Edit tour
Windows
Analysis Report
SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe |
| Analysis ID: | 1552608 |
| MD5: | ffbe76f6a6ab2e4a2c1dfe53bccae08f |
| SHA1: | 6686fc4829a3ec4f40654d566d6382bcf9be8206 |
| SHA256: | 518ed5183136a449ac608c54dd26f896cfcbe52405282fdbfe1ca80b5ce5d6b0 |
| Tags: | exe |
| Infos: |  |
 | |
Detection
| Score: | 48 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Compliance
| Score: | 34 |
| Range: | 0 - 100 |
Signatures
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Drops PE files with benign system names
Found suspicious ZIP file
Overwrites Mozilla Firefox settings
Query firmware table information (likely to detect VMs)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes many files with high entropy
Adds / modifies Windows certificates
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
EXE planting / hijacking vulnerabilities found
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Is looking for software installed on the system
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches the installation path of Mozilla Firefox
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64
SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe (PID: 7304 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Win32.Appl ication.Ag ent.NSIF6L .17895.288 80.exe" MD5: FFBE76F6A6AB2E4A2C1DFE53BCCAE08F) - SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.tmp (PID: 7320 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-N0G PG.tmp\Sec uriteInfo. com.Win32. Applicatio n.Agent.NS IF6L.17895 .28880.tmp " /SL5="$2 0452,17955 33,918016, C:\Users\u ser\Deskto p\Securite Info.com.W in32.Appli cation.Age nt.NSIF6L. 17895.2888 0.exe" MD5: 04FFDF77022AB3DCA17CC5BB9BB2B7CD) 
cmd.exe (PID: 7384 cmdline: "C:\Window s\system32 \cmd.exe" "C:\Window s\system32 \cmd.exe" /S /C ""C: \Users\use r\AppData\ Local\Temp \is-207R9. tmp\tt-ins taller-hel per.exe" - -getuid > "C:\Users\ user\AppDa ta\Local\T emp\is-207 R9.tmp\~ex ecwithresu lt.txt"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7392 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
tt-installer-helper.exe (PID: 7432 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\is-207 R9.tmp\tt- installer- helper.exe " --getuid MD5: 71AE055CBC9FBAD09AF9B5CA73D75DFF) - 7za.exe (PID: 7796 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-207 R9.tmp\7za .exe" x "C :\Users\us er\AppData \Local\Tem p\is-207R9 .tmp\tt-in stall.zip" -o"C:\Pro gram Files (x86)\Tel amon Clean er\" * -r -aoa MD5: DFD1CF824C781069DEF1D239A626D43E) - conhost.exe (PID: 7804 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - tt-cleaner.exe (PID: 7856 cmdline:
"C:\Progra m Files (x 86)\Telamo n Cleaner\ tt-cleaner .exe" --in stall --l= t MD5: F3AC01439485955780C640B794CBBE15) - schtasks.exe (PID: 7928 cmdline:
"schtasks" /create / sc "onlogo n" /tn "Te lamon Clea ner" /tr " \"C:\Progr am Files ( x86)\Telam on Cleaner \tt-cleane r.exe\" -- autorun" / rl "highes t" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7940 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 7968 cmdline:
"schtasks" /create / tn "Telamo n Cleaner Autorun Af ter Wake U p" /XML "C :\Program Files (x86 )\Telamon Cleaner\co nfig\autor unConfig.x ml" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7980 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5596 cmdline:
"C:\Window s\system32 \cmd.exe" "C:\Window s\system32 \cmd.exe" /S /C ""C: \Users\use r\AppData\ Local\Temp \is-207R9. tmp\tt-ins taller-hel per.exe" - -getyavid --filename =SecuriteI nfo.com.Wi n32.Applic ation.Agen t.NSIF6L.1 7895.28880 .exe > "C: \Users\use r\AppData\ Local\Temp \is-207R9. tmp\~execw ithresult. txt"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 6096 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - tt-installer-helper.exe (PID: 3752 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-207 R9.tmp\tt- installer- helper.exe " --getyav id --filen ame=Securi teInfo.com .Win32.App lication.A gent.NSIF6 L.17895.28 880.exe MD5: 71AE055CBC9FBAD09AF9B5CA73D75DFF) - downloader.exe (PID: 2500 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-207 R9.tmp\dow nloader.ex e" --partn er 701357 --distr /q uiet /msic l "VID=201 ILIGHT=1 YABROWSER= y YBSENDST AT=y" MD5: B9314504E592D42CB36534415A62B3AF) 
YandexPackSetup.exe (PID: 4948 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\7F4987 FB1A6E43d6 9E3E94B29E B75926\Yan dexPackSet up.exe" /q uiet /msic l "VID=201 ILIGHT=1 YABROWSER= y YBSENDST AT=y" MD5: F78A953ABAEEA2A78B60390337BD309C) - downloader.exe (PID: 5308 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\is-207R 9.tmp\down loader.exe --stat dw nldr/p=701 357/cnt=0/ dt=7/ct=1/ rt=0 --dh 2232 --st 1731133080 MD5: B9314504E592D42CB36534415A62B3AF) - tt-cleaner.exe (PID: 7664 cmdline:
"C:\Progra m Files (x 86)\Telamo n Cleaner\ tt-cleaner .exe" MD5: F3AC01439485955780C640B794CBBE15)
- tt-cleaner.exe (PID: 8072 cmdline:
"C:\Progra m Files (x 86)\Telamo n Cleaner\ tt-cleaner .exe" --au torun MD5: F3AC01439485955780C640B794CBBE15) - QtWebEngineProcess.exe (PID: 7476 cmdline:
"C:\Progra m Files (x 86)\Telamo n Cleaner\ QtWebEngin eProcess.e xe" --type =renderer --no-sandb ox --disab le-gpu-mem ory-buffer -video-fra mes --enab le-threade d-composit ing --use- gl=angle - -enable-fe atures=All owContentI nitiatedDa taUrlNavig ations,Tra cingServic eInProcess --disable -features= Background Fetch,Blin kGenProper tyTrees,Mo joVideoCap ture,Netwo rkServiceN otSupporte d,OriginTr ials,SmsRe ceiver,Use PdfComposi torService ForPrint,U seSurfaceL ayerForVid eo,VizDisp layComposi tor,WebAut henticatio n,WebAuthe nticationC able,WebPa yments,Web USB --lang =en-CH --w ebengine-s chemes=qrc :sLV --dev ice-scale- factor=1 - -num-raste r-threads= 2 --enable -main-fram e-before-a ctivation --service- request-ch annel-toke n=13200293 8196997539 44 --rende rer-client -id=3 --mo jo-platfor m-channel- handle=325 6 /prefetc h:1 MD5: C45C14CB2D5210262A3E8A7FCE1DCB94)
msiexec.exe (PID: 7768 cmdline: C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077) - msiexec.exe (PID: 6156 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng E5FBDD7 FD5622990E E00A256BFE 64E45 MD5: 9D09DC1EDA745A5F87553048E57620CF) - lite_installer.exe (PID: 4268 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\F82B65 CD-DDB7-42 05-9C8F-75 20B2E190EC \lite_inst aller.exe" --use-use r-default- locale --s ilent --re mote-url=h ttp://down loader.yan dex.net/do wnloadable _soft/brow ser/pseudo portal-ru/ Yandex.exe --send-st atistics - -YBSENDSTA T --cumtom -welcome-p age=https: //browser. yandex.ru/ promo/welc ome_com/5/ --YABROWS ER MD5: AAFDFAA7A989DDB216510FC9AE5B877F) - seederexe.exe (PID: 7312 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\4F095C B1-ECE3-4F 28-BD6D-6A 5874599F21 \seederexe .exe" "--y qs=" "--yh p=" "--ili ght=1" "-- oem=" "--n opin=n" "- -pin_custo m=n" "--pi n_desktop= n" "--pin_ taskbar=y" "--locale =ch" "--br owser=y" " --browser_ default=" "--logleve l=trace" " --ess=" "- -clids=C:\ Users\user \AppData\L ocal\Temp\ clids-yase arch.xml" "--sender= C:\Users\u ser\AppDat a\Local\Te mp\F6677A4 1-6A2A-4DD 7-AE6A-7CF 5D3BB6293\ sender.exe " "--is_el evated=yes " "--ui_le vel=2" "-- good_token =1" "--no_ opera=n" MD5: 225BA20FA3EDD13C9C72F600FF90E6CB) - sender.exe (PID: 7964 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\F6677A4 1-6A2A-4DD 7-AE6A-7CF 5D3BB6293\ sender.exe --send "/ status.xml ?clid=1015 4070-201&u uid=766fba 81-1141-44 1E-AB11-D8 36615Beb82 &vnt=Windo ws 10x64&f ile-no=8%0 A15%0A25%0 A45%0A57%0 A61%0A103% 0A111%0A" MD5: F1A8F60C018647902E70CF3869E1563F)
{9F8A1EE2-E35C-453A-9DED-925403FA913E}.exe (PID: 1104 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\{9F8A1 EE2-E35C-4 53A-9DED-9 25403FA913 E}.exe" -- job-name=y BrowserDow nloader-{E 7645155-90 A7-40DC-9A 3C-B01031D BD059} --s end-statis tics --loc al-path=C: \Users\use r\AppData\ Local\Temp \{9F8A1EE2 -E35C-453A -9DED-9254 03FA913E}. exe --YABR OWSER --cu mtom-welco me-page=ht tps://brow ser.yandex .ru/promo/ welcome_co m/5/ --sil ent --remo te-url=htt p://downlo ader.yande x.net/down loadable_s oft/browse r/pseudopo rtal-ru/Ya ndex.exe?c lid=101540 49-201&ui= 766fba81-1 141-441E-A B11-D83661 5Beb82 --u se-user-de fault-loca le --YBSEN DSTAT MD5: 6E358158AB5BE3E47DEFF097020A2A42) - yb67C3.tmp (PID: 1820 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\yb67C3 .tmp" --ab t-config-r esource-fi le="C:\Use rs\user\Ap pData\Loca l\Temp\abt _config_re source" -- abt-update -path="C:\ Users\user \AppData\L ocal\Temp\ f367c220-b a68-4acf-8 52a-eee1c7 e145e8.tmp " --brand- name=yande x --brand- package="C :\Users\us er\AppData \Local\Tem p\BrandFil e" --clids -file="C:\ Users\user \AppData\L ocal\Temp\ clids.xml" --cumtom- welcome-pa ge=https:/ /browser.y andex.ru/p romo/welco me_com/5/ --install- start-time -no-uac=69 07571237 - -installer -brand-id= yandex --i nstaller-p artner-id= pseudoport al-ru --in stallerdat a="C:\User s\user\App Data\Local \Temp\mast er_prefere nces" --jo b-name=yBr owserDownl oader-{E76 45155-90A7 -40DC-9A3C -B01031DBD 059} --loc al-path="C :\Users\us er\AppData \Local\Tem p\{9F8A1EE 2-E35C-453 A-9DED-925 403FA913E} .exe" --pa rtner-pack age="C:\Us ers\user\A ppData\Loc al\Temp\Pa rtnerFile" --progres s-window=0 --remote- url=http:/ /downloade r.yandex.n et/downloa dable_soft /browser/p seudoporta l-ru/Yande x.exe?clid =10154049- 201&ui=766 fba81-1141 -441E-AB11 -D836615Be b82 --send -statistic s --silent --source= lite --use -user-defa ult-locale --variati ons-update -path="C:\ Users\user \AppData\L ocal\Temp\ 8e0612b6-1 b28-444c-a 027-5ec0b6 40ba1d.tmp " --verbos e-logging --yabrowse r --yandex -website-i con-file=" C:\Users\u ser\AppDat a\Local\Te mp\website .ico" --yb sendstat MD5: 6CB09658AD2D00003F20230BDE499A1E) - setup.exe (PID: 1420 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\YB_C5C A6.tmp\set up.exe" -- install-ar chive="C:\ Users\user \AppData\L ocal\Temp\ YB_C5CA6.t mp\BROWSER .PACKED.7Z " --abt-co nfig-resou rce-file=" C:\Users\u ser\AppDat a\Local\Te mp\abt_con fig_resour ce" --abt- update-pat h="C:\User s\user\App Data\Local \Temp\f367 c220-ba68- 4acf-852a- eee1c7e145 e8.tmp" -- brand-name =yandex -- brand-pack age="C:\Us ers\user\A ppData\Loc al\Temp\Br andFile" - -clids-fil e="C:\User s\user\App Data\Local \Temp\clid s.xml" --c umtom-welc ome-page=h ttps://bro wser.yande x.ru/promo /welcome_c om/5/ --in stall-star t-time-no- uac=690757 1237 --ins taller-bra nd-id=yand ex --insta ller-partn er-id=pseu doportal-r u --instal lerdata="C :\Users\us er\AppData \Local\Tem p\master_p references " --job-na me=yBrowse rDownloade r-{E764515 5-90A7-40D C-9A3C-B01 031DBD059} --local-p ath="C:\Us ers\user\A ppData\Loc al\Temp\{9 F8A1EE2-E3 5C-453A-9D ED-925403F A913E}.exe " --partne r-package= "C:\Users\ user\AppDa ta\Local\T emp\Partne rFile" --p rogress-wi ndow=0 --r emote-url= http://dow nloader.ya ndex.net/d ownloadabl e_soft/bro wser/pseud oportal-ru /Yandex.ex e?clid=101 54049-201& ui=766fba8 1-1141-441 E-AB11-D83 6615Beb82 --send-sta tistics -- silent --s ource=lite --use-use r-default- locale --v ariations- update-pat h="C:\User s\user\App Data\Local \Temp\8e06 12b6-1b28- 444c-a027- 5ec0b640ba 1d.tmp" -- verbose-lo gging --ya browser -- yandex-web site-icon- file="C:\U sers\user\ AppData\Lo cal\Temp\w ebsite.ico " --ybsend stat MD5: 5CD6C5AFC57B002023838E55DC313BB3) - setup.exe (PID: 2784 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\YB_C5CA 6.tmp\setu p.exe --ty pe=crashpa d-handler /prefetch: 4 --monito r-self-ann otation=pt ype=crashp ad-handler "--databa se=C:\User s\user\App Data\Local \Yandex\Ya ndexBrowse r\User Dat a\Crashpad " --url=ht tps://cras h-reports. browser.ya ndex.net/s ubmit --an notation=m achine_id= 3f5c7cd44d 1f6ac76993 4cada267b4 df --annot ation=main _process_p id=1420 -- annotation =plat=Win3 2 --annota tion=prod= Yandex --a nnotation= session_lo gout=False --annotat ion=ver=24 .10.2.705 --initial- client-dat a=0x344,0x 348,0x34c, 0x304,0x35 0,0xeccbe8 ,0xeccbf4, 0xeccc00 MD5: 5CD6C5AFC57B002023838E55DC313BB3) 
Yandex.exe (PID: 6036 cmdline: C:\Users\u ser\AppDat a\Local\Ya ndex\YaPin \Yandex.ex e --silent MD5: A441A9EE7E6C3F26F3DBAA2F1F10BAB0) - explorer.exe (PID: 1516 cmdline:
C:\Users\u ser\AppDat a\Local\Ya ndex\YaPin \Yandex.ex e --silent /pin-path ="C:\Users \user\AppD ata\Local\ Yandex\YaP in\Yandex. lnk" --is- pinning MD5: A441A9EE7E6C3F26F3DBAA2F1F10BAB0) - clidmgr.exe (PID: 5912 cmdline:
"C:\Users\ user\AppDa ta\Local\Y andex\Yand exBrowser\ Applicatio n\clidmgr. exe" --app id=yabrows er --vendo r-xml-path ="C:\Users \user\AppD ata\Local\ Temp\clids .xml" MD5: 86B97526F262ECF87ED7ECD6C7EB4218) - conhost.exe (PID: 1148 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - clidmgr.exe (PID: 416 cmdline:
"C:\Users\ user\AppDa ta\Local\Y andex\Yand exBrowser\ Applicatio n\clidmgr. exe" --app id=yabrows er --vendo r-xml-path ="C:\Users \user\AppD ata\Local\ Yandex\Yan dexBrowser \Temp\sour ce1420_187 6138810\Br owser-bin\ clids_yand ex_second. xml" MD5: 86B97526F262ECF87ED7ECD6C7EB4218) - conhost.exe (PID: 6236 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
browser.exe (PID: 7108 cmdline: "C:\Users\ user\AppDa ta\Local\Y andex\Yand exBrowser\ Applicatio n\browser. exe" --pro gress-wind ow=0 --ins tall-start -time-no-u ac=6907571 237 MD5: 72BC2A73B7AB14FFEC64AD8FEA21DE44) - browser.exe (PID: 6172 cmdline:
C:\Users\u ser\AppDat a\Local\Ya ndex\Yande xBrowser\A pplication \browser.e xe --type= crashpad-h andler "-- user-data- dir=C:\Use rs\user\Ap pData\Loca l\Yandex\Y andexBrows er\User Da ta" /prefe tch:4 --mo nitor-self -annotatio n=ptype=cr ashpad-han dler "--da tabase=C:\ Users\user \AppData\L ocal\Yande x\YandexBr owser\User Data\Cras hpad" --ur l=https:// crash-repo rts.browse r.yandex.n et/submit --annotati on=machine _id= --ann otation=ma in_process _pid=7108 --annotati on=metrics _client_id =fb5b54aed d4644afa97 20a1c72e20 ce1 --anno tation=pla t=Win32 -- annotation =prod=Yand ex --annot ation=sess ion_logout =False --a nnotation= ver=24.10. 2.705 --in itial-clie nt-data=0x 160,0x164, 0x168,0x13 c,0x16c,0x 63629a24,0 x63629a30, 0x63629a3c MD5: 72BC2A73B7AB14FFEC64AD8FEA21DE44) - browser.exe (PID: 7568 cmdline:
"C:\Users\ user\AppDa ta\Local\Y andex\Yand exBrowser\ Applicatio n\browser. exe" --typ e=gpu-proc ess --user -id=766fba 81-1141-44 1E-AB11-D8 36615Beb82 --brand-i d=yandex - -partner-i d=pseudopo rtal-ru -- gpu-prefer ences=UAAA AAAAAADgAA AMAAAAAAAA AAAAAAAAAA BgAAEAAAAA AAAABAAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA ABAAAAAAAA AAEAAAAAAA AAAIAAAAAA AAAAgAAAAA AAAA --gpu -process-k ind=sandbo xed --fiel d-trial-ha ndle=2744, i,21191010 8418698178 3,13586244 7542789564 24,262144 --enable-f eatures=In stallerNew Identity20 24 --varia tions-seed -version - -mojo-plat form-chann el-handle= 2736 /pref etch:2 MD5: 72BC2A73B7AB14FFEC64AD8FEA21DE44) - browser.exe (PID: 7736 cmdline:
"C:\Users\ user\AppDa ta\Local\Y andex\Yand exBrowser\ Applicatio n\browser. exe" --typ e=gpu-proc ess --user -id=766fba 81-1141-44 1E-AB11-D8 36615Beb82 --brand-i d=yandex - -partner-i d=pseudopo rtal-ru -- gpu-prefer ences=UAAA AAAAAADgAA AMAAAAAAAA AAAAAAAAAA BgAAEAAAAA AAAABAAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA ABAAAAAAAA AAEAAAAAAA AAAIAAAAAA AAAAgAAAAA AAAA --use -gl=disabl ed --gpu-p rocess-kin d=trampoli ne --field -trial-han dle=2556,i ,211910108 4186981783 ,135862447 5427895642 4,262144 - -enable-fe atures=Ins tallerNewI dentity202 4 --variat ions-seed- version -- mojo-platf orm-channe l-handle=3 512 /prefe tch:6 MD5: 72BC2A73B7AB14FFEC64AD8FEA21DE44) - browser.exe (PID: 7524 cmdline:
"C:\Users\ user\AppDa ta\Local\Y andex\Yand exBrowser\ Applicatio n\browser. exe" --typ e=utility --utility- sub-type=n etwork.moj om.Network Service -- lang=ru -- service-sa ndbox-type =none --us er-id=766f ba81-1141- 441E-AB11- D836615Beb 82 --brand -id=yandex --partner -id=pseudo portal-ru --process- name="Netw ork Servic e" --field -trial-han dle=2840,i ,211910108 4186981783 ,135862447 5427895642 4,262144 - -enable-fe atures=Ins tallerNewI dentity202 4 --variat ions-seed- version -- mojo-platf orm-channe l-handle=4 544 --brve r=24.10.2. 705 /prefe tch:3 MD5: 72BC2A73B7AB14FFEC64AD8FEA21DE44)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: | ||
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Code function: | 4_2_00AC56A0 | |
| Source: | Code function: | 4_2_00AC5F10 | |
| Source: | Code function: | 4_2_00AC63B0 | |
| Source: | Code function: | 4_2_00AC58E0 | |
| Source: | Code function: | 4_2_00AC5C70 | |
| Source: | Code function: | ||