep VirtualAlloc LookupAccountNameW OpenFileMappingW CreateDirectoryA ShellExecuteW GetUserNameExW FindFirstFileExA FindNextFileA GetDriveTypeW OutputDebugStringA GetModuleHandleExA SetSecurityDescriptorDacl CreateProcessAsUserW SetKernelObjectSecurity MapViewOfFileEx GetThreadContext ConnectNamedPipe DisconnectNamedPipe CreateRemoteThread WriteProcessMemory ReadProcessMemory GetComputerNameExW VirtualProtectEx VirtualAllocEx SleepConditionVariableSRW GetFileAttributesExW recv bind send accept WSAStartup socket closesocket listen GetFileAttributesA DeviceIoControl DeleteFileA FindFirstFileA RegOpenKeyExA RegEnumKeyExA SleepEx GetModuleFileNameExW ShellExecuteExW GetTempPathA GetTempFileNameA GetWindowThreadProcessId StartServiceCtrlDispatcherW CreateServiceW StartServiceW33:T7c6,"" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2636_23716\Yandex.exe" (Handle: 96) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2636_23716\Yandex.exe" (Handle: 96) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2636_23716\Yandex.exe" (Handle: 96) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2636_23716\Yandex.exe" (Handle: 96) "" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2636_23716\Yandex.exe" (Handle: 1860) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2636_23716\Yandex.exe" (Handle: 1860) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2636_23716\Yandex.exe" (Handle: 1860) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\2636_23716\Yandex.exe" (Handle: 1860) "" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\yb5FDD.tmp" (Handle: 160) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\yb5FDD.tmp" (Handle: 160) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\yb5FDD.tmp" (Handle: 160) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\yb5FDD.tmp" (Handle: 160) "yb5FDD.tmp" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\YB_6BC33.tmp\setup.exe" (Handle: 64) "yb5FDD.tmp" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\YB_6BC33.tmp\setup.exe" (Handle: 64) "yb5FDD.tmp" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\YB_6BC33.tmp\setup.exe" (Handle: 64) "yb5FDD.tmp" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\YB_6BC33.tmp\setup.exe" (Handle: 64)34:T25fd,Found malicious artifacts related to "5.45.205.231": ... URL: http://download.cdn.yandex.net/browser/yandex/browser-setup.arc (AV positives: 1/67 scanned on 07/16/2018 07:44:50) URL: http://download.cdn.yandex.net/browser/tb/tr/lite/Yandex.exe (AV positives: 1/67 scanned on 06/20/2018 22:10:46) URL: http://download.yandex.ru/punto/PuntoSwitcherSetup.exe (AV positives: 1/67 scanned on 04/02/2018 09:07:51) URL: http://download.cdn.yandex.net/punto/PuntoSwitcherSetup.exe (AV positives: 1/67 scanned on 03/07/2018 17:09:20) URL: http://download.yandex.ru/opera/Opera_setup.exe (AV positives: 1/65 scanned on 11/21/2017 01:06:39) File SHA256: 30b2ca6215ea78f71aa6b840aea644184b191c62dc8b0a0c1b8549ad34013968 (Date: 07/17/2018 15:03:59) File SHA256: b670156f1ed856c6488536a849eaf4ffdf875aee1e2cc9bc3ba48fdf5a502f90 (Date: 07/16/2018 22:10:16) File SHA256: 4753ed7e6385134f7d9bf04e4bbb3d75caf73408fbb6ca008c352cb59a026425 (Date: 07/12/2018 01:58:50) File SHA256: 8988e4a179927c7e119a250b6a80a025c87ae3ded754036da07fb9f710042ecb (Date: 07/06/2018 19:42:49) File SHA256: f4441e21ea01061ea434abec61da46c0c9869774bbe38a6e0d33c64bc77afe1e (Date: 07/06/2018 18:58:42) File SHA256: d0c02c67490dbea829be79f4e6186b5f7438b8e181eb3a7b2864715122245307 (AV positives: 2/67 scanned on 06/24/2018 23:26:33) File SHA256: 9a3255c995cfb19d85ba8f8ff31677bcf1b0b32b07ae850acc312acee8f4ba91 (AV positives: 1/59 scanned on 03/27/2018 09:22:46) File SHA256: 50cbc797c4a100ca24b36648de2655dd1620ee9e7b481aa9a5fee96283eef366 (AV positives: 1/68 scanned on 03/07/2018 17:09:25) File SHA256: b74490e6ded6ec7c9721a80d73678108c5037a13dd3c7486ea2246cab264c00c (AV positives: 59/67 scanned on 01/16/2018 13:24:37) File SHA256: e0915a00e5435deaff463846a725c8b16b715989336357fd6e663241b43d101e (AV positives: 60/68 scanned on 01/11/2018 17:01:56) Found malicious artifacts related to "213.180.193.82": ... File SHA256: d0c9203fda5b668b943ef44dcd76cc748b252e6b0929759b20d47b3c8090650e (Date: 07/17/2018 15:50:23) File SHA256: fc6ec4cc0e62e2dbad1b8942b294bcdd4d195baa512ffe49ee0792152781ee9c (Date: 07/16/2018 22:12:23) File SHA256: b670156f1ed856c6488536a849eaf4ffdf875aee1e2cc9bc3ba48fdf5a502f90 (Date: 07/16/2018 22:10:16) File SHA256: 63f66a5af28a21a5e6c79f34c670a52191a88b3ce03788b8a2d48bd63292699c (Date: 07/16/2018 16:42:12) File SHA256: f95bdf2aa758cf26527d6c231109a8fa09926c40a455dfe185d11c808dd5c6e4 (Date: 07/16/2018 16:39:44) File SHA256: 43b68ac66bcbd8629ef8aa29190c63662322d8f5b12b4441e13e0cd5b641934a (AV positives: 1/69 scanned on 07/15/2018 04:11:51) File SHA256: 5e144456b1a7a5c4916aba9f42cfb391919e2f5a67913d5819ec696f56f5f759 (AV positives: 1/70 scanned on 07/14/2018 05:10:21) File SHA256: 20b690675e5b06a70ea6ec86e5df81acb9a8ffdd2b0abd63b47e8499f92ca13f (AV positives: 16/70 scanned on 05/08/2018 00:48:10) File SHA256: cdcec354fd8b8b20dbc896621da40af65b4422cdd08d349044958d57e23ecdf5 (AV positives: 21/66 scanned on 03/14/2018 21:08:15) File SHA256: 9a3255c995cfb19d85ba8f8ff31677bcf1b0b32b07ae850acc312acee8f4ba91 (AV positives: 1/70 scanned on 03/07/2018 10:43:04) Found malicious artifacts related to "5.45.247.9": ... URL: https://cache-ams01.cdn.yandex.net/download.cdn.yandex.net/bm/BrowserManagerInstaller-ru.exe (AV positives: 1/68 scanned on 06/22/2018 12:02:02) URL: https://cache-ams01.cdn.yandex.net:80/download.cdn.yandex.net/punto/puntoswitchersetup.exe (AV positives: 1/67 scanned on 05/05/2018 04:06:53) URL: http://cache-ams01.cdn.yandex.net/download.cdn.yandex.net/punto/PuntoSwitcherSetup.exe (AV positives: 1/64 scanned on 09/27/2017 18:47:11) URL: https://cache-ams01.cdn.yandex.net/download.cdn.yandex.net/punto/PuntoSwitcherSetup.exe (AV positives: 1/64 scanned on 05/07/2017 11:56:39) URL: http://cache-ams01.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/savefrom2/Yandex.exe (AV positives: 1/67 scanned on 04/04/2016 07:23:06) File SHA256: a71f3c22f1b8413644626ec05be0790aef6a23b2fa48c653a2d902d396ebae54 (Date: 06/10/2018 19:35:22) File SHA256: de411af16406a6102fb5b786c10e0ef9b87b29b51bd57de95609ea621b6d21b4 (Date: 06/10/2018 17:35:25) File SHA256: 4fafb6ffe1508964f1a4a8dbb187a74747cc7a1b9b7952b1c73e6bad2ab47e4c (Date: 06/10/2018 14:22:52) File SHA256: e4939bebe06acea6a432f8d4b053b28aa80a6536ea4a8ad2edf15f9049d9998c (Date: 06/10/2018 14:22:08) File SHA256: 596f5f494f75664d3d7535ba9318cb2d3f4026551c5f78d498f713bc2d81b3f6 (Date: 06/10/2018 14:21:55) File SHA256: aed99e3aca3b64470e613a0ae63b6f6e0ec43fa4bec8bfe59423322943987f24 (AV positives: 50/67 scanned on 03/12/2018 18:14:12) File SHA256: b74490e6ded6ec7c9721a80d73678108c5037a13dd3c7486ea2246cab264c00c (AV positives: 59/67 scanned on 01/16/2018 13:24:36) File SHA256: 9a3255c995cfb19d85ba8f8ff31677bcf1b0b32b07ae850acc312acee8f4ba91 (AV positives: 1/59 scanned on 12/15/2017 10:54:37) File SHA256: 59608fb96cdfbcaa4e6d0e203252e2d7a2953d3dd078c353e7f069afba7cec04 (AV positives: 1/68 scanned on 12/14/2017 10:40:45) File SHA256: aedb69fd18ad766570bdf3b14b487ffb2885cef0854d81360ab02999d8936ddb (AV positives: 1/68 scanned on 12/02/2017 10:14:42) Found malicious artifacts related to "87.250.250.55": ... File SHA256: d0c9203fda5b668b943ef44dcd76cc748b252e6b0929759b20d47b3c8090650e (Date: 07/17/2018 15:50:23) File SHA256: 70722f628a5493fb464d41b38b0459462e128d5cb31709777ddaa8a7e63cf66e (Date: 07/17/2018 15:48:50) File SHA256: 063df16292cccc23c70d830e6a804482cb02d41d3a2d027d1105c0c39d47d496 (Date: 07/17/2018 15:46:00) File SHA256: 30b2ca6215ea78f71aa6b840aea644184b191c62dc8b0a0c1b8549ad34013968 (Date: 07/17/2018 15:03:59) File SHA256: 2bf6c8af6c17db28c0b36a4a811fad753012aa9b45c7c3eb123ce95600b46741 (Date: 07/17/2018 15:03:33) File SHA256: 20b690675e5b06a70ea6ec86e5df81acb9a8ffdd2b0abd63b47e8499f92ca13f (AV positives: 16/70 scanned on 05/08/2018 00:48:10) File SHA256: b10b2cda59c75e816a887e29c854df1f0293aefbef66d7fc7f4dd347f8580ba7 (AV positives: 1/69 scanned on 04/11/2018 08:54:47) File SHA256: b0ef412ce266e7c957406ac2e5d1ffa7d960138271dcf738c9e3861b7ff5fe38 (AV positives: 55/67 scanned on 04/09/2018 22:05:06) File SHA256: 117f2b3f0d630c4b311fbd8919ebf0e5baafab8cad6619d244c4a31cae5abd75 (AV positives: 1/70 scanned on 03/28/2018 17:16:48) File SHA256: 1d06e630efb1d58e2deab9a9434a2bc240fac49155ad17b713663140e3e94570 (AV positives: 1/67 scanned on 03/03/2018 11:21:41) Found malicious artifacts related to "87.250.251.14": ... File SHA256: 4a6f51420469e4e8369ac4827437838b46b64cf054b831505104a2c67ac00642 (AV positives: 57/68 scanned on 07/10/2018 19:15:40) File SHA256: c546b2b93dd167e1283b53c577ff07161f85c78491a214c40ca98e2b8f912e11 (AV positives: 1/67 scanned on 07/10/2018 02:10:25) File SHA256: 5c06cdd90e71acddd922569aa0899ef6bf40ce442619f4b1ebcaaf04ee9b7166 (AV positives: 1/67 scanned on 07/07/2018 16:59:44) File SHA256: 4cc42f17470f04e369363e1339d769e1336e9e41b746b52afa7f7fa30faa6827 (AV positives: 1/65 scanned on 07/03/2018 23:56:05) File SHA256: 50b6113b7422435fd5a007d053a6aca32ec14bec06c7f7fe7f41d3ce43490804 (AV positives: 1/70 scanned on 05/30/2018 00:18:11) File SHA256: 2e518a4bd6ddf55654f8fbd93eae07af12465f20f6547b7f4bff0671b10bcf5c (Date: 01/02/2018 18:30:14) File SHA256: 7116a2be0ce7f858efe4a4165ea8a6828cf36a757dd76e3265b26144bb42d301 (Date: 11/30/2017 13:41:40) File SHA256: faa1fe226405243f3340476321f6bbe8712b441eeb9e22b6c30837702880cc85 (Date: 11/29/2017 19:44:58) File SHA256: 1320040f8494c09f18e3b1479289848f2fd91fa7fcb2a622b349423088d1036f (Date: 11/18/2017 08:47:46) File SHA256: ad4a297c35109160ab442411618a063126ee54656159e6bf5c513819681f2638 (Date: 11/03/2017 08:13:34) Found malicious artifacts related to "5.45.247.12": ... URL: http://cache-ams04.cdn.yandex.net/download.cdn.yandex.net/browser/besiktas/tr/Yandex.exe (AV positives: 1/68 scanned on 06/23/2018 23:23:52) URL: http://cache-ams04.cdn.yandex.net/downloader.yandex.net/getfirefox/FirefoxSetup.exe (AV positives: 1/68 scanned on 06/23/2018 23:09:25) URL: http://cache-ams04.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2290872-5&ui={B2FC2681-93B9-4DFB-9FCE-24B63C451C75} (AV positives: 1/64 scanned on 11/04/2017 15:21:52) URL: http://cache-ams04.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=none&ui={D9E70ECF-FEE9-4488-B318-896BD226598A} (AV positives: 1/64 scanned on 11/02/2017 20:51:35) URL: http://cache-ams04.cdn.yandex.net:443/download.cdn.yandex.net/browser/update/17_9_1_768_1618_w_s_p/tb.exe (AV positives: 1/64 scanned on 10/31/2017 00:21:14) File SHA256: c010582b351c6b8c79696e464adf008af74bcee6b0c13af88d69bf76aade7b98 (Date: 06/12/2018 22:13:33) File SHA256: d2bc4a296a854488a0b74c41bbcfd98cd1d6391d8b179c65c7d3c163edc07cbc (Date: 06/12/2018 22:13:07) File SHA256: df99935caea61979a81a5c4d64222f4c9890a56b144ae86c4b5b9f3066641f15 (Date: 06/01/2018 16:53:16) File SHA256: d66924979a4d8e4269f5c2cb6bd33912f445b2ec836467b904c0e718a8171592 (Date: 06/01/2018 16:52:28) File SHA256: cd25f5096a29cf545462b043ec13117e7f34752ddbb3ac5803d774d3c9cac9a4 (Date: 06/01/2018 16:46:34) File SHA256: ca5005151916a447a1f7b554a1f4cdfd6873b299d2c014147cbe37521078c2fc (AV positives: 1/66 scanned on 04/04/2018 13:07:48) File SHA256: 9a3255c995cfb19d85ba8f8ff31677bcf1b0b32b07ae850acc312acee8f4ba91 (AV positives: 1/57 scanned on 02/24/2018 11:51:37) File SHA256: 48cf4a2fdab5a0757d3faaf3d95120db4d708b5be9c1772c8c02b0a77fa37a30 (AV positives: 57/67 scanned on 01/26/2018 14:47:35) File SHA256: 88ee848c757d4652a3c11fbd0d99ee4da9c08bcadb23c753a049ec17625ff529 (AV positives: 56/65 scanned on 01/19/2018 19:31:17) File SHA256: b74490e6ded6ec7c9721a80d73678108c5037a13dd3c7486ea2246cab264c00c (AV positives: 59/67 scanned on 01/16/2018 13:24:36)35:T25fd,Found malicious artifacts related to "5.45.205.231": ... URL: http://download.cdn.yandex.net/browser/yandex/browser-setup.arc (AV positives: 1/67 scanned on 07/16/2018 07:44:50) URL: http://download.cdn.yandex.net/browser/tb/tr/lite/Yandex.exe (AV positives: 1/67 scanned on 06/20/2018 22:10:46) URL: http://download.yandex.ru/punto/PuntoSwitcherSetup.exe (AV positives: 1/67 scanned on 04/02/2018 09:07:51) URL: http://download.cdn.yandex.net/punto/PuntoSwitcherSetup.exe (AV positives: 1/67 scanned on 03/07/2018 17:09:20) URL: http://download.yandex.ru/opera/Opera_setup.exe (AV positives: 1/65 scanned on 11/21/2017 01:06:39) File SHA256: 30b2ca6215ea78f71aa6b840aea644184b191c62dc8b0a0c1b8549ad34013968 (Date: 07/17/2018 15:03:59) File SHA256: b670156f1ed856c6488536a849eaf4ffdf875aee1e2cc9bc3ba48fdf5a502f90 (Date: 07/16/2018 22:10:16) File SHA256: 4753ed7e6385134f7d9bf04e4bbb3d75caf73408fbb6ca008c352cb59a026425 (Date: 07/12/2018 01:58:50) File SHA256: 8988e4a179927c7e119a250b6a80a025c87ae3ded754036da07fb9f710042ecb (Date: 07/06/2018 19:42:49) File SHA256: f4441e21ea01061ea434abec61da46c0c9869774bbe38a6e0d33c64bc77afe1e (Date: 07/06/2018 18:58:42) File SHA256: d0c02c67490dbea829be79f4e6186b5f7438b8e181eb3a7b2864715122245307 (AV positives: 2/67 scanned on 06/24/2018 23:26:33) File SHA256: 9a3255c995cfb19d85ba8f8ff31677bcf1b0b32b07ae850acc312acee8f4ba91 (AV positives: 1/59 scanned on 03/27/2018 09:22:46) File SHA256: 50cbc797c4a100ca24b36648de2655dd1620ee9e7b481aa9a5fee96283eef366 (AV positives: 1/68 scanned on 03/07/2018 17:09:25) File SHA256: b74490e6ded6ec7c9721a80d73678108c5037a13dd3c7486ea2246cab264c00c (AV positives: 59/67 scanned on 01/16/2018 13:24:37) File SHA256: e0915a00e5435deaff463846a725c8b16b715989336357fd6e663241b43d101e (AV positives: 60/68 scanned on 01/11/2018 17:01:56) Found malicious artifacts related to "213.180.193.82": ... File SHA256: d0c9203fda5b668b943ef44dcd76cc748b252e6b0929759b20d47b3c8090650e (Date: 07/17/2018 15:50:23) File SHA256: fc6ec4cc0e62e2dbad1b8942b294bcdd4d195baa512ffe49ee0792152781ee9c (Date: 07/16/2018 22:12:23) File SHA256: b670156f1ed856c6488536a849eaf4ffdf875aee1e2cc9bc3ba48fdf5a502f90 (Date: 07/16/2018 22:10:16) File SHA256: 63f66a5af28a21a5e6c79f34c670a52191a88b3ce03788b8a2d48bd63292699c (Date: 07/16/2018 16:42:12) File SHA256: f95bdf2aa758cf26527d6c231109a8fa09926c40a455dfe185d11c808dd5c6e4 (Date: 07/16/2018 16:39:44) File SHA256: 43b68ac66bcbd8629ef8aa29190c63662322d8f5b12b4441e13e0cd5b641934a (AV positives: 1/69 scanned on 07/15/2018 04:11:51) File SHA256: 5e144456b1a7a5c4916aba9f42cfb391919e2f5a67913d5819ec696f56f5f759 (AV positives: 1/70 scanned on 07/14/2018 05:10:21) File SHA256: 20b690675e5b06a70ea6ec86e5df81acb9a8ffdd2b0abd63b47e8499f92ca13f (AV positives: 16/70 scanned on 05/08/2018 00:48:10) File SHA256: cdcec354fd8b8b20dbc896621da40af65b4422cdd08d349044958d57e23ecdf5 (AV positives: 21/66 scanned on 03/14/2018 21:08:15) File SHA256: 9a3255c995cfb19d85ba8f8ff31677bcf1b0b32b07ae850acc312acee8f4ba91 (AV positives: 1/70 scanned on 03/07/2018 10:43:04) Found malicious artifacts related to "5.45.247.9": ... URL: https://cache-ams01.cdn.yandex.net/download.cdn.yandex.net/bm/BrowserManagerInstaller-ru.exe (AV positives: 1/68 scanned on 06/22/2018 12:02:02) URL: https://cache-ams01.cdn.yandex.net:80/download.cdn.yandex.net/punto/puntoswitchersetup.exe (AV positives: 1/67 scanned on 05/05/2018 04:06:53) URL: http://cache-ams01.cdn.yandex.net/download.cdn.yandex.net/punto/PuntoSwitcherSetup.exe (AV positives: 1/64 scanned on 09/27/2017 18:47:11) URL: https://cache-ams01.cdn.yandex.net/download.cdn.yandex.net/punto/PuntoSwitcherSetup.exe (AV positives: 1/64 scanned on 05/07/2017 11:56:39) URL: http://cache-ams01.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/savefrom2/Yandex.exe (AV positives: 1/67 scanned on 04/04/2016 07:23:06) File SHA256: a71f3c22f1b8413644626ec05be0790aef6a23b2fa48c653a2d902d396ebae54 (Date: 06/10/2018 19:35:22) File SHA256: de411af16406a6102fb5b786c10e0ef9b87b29b51bd57de95609ea621b6d21b4 (Date: 06/10/2018 17:35:25) File SHA256: 4fafb6ffe1508964f1a4a8dbb187a74747cc7a1b9b7952b1c73e6bad2ab47e4c (Date: 06/10/2018 14:22:52) File SHA256: e4939bebe06acea6a432f8d4b053b28aa80a6536ea4a8ad2edf15f9049d9998c (Date: 06/10/2018 14:22:08) File SHA256: 596f5f494f75664d3d7535ba9318cb2d3f4026551c5f78d498f713bc2d81b3f6 (Date: 06/10/2018 14:21:55) File SHA256: aed99e3aca3b64470e613a0ae63b6f6e0ec43fa4bec8bfe59423322943987f24 (AV positives: 50/67 scanned on 03/12/2018 18:14:12) File SHA256: b74490e6ded6ec7c9721a80d73678108c5037a13dd3c7486ea2246cab264c00c (AV positives: 59/67 scanned on 01/16/2018 13:24:36) File SHA256: 9a3255c995cfb19d85ba8f8ff31677bcf1b0b32b07ae850acc312acee8f4ba91 (AV positives: 1/59 scanned on 12/15/2017 10:54:37) File SHA256: 59608fb96cdfbcaa4e6d0e203252e2d7a2953d3dd078c353e7f069afba7cec04 (AV positives: 1/68 scanned on 12/14/2017 10:40:45) File SHA256: aedb69fd18ad766570bdf3b14b487ffb2885cef0854d81360ab02999d8936ddb (AV positives: 1/68 scanned on 12/02/2017 10:14:42) Found malicious artifacts related to "87.250.250.55": ... File SHA256: d0c9203fda5b668b943ef44dcd76cc748b252e6b0929759b20d47b3c8090650e (Date: 07/17/2018 15:50:23) File SHA256: 70722f628a5493fb464d41b38b0459462e128d5cb31709777ddaa8a7e63cf66e (Date: 07/17/2018 15:48:50) File SHA256: 063df16292cccc23c70d830e6a804482cb02d41d3a2d027d1105c0c39d47d496 (Date: 07/17/2018 15:46:00) File SHA256: 30b2ca6215ea78f71aa6b840aea644184b191c62dc8b0a0c1b8549ad34013968 (Date: 07/17/2018 15:03:59) File SHA256: 2bf6c8af6c17db28c0b36a4a811fad753012aa9b45c7c3eb123ce95600b46741 (Date: 07/17/2018 15:03:33) File SHA256: 20b690675e5b06a70ea6ec86e5df81acb9a8ffdd2b0abd63b47e8499f92ca13f (AV positives: 16/70 scanned on 05/08/2018 00:48:10) File SHA256: b10b2cda59c75e816a887e29c854df1f0293aefbef66d7fc7f4dd347f8580ba7 (AV positives: 1/69 scanned on 04/11/2018 08:54:47) File SHA256: b0ef412ce266e7c957406ac2e5d1ffa7d960138271dcf738c9e3861b7ff5fe38 (AV positives: 55/67 scanned on 04/09/2018 22:05:06) File SHA256: 117f2b3f0d630c4b311fbd8919ebf0e5baafab8cad6619d244c4a31cae5abd75 (AV positives: 1/70 scanned on 03/28/2018 17:16:48) File SHA256: 1d06e630efb1d58e2deab9a9434a2bc240fac49155ad17b713663140e3e94570 (AV positives: 1/67 scanned on 03/03/2018 11:21:41) Found malicious artifacts related to "87.250.251.14": ... File SHA256: 4a6f51420469e4e8369ac4827437838b46b64cf054b831505104a2c67ac00642 (AV positives: 57/68 scanned on 07/10/2018 19:15:40) File SHA256: c546b2b93dd167e1283b53c577ff07161f85c78491a214c40ca98e2b8f912e11 (AV positives: 1/67 scanned on 07/10/2018 02:10:25) File SHA256: 5c06cdd90e71acddd922569aa0899ef6bf40ce442619f4b1ebcaaf04ee9b7166 (AV positives: 1/67 scanned on 07/07/2018 16:59:44) File SHA256: 4cc42f17470f04e369363e1339d769e1336e9e41b746b52afa7f7fa30faa6827 (AV positives: 1/65 scanned on 07/03/2018 23:56:05) File SHA256: 50b6113b7422435fd5a007d053a6aca32ec14bec06c7f7fe7f41d3ce43490804 (AV positives: 1/70 scanned on 05/30/2018 00:18:11) File SHA256: 2e518a4bd6ddf55654f8fbd93eae07af12465f20f6547b7f4bff0671b10bcf5c (Date: 01/02/2018 18:30:14) File SHA256: 7116a2be0ce7f858efe4a4165ea8a6828cf36a757dd76e3265b26144bb42d301 (Date: 11/30/2017 13:41:40) File SHA256: faa1fe226405243f3340476321f6bbe8712b441eeb9e22b6c30837702880cc85 (Date: 11/29/2017 19:44:58) File SHA256: 1320040f8494c09f18e3b1479289848f2fd91fa7fcb2a622b349423088d1036f (Date: 11/18/2017 08:47:46) File SHA256: ad4a297c35109160ab442411618a063126ee54656159e6bf5c513819681f2638 (Date: 11/03/2017 08:13:34) Found malicious artifacts related to "5.45.247.12": ... URL: http://cache-ams04.cdn.yandex.net/download.cdn.yandex.net/browser/besiktas/tr/Yandex.exe (AV positives: 1/68 scanned on 06/23/2018 23:23:52) URL: http://cache-ams04.cdn.yandex.net/downloader.yandex.net/getfirefox/FirefoxSetup.exe (AV positives: 1/68 scanned on 06/23/2018 23:09:25) URL: http://cache-ams04.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2290872-5&ui={B2FC2681-93B9-4DFB-9FCE-24B63C451C75} (AV positives: 1/64 scanned on 11/04/2017 15:21:52) URL: http://cache-ams04.cdn.yandex.net/downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=none&ui={D9E70ECF-FEE9-4488-B318-896BD226598A} (AV positives: 1/64 scanned on 11/02/2017 20:51:35) URL: http://cache-ams04.cdn.yandex.net:443/download.cdn.yandex.net/browser/update/17_9_1_768_1618_w_s_p/tb.exe (AV positives: 1/64 scanned on 10/31/2017 00:21:14) File SHA256: c010582b351c6b8c79696e464adf008af74bcee6b0c13af88d69bf76aade7b98 (Date: 06/12/2018 22:13:33) File SHA256: d2bc4a296a854488a0b74c41bbcfd98cd1d6391d8b179c65c7d3c163edc07cbc (Date: 06/12/2018 22:13:07) File SHA256: df99935caea61979a81a5c4d64222f4c9890a56b144ae86c4b5b9f3066641f15 (Date: 06/01/2018 16:53:16) File SHA256: d66924979a4d8e4269f5c2cb6bd33912f445b2ec836467b904c0e718a8171592 (Date: 06/01/2018 16:52:28) File SHA256: cd25f5096a29cf545462b043ec13117e7f34752ddbb3ac5803d774d3c9cac9a4 (Date: 06/01/2018 16:46:34) File SHA256: ca5005151916a447a1f7b554a1f4cdfd6873b299d2c014147cbe37521078c2fc (AV positives: 1/66 scanned on 04/04/2018 13:07:48) File SHA256: 9a3255c995cfb19d85ba8f8ff31677bcf1b0b32b07ae850acc312acee8f4ba91 (AV positives: 1/57 scanned on 02/24/2018 11:51:37) File SHA256: 48cf4a2fdab5a0757d3faaf3d95120db4d708b5be9c1772c8c02b0a77fa37a30 (AV positives: 57/67 scanned on 01/26/2018 14:47:35) File SHA256: 88ee848c757d4652a3c11fbd0d99ee4da9c08bcadb23c753a049ec17625ff529 (AV positives: 56/65 scanned on 01/19/2018 19:31:17) File SHA256: b74490e6ded6ec7c9721a80d73678108c5037a13dd3c7486ea2246cab264c00c (AV positives: 59/67 scanned on 01/16/2018 13:24:36)36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////////////////////////////////////////////////////////+P////////////////////iP///////////////////4iI//////////////////+IiI//////////////////iIiI/////////////////4iIiI////////////////+IiIiI////////////////iIiP+I///////////////4iI///4j/////j///////+I//////iP//j/////////j///////+I//////////gZj////////4////////cRGZl4/////////////4kRERERmZj//////////4EREY//+BGZmP//////+IcREX//mf/3GZl4j///+I//+Hj//5n//4eP//iP/4j///+P//+Z///4////iP+P///4////mf///4////j/////+P///5n///+P//////////f///+Z////f//////////w///5mZ///w//////////8P//mXeZ//8P//////////D/+Zf/eZ//D//////////wf3l///eZ9w//////////8A+H////ePAP//////////AA//////8AD//////////wAAf///9wAA//////////8AAAAAAAAAAP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791119558495,"unified_at":"2026-10-04T13:12:38.495Z","metadata":{"hashes":{"sha256":"43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8","sha1":"73822243ade9421aca5031fd880895f7b6b95679","md5":"f5ca00efc0c96b54bfb2f1d6b72ba974","sha512":"a8a67ca9b96cd965b7d8dadd8dd1e73197055fb713bb0445e653ee4e80c59f18d695e2b2744440f6ab33c064986c93e14dfec57391bfc5c717491970ef5f465f","ssdeep":"24576:X1haMyPdPo8qYoQuB9xXvwo2dPiceFN9P4TaiT:raVdYYoQSnvwddPiceL9P4O","ssdeep_chunks":["24576:X1haMyP","24576:1haMyPd","24576:haMyPdP","24576:aMyPdPo","24576:MyPdPo8","24576:yPdPo8q","24576:PdPo8qY","24576:dPo8qYo","24576:Po8qYoQ","24576:o8qYoQu","24576:8qYoQuB","24576:qYoQuB9","24576:YoQuB9x","24576:oQuB9xX","24576:QuB9xXv","24576:uB9xXvw","24576:B9xXvwo","24576:9xXvwo2","24576:xXvwo2d","24576:Xvwo2dP","24576:vwo2dPi","24576:wo2dPic","24576:o2dPice","24576:2dPiceF","24576:dPiceFN","24576:PiceFN9","24576:iceFN9P","24576:ceFN9P4","24576:eFN9P4T","24576:FN9P4Ta","24576:N9P4Tai","24576:9P4TaiT","49152:X1haMyP","49152:1haMyPd","49152:haMyPdP","49152:aMyPdPo","49152:MyPdPo8","49152:yPdPo8q","49152:PdPo8qY","49152:dPo8qYo","49152:Po8qYoQ","49152:o8qYoQu","49152:8qYoQuB","49152:qYoQuB9","49152:YoQuB9x","49152:oQuB9xX","49152:QuB9xXv","49152:uB9xXvw","49152:B9xXvwo","49152:9xXvwo2","49152:xXvwo2d","49152:Xvwo2dP","49152:vwo2dPi","49152:wo2dPic","49152:o2dPice","49152:2dPiceF","49152:dPiceFN","49152:PiceFN9","49152:iceFN9P","49152:ceFN9P4","49152:eFN9P4T","49152:FN9P4Ta","49152:N9P4Tai","49152:9P4TaiT","24576:raVdYYo","24576:aVdYYoQ","24576:VdYYoQS","24576:dYYoQSn","24576:YYoQSnv","24576:YoQSnvw","24576:oQSnvwd","24576:QSnvwdd","24576:SnvwddP","24576:nvwddPi","24576:vwddPic","24576:wddPice","24576:ddPiceL","24576:dPiceL9","24576:PiceL9P","24576:iceL9P4","24576:ceL9P4O"],"imphash":"d421940b3670138e77fa585fd87b8581"},"file_info":{"file_name":"Yandex.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":999416,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1531930818000,"last_seen":1655815261000,"last_multi_scan":1655815261000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":32,"suspicious_count":28,"malicious_count":9,"total":69},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to read monitor info"},{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$24","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00015063-00002636-50403-285-0115177B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00015063-00002636-50403-692-01130A60\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00015063-00002636-50403-1110-0113FEFB\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00015310-00003368-64636-284-00D3177B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00015310-00003368-64636-691-00D10A60\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00015310-00003368-64636-1123-00D1FEFB\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00018456-00001208-20285-285-00D3177B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00018456-00001208-20285-692-00D10A60\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00018456-00001208-20285-1110-00D1FEFB\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00019402-00002680-32526-142-01386A04","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00015063-00002636-50403-244-01153268\n GetTimeZoneInformation@KERNEL32.DLL at 00015310-00003368-64636-243-00D33268\n GetTimeZoneInformation@KERNEL32.DLL at 00018456-00001208-20285-244-00D33268","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00015063-00002636-50403-585-0112D810\n GetVersionExW@KERNEL32.DLL at 00015310-00003368-64636-584-00D0D810\n GetVersionExW@KERNEL32.DLL at 00018456-00001208-20285-585-00D0D810","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00015063-00002636-50403-924-0111DD8F\n GetUserDefaultUILanguage@KERNEL32.DLL at 00015310-00003368-64636-935-00CFDD8F\n GetUserDefaultUILanguage@KERNEL32.DLL at 00018456-00001208-20285-924-00CFDD8F\n EnumSystemLocalesW@KERNEL32.DLL at 00019402-00002680-32526-366-01399DDD\n GetUserDefaultLCID@KERNEL32.DLL at 00019402-00002680-32526-319-01396766\n EnumSystemLocalesW@KERNEL32.DLL at 00019402-00002680-32526-363-01399E78\n GetUserDefaultLCID@KERNEL32.DLL at 00019402-00002680-32526-361-0139A458\n EnumSystemLocalesW@KERNEL32.DLL at 00019402-00002680-32526-362-01399D92\n EnumSystemLocalesW@KERNEL32.DLL at 00019402-00002680-32526-326-013961C2\n EnumSystemLocalesW@KERNEL32.dll at 39021-1100-10023CB7\n EnumSystemLocalesW@KERNEL32.dll at 39021-1099-10023BD1\n GetUserDefaultLCID@KERNEL32.dll at 39021-1098-10024297\n EnumSystemLocalesW@KERNEL32.dll at 39021-1069-1001D0E9\n GetUserDefaultLCID@KERNEL32.dll at 39021-1062-1001D6AC\n EnumSystemLocalesW@KERNEL32.dll at 39021-1103-10023C1C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00015063-00002636-50403-742-0111F90A\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00015310-00003368-64636-752-00CFF90A\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00018456-00001208-20285-742-00CFF90A\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00018456-00001208-26559-748-00CFF90A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00015063-00002636-50403-1442-01112C30\n GetProcessHeap@KERNEL32.DLL at 00015063-00002636-50403-1441-01112C50\n GetProcessHeap@KERNEL32.DLL at 00015310-00003368-64636-1446-00CF2C50\n GetProcessHeap@KERNEL32.DLL at 00015310-00003368-64636-1447-00CF2C30\n GetProcessHeap@KERNEL32.DLL at 00018456-00001208-20285-1442-00CF2C30\n GetProcessHeap@KERNEL32.DLL at 00018456-00001208-20285-1441-00CF2C50\n GetProcessHeap@KERNEL32.DLL at 00019402-00002680-32526-85-01381F82\n GetProcessHeap@KERNEL32.DLL at 00019402-00002680-32526-84-01382230\n GetProcessHeap@KERNEL32.DLL at 00019402-00002680-32526-437-013821DC\n GetProcessHeap@KERNEL32.DLL at 00019402-00002680-32526-438-01382101\n GetProcessHeap@KERNEL32.DLL at 00019402-00002680-32526-439-0138211B\n GetProcessHeap@KERNEL32.dll at 39021-2200-1001D977","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\YANDEX.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\YANDEX.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/68 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"download.cdn.yandex.net\"\n \"cache-ams01.cdn.yandex.net\"\n \"subca.ocsp-certum.com\"\n \"yandex.ocsp-responder.com\"\n \"storage.ape.yandex.net\"\n \"clck.yandex.ru\"\n \"cache-ams06.cdn.yandex.net\"\n \"cache-ams05.cdn.yandex.net\"\n \"cache-ams04.cdn.yandex.net\"\n \"cache-ams02.cdn.yandex.net\"\n \"api.browser.yandex.ru\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"5.45.205.231:80\"\n \"213.180.193.82:443\"\n \"5.45.247.9:80\"\n \"23.111.11.211:80\"\n \"87.250.250.55:443\"\n \"87.250.251.14:443\"\n \"5.45.205.231:443\"\n \"5.45.247.12:443\"\n \"5.45.247.9:443\"\n \"5.45.247.10:443\"\n \"5.45.247.13:443\"\n \"5.45.247.14:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\TeamcityAgent\\work\\6a6d135591f2f49f\\src\\out\\Release\\lite_installer.exe.pdb\"\n \"C:\\TeamcityAgent\\work\\6a6d135591f2f49f\\src\\out\\Release\\browser-setup.arc.pdb\"\n \"C:\\TeamcityAgent\\work\\6a6d135591f2f49f\\src\\out\\Release\\WidevineCdm\\_platform_specific\\win_x86\\widevinecdmadapter.dll.pdb\"\n \"C:\\TeamcityAgent\\work\\6a6d135591f2f49f\\src\\out\\Release\\FBPinLauncher.exe.pdb\"\n \"C:\\BuildAgent\\work\\11a22189164a1f21\\bm-upd\\Release\\yupdate-exec.pdb\"\n \"C:\\TeamcityAgent\\work\\6a6d135591f2f49f\\src\\out\\Release\\winrt_helper.dll.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\2636_23716\\Yandex.exe\"\n \"\" created file \"%TEMP%\\2636_23716\\Yandex.exe:Zone.Identifier\"\n \"\" created file \"%TEMP%\\lite_installer.log\"\n \"\" created file \"%TEMP%\\distrib_info\"\n \"\" created file \"%TEMP%\\PartnerFile\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\3E40F524-16FA-440A-B919-B44AB355B174\"\n \"3E40F524-16FA-440A-B919-B44AB355B174\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"IESQMMUTEX_0_191\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!wtgj3u0!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\!IETld!Mutex\"\n \"Local\\c:!users!wtgj3u0!appdata!roaming!microsoft!windows!ietldcache!\"\n \"RasPbFile\"\n \"IESQMMUTEX_0_208\"\n \"Local\\WininetStartupMutex\"\n \"Local\\c:!users!wtgj3u0!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\YandexBrowserLiteInstallerMutex-E523E369-4A72-4B13-AD57-5B956174172A\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"dllyupdate.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"yupdate-exec.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"clidmgr.exe\" as clean (type is \"PE32 executable (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"ph.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"d3dcompiler_47.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"service_update.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"show-dlg.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"natives_blob.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$27","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" with commandline \"--spawned_in_protected_dir\" (UID: 00015310-00003368)\n Spawned process \"\" with commandline \"--parent-installer-process-id=3368 --run-as-admin --setup-cmd-li ...\" (UID: 00018456-00001208)\n Spawned process \"yb5FDD.tmp\" with commandline \"--brand-name=yandex --brand-package=\"%TEMP%\\BrandFile\" --clids-f ...\" (UID: 00019402-00002680)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"\" with commandline \"--spawned_in_protected_dir\" (UID: 00015310-00003368)\n Spawned process \"\" with commandline \"--parent-installer-process-id=3368 --run-as-admin --setup-cmd-li ...\" (UID: 00018456-00001208)\n Spawned process \"yb5FDD.tmp\" with commandline \"--brand-name=yandex --brand-package=\"%TEMP%\\BrandFile\" --clids-f ...\" (UID: 00019402-00002680)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: F1:E7:B6:C0:C1:0D:A9:43:6E:CC:04:FF:5F:C3:B6:91:6B:46:CF:4C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign CodeSigning CA - G3, O=GlobalSign nv-sa, C=BE\" (SHA1: B1:A1:F7:B5:2C:D3:1A:CD:15:42:FA:DF:9C:F0:EE:41:D7:61:4F:75; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: C0:E4:9D:2D:7D:90:A5:CD:42:7F:02:D9:12:56:94:D5:D6:EC:5B:71; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Timestamping CA - G2, O=GlobalSign nv-sa, C=BE\" (SHA1: 63:B8:2F:AB:61:F5:83:90:96:95:05:0B:00:24:9C:50:29:33:EC:79; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"http://tr-tr.facebook.com\" (Indicator: \"facebook.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$2b","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00015310-00003368-00000105-13236022564","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 40 calls to GetProcAddress@KERNEL32.DLL at 00015063-00002636-50403-1203-01140480\n Found 40 calls to GetProcAddress@KERNEL32.DLL at 00015310-00003368-64636-1216-00D20480\n Found 40 calls to GetProcAddress@KERNEL32.DLL at 00018456-00001208-20285-1203-00D20480\n Found 40 calls to GetProcAddress@KERNEL32.DLL at 00019402-00002680-32526-1093-01388938\n Found 39 calls to GetProcAddress@KERNEL32.dll at 39021-1633-1001247C\n Found 10 calls to GetProcAddress@KERNEL32.dll at 49791-1817-1000E13F\n Found 30 calls to GetProcAddress@KERNEL32.dll at 49791-1346-1000E21E","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.8573371846","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"00019402-00002680.00000001.22901.013A0000.00000002.mdmp\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00015063-00002636-50403-1108-0113F915\n cpuid at 00015063-00002636-50403-1282-01133080\n cpuid at 00015310-00003368-64636-1287-00D13080\n cpuid at 00015310-00003368-64636-1121-00D1F915\n cpuid at 00018456-00001208-20285-1108-00D1F915\n cpuid at 00018456-00001208-20285-1282-00D13080\n cpuid at 00019402-00002680-32526-20-01386BC6\n cpuid at 00019402-00002680-32526-253-013845D0\n cpuid at 39021-197-1000F79C\n cpuid at 37868-123-00401EC3\n cpuid at 40051-2494-004489F3\n cpuid at 49791-37-1000C366\n cpuid at 49791-859-10008FF0\n cpuid at 54040-165-1018E2D1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to read monitor info","description":"GetMonitorInfoW@USER32.DLL at 00015310-00003368-64636-788-00D18694\n GetMonitorInfoW@USER32.DLL at 00015310-00003368-64636-867-00D09C60\n GetMonitorInfoW@USER32.DLL at 00015310-00003368-12826-788-00D18694","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-62","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"wtgj3u0@yandex[1].txt\" containing the spoofed Windows username \"WTGJ3U0\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$2c","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2d","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"subca.ocsp-certum.com\" seems to be random\n \"clck.yandex.ru\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"OpenGL ES GLSL ES 1.00 SwiftShader 4.0.0.3\"\n Heuristic match: \"OpenGL ES GLSL ES 3.00 SwiftShader 4.0.0.3\"\n Heuristic match: \"OpenGL ES 2.0 SwiftShader 4.0.0.3\"\n Heuristic match: \"OpenGL ES 3.0 SwiftShader 4.0.0.3\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00015310-00003368-64636-1359-00D182AE","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00015063-00002636-50403-738-01131540\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00015310-00003368-64636-748-00D11540\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00018456-00001208-20285-738-00D11540","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2e","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2f","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$31","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$32","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"7739bc7779a8c077be72c077d62dc0771de2bb7705a2c077c868bf7757d1c677bee3bb77616fc0776841be770050be7700000000ad37a6768b2da676b641a67600000000\" to virtual address \"0x75751000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"92e6bb7779a8c077be72c077d62dc0771de2bb7705a2c077bee3bb77616fc0776841be770050be7700000000ad37a6768b2da676b641a67600000000\" to virtual address \"0x75201000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"4053be775858bf77186abf77653cc0770000000000bf5e760000000056cc5e76000000007cca5e76000000003768f3756a2cc077d62dc077000000002069f3750000000029a65e7600000000a48df37500000000f70e5e7600000000\" to virtual address \"0x76051000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"c4ca5e7680bb5e76aa6e5f769fbb5e7608bb5e7646ce5e7661385f76de2f5f76d0d95e760000000017796b764f916b767f6f6b76f4f76b7611f76b76f2836b76857e6b7600000000\" to virtual address \"0x6BFA1000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"d3dcompiler_47.dll\" claims program is from Fri Aug 12 15:20:33 2089","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%TEMP%\\2636_23716\\Yandex.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"Yandex.exe.bin\" (Offset: 335582)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY PE EXE or DLL Windows file download HTTP\" (SID: 2018959, Rev: 3, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"C:\\Yandex.exe\"\n \"yb5FDD.tmp\" allocated memory in \"%TEMP%\\YB_6BC33.tmp\\SETUP.EX_\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$33","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 12 (or more) hosts in at least 2 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Yandex.Browser lite installer\n Microsoft-CryptoAPI/6.1","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$34","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$35","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 11 domains and 11 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":38,"imported_dlls_count":91,"dropped_files_count":0,"extracted_files_count":45,"files_written_count":94,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":12,"dns_resolutions_count":11,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b4f68c07ca3e12c19385ef5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"Yandex.exe","analysis_start_time":"2018-07-18T17:17:05+00:00","indicators_count":{"informative":32,"suspicious":41,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"5.45.205.231","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"213.180.193.82","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"5.45.247.9","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"23.111.11.211","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"87.250.250.55","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"87.250.251.14","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"5.45.205.231","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"5.45.247.12","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"5.45.247.9","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"5.45.247.10","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"5.45.247.13","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"address":"5.45.247.14","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}],"dns_resolutions":[{"domain":"yandex.ocsp-responder.com","address":"5.45.205.231","ttl":563,"country":"Russian Federation","registrar_name":"Key-Systems GmbH","registrar_organization":"Asseco Data Systems S.A.","registrar_creation_date":"2014-02-20T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"subca.ocsp-certum.com","address":"23.111.11.211","ttl":59,"country":"United States","registrar_name":"Key-Systems GmbH","registrar_organization":"Asseco Data Systems S.A.","registrar_creation_date":"2013-12-19T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"storage.ape.yandex.net","address":"87.250.250.55","ttl":533,"country":"Russian Federation","registrar_name":"Safenames Ltd","registrar_name_servers":"NS1.YANDEX.NET","registrar_creation_date":"2000-11-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"download.cdn.yandex.net","address":"5.45.205.231","ttl":1355,"country":"Russian Federation","registrar_name":"Safenames Ltd","registrar_name_servers":"NS1.YANDEX.NET","registrar_creation_date":"2000-11-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"clck.yandex.ru","address":"77.88.21.14","ttl":175,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"cache-ams06.cdn.yandex.net","address":"5.45.247.14","ttl":3542,"country":"Russian Federation","registrar_name":"Safenames Ltd","registrar_name_servers":"NS1.YANDEX.NET","registrar_creation_date":"2000-11-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"cache-ams05.cdn.yandex.net","address":"5.45.247.13","ttl":2157,"country":"Russian Federation","registrar_name":"Safenames Ltd","registrar_name_servers":"NS1.YANDEX.NET","registrar_creation_date":"2000-11-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"cache-ams04.cdn.yandex.net","address":"5.45.247.12","ttl":2163,"country":"Russian Federation","registrar_name":"Safenames Ltd","registrar_name_servers":"NS1.YANDEX.NET","registrar_creation_date":"2000-11-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"cache-ams02.cdn.yandex.net","address":"5.45.247.10","ttl":3117,"country":"Russian Federation","registrar_name":"Safenames Ltd","registrar_name_servers":"NS1.YANDEX.NET","registrar_creation_date":"2000-11-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"cache-ams01.cdn.yandex.net","address":"5.45.247.9","ttl":1692,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"domain":"api.browser.yandex.ru","address":"213.180.204.82","ttl":53,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}],"http_requests":[{"host":"download.cdn.yandex.net","host_ip":"5.45.205.231:80","url":"/browser/newcmp_clang/browser-setup.arc","method":"GET","header":"GET /browser/newcmp_clang/browser-setup.arc HTTP/1.1\nAccept: */*\nUser-Agent: Yandex.Browser lite installer\nHost: download.cdn.yandex.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"host":"cache-ams01.cdn.yandex.net","host_ip":"5.45.247.9:80","url":"/download.cdn.yandex.net/browser/newcmp_clang/browser-setup.arc","method":"GET","header":"GET /download.cdn.yandex.net/browser/newcmp_clang/browser-setup.arc HTTP/1.1\nAccept: */*\nUser-Agent: Yandex.Browser lite installer\nHost: cache-ams01.cdn.yandex.net\nCache-Control: no-cache\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"host":"subca.ocsp-certum.com","host_ip":"23.111.11.211:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w%2FsCEQCTkoVAAWVxX5R%2FKI%2FvyZso","method":"GET","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w%2FsCEQCTkoVAAWVxX5R%2FKI%2FvyZso HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: subca.ocsp-certum.com","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"host":"subca.ocsp-certum.com","host_ip":"23.111.11.211:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I","method":"GET","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: subca.ocsp-certum.com","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"host":"yandex.ocsp-responder.com","host_ip":"5.45.205.231:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CED7RsBDrSNCY%2F9y36lXia8Q%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CED7RsBDrSNCY%2F9y36lXia8Q%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: yandex.ocsp-responder.com","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"host":"yandex.ocsp-responder.com","host_ip":"5.45.205.231:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEDW%2B4oHUybRMPxusv%2FiNIYI%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEDW%2B4oHUybRMPxusv%2FiNIYI%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: yandex.ocsp-responder.com","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"host":"yandex.ocsp-responder.com","host_ip":"5.45.205.231:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEGdor8MNwaMcK9ynWHzW2Mc%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEGdor8MNwaMcK9ynWHzW2Mc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: yandex.ocsp-responder.com","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"host":"yandex.ocsp-responder.com","host_ip":"5.45.205.231:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEAznbZRyGgcQAP7QS0XLajM%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEAznbZRyGgcQAP7QS0XLajM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: yandex.ocsp-responder.com","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}],"processes":[{"pid":2636,"ppid":0,"name":"Yandex.exe","command_line":"","sha256":"43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8","normalized_path":"C:\\Yandex.exe","uid":"00015063-00002636","icon":"$36"},{"pid":3368,"ppid":2636,"name":"Yandex.exe","command_line":"--spawned_in_protected_dir","sha256":"43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8","normalized_path":"%TEMP%\\2636_23716\\Yandex.exe","parent_uid":"00015063-00002636","uid":"00015310-00003368"},{"pid":1208,"ppid":3368,"name":"Yandex.exe","command_line":"--parent-installer-process-id=3368 --run-as-admin --setup-cmd-line=\"fake_browser_arc --brand-name=yandex --distr-info-file=\\\"%TEMP%\\distrib_info\\\" --histogram-download-time=9 --make-browser-default-after-import --ok-button-pressed-time=181725385 --progress-window=196986 --send-statistics --spawned_in_protected_dir --verbose-logging\" --spawned_in_protected_dir","sha256":"43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8","normalized_path":"%TEMP%\\2636_23716\\Yandex.exe","parent_uid":"00015310-00003368","uid":"00018456-00001208"},{"pid":2680,"ppid":1208,"name":"yb5FDD.tmp","command_line":"--brand-name=yandex --brand-package=\"%TEMP%\\BrandFile\" --clids-file=\"%TEMP%\\clids.xml\" --distr-info-file=\"%TEMP%\\distrib_info\" --histogram-download-time=9 --installerdata=\"%TEMP%\\master_preferences\" --make-browser-default-after-import --ok-button-pressed-time=181725385 --partner-package=\"%TEMP%\\PartnerFile\" --progress-window=196986 --send-statistics --source=lite --spawned_in_protected_dir --verbose-logging","sha256":"fe9c374725f70648b6fa4807fcb0c8ba05c24e04dcbde9800d2d8a5c0a3166b7","normalized_path":"%TEMP%\\yb5FDD.tmp","parent_uid":"00018456-00001208","uid":"00019402-00002680"}],"all_imported_dlls":["rtutils.dll","RpcRtRemote.dll","winhttp.dll","sfc.dll","cabinet.dll","dnsapi.dll","IPHLPAPI.DLL","normaliz.dll","rasman.dll","npmproxy.dll","ncrypt.dll","ole32.dll","crypt32.dll","winnsi.dll","cryptnet.dll","msvcrt.dll","lpk.dll","usp10.dll","apphelp.dll","msasn1.dll","userenv.dll","gdi32.dll","user32.dll","cryptbase.dll","urlmon.dll","nlaapi.dll","NapiNSP.dll","bcrypt.dll","setupapi.dll","clbcatq.dll","msimg32.dll","rasadhlp.dll","dhcpcsvc6.dll","webio.dll","sfc_os.dll","imagehlp.dll","msctf.dll","SensApi.dll","cryptsp.dll","cfgmgr32.dll","propsys.dll","wininet.dll","ws2_32.dll","FWPUCLNT.DLL","devrtl.dll","rpcss.dll","comctl32.dll","netprofm.dll","dhcpcsvc.dll","gpapi.dll","winrnr.dll","advapi32.dll","rpcrt4.dll","sspicli.dll","secur32.dll","devobj.dll","kernel32.dll","imm32.dll","profapi.dll","ntmarta.dll","nsi.dll","credssp.dll","bcryptprimitives.dll","dwmapi.dll","pnrpnsp.dll","wintrust.dll","msxml3.dll","msxml3r.dll","dui70.dll","shlwapi.dll","uxtheme.dll","mswsock.dll","wship6.dll","mpr.dll","WindowsCodecs.dll","ntdll.dll","KernelBase.dll","sechost.dll","GdiPlus.dll","version.dll","WSHTCPIP.DLL","rsaenh.dll","schannel.dll","shell32.dll","oleaut32.dll","ExplorerFrame.dll","duser.dll","winmm.dll","iertutil.dll","Wldap32.dll","rasapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dllyupdate.dll","sha256":"dc761e633640a4b8dbc6bb1eec26031a3e82dcadcb649c04d5e0c1ff99c86c0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"yupdate-exec.exe","sha256":"ec75e4a45eea0c455a59c10a1be024e700922f35b48b347be7b921e9e0fe76da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"clidmgr.exe","sha256":"33919f6b6975431c22a06c41c32e5f7092860958c68e453eaff9781bb6ab274a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"ph.dll","sha256":"1d289208baff6c118355b606a09a7b608570d6bdcecb8759e5df7bc2538a0165","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"d3dcompiler_47.dll","sha256":"d628564fbd63f394ccd575df7e8f62dd2de41a548b7cf22f1f40c8271a34190a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"service_update.exe","sha256":"df1935c7876cbd39c15be68afd8558d228222052f2404509ad960ee95a4f1b2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"show-dlg.exe","sha256":"f826bfae379570be0432f147f22cca204b5717fa5d5c9c3013025047c30ab875","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"natives_blob.bin","sha256":"18dd5075de1eecbdb7bb2eeeded7f2e03d91a9b443b89a84c153f3089fa18444","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"wtgj3u0@yandex[1].txt","sha256":"8a27968fe64144ab6c9c64d1e8c1df04306c9c29f7d284a5e2f32f8d495f30de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"browser-setup[1].arc","sha256":"ef01a24dbd98cbfd2f997193f0a44773af855fcef26ac3076e804c3c1a1001f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"install[1]","sha256":"6978e2340a8503590a60b7d19aae46c4ea02a62986b91628d06ae0e35b011e0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"02[1].jpg","sha256":"f720cabae638c8b307decf43a0987f191a761b31c8f023f8e91dfc13019093e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"06[1].jpg","sha256":"d9ec15810e5254acbe63fd283dd1c753aa7472b6c7020ef3aef8d4d970362c55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"04[1].jpg","sha256":"33a99ab1ace8fde740c6d3ff552be07392332f1ac67cb9f1cce0f762be566b02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"03[1].jpg","sha256":"5f15d8adf654ac2d9d2292e42f4f15350e12b0a2ad2be6cea21ea4cdc7490d63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"08[1].jpg","sha256":"3be6078aac08d093e56b6109dd2fd90926e2462cc54e977ad606890528d7ab19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"05[1].jpg","sha256":"367dc7a2454af92cdcdd8765601c4a4d037d4cfb8ab1419f5112cc92eeb5fd3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"07[1].jpg","sha256":"f85b9a2584d10a325e4604b1065e230dab904ce3dc10f6a56208565d6d4d4f81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501","sha256":"665ec9a19dc4cf143497e19d5294fd33c7a30a5844348297fcef2c675f11e372","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"68FAF71AF355126BCA00CE2E73CC7374_77B682CF3AAC7B00161DFFF7DEA4CC8C","sha256":"5477738a0e05540b572a6781085fe54ddbccc683998bd3069690882f6fd0e6d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0","sha256":"d0e3afffd288959e441221e3baf83165e1b9c1502d57f7c7f00ff58dad4c444f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6","sha256":"9d41a9e6a4686f5275bd7ad786446daf3db19a39ec000541392c07a614a55251","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"A6D8662C7600817D67B3C1A03BC53A1B","sha256":"896e071cea5d72c2dc5fee5caca30701ea94b332f218169619600c059d7ba4e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"C8E7EC0C85688F4738F3BE49B104BA67","sha256":"3bc69d749b78fe6dea032a77a317adb76d2a54ae4660bae73dee8c87cc028ca7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"E887E036775F4159E2816B7B9E527E5F_2D47C764F01AFF24FCD352F9AB9152AB","sha256":"731c812a7db886877738c712a78c6c8369c77c5f21ac70f1d8f35b3f347ae914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"E887E036775F4159E2816B7B9E527E5F_8D607D755829D85DB7B65E5E7F9DAA2C","sha256":"c475a2392587816f26ac41bace29b32ecdd2a592b6bc55cd1cb94755401c9d8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"E887E036775F4159E2816B7B9E527E5F_AC271B9C2ADF7E284FD9A99AD1F4E0A2","sha256":"2acb00c32a96963f3144887e75b69dcfd4d9c7e845c93e7afa7ea6ea3b99900d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"E887E036775F4159E2816B7B9E527E5F_DD9BE5D3F96AD52F86FFC9DE94EA2115","sha256":"0fbe13648f10e37a65d1f46ffa556ebcc69d8026d0c6ace37e5bc25387a6abfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Yandex.exe","sha256":"c4ffdce99ce41d9a5eef2f0995a25bb5c560d32a7fe853c162c82b593c1ccf34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"setup.exe","sha256":"e2e14b052583eeef12bb38495d393e24c890ff2033a4e3605838c90ace87af8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"widevinecdm.dll","sha256":"f971e3255696e802f9f0e1cbc6e2ef7eca28c2a1176fa2733d4d947aa82fc3d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"browser_watcher.dll","sha256":"5dc18630b600d7c27967dc4c9b1b8a233b4df0fae7c428ad843d1a3aa880f033","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"nacl64.exe","sha256":"e9b28152b91ed53897e41cf76bcfc18e8fc1569d48b6a55cd7cad06376277a0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"winrt_helper.dll","sha256":"4068ae228535a5a868badacfb8e6ca56417a6280ce2e63c8a7a9ed142cd9f613","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"7z.dll","sha256":"d7f3cce319b94677bece22745d97397239d7b406d7da0fac214932f4038b5896","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"libglesv2.dll","sha256":"cb22a42f9ab2ce4caf26cb6c60dccb7d5efcbb551e504fd2079b319b448e500f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"eventlog_provider.dll","sha256":"6044a6c0b3dacbb11dc0ccdaadfc12e1bf8c002b6dc99fb067a3284f5c8f0f25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"libegl.dll","sha256":"eddef8c8294908da94a617103fdd46fb6d7b4c7fd2bcbf9fbff3742c8d2a58a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"fbpinlauncher.exe","sha256":"bf789ae754220349979c2964bba2c65be4229dfe62d78732aeb7410a726bde9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"widevinecdmadapter.dll","sha256":"8bfe0633cf22867275534eb0ae112db10f6de6a6b18171636e9286f5e999d344","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"v8_context_snapshot.bin","sha256":"012a02ea5e9693d7a58d8d3d90a9a01f6867bb2b2d9f300e113d3105bf5144ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"unpacki.dll","sha256":"1a8ff09fd6d6a29480defde99b452f8d632b294a2d88c42034e40269263f3125","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"notification_helper.exe","sha256":"d13c02bf8f2d68045772a26408c9054340da4bc0a4b7882581155771f23e132f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"browser.exe","sha256":"87fb8cbf81722811da3a914aa983f2e43e93beaa3fba7b87cea0310b86e88b1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"browser_elf.dll","sha256":"31ae17012fae60b30725480aadd21821f6e49b5549b21535c0310d12facde5a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}],"files_written":[{"path":"C:\\Yandex.exe","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"C:\\Yandex.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\distrib_info","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\PartnerFile","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\BrandFile","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\master_preferences","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\clids.xml","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\browser-setup[1].arc","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1B1F4BA66CDBFEC85A20E11BF729AF23_CC184C27C29686D11B7AABEBF2E4A123","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE432C2EE45E016635C9B13C029DA7E7","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\68FAF71AF355126BCA00CE2E73CC7374_15626A0FE56C372A9AC07ECF467921D6","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\856FDBDDFEAC90A3D62D621EBF196637","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\68FAF71AF355126BCA00CE2E73CC7374_77B682CF3AAC7B00161DFFF7DEA4CC8C","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\68FAF71AF355126BCA00CE2E73CC7374_77B682CF3AAC7B00161DFFF7DEA4CC8C","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\install[1]","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E887E036775F4159E2816B7B9E527E5F_DD9BE5D3F96AD52F86FFC9DE94EA2115","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E887E036775F4159E2816B7B9E527E5F_B8E49E8F6A4C23D6D087445ECD8300B7","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5C6DF05E25A197910177D58D92C39968","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\DA67B12F4C0184D0A1ED54E3B43E7FCA","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E887E036775F4159E2816B7B9E527E5F_AC271B9C2ADF7E284FD9A99AD1F4E0A2","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E887E036775F4159E2816B7B9E527E5F_0812138913A4B33616CDA814D007E409","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E887E036775F4159E2816B7B9E527E5F_DD9BE5D3F96AD52F86FFC9DE94EA2115","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E887E036775F4159E2816B7B9E527E5F_AC271B9C2ADF7E284FD9A99AD1F4E0A2","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E887E036775F4159E2816B7B9E527E5F_8D607D755829D85DB7B65E5E7F9DAA2C","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E887E036775F4159E2816B7B9E527E5F_B4AE23614FE54ACA19BB62C4434E7512","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0DA515F703BB9B49479E8697ADB0B955_3892112A29C43C0A69939B6A10C7FF4C","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BA79029EC3FFD076F5DAC2F70A18685","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E887E036775F4159E2816B7B9E527E5F_8D607D755829D85DB7B65E5E7F9DAA2C","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\02[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QIJSVQWS\\03[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\KNHT6272\\04[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\DDA81A73291E20E6ACF6CACA76D5C942_551A8331597B9DD79FA58D60F684F8EF","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B0B1E3C3B1330A269DBEE4BA6313E7B4","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QRW5BOH4\\05[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CQF567AQ\\06[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QRW5BOH4\\07[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QIJSVQWS\\08[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C8E7EC0C85688F4738F3BE49B104BA67","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E887E036775F4159E2816B7B9E527E5F_2D47C764F01AFF24FCD352F9AB9152AB","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E887E036775F4159E2816B7B9E527E5F_B402840140851A349C447197242450DD","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C8E7EC0C85688F4738F3BE49B104BA67","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\A6D8662C7600817D67B3C1A03BC53A1B","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E887E036775F4159E2816B7B9E527E5F_2D47C764F01AFF24FCD352F9AB9152AB","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\A6D8662C7600817D67B3C1A03BC53A1B","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\lite_installer.log","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\yb5FDD.tmp","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BROWSER.PACKED.7Z","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BRAND_BY","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BRAND_COMMON","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BRAND_INT","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BRAND_TB","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BRAND_UA-RU","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BRAND_UA-UK","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BRAND_UA-YANDEX","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\BRAND_YANDEX","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%TEMP%\\YB_6BC33.tmp\\SEARCHBAND.EXE","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\System32\\en-US\\ntdll.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SESSION MANAGER\\","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CACHE\\","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\3E40F524-16FA-440A-B919-B44AB355B174","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"3E40F524-16FA-440A-B919-B44AB355B174","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\c:!users!wtgj3u0!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\c:!users!wtgj3u0!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\c:!users!wtgj3u0!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\YandexBrowserLiteInstallerMutex-E523E369-4A72-4B13-AD57-5B956174172A","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Local\\c:!users!wtgj3u0!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\YandexBrowserLiteInstallerMutex-E523E369-4A72-4B13-AD57-5B956174172A","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wtgj3u0!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wtgj3u0!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wtgj3u0!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wtgj3u0!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\YandexBrowserInstaller-0B3B78DD-AC06-4C74-9DA3-62C8809FED32","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]},{"name":"Global\\YandexBrowserInstaller-0B3B78DD-AC06-4C74-9DA3-62C8809FED32","sources":[{"report_type":"sandbox","report_id":"5b4f68c07ca3e12c19385ef5"}]}]}},"report_ids":{"sandbox_job_ids":["5b4f68c07ca3e12c19385ef5"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Sample 43ba23cf5e24… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 43ba23cf5e24…. Threat score 100/100. 2/29 AV engines flagged this file. 9 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 43ba23cf5e24… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 43ba23cf5e24…. Threat score 100/100. 2/29 AV engines flagged this file. 9 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/43ba23cf5e2457a27ba980cf92f20ab8659afd21d80c162ab7a0aec68de562f8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 43ba23cf5e24… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 43ba23cf5e24…. Threat score 100/100. 2/29 AV engines flagged this file. 9 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]