e36891d982acaa5b12e27cf55fae3581e29dd0ef35d0dd98ae93296034b5177e

Resubmissions

17-10-2022 19:36

221017-ybkpeacgf7 10

17-10-2022 17:27

221017-v1ye1scfdl 8

17-10-2022 14:10

221017-rg6qhacbgq 8

Analysis

max time kernel
151s
max time network
1803s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-10-2022 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Yandex.exe
Size

2.4MB
MD5

09bb3df23630c9111a5860cb96bde6ad
SHA1

217d78e392e7ef295596862175eb353977a85738
SHA256

e36891d982acaa5b12e27cf55fae3581e29dd0ef35d0dd98ae93296034b5177e
SHA512

8a216eac67b5d4bc54781a166cd48ab8a68e0b983fb346c14030eca060046fe7484f76fa4eb006164c5781684cad82f7d29afaf9514e70c81feffe70df402f31
SSDEEP

49152:CsEpJsMKSCZrcPEGuW9Q+iA5H5u8QeuL:CsEpuBZrcPEGuWMxt

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 25 IoCs

Processes:

yb6BCE.tmpsetup.exesetup.exesetup.exeservice_update.exeservice_update.exeservice_update.exeservice_update.exeservice_update.exeservice_update.exeservice_update.exeYandex.execlidmgr.execlidmgr.execlidmgr.execlidmgr.exeSEARCHBAND.EXEsearchbandapp.exebrowser.exebrowser.exebrowser.exebrowser.exebrowser.exebrowser.exebrowser_diagnostics.exe

pid	process
2008	yb6BCE.tmp
676	setup.exe
1628	setup.exe
1120	setup.exe
1476	service_update.exe
2012	service_update.exe
1684	service_update.exe
2024	service_update.exe
2044	service_update.exe
1228	service_update.exe
1992	service_update.exe
904	Yandex.exe
972	clidmgr.exe
1616	clidmgr.exe
1280	clidmgr.exe
1524	clidmgr.exe
2012	SEARCHBAND.EXE
992	searchbandapp.exe
568	browser.exe
1200	browser.exe
2028	browser.exe
1584	browser.exe
1664	browser.exe
2084	browser.exe
2624	browser_diagnostics.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

browser.exesearchbandapp.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	browser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	searchbandapp.exe

Loads dropped DLL 53 IoCs

Processes:

Yandex.exeYandex.exeyb6BCE.tmpsetup.exesetup.exeservice_update.exeservice_update.exeservice_update.exeYandex.exeMsiExec.exebrowser.exebrowser.exebrowser.exebrowser.exebrowser.exe

pid	process
544	Yandex.exe
544	Yandex.exe
544	Yandex.exe
1536	Yandex.exe
2008	yb6BCE.tmp
676	setup.exe
676	setup.exe
676	setup.exe
1628	setup.exe
1628	setup.exe
1628	setup.exe
1476	service_update.exe
1476	service_update.exe
1476	service_update.exe
1476	service_update.exe
1476	service_update.exe
1684	service_update.exe
1684	service_update.exe
2044	service_update.exe
1684	service_update.exe
1628	setup.exe
1628	setup.exe
1628	setup.exe
1628	setup.exe
1628	setup.exe
904	Yandex.exe
1628	setup.exe
1628	setup.exe
1628	setup.exe
1628	setup.exe
1628	setup.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
568	browser.exe
1200	browser.exe
568	browser.exe
568	browser.exe
1584	browser.exe
1584	browser.exe
1664	browser.exe
1664	browser.exe
2084	browser.exe
2084	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

browser.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\YandexBrowserAutoLaunch_45886AE68CD319C7351FF54A1DBD4B87 = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --shutdown-if-not-closed-by-system-restart"	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	browser.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 11 IoCs

Processes:

service_update.exeservice_update.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	service_update.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	service_update.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	service_update.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_BD3730E24B5091FBD030C756E510C3A2	service_update.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\USXIMQLE.txt	service_update.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Yandex\ui	service_update.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	service_update.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	service_update.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_BD3730E24B5091FBD030C756E510C3A2	service_update.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\USXIMQLE.txt	service_update.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\_[1].js	service_update.exe

Drops file in Program Files directory 3 IoCs

Processes:

service_update.exeservice_update.exe

description	ioc	process
File created	C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe	service_update.exe
File opened for modification	C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe	service_update.exe
File opened for modification	C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\debug.log	service_update.exe

Drops file in Windows directory 17 IoCs

Processes:

service_update.exemsiexec.exeservice_update.exebrowser.exe

description	ioc	process
File created	C:\Windows\Tasks\Repairing Yandex Browser update service.job	service_update.exe
File opened for modification	C:\Windows\Installer\6e5b1c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI605B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Tasks\Update for Yandex Browser.job	service_update.exe
File opened for modification	C:\Windows\Installer\MSI6510.tmp	msiexec.exe
File created	C:\Windows\Installer\6e5b20.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI690A.tmp	msiexec.exe
File created	C:\Windows\Installer\6e5b1e.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6211.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6251.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68E9.tmp	msiexec.exe
File created	C:\Windows\Tasks\System update for Yandex Browser.job	service_update.exe
File opened for modification	C:\Windows\Installer\MSI65EB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6e5b1e.ipi	msiexec.exe
File created	C:\Windows\Tasks\Обновление Браузера Яндекс.job	browser.exe
File created	C:\Windows\Installer\6e5b1c.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

browser.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	browser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	browser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	browser.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

service_update.exeservice_update.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\Yandex	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3F0B883-F4A2-4D20-B170-575387617325}\92-64-c9-6a-b1-99	service_update.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	service_update.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3F0B883-F4A2-4D20-B170-575387617325}\WpadDecisionReason = "1"	service_update.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-64-c9-6a-b1-99\WpadDecisionReason = "1"	service_update.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-64-c9-6a-b1-99\WpadDecision = "0"	service_update.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	service_update.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\Yandex\UICreated_SYSTEM = "1"	service_update.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-64-c9-6a-b1-99\WpadDecisionTime = 90197a5943e2d801	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Yandex	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	service_update.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	service_update.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	service_update.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3F0B883-F4A2-4D20-B170-575387617325}\WpadNetworkName = "Network 3"	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-64-c9-6a-b1-99	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	service_update.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	service_update.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	service_update.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3F0B883-F4A2-4D20-B170-575387617325}\WpadDecisionTime = 90197a5943e2d801	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	service_update.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	service_update.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3F0B883-F4A2-4D20-B170-575387617325}	service_update.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	service_update.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	service_update.exe

Modifies registry class 64 IoCs

Processes:

browser.exesetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\SystemFileAssociations\.jpeg\shell	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.infected	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.xhtml\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexHTML.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexGIF.L5W3RHVM4G72LK3XVS2RJZEJ54	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexXML.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open\command	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.gif	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\https\DefaultIcon	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexBrowser.crx\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexPNG.L5W3RHVM4G72LK3XVS2RJZEJ54\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexSWF.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexTXT.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexWEBM.L5W3RHVM4G72LK3XVS2RJZEJ54\ = "Yandex Browser WEBM Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexCSS.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\yabrowser\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexCSS.L5W3RHVM4G72LK3XVS2RJZEJ54\ = "Yandex Browser CSS Document"	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexTXT.L5W3RHVM4G72LK3XVS2RJZEJ54\ = "Yandex Browser TXT Document"	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexWEBP.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\yabrowser\shell\open\command	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexHTML.L5W3RHVM4G72LK3XVS2RJZEJ54\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.crx\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexFB2.L5W3RHVM4G72LK3XVS2RJZEJ54\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,-122"	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.htm	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.html\OpenWithProgids\YandexHTML.L5W3RHVM4G72LK3XVS2RJZEJ54	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.epub\OpenWithProgids\YandexEPUB.L5W3RHVM4G72LK3XVS2RJZEJ54	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexGIF.L5W3RHVM4G72LK3XVS2RJZEJ54\shell	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexTIFF.L5W3RHVM4G72LK3XVS2RJZEJ54\shell	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexPDF.L5W3RHVM4G72LK3XVS2RJZEJ54\ = "Yandex Browser PDF Document"	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexWEBP.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexWEBM.L5W3RHVM4G72LK3XVS2RJZEJ54\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,-132"	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\yabrowser\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,0"	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.htm\ = "YandexHTML.L5W3RHVM4G72LK3XVS2RJZEJ54"	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\https	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\SystemFileAssociations\.png\shell\image_search\command	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexXML.L5W3RHVM4G72LK3XVS2RJZEJ54\ = "Yandex Browser XML Document"	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.gif\OpenWithProgids	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexEPUB.L5W3RHVM4G72LK3XVS2RJZEJ54\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexPDF.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open\command	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.fb2	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.swf	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexINFE.L5W3RHVM4G72LK3XVS2RJZEJ54\ = "Malware Infected File"	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexTIFF.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1"	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\SystemFileAssociations\.jpeg\shell\image_search	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexHTML.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open\command	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexCRX.L5W3RHVM4G72LK3XVS2RJZEJ54\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexWEBM.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexPDF.L5W3RHVM4G72LK3XVS2RJZEJ54	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\yabrowser\shell\ = "open"	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.jpg\OpenWithProgids\YandexJPEG.L5W3RHVM4G72LK3XVS2RJZEJ54	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexWEBP.L5W3RHVM4G72LK3XVS2RJZEJ54\shell	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\SystemFileAssociations\.gif	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.gif	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexCRX.L5W3RHVM4G72LK3XVS2RJZEJ54\ = "Yandex Browser CRX Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.jpg	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.webp	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\https\shell\open\command	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexCRX.L5W3RHVM4G72LK3XVS2RJZEJ54\shell	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexSWF.L5W3RHVM4G72LK3XVS2RJZEJ54\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1"	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\https\URL Protocol	browser.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\SystemFileAssociations\.tif	browser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexBrowser.crx\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\",0"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\YandexEPUB.L5W3RHVM4G72LK3XVS2RJZEJ54\ = "Yandex Browser EPUB Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.shtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.gif\OpenWithProgids\YandexGIF.L5W3RHVM4G72LK3XVS2RJZEJ54	browser.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Yandex.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Yandex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Yandex.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Yandex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	Yandex.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

setup.exeservice_update.exeservice_update.exeservice_update.exeservice_update.exeservice_update.exeservice_update.exeSEARCHBAND.EXEmsiexec.exesearchbandapp.exebrowser.exebrowser.exebrowser.exebrowser.exe

pid	process
1628	setup.exe
1476	service_update.exe
2012	service_update.exe
1684	service_update.exe
1684	service_update.exe
2044	service_update.exe
1228	service_update.exe
1992	service_update.exe
1628	setup.exe
2012	SEARCHBAND.EXE
1564	msiexec.exe
1564	msiexec.exe
992	searchbandapp.exe
1628	setup.exe
568	browser.exe
1584	browser.exe
1664	browser.exe
2084	browser.exe
568	browser.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

SEARCHBAND.EXEmsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2012	SEARCHBAND.EXE
Token: SeIncreaseQuotaPrivilege	2012	SEARCHBAND.EXE
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeSecurityPrivilege	1564	msiexec.exe
Token: SeCreateTokenPrivilege	2012	SEARCHBAND.EXE
Token: SeAssignPrimaryTokenPrivilege	2012	SEARCHBAND.EXE
Token: SeLockMemoryPrivilege	2012	SEARCHBAND.EXE
Token: SeIncreaseQuotaPrivilege	2012	SEARCHBAND.EXE
Token: SeMachineAccountPrivilege	2012	SEARCHBAND.EXE
Token: SeTcbPrivilege	2012	SEARCHBAND.EXE
Token: SeSecurityPrivilege	2012	SEARCHBAND.EXE
Token: SeTakeOwnershipPrivilege	2012	SEARCHBAND.EXE
Token: SeLoadDriverPrivilege	2012	SEARCHBAND.EXE
Token: SeSystemProfilePrivilege	2012	SEARCHBAND.EXE
Token: SeSystemtimePrivilege	2012	SEARCHBAND.EXE
Token: SeProfSingleProcessPrivilege	2012	SEARCHBAND.EXE
Token: SeIncBasePriorityPrivilege	2012	SEARCHBAND.EXE
Token: SeCreatePagefilePrivilege	2012	SEARCHBAND.EXE
Token: SeCreatePermanentPrivilege	2012	SEARCHBAND.EXE
Token: SeBackupPrivilege	2012	SEARCHBAND.EXE
Token: SeRestorePrivilege	2012	SEARCHBAND.EXE
Token: SeShutdownPrivilege	2012	SEARCHBAND.EXE
Token: SeDebugPrivilege	2012	SEARCHBAND.EXE
Token: SeAuditPrivilege	2012	SEARCHBAND.EXE
Token: SeSystemEnvironmentPrivilege	2012	SEARCHBAND.EXE
Token: SeChangeNotifyPrivilege	2012	SEARCHBAND.EXE
Token: SeRemoteShutdownPrivilege	2012	SEARCHBAND.EXE
Token: SeUndockPrivilege	2012	SEARCHBAND.EXE
Token: SeSyncAgentPrivilege	2012	SEARCHBAND.EXE
Token: SeEnableDelegationPrivilege	2012	SEARCHBAND.EXE
Token: SeManageVolumePrivilege	2012	SEARCHBAND.EXE
Token: SeImpersonatePrivilege	2012	SEARCHBAND.EXE
Token: SeCreateGlobalPrivilege	2012	SEARCHBAND.EXE
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

Yandex.exebrowser.exe

pid	process
544	Yandex.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

browser.exe

pid	process
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe
568	browser.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Yandex.exebrowser.exe

pid process

544 Yandex.exe
568 browser.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Yandex.exeYandex.exeyb6BCE.tmpsetup.exesetup.exeservice_update.exeservice_update.exeservice_update.exe

description	pid	process	target process
PID 544 wrote to memory of 1536	544	Yandex.exe	Yandex.exe
PID 544 wrote to memory of 1536	544	Yandex.exe	Yandex.exe
PID 544 wrote to memory of 1536	544	Yandex.exe	Yandex.exe
PID 544 wrote to memory of 1536	544	Yandex.exe	Yandex.exe
PID 544 wrote to memory of 1536	544	Yandex.exe	Yandex.exe
PID 544 wrote to memory of 1536	544	Yandex.exe	Yandex.exe
PID 544 wrote to memory of 1536	544	Yandex.exe	Yandex.exe
PID 1536 wrote to memory of 2008	1536	Yandex.exe	yb6BCE.tmp
PID 1536 wrote to memory of 2008	1536	Yandex.exe	yb6BCE.tmp
PID 1536 wrote to memory of 2008	1536	Yandex.exe	yb6BCE.tmp
PID 1536 wrote to memory of 2008	1536	Yandex.exe	yb6BCE.tmp
PID 1536 wrote to memory of 2008	1536	Yandex.exe	yb6BCE.tmp
PID 1536 wrote to memory of 2008	1536	Yandex.exe	yb6BCE.tmp
PID 1536 wrote to memory of 2008	1536	Yandex.exe	yb6BCE.tmp
PID 2008 wrote to memory of 676	2008	yb6BCE.tmp	setup.exe
PID 2008 wrote to memory of 676	2008	yb6BCE.tmp	setup.exe
PID 2008 wrote to memory of 676	2008	yb6BCE.tmp	setup.exe
PID 2008 wrote to memory of 676	2008	yb6BCE.tmp	setup.exe
PID 2008 wrote to memory of 676	2008	yb6BCE.tmp	setup.exe
PID 2008 wrote to memory of 676	2008	yb6BCE.tmp	setup.exe
PID 2008 wrote to memory of 676	2008	yb6BCE.tmp	setup.exe
PID 676 wrote to memory of 1628	676	setup.exe	setup.exe
PID 676 wrote to memory of 1628	676	setup.exe	setup.exe
PID 676 wrote to memory of 1628	676	setup.exe	setup.exe
PID 676 wrote to memory of 1628	676	setup.exe	setup.exe
PID 676 wrote to memory of 1628	676	setup.exe	setup.exe
PID 676 wrote to memory of 1628	676	setup.exe	setup.exe
PID 676 wrote to memory of 1628	676	setup.exe	setup.exe
PID 1628 wrote to memory of 1120	1628	setup.exe	setup.exe
PID 1628 wrote to memory of 1120	1628	setup.exe	setup.exe
PID 1628 wrote to memory of 1120	1628	setup.exe	setup.exe
PID 1628 wrote to memory of 1120	1628	setup.exe	setup.exe
PID 1628 wrote to memory of 1120	1628	setup.exe	setup.exe
PID 1628 wrote to memory of 1120	1628	setup.exe	setup.exe
PID 1628 wrote to memory of 1120	1628	setup.exe	setup.exe
PID 1628 wrote to memory of 1476	1628	setup.exe	service_update.exe
PID 1628 wrote to memory of 1476	1628	setup.exe	service_update.exe
PID 1628 wrote to memory of 1476	1628	setup.exe	service_update.exe
PID 1628 wrote to memory of 1476	1628	setup.exe	service_update.exe
PID 1628 wrote to memory of 1476	1628	setup.exe	service_update.exe
PID 1628 wrote to memory of 1476	1628	setup.exe	service_update.exe
PID 1628 wrote to memory of 1476	1628	setup.exe	service_update.exe
PID 1476 wrote to memory of 2012	1476	service_update.exe	service_update.exe
PID 1476 wrote to memory of 2012	1476	service_update.exe	service_update.exe
PID 1476 wrote to memory of 2012	1476	service_update.exe	service_update.exe
PID 1476 wrote to memory of 2012	1476	service_update.exe	service_update.exe
PID 1476 wrote to memory of 2012	1476	service_update.exe	service_update.exe
PID 1476 wrote to memory of 2012	1476	service_update.exe	service_update.exe
PID 1476 wrote to memory of 2012	1476	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2024	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2024	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2024	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2024	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2024	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2024	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2024	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2044	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2044	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2044	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2044	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2044	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2044	1684	service_update.exe	service_update.exe
PID 1684 wrote to memory of 2044	1684	service_update.exe	service_update.exe
PID 2044 wrote to memory of 1228	2044	service_update.exe	service_update.exe

C:\Users\Admin\AppData\Local\Temp\Yandex.exe
"C:\Users\Admin\AppData\Local\Temp\Yandex.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\Yandex.exe
"C:\Users\Admin\AppData\Local\Temp\Yandex.exe" --parent-installer-process-id=544 --run-as-admin --setup-cmd-line="fake_browser_arc --abt-config-resource-file=\"C:\Users\Admin\AppData\Local\Temp\abt_config_resource\" --abt-update-path=\"C:\Users\Admin\AppData\Local\Temp\ba7bd6d8-f66e-46eb-81f2-7c992023debb.tmp\" --brand-name=yandex --create-alice-shortcut-in-taskbar --distr-info-file=\"C:\Users\Admin\AppData\Local\Temp\distrib_info\" --make-browser-default-after-import --ok-button-pressed-time=639589500 --progress-window=327972 --send-statistics --variations-update-path=\"C:\Users\Admin\AppData\Local\Temp\d0329589-1450-4c93-9f27-723d0af0c235.tmp\" --verbose-logging"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\yb6BCE.tmp
"C:\Users\Admin\AppData\Local\Temp\yb6BCE.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ba7bd6d8-f66e-46eb-81f2-7c992023debb.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --clids-searchband-file="C:\Users\Admin\AppData\Local\Temp\clids_searchband.xml" --create-alice-shortcut-in-taskbar --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=21 --install-start-time-no-uac=641087100 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=639589500 --progress-window=327972 --send-statistics --source=lite --variations-update-path="C:\Users\Admin\AppData\Local\Temp\d0329589-1450-4c93-9f27-723d0af0c235.tmp" --verbose-logging
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\BROWSER.PACKED.7Z" --searchband-file="C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\SEARCHBAND.EXE" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ba7bd6d8-f66e-46eb-81f2-7c992023debb.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --clids-searchband-file="C:\Users\Admin\AppData\Local\Temp\clids_searchband.xml" --create-alice-shortcut-in-taskbar --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=21 --install-start-time-no-uac=641087100 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=639589500 --progress-window=327972 --send-statistics --source=lite --variations-update-path="C:\Users\Admin\AppData\Local\Temp\d0329589-1450-4c93-9f27-723d0af0c235.tmp" --verbose-logging
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:676

C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\BROWSER.PACKED.7Z" --searchband-file="C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\SEARCHBAND.EXE" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ba7bd6d8-f66e-46eb-81f2-7c992023debb.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --clids-searchband-file="C:\Users\Admin\AppData\Local\Temp\clids_searchband.xml" --create-alice-shortcut-in-taskbar --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=21 --install-start-time-no-uac=641087100 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=639589500 --progress-window=327972 --send-statistics --source=lite --variations-update-path="C:\Users\Admin\AppData\Local\Temp\d0329589-1450-4c93-9f27-723d0af0c235.tmp" --verbose-logging --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=706404300
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=a3028db1baffc0578427f8e443889a44 --annotation=main_process_pid=1628 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=22.9.3.891 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x6721d8,0x6721e8,0x6721f4
6⤵
- Executes dropped EXE
PID:1120

C:\Windows\TEMP\sdwra_1628_313076181\service_update.exe
"C:\Windows\TEMP\sdwra_1628_313076181\service_update.exe" --setup
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1476

C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
"C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe" --install
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2012

C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
6⤵
- Executes dropped EXE
PID:972

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source1628_1947970745\Browser-bin\clids_yandex.xml"
6⤵
- Executes dropped EXE
PID:1616

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=searchband --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids_searchband.xml"
6⤵
- Executes dropped EXE
PID:1280

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=searchband --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source1628_1947970745\Browser-bin\clids_searchband.xml"
6⤵
- Executes dropped EXE
PID:1524

C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\SEARCHBAND.EXE
"C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\SEARCHBAND.EXE" /forcequiet
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
"C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe" --run-as-service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684

C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
"C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=a3028db1baffc0578427f8e443889a44 --annotation=main_process_pid=1684 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=22.9.3.891 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0x1467ae8,0x1467af8,0x1467b04
2⤵
- Executes dropped EXE
PID:2024

C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
"C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe" --update-scheduler
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044

C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
"C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe" --update-background-scheduler
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1228

C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
"C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe" --statistics=https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=version_folder_files_check_unused,-brand_id=unknown,-error=FONT_NOT_FOUND,-files_mask=66977119,-installer_type=service_audit,-launched=false,-old_style=0,-old_ver=,-result=0,-stage=error,-target=version_folder_files_check,-ui=B706ECF8_D3E0_40B9_B3CF_B58C45078EB1/*
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4D32F83C5C43C1D0A7B212F127ADCF59
2⤵
- Loads dropped DLL
PID:868

C:\Users\Admin\AppData\Local\Yandex\SearchBand\Installer\searchbandapp.exe
"C:\Users\Admin\AppData\Local\Yandex\SearchBand\Installer\searchbandapp.exe" /install
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:992

C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.0.0.1903\searchbandapp64.exe
"C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.0.0.1903\searchbandapp64.exe" /auto
2⤵
PID:2696

C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.0.0.1903\crashreporter64.exe
C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.0.0.1903\crashreporter64.exe
3⤵
PID:2720

C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.0.0.1903\searchbandapp64.exe
"C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.0.0.1903\searchbandapp64.exe" /update-check
3⤵
PID:2200

C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.5.0.1923\searchbandapp64.exe
"C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.5.0.1923\searchbandapp64.exe" /update-install
4⤵
PID:2460

C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.5.0.1923\searchbandapp64.exe
"C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.5.0.1923\searchbandapp64.exe" /auto
5⤵
PID:1400

C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.5.0.1923\crashreporter64.exe
C:\Users\Admin\AppData\Local\Yandex\SearchBand\Application\5.5.0.1923\crashreporter64.exe
6⤵
PID:2036

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=327972 --ok-button-pressed-time=639589500 --install-start-time-no-uac=641087100
1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:568

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=568 --annotation=metrics_client_id=5ae80915b06c4a7da6c32c7220e3adf4 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=22.9.3.891 --initial-client-data=0xe4,0xe8,0xec,0xb8,0xf0,0x734da3b0,0x734da3c0,0x734da3cc
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1244,i,934892718520632585,7148321471665767221,131072 /prefetch:2
2⤵
- Executes dropped EXE
PID:2028

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --process-name="Network Service" --mojo-platform-channel-handle=1392 --field-trial-handle=1244,i,934892718520632585,7148321471665767221,131072 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1584

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=utility --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --process-name="Storage Service" --mojo-platform-channel-handle=1616 --field-trial-handle=1244,i,934892718520632585,7148321471665767221,131072 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1664

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --process-name="Audio Service" --mojo-platform-channel-handle=2016 --field-trial-handle=1244,i,934892718520632585,7148321471665767221,131072 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2084

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --extension-process --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --display-capture-permissions-policy-allowed --enable-instaserp --enable-ignition --allow-prefetch --lang=ru --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2116 --field-trial-handle=1244,i,934892718520632585,7148321471665767221,131072 /prefetch:1
2⤵
PID:2276

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\22.9.3.891\browser_diagnostics.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\22.9.3.891\browser_diagnostics.exe" --uninstall
2⤵
- Executes dropped EXE
PID:2624

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2908

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2524

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={8CFEAB96-025C-4738-A3D5-ED7C182BAE16}
1⤵
PID:1656

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1666023194 --annotation=last_update_date=1666023194 --annotation=launches_after_update=1 --annotation=machine_id=a3028db1baffc0578427f8e443889a44 --annotation=main_process_pid=1656 --annotation=metrics_client_id=5ae80915b06c4a7da6c32c7220e3adf4 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=22.9.3.891 --initial-client-data=0xe8,0xec,0xf0,0xbc,0xf4,0x734da3b0,0x734da3c0,0x734da3cc
2⤵
PID:2704

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1236 --field-trial-handle=1352,i,500031699510255967,15761186908044668837,131072 /prefetch:2
2⤵
PID:2924

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --process-name="Network Service" --mojo-platform-channel-handle=1392 --field-trial-handle=1352,i,500031699510255967,15761186908044668837,131072 /prefetch:8
2⤵
PID:2516

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --bits_job_guid={DCE820E0-3733-4AA7-B23E-458DE236EECC}
1⤵
PID:2700

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1666023194 --annotation=last_update_date=1666023194 --annotation=launches_after_update=2 --annotation=machine_id=a3028db1baffc0578427f8e443889a44 --annotation=main_process_pid=2700 --annotation=metrics_client_id=5ae80915b06c4a7da6c32c7220e3adf4 --annotation=micromode=broupdater --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=22.9.3.891 --initial-client-data=0xe8,0xec,0xf0,0xbc,0xf4,0x734da3b0,0x734da3c0,0x734da3cc
2⤵
PID:2780

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1200 --field-trial-handle=1332,i,14542340180468715779,184071374923972088,131072 /prefetch:2
2⤵
PID:2524

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --process-name="Network Service" --mojo-platform-channel-handle=1384 --field-trial-handle=1332,i,14542340180468715779,184071374923972088,131072 /prefetch:8
2⤵
PID:772

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=dayuse --bits_job_guid={EC478360-3CEC-4F89-9136-B23B3444478B}
1⤵
PID:2096

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1666023194 --annotation=last_update_date=1666023194 --annotation=launches_after_update=2 --annotation=machine_id=a3028db1baffc0578427f8e443889a44 --annotation=main_process_pid=2096 --annotation=metrics_client_id=5ae80915b06c4a7da6c32c7220e3adf4 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=22.9.3.891 --initial-client-data=0xe8,0xec,0xf0,0xbc,0xf4,0x734da3b0,0x734da3c0,0x734da3cc
2⤵
PID:688

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1160 --field-trial-handle=1300,i,2235267879634921619,15087066143211848312,131072 /prefetch:2
2⤵
PID:3056

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=3647E86A-0550-43FF-8E9D-DA8A61763C58 --brand-id=yandex --process-name="Network Service" --mojo-platform-channel-handle=1400 --field-trial-handle=1300,i,2235267879634921619,15087066143211848312,131072 /prefetch:8
2⤵
PID:2344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
C:\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
C:\ProgramData\Yandex\YandexBrowser\service_update.log
Filesize
1KB

MD5
3841b217dadfca886361b36082475324

SHA1
2303ec719cb0c354aba12af82111bdee72c70cf3

SHA256
65859c0a82b01347e1d58bfdc0ebe91ac17b7f653c5ade553de39e05cd693aea

SHA512
371f2a4317ca4a781c662f1f8271a2a9ea41bbcadc748d74e0f3afd422055a5e32dc557d5a2d2664bf0522cb91f1445ebaf066ff3bf3facdb1916f9fc2e6924a

Download Submit
C:\ProgramData\Yandex\YandexBrowser\service_update.log
Filesize
2KB

MD5
1c954575aeb07cd62dadaa0fe8a9b6e0

SHA1
586a40504c9ee3256720b3bac509997531ce9c74

SHA256
22fa23dc66ef504fb4899361e094eceb68184d7de0445f1f4a22d536022ee8c2

SHA512
1db238569abf5caf399f1eb3d9cd343b26b041d030038c748f9d8fa4319dd6d4bfdf2c4b271a0b735085a6d32dd3add962829e79d50e7558ed40d77f665b1010

Download Submit
C:\ProgramData\Yandex\YandexBrowser\service_update.log
Filesize
2KB

MD5
1c954575aeb07cd62dadaa0fe8a9b6e0

SHA1
586a40504c9ee3256720b3bac509997531ce9c74

SHA256
22fa23dc66ef504fb4899361e094eceb68184d7de0445f1f4a22d536022ee8c2

SHA512
1db238569abf5caf399f1eb3d9cd343b26b041d030038c748f9d8fa4319dd6d4bfdf2c4b271a0b735085a6d32dd3add962829e79d50e7558ed40d77f665b1010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
1KB

MD5
23f9423cf524effb7face1eb98d52a8c

SHA1
eb955023494ed7a84206ef31f949abe63dd68be2

SHA256
665e08a4aa1f6a4dc2407396b4ddac675dace1af690d87a988d013afe4c47651

SHA512
987cfed79741992d50cffea008903772c3eec9bcb17a6edb2656935e8796ef5d168f7a98df101c36ff8160f5d6ed608bd139d43f15502c993f49a862263b4416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_BD3730E24B5091FBD030C756E510C3A2
Filesize
1KB

MD5
702336d313fa6f1bc13a50f29e3b81f5

SHA1
432c93866ab439af4625329205a69a91d3f68f39

SHA256
d28fe506481585650dd7337c1e620b07f7aa469cfc19f30b9d271ccfcfaf061f

SHA512
8fc04d083fb27b5e1a0b4b10fe93d4c3420b356d2a7a8870d502803a6d3882f474ddf42ac567e1c64858bdedced9e50a85175ec46f2dca002845437652b5c4bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2
Filesize
727B

MD5
3dc4181e96e768b9f4bbf41d1afa1dc1

SHA1
9ee79c2f26bf520c4e8a3b36daff9ce8e6e3cca8

SHA256
a72e1936399b803b5c282aa625b1dd2e3c924897ba728887035ebd30a4e9eae4

SHA512
8c6c6ec2b6513697995aac13b9f946a7f5442cea77d0d3053ae9cf0d7dedd6942c8eceabfcd0380156403002bea026b3b18d4926fec92a146faf41f0144a7958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
471B

MD5
da5a9f149955d936a31dc5e456666aac

SHA1
195238d41c1e13448f349f43bb295ef2d55cb47a

SHA256
79ac574c7c45144bb35b59ff79c78dc59b66592715dea01b389e3620db663224

SHA512
60d7d1f5405470ba1e6b80066af2e78240acbea8db58b5a03660874605178aebaa9ce342ca97f17798109e7411e82466db5af064e39eaddc05410f2abe672f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize
1KB

MD5
33fb8b8ae9693b689843bf76ca8292ef

SHA1
cb79cf07c005d51ab9b194c002dc0ba69457a70d

SHA256
7567f15a528544618bc2112ce991866f5048b046b42c67d18ea1807bddfa7a9c

SHA512
bd3fb67c20272bca3d5aac6e420c6a719191bebb8d278fdd293546167a4615182fff97fb1f76985709441924d58ac2af99c0f94eb7c475aa9be1cb5910e35a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560
Filesize
1KB

MD5
e94fb54871208c00df70f708ac47085b

SHA1
4efc31460c619ecae59c1bce2c008036d94c84b8

SHA256
7b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86

SHA512
2e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB
Filesize
727B

MD5
61c5ee28e0ed1b62787302ea7c2da960

SHA1
a1176b0bbbe42255802e481fa75d8f5a4819697e

SHA256
f3218c6b9ea5e247e70df55b4f208123b103b5196dc5b46991a48052bf026e8f

SHA512
b1af06478913f340bba4e394364f3f8e5b8cdb7f806e8d6597d173047ca1c955f3f755450d00b2739a9a5598b7c58a809127b84bf1191656b599bddbc35339ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize
508B

MD5
26d6953e9d244f11f78a35b93b3f1fb6

SHA1
ecbf0f1f7a8c57c486272c253bf79d0aae6320c6

SHA256
99471cb8c8338a158c9e0d0bd548b87b04dc6dbe7c998ab0884791d283b55d55

SHA512
5f63b74c6cddb39ae42b240cb0c4c51ac4eada4672aa5db700e93cfe99655686e547cb215d78f6da13caf6cd21d9741c211e85db7fb7d3daf4da00b29c738333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_BD3730E24B5091FBD030C756E510C3A2
Filesize
536B

MD5
280bfe6df24462b8a0833599c97dff5d

SHA1
962c08937473f2026482f9f49c83f897b93cde58

SHA256
671f68e1ca5ccb367fd43c5c55e258516bd5d7553aeab43acbc2787584d2bbf5

SHA512
78174291388e124701eab29d21dbdc47c389a5730196902cb84fb8a5e6c8aeecfab036e541e57239a0d4ffd7fe65714b97ca03cd084bc593e9f6b1779e8e7449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2
Filesize
434B

MD5
5cdb0ca02a60122d42f544f5e21e8060

SHA1
64de8e630bc5ca9664c31ac60554b70524926b9b

SHA256
97b9597d8bd7cb88b19c4c4885a8522a9c0961f17fbd90443263880131c14434

SHA512
69567e4514cab4a73f10b81c1dd996fa1316c92a9fed3bf6630a5ff7c858b21cfb64e6208b38f359eeb7ba3d0ef3ea9e137a67679f5e7e2ca6288c26cf855c6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
430B

MD5
37bf169a82c5f0c3b9d1344148e5f25a

SHA1
54e860ec04dc74a4afd35361f00880a881d83083

SHA256
b26a2097c704feaadd674cfa8048e2b9d0e3337fe2f656f9cd4ce39a97f338a5

SHA512
cea7808bb606c9b4c4697d0e56746443e1fde83538ab1b36d8d84a99714239c559d0b6d4cad4177031a741e7e91412d37f542c99400765bb319459294634c9b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
b26f325248fd9e7623aa2f16b7fe19eb

SHA1
bd5568d654070a1850d7c0a75d76dd7281f63c94

SHA256
85b00275abe9f342e249d2dcb3851b44153fb732fec74e52bb0923b6980bb374

SHA512
edd9d21432eb0653404f39270b5356f5ef0ad6db20983cc5ed48f5e4ec264a39badaffdc4fd02d200e24dd5583f6bff556e08bae5908f836f67ae76aa464ea06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize
506B

MD5
f513c43ddab00c64128c81fa784b78e7

SHA1
38e2463ae4340fa387f07770fab180da685bc177

SHA256
b8de8133150e8c6efd47ee85aceec33d6b8d3c1daad2f9fca0ac9698136ab345

SHA512
6b0a56ef6f7d9795b3803d2730d44addfcb450f278c94f7b9fbc47136b1e8a46fd4678ddb9c3d37f0a41e2af12f0262c76e47bfbeaf79a23c73f7ae106db3e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560
Filesize
264B

MD5
09eb4d4bdcb9aa1e8146307188b1c373

SHA1
96b3534ab568e354406c1a229b218ef845727963

SHA256
3b45187e42de366004c91a040458137e7ba9d154222a23888bb41ec39d963eb6

SHA512
96c2ce21b558caffc2712a331eca195575ab1ec0e930dedd7130ca79758de7f976cbda42a0a4787fb4b1f64728f1e4baadeeb708d9106db48fdbe1c6c61a62a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB
Filesize
442B

MD5
6b9671d33f48f774415f5f4f53fabd42

SHA1
39cc26d1f8675275697ad4688c6b7b19b6f05d0a

SHA256
6b4394d9b9a02ad4aff1283649f5047cde8ff0b3fcd097802918c28f1b120b4e

SHA512
957f30fb3a18cc2904c2c3ad528bf840b988fea5e17eb13124e237b8c3f846434b4649e5011f126702593be840ed4f72c639ef1d2d00930ff171b7a7bbcf0c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
02b1a98dd03e00582bebd830b3345d20

SHA1
57688297c43d860202f8555f75fe5ff5afbba527

SHA256
841d9cae96a1ce425965223b3d5acb0963858b5e3410d8185a8a4a2c26608135

SHA512
a0d166f64e7fab8c42fdf9b44b3b66bc7204e1a9a11bb69c04aac0066905604e6aee5085ca0e177e5936ad8bfda31cebe01f8b577d9fefc395c64f7005da4a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\BRAND_COMMON
Filesize
23.3MB

MD5
105d3263b0bca342b425fc45702c8856

SHA1
00180722d29af289bb7d2138a52b9d784ce367da

SHA256
7547bc1f22cb361a4e644f899f8494faa013e15f05b75b77e1ea596532dc4fee

SHA512
f6d3a7a25af1c10bbf5fb18b406f30c2c7d92778731f6b6d3eb6f181bc7854e920f99e1f55d2fdc0484bd1bd9bb13942ef13da85d1823c1f5cba16568cb45efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\BROWSER.PACKED.7Z
Filesize
90.8MB

MD5
5e99de825a34c299b8eef00c8d475e3d

SHA1
6fc1d9ef19f3d2aae0fb4ac596afbb24b408d83d

SHA256
6f945efb7783b3ba9b8b48ffef9dc62322d11d51c401bbeaa1cf0aebf768b4ed

SHA512
dd272ce4dd7f4529fb4b4a182cab7fa63bae0f455ea5bf843888c59d9fc13d1564b0f436b5afcd2c3d449979dcd82e0c71f45b6ae54e41e1ebbb649dd060e68a

Download Submit
C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\brand_yandex
Filesize
2.1MB

MD5
cff7f43a37e2081aa5271b2e42e20699

SHA1
9d50fec6b4b583e6b90cbc6906bb6838ded606d8

SHA256
58ee5e657246dadd99f6194ffe082a27a8896aaa4500ff6773054a3929a912fd

SHA512
4eb33ae0d9c9afb8116c9454b1ce06cefc6f59f21463ba9c04d45ed09b3fe61d1ef3aee1570e92d2657d4f6d33a603288f5ff5c04464bb6da75e16002763e2de

Download Submit
C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\distrib_info
Filesize
293B

MD5
5ff4663cf4ed5b1c4c7e84ae7a26484b

SHA1
738deb4f237c34acab7ecf6a2899c7bd94ecd34a

SHA256
f69eb6cd9983e819f7c1273598046ace4ef35c97cc651b89b460bb05dbd58c81

SHA512
f9f7a15bd4d811d0a0a986d24b18d76434f89f81f6554cf0f707a0298a26f0732389e85394d186dd22a6c0306b8568c94d5583891196328e0e3945f44af59bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Filesize
13KB

MD5
7287c14368e8117ee455ff33ef0e0117

SHA1
efe6c9d6bc7431b9cf4b960a7ef3ec04752c5319

SHA256
c12c9be523abf57c10cc9bfda04b66b62756dd12ba5ddec0173eaa5df45c33ea

SHA512
1e7f038f5f640f5a6c00af23436a8d25a4c8774c5289efe13ba86ed668ae74c1bb8b022190026f4f544654f8e0a3bb6141335ad0649cc7195299e4a6316550f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Filesize
14KB

MD5
bcf4c49c6c05af0debd63c509c091af8

SHA1
65ad79c1a9830dc447c63c806d9d7533d867f3e2

SHA256
a2a6851fa73293d7636b856ea8fb8332a31b4297725f30cff2c73a943bef560f

SHA512
15fbbd7e8fdd351dc1c9e0c4b667f8b9d7d4e85da989b4e9d9d0a2d90b83c4adb4993d2577d5f32e3dc2a2564bb707e95e31018c3a70a667c85fb372d2315b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Filesize
24KB

MD5
cdf2276377209ed99108f4fcfd2617da

SHA1
95ec14b3ccd54f015fff7d5eaa6c0ca366b62ede

SHA256
952057de92a60675cdaf2bcb6f44d40382e7c507cf594c853834f07414550292

SHA512
6895fa86fc8e55403785a3446b86aa7b0b519ee9d26920d70fb4ac16d0bd061a920a97ccfad463a89df86cd1eb1f8a51717880433bcca767cdc6db05a3bea167

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Filesize
26KB

MD5
9d60a64b3514a14537b64e528b737698

SHA1
129761b25a3d28ec8778b4f3715439a8ba6ba30c

SHA256
3e7f2d8b8a77a4a55f0903bb56a33110b36b41cc966c1497dba51f90a019ec85

SHA512
f84e3f2c04c0564bdd25c3ccafea28ddee5ee512eaa34f680985fa63e0fa35c7bc923dc1117d6fa1da8f3ea90c58850e4572374153d7c4f46675b5f643da50c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\master_preferences
Filesize
129KB

MD5
517cebb5d922c6be230ce63948323b5e

SHA1
42cdd2f94dd6258441645e831552fc609e801e44

SHA256
fdd8fee19d1fb229f1bd4e6cdf703c69cda41278191165f337af6542c66847da

SHA512
c43e59415c5d8f3d0a842f273326348cc3593226183285bf006c4772a21430907c675e50451e3d6f4c72bc3febff1d34a57654bd8bc6c8e59da1bcc6e84d6a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\master_preferences
Filesize
129KB

MD5
517cebb5d922c6be230ce63948323b5e

SHA1
42cdd2f94dd6258441645e831552fc609e801e44

SHA256
fdd8fee19d1fb229f1bd4e6cdf703c69cda41278191165f337af6542c66847da

SHA512
c43e59415c5d8f3d0a842f273326348cc3593226183285bf006c4772a21430907c675e50451e3d6f4c72bc3febff1d34a57654bd8bc6c8e59da1bcc6e84d6a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\website.ico
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\yandex_browser_installer.log
Filesize
5KB

MD5
48277f38734775e5fbacd96b389cf41a

SHA1
7f6ffbb21ed5d8d6408af688119923480a953911

SHA256
fe3e42f785fdcefee61a67f7e9b62ff27cec0d43c91313f78eddb5ca2124d267

SHA512
77c859e1fa4d4b7897502a09cb89f8eede95f5baadbf06c0c3df993c1d0ac1db5033d8fc509615ae9793749c05bc2a589383bd05a76800d76abb123ffc8edf32

Download Submit
C:\Users\Admin\AppData\Local\Temp\yb6BCE.tmp
Filesize
149.8MB

MD5
ff228e3e10f4d98d961e8a361861180d

SHA1
30fb83fafd7e79ed0ecd11a5231773d46a83e9f7

SHA256
b64ea939b798557ffe48495520fb4a0e249a30d316cefc8c4ceca021b4b091ad

SHA512
1763b1fc773aa4a3f6e34157751b7707467916ffee91d0ddf2096fe2bc5bffe677229de1ed35a47d35af4c25139d624189a8d5c418de8174126aef0f0bfc85e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\yb6BCE.tmp
Filesize
149.8MB

MD5
ff228e3e10f4d98d961e8a361861180d

SHA1
30fb83fafd7e79ed0ecd11a5231773d46a83e9f7

SHA256
b64ea939b798557ffe48495520fb4a0e249a30d316cefc8c4ceca021b4b091ad

SHA512
1763b1fc773aa4a3f6e34157751b7707467916ffee91d0ddf2096fe2bc5bffe677229de1ed35a47d35af4c25139d624189a8d5c418de8174126aef0f0bfc85e9

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui
Filesize
38B

MD5
f59273c1bfa395de52c27c0d4bda8953

SHA1
0eb0cc5fc14ef52e71376c48f88229102c9d43ac

SHA256
c597417c0308ac566a7c0eedb66163463ca1f257570cc3199587cca58e314bb4

SHA512
e055e71711d48b860e02d89ab7f59b9a01b9920f222cff58abb675111ceca3c9bf51a84c013f46e9314728ca31ec7d8c29625801956d6e8b76efd2fea65972e9

Download Submit
C:\Windows\TEMP\sdwra_1628_313076181\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
C:\Windows\Temp\sdwra_1628_313076181\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Program Files (x86)\Yandex\YandexBrowser\22.9.3.891\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
\Users\Admin\AppData\Local\Temp\YB_1D6F6.tmp\setup.exe
Filesize
3.9MB

MD5
7600b48ce4fb19c29eae3079d826c699

SHA1
9306e894d2645f71a49a3006b5046896a9917ef9

SHA256
f5e44bb904f6fe2b59ca129b53c44d7e25f6ce0b65a51203a4a23a6dfe40871b

SHA512
1a11be3bc8487f1ec7168d7843674a5192b737f28be66a91fe073d824d69605608633b0ca7fad845dedb22f46849b89619f547e10f360f32ff49998fd9daff6c

Download Submit
\Users\Admin\AppData\Local\Temp\yb6BCE.tmp
Filesize
149.8MB

MD5
ff228e3e10f4d98d961e8a361861180d

SHA1
30fb83fafd7e79ed0ecd11a5231773d46a83e9f7

SHA256
b64ea939b798557ffe48495520fb4a0e249a30d316cefc8c4ceca021b4b091ad

SHA512
1763b1fc773aa4a3f6e34157751b7707467916ffee91d0ddf2096fe2bc5bffe677229de1ed35a47d35af4c25139d624189a8d5c418de8174126aef0f0bfc85e9

Download Submit
\Users\Admin\AppData\Local\Temp\yb6BCE.tmp
Filesize
149.8MB

MD5
ff228e3e10f4d98d961e8a361861180d

SHA1
30fb83fafd7e79ed0ecd11a5231773d46a83e9f7

SHA256
b64ea939b798557ffe48495520fb4a0e249a30d316cefc8c4ceca021b4b091ad

SHA512
1763b1fc773aa4a3f6e34157751b7707467916ffee91d0ddf2096fe2bc5bffe677229de1ed35a47d35af4c25139d624189a8d5c418de8174126aef0f0bfc85e9

Download Submit
\Users\Admin\AppData\Local\Temp\yb6BCE.tmp
Filesize
149.8MB

MD5
ff228e3e10f4d98d961e8a361861180d

SHA1
30fb83fafd7e79ed0ecd11a5231773d46a83e9f7

SHA256
b64ea939b798557ffe48495520fb4a0e249a30d316cefc8c4ceca021b4b091ad

SHA512
1763b1fc773aa4a3f6e34157751b7707467916ffee91d0ddf2096fe2bc5bffe677229de1ed35a47d35af4c25139d624189a8d5c418de8174126aef0f0bfc85e9

Download Submit
\Users\Admin\AppData\Local\Temp\yb6BCE.tmp
Filesize
149.8MB

MD5
ff228e3e10f4d98d961e8a361861180d

SHA1
30fb83fafd7e79ed0ecd11a5231773d46a83e9f7

SHA256
b64ea939b798557ffe48495520fb4a0e249a30d316cefc8c4ceca021b4b091ad

SHA512
1763b1fc773aa4a3f6e34157751b7707467916ffee91d0ddf2096fe2bc5bffe677229de1ed35a47d35af4c25139d624189a8d5c418de8174126aef0f0bfc85e9

Download Submit
\Windows\Temp\sdwra_1628_313076181\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Windows\Temp\sdwra_1628_313076181\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
\Windows\Temp\sdwra_1628_313076181\service_update.exe
Filesize
2.6MB

MD5
f5aef523c78f170e1c01c7d2bd80d207

SHA1
97a966c3941a7202d7e62979c21b2244e853d1b1

SHA256
48ac6ff5c8bd6bca8428cb03badd8ec91ea1ff32ee2720958b7806d5c2e6cae0

SHA512
f5d0cde11c38fc9f56911cd376003c17972e5724edb9b424ea3bf2da08bbd054cc830c16c16bdd5d3de463956ef686ef1b89c00f97eb3736f4c2588642a1d868

Download Submit
memory/544-55-0x0000000074001000-0x0000000074003000-memory.dmp

Filesize
8KB

Download
memory/544-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/676-71-0x0000000000000000-mapping.dmp

Download
memory/688-405-0x0000000000000000-mapping.dmp

Download
memory/772-395-0x0000000000000000-mapping.dmp

Download
memory/868-155-0x0000000000000000-mapping.dmp

Download
memory/904-142-0x0000000000000000-mapping.dmp

Download
memory/972-144-0x0000000000000000-mapping.dmp

Download
memory/1120-85-0x0000000000000000-mapping.dmp

Download
memory/1200-159-0x0000000000000000-mapping.dmp

Download
memory/1228-138-0x0000000000000000-mapping.dmp

Download
memory/1280-148-0x0000000000000000-mapping.dmp

Download
memory/1400-308-0x0000000000000000-mapping.dmp

Download
memory/1476-113-0x0000000000000000-mapping.dmp

Download
memory/1524-150-0x0000000000000000-mapping.dmp

Download
memory/1536-56-0x0000000000000000-mapping.dmp

Download
memory/1564-154-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Filesize
8KB

Download
memory/1584-195-0x0000000000000000-mapping.dmp

Download
memory/1616-146-0x0000000000000000-mapping.dmp

Download
memory/1628-79-0x0000000000000000-mapping.dmp

Download
memory/1664-230-0x0000000000000000-mapping.dmp

Download
memory/1992-140-0x0000000000000000-mapping.dmp

Download
memory/2008-68-0x0000000000000000-mapping.dmp

Download
memory/2012-152-0x0000000000000000-mapping.dmp

Download
memory/2012-122-0x0000000000000000-mapping.dmp

Download
memory/2024-129-0x0000000000000000-mapping.dmp

Download
memory/2028-194-0x0000000000000000-mapping.dmp

Download
memory/2036-310-0x0000000000000000-mapping.dmp

Download
memory/2044-134-0x0000000000000000-mapping.dmp

Download
memory/2084-265-0x0000000000000000-mapping.dmp

Download
memory/2200-304-0x0000000000000000-mapping.dmp

Download
memory/2344-441-0x0000000000000000-mapping.dmp

Download
memory/2460-306-0x0000000000000000-mapping.dmp

Download
memory/2516-349-0x0000000000000000-mapping.dmp

Download
memory/2524-394-0x0000000000000000-mapping.dmp

Download
memory/2624-297-0x0000000000000000-mapping.dmp

Download
memory/2696-299-0x0000000000000000-mapping.dmp

Download
memory/2704-313-0x0000000000000000-mapping.dmp

Download
memory/2720-301-0x0000000000000000-mapping.dmp

Download
memory/2780-359-0x0000000000000000-mapping.dmp

Download
memory/2908-303-0x0000000066A21000-0x0000000066A23000-memory.dmp

Filesize
8KB

Download
memory/2924-348-0x0000000000000000-mapping.dmp

Download
memory/3056-440-0x0000000000000000-mapping.dmp

Download