Analysis
-
max time kernel
89s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
YandexPackLoader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
YandexPackLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
YandexPackLoader.exe
-
Size
354KB
-
MD5
97eaf183c5dc80a30bd35a84652fad01
-
SHA1
ff027e4a8a911b84423c710c778c047c2334bb0e
-
SHA256
c3b2439d2c9835914f683cd26aa03a8ace1c95c3c92fd097e3f8256df735ff87
-
SHA512
b6f67033f0a92af702219029c5b590c767cde4ba2767d1d4e0d4aa866f016804da867a61966033a4ac3d34ccbb29021e9121d5ad4ff6fd396df3f233cc431436
-
SSDEEP
6144:0fp18znPaTavhPvnenut3drPAFl3oAOYk22zVstTtsOkz:0fp18wihPvncK3iYmkXqhsO
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Yandex.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation browser.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation browser.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation YandexPackLoader.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation browser.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation browser.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation browser.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation browser.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation browser.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation service_update.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation browser.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation Yandex.exe -
Executes dropped EXE 64 IoCs
pid Process 3180 YandexPackSetup.exe 3500 lite_installer.exe 1868 seederexe.exe 6892 Yandex.exe 7016 explorer.exe 7180 Yandex.exe 7460 explorer.exe 7536 sender.exe 7676 {37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe 12752 ybA037.tmp 12856 setup.exe 13044 setup.exe 13088 setup.exe 13236 2AE68B04.exe 13500 2AE68B04.exe 2272 service_update.exe 9204 service_update.exe 9312 service_update.exe 9324 service_update.exe 9408 service_update.exe 9476 service_update.exe 10488 clidmgr.exe 10540 clidmgr.exe 10684 browser.exe 10696 browser.exe 1752 browser.exe 3396 browser.exe 4596 browser.exe 684 browser.exe 1544 browser.exe 4828 browser.exe 1000 browser.exe 2808 browser.exe 3636 browser.exe 4732 browser.exe 6772 browser.exe 7564 browser.exe 7576 browser.exe 7560 browser.exe 1776 browser.exe 8768 browser.exe 13612 browser.exe 13736 browser.exe 14084 browser.exe 14096 browser.exe 14108 browser.exe 14120 browser.exe 14132 browser.exe 14148 browser.exe 14280 browser.exe 14268 browser.exe 14240 browser.exe 14216 browser.exe 14256 browser.exe 14228 browser.exe 9452 browser.exe 9708 browser.exe 10208 browser.exe 9880 browser.exe 10256 browser.exe 10216 browser.exe 10740 browser.exe 10752 browser.exe 10920 browser.exe -
Loads dropped DLL 64 IoCs
pid Process 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 10684 browser.exe 10696 browser.exe 10684 browser.exe 1752 browser.exe 1752 browser.exe 3396 browser.exe 3396 browser.exe 4596 browser.exe 684 browser.exe 4596 browser.exe 684 browser.exe 4828 browser.exe 4828 browser.exe 1544 browser.exe 1544 browser.exe 1000 browser.exe 1000 browser.exe 2808 browser.exe 2808 browser.exe 3636 browser.exe 3636 browser.exe 4732 browser.exe 4732 browser.exe 4732 browser.exe 4732 browser.exe 4732 browser.exe 4732 browser.exe 4732 browser.exe 7564 browser.exe 7564 browser.exe 7576 browser.exe 7576 browser.exe 7560 browser.exe 7560 browser.exe 6772 browser.exe 6772 browser.exe 1776 browser.exe 1776 browser.exe 8768 browser.exe 8768 browser.exe 13612 browser.exe 13736 browser.exe 13736 browser.exe 13612 browser.exe 14084 browser.exe 14084 browser.exe 14096 browser.exe 14096 browser.exe 14108 browser.exe 14108 browser.exe 14120 browser.exe 14120 browser.exe 14132 browser.exe 14132 browser.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YandexBrowserAutoLaunch_45886AE68CD319C7351FF54A1DBD4B87 = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --shutdown-if-not-closed-by-system-restart" browser.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Checks system information in the registry 2 TTPs 4 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName browser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer browser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName browser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName browser.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Yandex\ui service_update.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe service_update.exe File opened for modification C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe service_update.exe File opened for modification C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\debug.log service_update.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7EC7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7FB2.tmp msiexec.exe File created C:\Windows\Tasks\System update for Yandex Browser.job service_update.exe File created C:\Windows\Tasks\Обновление Браузера Яндекс.job browser.exe File opened for modification C:\Windows\Installer\MSI8315.tmp msiexec.exe File created C:\Windows\Tasks\Update for Yandex Browser.job service_update.exe File created C:\Windows\Installer\e577c25.msi msiexec.exe File opened for modification C:\Windows\Installer\e577c25.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8022.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8042.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI80A1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7E87.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI80FF.tmp msiexec.exe File created C:\Windows\Tasks\Repairing Yandex Browser update service.job service_update.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7E29.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI7FE2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI819D.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 10 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName browser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS browser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName browser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS browser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName browser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer browser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS browser.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconURL = "http://www.bing.com/favicon.ico" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Яндекс" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\DisplayName = "Bing" seederexe.exe Key deleted \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\YaCreationDate = "2024-58-08" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\NTTopResultURL seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconURLFallback = "http://www.bing.com/favicon.ico" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\YaCreationDate = "2024-58-08" seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\MINIE seederexe.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\ShowSearchSuggestionsInAddressGlobal = "1" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\URL = "https://yandex.ru/search/?win=645&clid=2905873-10&text={searchTerms}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "https://www.ya.ru/favicon.ico" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\FaviconURL = "http://www.bing.com/favicon.ico" seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\FaviconURLFallback = "https://www.ya.ru/favicon.ico" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" seederexe.exe Key deleted \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed seederexe.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\LinksBandEnabled = "1" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\DisplayName = "Яндекс" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\NTURL = "https://yandex.ru/search/?win=645&clid=2905875-10&text={searchTerms}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "https://yandex.ru/search/?win=645&clid=2905875-10&text={searchTerms}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\DisplayName = "Bing" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\FaviconURLFallback = "http://www.bing.com/favicon.ico" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\SearchScopes seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png" seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\SuggestionsURL seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "https://yandex.ru/search/?win=645&clid=2905873-10&text={searchTerms}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}" seederexe.exe Key deleted \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\buffer\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" seederexe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\8e838702-0d8e-11ef-95fb-62c35996caed\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" seederexe.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.ya.ru/?win=645&clid=2905872-10" seederexe.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Yandex service_update.exe Key created \REGISTRY\USER\.DEFAULT\Software service_update.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow service_update.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Yandex\UICreated_SYSTEM = "1" service_update.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry browser.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexFB2.4VXOXVMKBIFDZYRTHYTIF24BXU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,-122" setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexXML.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.bmp\shell\image_search\Icon = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,0" browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexHTML.4VXOXVMKBIFDZYRTHYTIF24BXU\Application\ApplicationDescription = "Яндекс\u00a0Браузер – это быстрая и\u00a0удобная программа для\u00a0работы в\u00a0интернете и\u00a0просмотра веб-страниц." setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.infected setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.xhtml\OpenWithProgids\YandexHTML.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer seederexe.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\HomeButtonEnabled = "1" seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexWEBP.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexPNG.4VXOXVMKBIFDZYRTHYTIF24BXU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,-113" setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexPNG.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexCSS.4VXOXVMKBIFDZYRTHYTIF24BXU\DefaultIcon setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexJS.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexJPEG.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.shtml\OpenWithProgids setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.png\shell\image_search\ = "Поиск по картинке" browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.png\shell\image_search\command browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.crx setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexJPEG.4VXOXVMKBIFDZYRTHYTIF24BXU\DefaultIcon setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.htm setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexWEBP.4VXOXVMKBIFDZYRTHYTIF24BXU\DefaultIcon setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.tif\OpenWithProgids setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.webm setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.tiff\shell\image_search browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.tiff\shell\image_search\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --image-search=\"%1\"" browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexGIF.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexTIFF.4VXOXVMKBIFDZYRTHYTIF24BXU\shell setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.webp\shell\image_search browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.webp setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.tiff browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.webp browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.bmp\shell\image_search browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexSVG.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1" setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexSWF.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexXML.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.svg\OpenWithProgids\YandexSVG.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.mhtml\OpenWithProgids setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\yabrowser\shell\open\ddeexec setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.jpg\shell\image_search\command browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.png\shell\image_search\Icon = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,0" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Yandex.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.css setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.epub\OpenWithProgids setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.gif\shell\image_search\command browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexJS.4VXOXVMKBIFDZYRTHYTIF24BXU\shell setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexWEBP.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open\command setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.webp\shell\image_search\Icon = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,0" browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexPDF.4VXOXVMKBIFDZYRTHYTIF24BXU\ = "Yandex Browser PDF Document" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.css\OpenWithProgids\YandexCSS.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.jpeg\shell\image_search\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --image-search=\"%1\"" browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexHTML.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexJS.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open\command setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexWEBM.4VXOXVMKBIFDZYRTHYTIF24BXU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,-132" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexXML.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1" setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.shtml setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\yabrowser setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexCSS.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexWEBM.4VXOXVMKBIFDZYRTHYTIF24BXU\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1" setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.jpg\shell\image_search browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.bmp\shell\image_search\command browser.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\YandexGIF.4VXOXVMKBIFDZYRTHYTIF24BXU setup.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.fb2 setup.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 3180 YandexPackSetup.exe 3180 YandexPackSetup.exe 4136 msiexec.exe 4136 msiexec.exe 3500 lite_installer.exe 3500 lite_installer.exe 1868 seederexe.exe 1868 seederexe.exe 1868 seederexe.exe 1868 seederexe.exe 1868 seederexe.exe 1868 seederexe.exe 1868 seederexe.exe 1868 seederexe.exe 1868 seederexe.exe 1868 seederexe.exe 3500 lite_installer.exe 3500 lite_installer.exe 7536 sender.exe 7536 sender.exe 8512 msedge.exe 8512 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13560 msedge.exe 9488 identity_helper.exe 9488 identity_helper.exe 13044 setup.exe 13044 setup.exe 13044 setup.exe 13044 setup.exe 10684 browser.exe 10684 browser.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
pid Process 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 10684 browser.exe 10684 browser.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3180 YandexPackSetup.exe Token: SeIncreaseQuotaPrivilege 3180 YandexPackSetup.exe Token: SeSecurityPrivilege 4136 msiexec.exe Token: SeCreateTokenPrivilege 3180 YandexPackSetup.exe Token: SeAssignPrimaryTokenPrivilege 3180 YandexPackSetup.exe Token: SeLockMemoryPrivilege 3180 YandexPackSetup.exe Token: SeIncreaseQuotaPrivilege 3180 YandexPackSetup.exe Token: SeMachineAccountPrivilege 3180 YandexPackSetup.exe Token: SeTcbPrivilege 3180 YandexPackSetup.exe Token: SeSecurityPrivilege 3180 YandexPackSetup.exe Token: SeTakeOwnershipPrivilege 3180 YandexPackSetup.exe Token: SeLoadDriverPrivilege 3180 YandexPackSetup.exe Token: SeSystemProfilePrivilege 3180 YandexPackSetup.exe Token: SeSystemtimePrivilege 3180 YandexPackSetup.exe Token: SeProfSingleProcessPrivilege 3180 YandexPackSetup.exe Token: SeIncBasePriorityPrivilege 3180 YandexPackSetup.exe Token: SeCreatePagefilePrivilege 3180 YandexPackSetup.exe Token: SeCreatePermanentPrivilege 3180 YandexPackSetup.exe Token: SeBackupPrivilege 3180 YandexPackSetup.exe Token: SeRestorePrivilege 3180 YandexPackSetup.exe Token: SeShutdownPrivilege 3180 YandexPackSetup.exe Token: SeDebugPrivilege 3180 YandexPackSetup.exe Token: SeAuditPrivilege 3180 YandexPackSetup.exe Token: SeSystemEnvironmentPrivilege 3180 YandexPackSetup.exe Token: SeChangeNotifyPrivilege 3180 YandexPackSetup.exe Token: SeRemoteShutdownPrivilege 3180 YandexPackSetup.exe Token: SeUndockPrivilege 3180 YandexPackSetup.exe Token: SeSyncAgentPrivilege 3180 YandexPackSetup.exe Token: SeEnableDelegationPrivilege 3180 YandexPackSetup.exe Token: SeManageVolumePrivilege 3180 YandexPackSetup.exe Token: SeImpersonatePrivilege 3180 YandexPackSetup.exe Token: SeCreateGlobalPrivilege 3180 YandexPackSetup.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeShutdownPrivilege 10684 browser.exe Token: SeCreatePagefilePrivilege 10684 browser.exe Token: SeShutdownPrivilege 10684 browser.exe Token: SeCreatePagefilePrivilege 10684 browser.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3180 YandexPackSetup.exe 3180 YandexPackSetup.exe 7016 explorer.exe 7460 explorer.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 13288 msedge.exe 13288 msedge.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 13288 msedge.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 10684 browser.exe 13288 msedge.exe 13288 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 10684 browser.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 3180 632 YandexPackLoader.exe 84 PID 632 wrote to memory of 3180 632 YandexPackLoader.exe 84 PID 632 wrote to memory of 3180 632 YandexPackLoader.exe 84 PID 632 wrote to memory of 4088 632 YandexPackLoader.exe 85 PID 632 wrote to memory of 4088 632 YandexPackLoader.exe 85 PID 632 wrote to memory of 4088 632 YandexPackLoader.exe 85 PID 4136 wrote to memory of 2188 4136 msiexec.exe 91 PID 4136 wrote to memory of 2188 4136 msiexec.exe 91 PID 4136 wrote to memory of 2188 4136 msiexec.exe 91 PID 2188 wrote to memory of 3500 2188 MsiExec.exe 92 PID 2188 wrote to memory of 3500 2188 MsiExec.exe 92 PID 2188 wrote to memory of 3500 2188 MsiExec.exe 92 PID 2188 wrote to memory of 1868 2188 MsiExec.exe 94 PID 2188 wrote to memory of 1868 2188 MsiExec.exe 94 PID 2188 wrote to memory of 1868 2188 MsiExec.exe 94 PID 1868 wrote to memory of 6892 1868 seederexe.exe 95 PID 1868 wrote to memory of 6892 1868 seederexe.exe 95 PID 1868 wrote to memory of 6892 1868 seederexe.exe 95 PID 6892 wrote to memory of 7016 6892 Yandex.exe 96 PID 6892 wrote to memory of 7016 6892 Yandex.exe 96 PID 6892 wrote to memory of 7016 6892 Yandex.exe 96 PID 1868 wrote to memory of 7180 1868 seederexe.exe 97 PID 1868 wrote to memory of 7180 1868 seederexe.exe 97 PID 1868 wrote to memory of 7180 1868 seederexe.exe 97 PID 7180 wrote to memory of 7460 7180 Yandex.exe 98 PID 7180 wrote to memory of 7460 7180 Yandex.exe 98 PID 7180 wrote to memory of 7460 7180 Yandex.exe 98 PID 1868 wrote to memory of 7536 1868 seederexe.exe 99 PID 1868 wrote to memory of 7536 1868 seederexe.exe 99 PID 1868 wrote to memory of 7536 1868 seederexe.exe 99 PID 7676 wrote to memory of 12752 7676 {37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe 102 PID 7676 wrote to memory of 12752 7676 {37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe 102 PID 7676 wrote to memory of 12752 7676 {37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe 102 PID 12752 wrote to memory of 12856 12752 ybA037.tmp 104 PID 12752 wrote to memory of 12856 12752 ybA037.tmp 104 PID 12752 wrote to memory of 12856 12752 ybA037.tmp 104 PID 12856 wrote to memory of 13044 12856 setup.exe 106 PID 12856 wrote to memory of 13044 12856 setup.exe 106 PID 12856 wrote to memory of 13044 12856 setup.exe 106 PID 13044 wrote to memory of 13088 13044 setup.exe 107 PID 13044 wrote to memory of 13088 13044 setup.exe 107 PID 13044 wrote to memory of 13088 13044 setup.exe 107 PID 13236 wrote to memory of 13288 13236 2AE68B04.exe 109 PID 13236 wrote to memory of 13288 13236 2AE68B04.exe 109 PID 13288 wrote to memory of 13300 13288 msedge.exe 110 PID 13288 wrote to memory of 13300 13288 msedge.exe 110 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111 PID 13288 wrote to memory of 8504 13288 msedge.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\YandexPackLoader.exe"C:\Users\Admin\AppData\Local\Temp\YandexPackLoader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe"C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=10 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3180
-
-
C:\Users\Admin\AppData\Local\Temp\YandexPackLoader.exeC:\Users\Admin\AppData\Local\Temp\YandexPackLoader.exe --stat dwnldr/p=144135/rid=ae45c909-d2d7-4b3d-a89f-88e7da1d1528/sbr=0-0/hrc=200-200/bd=267-10627744/gtpr=1-1-1-255-1/cdr=0-b7-b7-ff-b7/for=3-0/fole=255-0/fwle=255-0/vr=ff-0/vle=ff-0/hovr=ff-ff/hovle=ff-ff/shle=ff-0/vmajor=10/vminor=0/vbuild=19041/distr_type=landing/cnt=0/dt=2/ct=0/rt=0 --dh 2352 --st 17152091332⤵PID:4088
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F684EC839CD3DD4BF037849D393791132⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\29B1B66D-C7DA-41EF-91F4-95008ED2298D\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\29B1B66D-C7DA-41EF-91F4-95008ED2298D\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3500
-
-
C:\Users\Admin\AppData\Local\Temp\5B89BF6B-E208-49F6-B255-E8B1A99CD5FD\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\5B89BF6B-E208-49F6-B255-E8B1A99CD5FD\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\2E43D167-8010-4A39-82B5-4B0E4A1437CC\sender.exe" "--is_elevated=yes" "--ui_level=3" "--good_token=x" "--no_opera=n"3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exeC:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6892 -
C:\Users\Admin\AppData\Local\Temp\pin\explorer.exeC:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:7016
-
-
-
C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exeC:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /website-path="C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Taskbar\Яндекс Маркет.website" /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\MARKET~1.ICO" /site-id="2AE68B04.8A85F169"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7180 -
C:\Users\Admin\AppData\Local\Temp\pin\explorer.exeC:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /website-path="C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Taskbar\Яндекс Маркет.website" /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\MARKET~1.ICO" /site-id="2AE68B04.8A85F169" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\2AE68B04.8A85F169\Яндекс Маркет.lnk" --is-pinning5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:7460
-
-
-
C:\Users\Admin\AppData\Local\Temp\2E43D167-8010-4A39-82B5-4B0E4A1437CC\sender.exeC:\Users\Admin\AppData\Local\Temp\2E43D167-8010-4A39-82B5-4B0E4A1437CC\sender.exe --send "/status.xml?clid=2905910-10&uuid=9ce4400a-fad8-43ba-9439-a65d172e95e6&vnt=Windows 10x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A38%0A40%0A42%0A45%0A57%0A59%0A89%0A102%0A103%0A111%0A123%0A124%0A125%0A129%0A"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:7536
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\{37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe"C:\Users\Admin\AppData\Local\Temp\{37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe" --job-name=yBrowserDownloader-{1A4A1B40-7225-4D23-94DB-6490631B3A46} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2905871-10&ui={9ce4400a-fad8-43ba-9439-a65d172e95e6} --use-user-default-locale1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7676 -
C:\Users\Admin\AppData\Local\Temp\ybA037.tmp"C:\Users\Admin\AppData\Local\Temp\ybA037.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\6f364c1b-7410-49a9-9f23-c87272e81725.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=478414331 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{1A4A1B40-7225-4D23-94DB-6490631B3A46} --local-path="C:\Users\Admin\AppData\Local\Temp\{37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2905871-10&ui={9ce4400a-fad8-43ba-9439-a65d172e95e6} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\89bd5d31-0bc1-438e-978a-f3b9fddc824f.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:12752 -
C:\Users\Admin\AppData\Local\Temp\YB_BC3A5.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\YB_BC3A5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_BC3A5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\6f364c1b-7410-49a9-9f23-c87272e81725.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=478414331 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{1A4A1B40-7225-4D23-94DB-6490631B3A46} --local-path="C:\Users\Admin\AppData\Local\Temp\{37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2905871-10&ui={9ce4400a-fad8-43ba-9439-a65d172e95e6} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\89bd5d31-0bc1-438e-978a-f3b9fddc824f.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:12856 -
C:\Users\Admin\AppData\Local\Temp\YB_BC3A5.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\YB_BC3A5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_BC3A5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\6f364c1b-7410-49a9-9f23-c87272e81725.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=478414331 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{1A4A1B40-7225-4D23-94DB-6490631B3A46} --local-path="C:\Users\Admin\AppData\Local\Temp\{37AEC4C2-327D-43EC-A540-DEAD4BFE267A}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2905871-10&ui={9ce4400a-fad8-43ba-9439-a65d172e95e6} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\89bd5d31-0bc1-438e-978a-f3b9fddc824f.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=4958590654⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:13044 -
C:\Users\Admin\AppData\Local\Temp\YB_BC3A5.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\YB_BC3A5.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=e7ae39fa5eee477481dc83ee66f9242b --annotation=main_process_pid=13044 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.4.2.885 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0x100ac7c,0x100ac88,0x100ac945⤵
- Executes dropped EXE
PID:13088
-
-
C:\Windows\TEMP\sdwra_13044_425462850\service_update.exe"C:\Windows\TEMP\sdwra_13044_425462850\service_update.exe" --setup5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
PID:2272 -
C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe" --install6⤵
- Executes dropped EXE
PID:9204
-
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"5⤵
- Executes dropped EXE
PID:10488
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source13044_571951515\Browser-bin\clids_yandex_second.xml"5⤵
- Executes dropped EXE
PID:10540
-
-
-
-
-
C:\Users\Admin\AppData\Local\Yandex\YaPin\2AE68B04.8A85F169\2AE68B04.exe"C:\Users\Admin\AppData\Local\Yandex\YaPin\2AE68B04.8A85F169\2AE68B04.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:13236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://market.yandex.ru/?win=645&clid=2905883-10&from=dist_taskbarpin2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:13288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff8b5446f8,0x7fff8b544708,0x7fff8b5447183⤵PID:13300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:23⤵PID:8504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:8512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:83⤵PID:8572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:13⤵PID:7336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:13⤵PID:7344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=4060 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:13560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:13⤵PID:13684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:83⤵PID:9028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:9488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:13⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:13⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:13⤵PID:12800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:13⤵PID:12808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:13⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 /prefetch:83⤵PID:5324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6224 /prefetch:83⤵PID:11308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:13⤵PID:11544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16585053765544539025,13357369798402922487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:13⤵PID:5468
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:7368
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:8736
-
C:\Users\Admin\AppData\Local\Yandex\YaPin\2AE68B04.8A85F169\2AE68B04.exe"C:\Users\Admin\AppData\Local\Yandex\YaPin\2AE68B04.8A85F169\2AE68B04.exe"1⤵
- Executes dropped EXE
PID:13500 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://market.yandex.ru/?win=645&clid=2905883-10&from=dist_taskbarpin2⤵PID:13624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8b5446f8,0x7fff8b544708,0x7fff8b5447183⤵PID:13636
-
-
-
C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe" --run-as-service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:9312 -
C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=e7ae39fa5eee477481dc83ee66f9242b --annotation=main_process_pid=9312 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.4.2.885 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x601578,0x601584,0x6015902⤵
- Executes dropped EXE
PID:9324
-
-
C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe" --update-scheduler2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:9408 -
C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.4.2.885\service_update.exe" --update-background-scheduler3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:9476
-
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=4784143311⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks system information in the registry
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:10684 -
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exeC:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=10684 --annotation=metrics_client_id=ff558e91828944298848a6f464d274de --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.4.2.885 --initial-client-data=0x180,0x184,0x188,0x15c,0x18c,0x72be986c,0x72be9878,0x72be98842⤵
- Executes dropped EXE
- Loads dropped DLL
PID:10696
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --mojo-platform-channel-handle=2380 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Network Service" --mojo-platform-channel-handle=2532 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Storage Service" --mojo-platform-channel-handle=2884 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3396
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Audio Service" --mojo-platform-channel-handle=3152 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4596
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Video Capture" --mojo-platform-channel-handle=3212 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --extension-process --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --no-appcompat-clear --allow-prefetch --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3740 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:22⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1544
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=3932 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4828
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Импорт профилей" --mojo-platform-channel-handle=4488 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --no-appcompat-clear --allow-prefetch --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4536 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3636
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --mojo-platform-channel-handle=4580 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4732
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --no-appcompat-clear --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5244 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:6772
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --mojo-platform-channel-handle=5392 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7564
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --no-appcompat-clear --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5544 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:7560
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=5736 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7576
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --no-appcompat-clear --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3928 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1776
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Утилиты Windows" --mojo-platform-channel-handle=4672 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8768
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=4508 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:13612
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Распаковщик файлов" --mojo-platform-channel-handle=4660 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:13736
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=6708 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:14084
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=6688 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:14096
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=4620 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:14108
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=6780 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:14120
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=6908 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:14132
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=7024 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
PID:14148
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=7140 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
PID:14280
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=7260 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
PID:14268
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=7376 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
PID:14256
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=7492 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
PID:14240
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=7980 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
PID:14228
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Data Decoder Service" --mojo-platform-channel-handle=8004 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
PID:14216
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Распаковщик файлов" --mojo-platform-channel-handle=6676 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵
- Executes dropped EXE
PID:9452
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --no-appcompat-clear --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=7680 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
PID:9708
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --no-appcompat-clear --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=3904 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:12⤵
- Checks computer location settings
PID:11068
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Утилиты Windows" --mojo-platform-channel-handle=1088 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵PID:11824
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Утилиты Windows" --mojo-platform-channel-handle=6600 --field-trial-handle=2388,i,15998343868126625202,14961867444574308914,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:82⤵PID:11804
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={F93F8637-1854-4501-A29C-766959BCF842}1⤵
- Executes dropped EXE
- Checks system information in the registry
- Enumerates system info in registry
PID:10208 -
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exeC:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1715209182 --annotation=last_update_date=1715209182 --annotation=launches_after_update=1 --annotation=machine_id=e7ae39fa5eee477481dc83ee66f9242b --annotation=main_process_pid=10208 --annotation=metrics_client_id=ff558e91828944298848a6f464d274de --annotation=micromode=broupdater --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.4.2.885 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x72be986c,0x72be9878,0x72be98842⤵
- Executes dropped EXE
PID:9880
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --gpu-process-kind=sandboxed --mojo-platform-channel-handle=2372 --field-trial-handle=2376,i,6243950963761878927,7178862945590322526,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:22⤵
- Executes dropped EXE
PID:10256
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Network Service" --mojo-platform-channel-handle=2440 --field-trial-handle=2376,i,6243950963761878927,7178862945590322526,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:32⤵
- Executes dropped EXE
PID:10216
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={16864288-A72E-4386-B6D2-866240235D9D}1⤵
- Executes dropped EXE
- Checks system information in the registry
- Enumerates system info in registry
PID:10740 -
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exeC:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1715209182 --annotation=last_update_date=1715209182 --annotation=launches_after_update=2 --annotation=machine_id=e7ae39fa5eee477481dc83ee66f9242b --annotation=main_process_pid=10740 --annotation=metrics_client_id=ff558e91828944298848a6f464d274de --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.4.2.885 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x72be986c,0x72be9878,0x72be98842⤵
- Executes dropped EXE
PID:10752
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --gpu-process-kind=sandboxed --mojo-platform-channel-handle=2300 --field-trial-handle=2344,i,352212004402914893,1861806928024570441,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version /prefetch:22⤵
- Executes dropped EXE
PID:10920
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=9ce4400a-fad8-43ba-9439-a65d172e95e6 --brand-id=yandex --partner-id=pseudoportal-ru --no-appcompat-clear --process-name="Network Service" --mojo-platform-channel-handle=2432 --field-trial-handle=2344,i,352212004402914893,1861806928024570441,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --brver=24.4.2.885 /prefetch:32⤵PID:10932
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x428 0x3281⤵PID:5396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
911B
MD53747b0e85fc47b37fe39323a8c1a8ded
SHA1fb5bc47f3faf236300968c650581956c879f2ac4
SHA256856f557d8d7ee77e8f1dae712aa1fc7dd92f77d81b0836d1298f8c497c18d3e1
SHA512139d6ab2b7a90b6e08eacbafbc56a5db4a0765be4eb7f79da181e2fbc816c563876886b4f8b114375370b2d88fdb9820c5c14e275008e363e910441df0d65e67
-
Filesize
2.3MB
MD5f485a219e036f8518946b3c26ec1c958
SHA18fd22ef99802b75fc2459ba4b1d6b9021f8077ed
SHA2562ac9926d740291344fec9488526fd75dfef38228c9fa59104a15ca1862d24e25
SHA512f30552586b0d008a5ebf8334da3230ccc134dc88b3c86d809459a14b4d0b0e71287506c72ca7db46e5b0e5200114a9921b5118f666872b1c4e3e3e15674182b2
-
Filesize
2KB
MD5f50b5f7ff074830b3e8f548f06ae65a9
SHA13047f0abbff37adf1906661de8d3f9d2e9e5dcdb
SHA2568ee151f62dc333c3a9f3ab0a2ab1a3a912a7bea766f76a51375bee2d9d8b8983
SHA512d8a601c3bce654d270e247fed651b53f400dee555e56d3f2f7278ef4c65a6b68d38dcf9986d89bf01fc1e1379f5773cdf93f6da9eccfdf1428136589f84c9c50
-
Filesize
3KB
MD5a4acd2ccc7659d5dc384b62a6fb289eb
SHA14d225c593da73c9b9927e3762a551f27b79aad04
SHA256420880a50c33c630f4173991442f449fff51b990bed3bc2c8cc49ae789c8f64c
SHA512d5ac89fe8a5bfab08736064b0509296be563734810f7c389da74f5ac6a059bbf886a58cd847a6220640fed002f9d04eeacd6766124c0f8cc4323f29c66da3121
-
Filesize
4KB
MD59cc2f13dfa8d47799a1b4c55c84d625d
SHA10f5392c27cc0066a6cd86fca29c1e6bd7c1fec67
SHA2563ff5167226a047d4b4c0e1b95ae5f7e108700ed2d7e4e3fd94768c8ef11acc14
SHA512a571e50b1b0ca122cf2068c945917e85d3b6b2b46e773e434f01f7727bd4704adfe7561ed24e23c0244d3c78f88dc9e468c89b8b5dd1008371faf05156e54659
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize1KB
MD5d16a9d41dd945aaf8c18a78cedeafb93
SHA1d23a52b0dcd6ef9a2a7e22a375022046e3ef68ee
SHA2566aad207167016381662e292c5d735f220d78808fa306d81e305615f7504e6dde
SHA51261a429c66ced29b4120e8ab052f8f6a05f1505f41c1e5b95365f19b21c89a3b4db0a05b959910462dbc9936dd2dbdc441ba7acfd451212090c849d259d0da392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_EBD7B8AF3A6D56C51CDE1B85E8C855A8
Filesize1KB
MD51129f86dd90e9fee6665369553500bde
SHA1d95394f2673f81196ade7c257a0c96c2eefb4349
SHA25681a7715fa173ef9f8c7a75be1ff8e35de57123d125e44c91a710e934978ce300
SHA51219879ecb45b4197acfdd62e086a3c03b139d8a7e73c57630cdfae4aa2598d8dab8856557842bdfd128ca64c15b73a856dc99f9c9ac990da40efa50f8a2a7e072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize1KB
MD5165d4b9d6dfe013c8d8d29170af84cba
SHA1d4c07a3b4efab7735f01adf59775b76d985e9c26
SHA2563832893ddd9a3ca411d9f8c46ef0d8f0f0441a2e08768c5739baf8833266ebfc
SHA5123b2d3e08393d6c12c8619bc945175da98aecffe4d8d7d113892d5d9b49b320631fc48bbe1caf0fda57cd0a13b2128c134aa67ee6db43fc49cdb413ae52fe732f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize1KB
MD5c4b7607fc4f62424c2d0aa33c6c5cb30
SHA17625af245fa68c14bfa2ce4f35c04775227d6477
SHA25698a6da51eca3717c1952d01e6d7f259792f41a0781655501805e32f8816ca49f
SHA512b721d2851e20fabd704eaef720aec4e0983882bc75d7b9629dc34ad143925cd014444d704f8b30af4ac359ef5b5f6a37f1b069466e80adb363c583137a708a9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize508B
MD5c92d65c623b03d7f8f89de39d7df2b54
SHA162ed9fab8767fcc641193bd56d4c310b17ca876a
SHA2567b72eeba8451b10d9858961d71f9791aa669c9a3bd300b550eb41ef31305a720
SHA512167a67f0b47337391c116614b976987ce9806afb0fe683a8473f4206ed6fc5a4085d2fe0d4cd34c6f761e6dbd1a93b48e8eefbc1ecdadbba29d64dceda0b7d98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_2D5E5B350E01A107C0352A3E192E40C3
Filesize532B
MD5ce5b19a5b94c8a9acd8a3ddffd1bee4e
SHA19bd30b3c82548008c2219b32edf40c81e711fa92
SHA256514b6d4aee58cbf0e5626ac923aea3e99aecc8b0557bc2b249aa2e40ae981d57
SHA5122751ffa33482ac91ce8d4e4b2c815f5473b5292f5317a79b7bc7383b6e732c05e917998373967d8d5d41493371f353cc11a94f532d7fdd06f0c445c42ccead04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_EBD7B8AF3A6D56C51CDE1B85E8C855A8
Filesize540B
MD5e8d98ea13acad0f444c118dcf3d40723
SHA17ab8c2a003d305d5d32e3132513daef5b1bd9ef0
SHA256cc2926c562a8daf7580c04f23916569a996ce5e459226258a9893e76971afbbb
SHA5127beb85142503f8b96f55a069e7d3451dde6862e1cec083ce9d5cf9e3a3c9a4c548a21ff4fbb9f6428e2480442dbb56252872d70c62b293016e83f21553715ec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize536B
MD570bca1cc7de7b1df380e7d808dab520c
SHA136c194d6c1bdd7a40d203b2e11d2b7e105bc6bd9
SHA2561871798d31fad78d6e50f299bc39923952b175529518c28a10cef88a34a314ff
SHA512b3c0969e3172c689e12b48b43b5cb19323bfbeb32d554c1c4faf4a41099149c00683bdea2483f74abee39eee2732bb6d96980073434d34008cb4a8ff22f6be49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Filesize506B
MD53fd804f21f7ce81291b0f75963a42894
SHA1a7a3a6d8b6c9b6321c9909bfcf5948a388242765
SHA2561a0ebc0ed7e183ab8f784b432a07a71d5f385ba0ad0df55bf996b81dbbd64469
SHA5120026c448609b5110b18c76c75c5f7ee1abdacc63139e5fe72c46ec162871dba5043528eea306b9d38993b8071d29673a92c1bd4ff1be6ceca4315fa0902718bc
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
71KB
MD576da70cb03b31db254dd614979a9dde8
SHA1a46db0276c60d5e9f982ac30594cc3fca6c82c43
SHA25665aaca0c01889c77cf30fc41abb2b5478e7b9bd69155ce4a522e8843e8641a91
SHA5124accde0d49105c246d186d62631de80466db545d233d06d9dbaec6129698ffc2bd303fa2fdcaa02d6a56e19339fc144bdaec7829c7ff27f5cd25d5a7a5de1c68
-
Filesize
131KB
MD5414de8df3436a3a41cdac8a91f3335e4
SHA1b68ef29e3e34f893a4245332f9cb70af11e3a9f7
SHA256aec8fd335a6d665a887392abb5019a7795ff5b38038d4983e1b15467550c1b45
SHA5126446a8d084477a6f7a33b35ccd46c9ca76eebcb31520231b9a141373b82f08e4628cc58a1bb7bd41fe295f0b122ac97f1755bf9ea833db90523d6ff1b5c99e22
-
Filesize
40KB
MD58840e46c0379cdbbfbffcf2eb8493944
SHA1040f151d086e9974185c809d8269befd9f9af9ff
SHA256f7e31d91b6940a491699392548881cdbebb86d3588df5ab858d99018a60971a2
SHA5127fca6ee47fcae56f659716df27f7c16b3c5a041248b228cd387f5e1d7ec30dc2e38df50547a9c7c4a6922c16191c3cc2e107b8d3c25458cab3639af0274dd890
-
Filesize
162KB
MD5a19d1abc31628a35c3c96ca3293f2449
SHA16b450165424a8ec5f1bec627f0359fdd8f644853
SHA2564959e9779c0021640ff163193381afee848a8df8bca19f09499099bdd7866cc2
SHA5124e709a3e7a0e9dff71734a7f8b0a12930991519dad74d48a0524085ef74f17ec22480015e3a47843cd7498cc2baf477665c569edb0ce82ec964daea739268779
-
Filesize
603KB
MD535f97775c6595d8cb4ec72d08ef7148a
SHA176f82e567aff3581d6ae29521643674f83979bf2
SHA25696ad92166df3dbedd9b11d9a8053d56950df2bf7d854841cd4f92afe65012abb
SHA51230b377f976bbe1f8ceaea2eaafc9943074d5c7a5d4356d1eb92410b8822330fdd4f8a39a0dbf9de70d63225652408b52de56e0c74c4a47d261cbe272e54b1e7e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
6KB
MD55fcf852768ea526b0c9e5ae5c737e556
SHA1a997388a037207a466f58d8aadc12e92e44a679c
SHA256b6da134f14fe505b699ba4ef1c80982f97ce4ef750769526ecc66cd0ad13d365
SHA512c3a428344fa99f2935898c02e3e7dd1eb2efb1a104a8ec9dcd050a52db2360f5284a47e988b8a0327996567020b49d03a1f558cfe048d16e352783d350422529
-
Filesize
7KB
MD5bdda3c5475946124d28520c0addd5cd1
SHA18918c953ca2505ec5672d37572d94daccaa2c68b
SHA256d342a8dfd34dc01c50892538c70f741342481fc47cb27a196355ee12916df780
SHA51256a48b4145e1aae6306ea748440451816a1a2866fa5917d367e28ebe5ca9363576f511705c4d2bac8c3dd9dd89d0391c0a7815b04edb543fbd1428508273ffd8
-
Filesize
6KB
MD527a2e8220a42b588c2070f03b71465e6
SHA12afa8f9e64cc9d3090605da702f69b8fa272ac13
SHA256165398327be5e8771f3045e91a69afe19402eb380e8d496b336a93ca0e5a96df
SHA51249fba638b0c8ce8aad55684cbadbced36702374bf4037dd2e9350618155efac26cadf4b9487264b82b11cf0816598104aa5a0253ea6af64062c062a6ee1d1846
-
Filesize
6KB
MD544e8c3610e87e5bd87eebca5f5746b14
SHA18b1c4afef8883a7691620aaceecf6a230cc04b1a
SHA2568da563703598c0bfa9a20ae34f26e9dff20c720a79b8903cd6b51e02f7059efd
SHA512e31073fe361f55564d1f71c9c06b58f155b8f6c56ac722ba82295e672f51b5ce9459caa372542485421546041b9300a624bff2abc02c399b6899e4a61de5ce0a
-
Filesize
1KB
MD534af2615227df804e27320c9de944208
SHA1498fd73efce896ea4fc6c26b51c2c1f96861c46c
SHA256d3cf0a9d0287f470c575864c93e0d370f5abb14d62c88fad2598f037e4686cf0
SHA512b9aaffe662bd9a42cbcf5d92a48ee261de3270794ae6211dab423111405078ec12c0a625d58131b7d4a678d055205cfa03cf990440dbf7950bdbed53f5b89292
-
Filesize
707B
MD5568c1af6bc94c29f1da4944df5c27c31
SHA1aae327a34bc51e639b9951a85245f5e712f77db7
SHA256f43c17e94e0a5434b2fc18da73dde44106fe84c450133e42ea9f7ee4ac800341
SHA512b707746bd3814fd1b83a6b44f81656d33adf19e46f75abe8af45b007d030dceff2657fd218cf5d9bad1a5a683423d84d4941d5e246818203faa205cb7f924abd
-
Filesize
1KB
MD59d14d2e236738ad14e430570a66484d4
SHA1837967ee522ae5540dd4abfec77649d7d9493441
SHA256dd0400cea094d7f675e11ef19b5c6fb3cbed5e437f341924760348fe4f8b2c55
SHA512a6dfcb37a55a388bc418c857947cab43af02e22cb237f677b092bfc34a1af5538a521e1bc6ee39a06c5e6aa81d607068b21f5f4a466bd8659aa73b92486ec1f7
-
Filesize
707B
MD515778a606169cba5b8078b3cd430a51e
SHA1f122e6e0c2a274d3558a3cb449040ce60c63b996
SHA2567bd8578cb110f9f109bbe26d7b9ad6a99b6eedeb403009d625953d1fea5040b6
SHA5123c1c488e1e6fc9e0c47b65e13ca3a9bd159520b34f1e059db4670335c8363e12fddb6f52c589ee4b16177557fc87d31e89e9bde615b9df9a937159eef49476fc
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5b8d9087677f7c00ffa126f4f992f9a9a
SHA13a71c7c0f684d4ee7cf171d7b576ee0200d4b082
SHA2563b466aeaf0f661246ecc94eddf36ad647a4cd11cf1c93b66073a1ae469308735
SHA512b928766870a3311f001634ee30bbc6ee188c7dd7fdad0d7a14e2e24670a0cd185dce8ce3399a6bbdd5328936ccc2bf1d8060c3e1b0f47c556346e34582c7ad29
-
Filesize
9KB
MD5037dcb9f2d8c769d7b9e362fedd36e84
SHA18019da23adf7b4baa2b4a0e615b9167f8d2aa984
SHA256ac03c5b69ffe00e7937efa6917d2a4212ddb2f6e911aeba54461fe8c59de53f2
SHA512c219b4c9c8077fe028fe863046f528ef389953878ec111f8cb9b00aaef74efc0ec428c930bdc5298bd5439afac81de5c9ec09c57a659f7e8ba263e509daed718
-
Filesize
17KB
MD5ea6ee9ae02402932201de0f23615e815
SHA117629127d63b37da0a2a2b2b196110d85372707d
SHA256f7383af8817bac1d59207a2080afc6b0dcb61a091cb1190d25fe18363838f8fb
SHA512918fe91a99e0e99e9cc6d17fdd5c2c9b3cb03ae8037681c1875faafc73c05d74fb29b612ea5de867ba96c158dc35fb28cf3f39487bf56f8bf4c6f3e6aaa2cf8f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7jyxcjs8.default-release\thumbnails\d1c6687bc38de4d0700054632c342d6b
Filesize15KB
MD5af80a936c10e18de168538a0722d6319
SHA19b1c84a1cf7330a698c89b9d7f33b17b4ba35536
SHA2562435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
SHA5129a1325c8ce05806e5c161a4cf47239f62baad8f79650fbd713e74928fce8171ced10ba7f24fac46c548e1dbf3f64106270cb25ca88c836c870107f5dc1f97879
-
Filesize
418KB
MD5372dd1f1a276a02aa9fbc0435bc9081d
SHA1258091e03a5eb6c10b242444aa9f8a449212861d
SHA2565fe9db11665ab3877380a68e19b20e0567a8e2ce888f36c15c188d117ecdc59c
SHA512640cd883835558a7dcd8c1d8eaf5b87f71341f9ddb2bae83c76d991a3d80b62782e454bf3db74cf16b3dd5952ced213202d8049d5a8efe860930eebd35de9ba9
-
Filesize
259KB
MD5e3057443a704b797124507b9cefdece8
SHA13fdc3be05efc7038023fa93544d675a2d5b9cbae
SHA256393f94297e3a2e4ffd771323bcaf8b59ebb57cb29a773a18917e7c0c9a9ecf50
SHA51262e608324bfc7d05ccb6025d39c96ac9328accd465a11e7fb636fffe7f1fe89c6f9a956778fafc97b70165058fcf903de5ae09847cc286ddc58a7aed6b2c2291
-
Filesize
1KB
MD55a40649cf7f6923e1e00e67a8e5fc6c8
SHA1fc849b64b31f2b3d955f0cb205db6921eacc1b53
SHA2566d432ba7096090837f9533a33a686c846ad67aed8ecc43af7ce8af42649cd51a
SHA5120fc42a2cc61528b14478f4b9ae098ea90e6b05ddbe10f3a6cdd6326d0d8e6185b49d2b8143b76a9f329bdc277cf02b54d98f374edd65df68a1ffc41e1c817786
-
Filesize
688KB
MD5ab6d42f949df8d7e6a48c07e9b0d86e0
SHA11830399574b1973e2272e5dcc368c4c10dbbe06b
SHA256205ebf52c47b42fa0ad1a734a1d882d96b567e15a32b19bdb907562db8ea09e2
SHA5126c4f9bb726384c87b6523e08339f7821ad4ec8717b26db902ca51df74eb89b46e4ded1504a131683b07b2bba3e6e911a549a8a83b2aad3971047c0fe315a1ad5
-
Filesize
8.6MB
MD5fb78961f07684303b0aec02666df3e0b
SHA1208a69979a7af92736cda71c5762bf62fe9c32c4
SHA256cd80b890380b4c8658c2ee752574a7872f14f07ef107e9f53394d6fd912157ce
SHA512fb3f27fdcd14a450f5043ac49c6520a451b5acc76be15c4c5e22f69dad1e6b852e7dd07fcb9509bdb138ce17bc032801642eb9727c524ff078379d1c7fc139c1
-
Filesize
10.1MB
MD5fb328409d7a4903823bf3f613d9ff7a4
SHA1f50506af1b4ac73129bba001822f2588ce69c084
SHA2567ac57c6158b9b4f0c025bdf8d02682cd0a36fc59dab8735a62bb476ea6bb48e9
SHA5129a0235f1842809ea491aad7cd15f6dd2c409268ef3103eba9c4cf28eddaab6ea6045131f263bda7bd89a73aa5b4485efbb09e1f3ad409fffece2193dc73ec849
-
Filesize
3.8MB
MD53f25c6acc5fe52b64ca69adfd2a30c9e
SHA1a55e1fa7b120ed221e5e6dec9af83974f78ee441
SHA256c817e97506b5a65fcf7bce098fbc65d5bafa0d851b01984ffbc26d8eda8aff54
SHA5124eea688d5278698278cae60235a036dcc4e8db81ca6a4d72c6af9dc94971323e087248897e1b1ee1de0a7dd3af94c68994259d40af047524b13bf659ffce8f01
-
Filesize
2KB
MD549c989f16e3388dbaa2123be9bc1865b
SHA1534da3f0954a0453d1fcd6706089bb3e624555ed
SHA256f96eb85637db0d3799494e753616051ae472fac6619602c86c13475283562a88
SHA512b2d27a6aa9c57dfe5aa4a046056012832711a425340286b7e3b350cb14716eb0f2e89f6f44cb5aef4a25c9a667f227cc6e0ef9e2ac526c9f8e99ef6e8d299004
-
Filesize
693B
MD5adf6e153bc4087c314ac0d70ea7bc370
SHA1c911c0918a36a144e224bf4acaa15e59e692b8f2
SHA2561b09f78ebc18b13f58f86b7af03cd8bad5e31ce4d27e6cc274c6da741b7a8736
SHA51288beaf6b95cdba1d4b27af9dd74d91bbdba68ee5c597d8d8990d9a07f710183e09295b5d34d520e7825bb4cff53b162d860fd6ffc1911ab145364ce02f0fc7b0
-
Filesize
11KB
MD54e1a0693240ab106d597a230874932ba
SHA1c1e00aafd9c30aacc1ef09da89e0535d6cbc03de
SHA256adb04bb2ac997a66ffa606659c54089c5fd0c83b2ee9d18de9fcc1d126894357
SHA51205d0ecc0e1bbaf8f04b356725b3cc7704726555820469f8a611beb8dd13963ae4ce32c884e5f0ad7d631d281282f5b27a2f911f752d979882f875226f2a0cf08
-
Filesize
161KB
MD5a26a2f17f488d873438d937229a54925
SHA1d64a8e162c63897aafacf430a0170847790abbd0
SHA256fb923a248ace524c0a12038c0c1f25086691da58d1c31ae4a1388cb923ccb52f
SHA512e4afc0a9b7080358d658f5587b39cdfe1a9c7fc5e69013694824097b9d4481374d67fb94fb60197622e6e6ef27c9392e3b35adbaa200be95f442f3b35ffce9fa
-
Filesize
40.8MB
MD5dc5128fcb8d7f6b849f1166532db2dc8
SHA18427501d440d5edbbb2662294bc5650d2bc8aab5
SHA25636e682f419c2b5d8e7c285d36088b56d59df3869dbd181943280696d4ca391ca
SHA512bcf0d463ed4f01a313b8e6be745ad55b42108be84cc5850c411dec19aa7c6d996782da49fc208559f1188941bdd1082d954cfa316f08c0ad2efcf0662952e524
-
Filesize
2.5MB
MD5aaed13466cb69e9b847d6ac255d2d1ec
SHA1279e10adbaad3a98baf12e63de46cefd8fccfd0c
SHA25680fa7971efae9a149a7f0e1147626b1d418f7ce954c4f9488b910fcfee973ec2
SHA5128a96d1067b6a81acf00cb984fb2a434a95d2f7efd1371c3b849d8470e4598fcd26407d175d95f26be6dcb896249d3778dd0ad816c5d13b50c98b488aee921508
-
Filesize
510B
MD523a1582758a185cbcdcca3d737d90f6e
SHA167ed968f591b68e82a0f5ecf3666b986b970aa5b
SHA256e2a13cdc8fe5ce5e7f0540fba6f94aa7ffeb012ebca09bb574dee8e6976294d0
SHA51208a653dfe44b40d73271a153dd3aff30819efcca6a9e484413d37ecbc675c381be6cf72be28aa5cb51ab9fd4273a1bfd967a11564d8e2152c1247447c9807192
-
Filesize
6KB
MD5c24bf80b737ab952dd7c5ad43fc02103
SHA132b83014a0957287688679bf9c31c16c80fa94d4
SHA25668a0a46f003f1a0a537d1df5342665f391f43de849a7491238e05d764c738adf
SHA51276274846190928c0d904829e01fa17f1c454a3efe62fc9b31451e235f72512fc1cdc0d7ca1aeca7caeaf235aaa7d6acfb57fa035ab4d4bee9442ce3ea82df830
-
Filesize
5KB
MD5ce6c3aadc5ba6a3e37493e93e569ca29
SHA1d493fdbf0382e1a8cdbdc545b62d0f3a61397b34
SHA2560824d48948e1051d7163c40a7f29b7447c0ef6fe242d31112b943b76be699e04
SHA512cce47862b71450b4e26a6ad9cf8c25c70d049ea7f5282995e920b6629bafed5feed2b4eb70234c17634b64915dbf2f0abccac0e6ce45af4c7ed499740b2beb52
-
Filesize
10.4MB
MD5e193fa663b502e98cab56bc656447e8c
SHA15c3507601ba5592ace7929f6b62b95102399416d
SHA256de8adc54741aae62b1de459ac266e0f00b0b80314813670b39fb013bf7cf21a5
SHA5124f943f1c4def35950f5df4a2693a9152159bb31c330972f54e7e0f519fab4ccdef09a047685fb4dc45d6f2b4389d34d8e14152e1e707bed446b800fb778d8b78
-
Filesize
9.8MB
MD56f2c02f5cb917971bdf2ef86f37e8563
SHA189d130275f26d6b9b9b0dd903b1413097c6632b3
SHA256efa5907a651e75a526a075cd30d3ede026dbc1ebbea402e78e77bc78a5848f44
SHA5121215e4a221003ef93cd33e280bddacb44082392b35ff73d3a5b4c60fe5fdc717b144c43e87c14944b6118c5bb9eb66915eb4e706ef4febad544721e86560f710
-
Filesize
2KB
MD54f3a43f058ce9c84ca6ded504d92fb3f
SHA16bf7437214bd13e18783f62f381f614eebdf4f94
SHA256a21e610516003f91e850b73030563089510d3872be99089cb0298907a9e7b00c
SHA5128a080499ea27db01ad12c6fc9d59abbcb9a99beabe1ebd57d6d823ffe935e43ea60f877879343b6297e6b2e3d62174f6f58d8f8190da7b44d674812263294a04
-
Filesize
397KB
MD51e64bdf002fa6dcae92e0b9ae4283867
SHA18db18047e35e77ca365a1da1648918fb710979c6
SHA256dec6ed68c43845defcc2031c8e8da56fd6e2a476e2d5a2ea204c92b82d559bab
SHA512b3207a4d10e07d97041bb471ba3f80e46dd70f2037ebc1a012b74943de4e78c5a5a2f5fb4c0a86615db34280b0d9f39a3f98f7b7734a7bf9fc29f41dd1bca1e2
-
Filesize
2KB
MD544c5980fd97fc1c9a537901e7bd469f0
SHA11ee767c4f04314a110a54e7ad468cd3221887883
SHA2561c16d6332bf8fbdba3c15c9f90c21aac57e78538cf69dfa495c82363ae0af87e
SHA51283d330c9091dfe1460ad9ccc0a9d026331ca0eee0a21160634cf55ef8afc06df30a4225d0d6557bb447e6de977de10e541a7251b51ef4fd2f92032d29cd2cf66
-
Filesize
8KB
MD55063e519c40d3b69277e8d1e629ce75b
SHA149a6d5a4f1ce357b1fc9970de88d714d30e909f9
SHA256e623a2ac717e8ffa04c38efa7540cb5b5ebb3e3bcad902ace08a019c45d54083
SHA51207961443ffabe35329f9b37eaa64e829646a30dd30e1fa1486c808a8b7d8b5c4e74f96106492f614b76ae531bb5a11a2ffd5d7a9545d7cf59c2a3c8c4c4964de
-
Filesize
341B
MD5977bc7b2384ef1b3e78df8fbc3eeb16b
SHA17ee6110ca253005d738929b7ba0cc54ed2ed0a2e
SHA25682e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
SHA5124d154832ef3ac05abb1499a5bc8235d72f64cdaa3e6870206a6363c1d85d821604ae8a96850c2c8bd540d479b8dd5f3ce032472ed96bbf7eddb168ea3d2d1cf6
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\Temp\chrome_Unpacker_BeginUnzipping10684_143809850\manifest.json
Filesize984B
MD50359d5b66d73a97ce5dc9f89ed84c458
SHA1ce17e52eaac909dd63d16d93410de675d3e6ec0d
SHA256beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755
SHA5128fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\Temp\chrome_Unpacker_BeginUnzipping10684_1756314619\manifest.json
Filesize159B
MD529012066e78d4e28ea709f43e49c9cc5
SHA188c04e80be6ad489b271f3f86a4f1c6d29c53f67
SHA256711594a302c5158486932dc5a5a080a8e7d2542a8c36da00cb8cc388a08a99b1
SHA512d4dd602aa722bd46fd9477e7b167e65285003594fd6ece49523533913e8281a4bbe1d971fa7fbbb0baf3944aba1d19b5f3a2c6b56dc1101bcdc6a53905f511ca
-
Filesize
4.5MB
MD5ac3768f0462853d08df284e67c7c4ebd
SHA1732581ac6f2e02246696817adc53d2e2e5d0dcb5
SHA256af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
SHA51227d558deffeeefe1198aebdf65a3fef0b0f3d6b6c4177d03ff32b0363f0a2fb1b7ff6454f45dd3254427cec9174b03181c50bc51dba212e6ab0114a6e72bcf96
-
Filesize
3.7MB
MD571d6e7120f957a8eaf4226a94491dc9c
SHA10ecdb7b86f5c22b7fc0d2b1a747d4f8c42ae7caa
SHA2565f4250f7edf25c801c2b0b78c4e453216a8cee2cc43831db886c8beaf4531f66
SHA5126bdf19cdab2669428dd5692a6345455da82437ab81e0ba3c9238b798baef729f0384396f743fe8e58329580ac4fcb2cc7c85f5d339e4941c5bf19abb5b55cfd5
-
Filesize
1KB
MD5fe00f5dd4497fe21b193b931fad6e72b
SHA12f7c0cf0806a5d3c3fd8354631d0d7d5883efd25
SHA256413b6f9e48057c9f0442768adfde7afa2b8eff1fcbb291c9bef20473ce9ed608
SHA512e0799e15dbd87e0fcd2c67f35ed39d3e2305cd53e4fa3ed4237bb118e465e22254c9389c142a0a147a3da3f6e1eeb408e30f6274c5495d82b99b8f5c06105b7b
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\Extensions\ghjgbemlcjioaaejhnnmgfpiplgalgcl.json
Filesize122B
MD58f1ef981951ada25c4b739f4654e73d4
SHA1cc03a958ce4fa86a76d10f343a4e236e2d4a0c8f
SHA256a1d9c5c34ae669a1cfc64ed674a1202e2659567c2092a5b16ae0b9bd56ede5e6
SHA5120687aaec870e30d759804f53a47814ad56a74063c23a5068f013f70fec1296bba0d69b8e002d66cc865f01aba437fdd46c5289454b978f3bb9d840b80e380962
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\about_logo_en.png
Filesize1KB
MD51376f5abbe56c563deead63daf51e4e9
SHA10c838e0bd129d83e56e072243c796470a6a1088d
SHA256c56ae312020aef1916a8a01d5a1fc67ed3b41e5da539c0f26632c904a5e49c62
SHA512a0bab3bae1307ea8c7ccbd558b86c9f40e748cdd6fd8067bb33eeef863191534af367a0058111553a2c3a24e666a99009176a8636c0a5db3bf1aa6226130498f
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\about_logo_en_2x.png
Filesize3KB
MD5900fdf32c590f77d11ad28bf322e3e60
SHA1310932b2b11f94e0249772d14d74871a1924b19f
SHA256fe20d86fd62a4d1ab51531b78231749bd5990c9221eab1e7958be6d6aef292d9
SHA51264ebc4c6a52440b4f9f05de8ffb343c2024c4690fe5c9f336e78cd1dd01ae8225e8bc446f386feb442e76136b20d6b04ee293467b21f5b294ce25e500922f453
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\about_logo_ru.png
Filesize1KB
MD5ff321ebfe13e569bc61aee173257b3d7
SHA193c5951e26d4c0060f618cf57f19d6af67901151
SHA2561039ea2d254d536410588d30f302e6ab727d633cf08cb409caa5d22718af5e64
SHA512e98fbfb4ed40c5ac804b9f4d9f0c163508c319ec91f5d1e9deb6a5d3eada9338980f1b5fe11c49e6e88935ecd50119d321ce55ca5bdd0723a6e8c414e1e68e16
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\about_logo_ru_2x.png
Filesize3KB
MD5a6911c85bb22e4e33a66532b0ed1a26c
SHA1cbd2b98c55315ac6e44fb0352580174ed418db0a
SHA2565bb0977553ded973c818d43a178e5d9874b24539dacbd7904cd1871e0ba82b23
SHA512279fb0c1f2871ce41b250e9a4662046bc13c6678a79866eaf317cc93c997a683114122092214ce24f8e7f8a40520fe4ca03f54930148f4f794df0df3ecf74e9d
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\configs\all_zip
Filesize624KB
MD535f8018ba3981a2f266698577be6aac4
SHA1a8398de2c4a22986ee32368c45d0614f326b1018
SHA256a666d69ae139d029d2f860db352eae06f85ec2a3f98c2f13c91e4b51097e420e
SHA512b00fda9194ddf88f364b62ef983ca020b8a0f5fadcfc48d9f087f8de124d74da32c22ea74fd8ed3f984c5bdc001d1f25a86b3e8454e9ed2caf84334df97de9ef
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\easylist\easylist.txt
Filesize620KB
MD58e4bcad511334a0d363fc9f0ece75993
SHA162d4b56e340464e1dc4344ae6cb596d258b8b5de
SHA2562f317fee439877eaadb1264bd3d1e153c963ef98596a4ccf227592aea12ae76f
SHA51265077bd249c51be198234ff927040ef849cd79adcd611ed2afae511bc2a257a21f13171bf01cb06fce788c1cff88c8ad39cf768c5900d77cd15453a35e7f0721
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\easylist\manifest.json
Filesize68B
MD515bcd6d3b8895b8e1934ef224c947df8
SHA1e4a7499779a256475d8748f6a00fb4580ac5d80d
SHA25677334f6256abddcc254f31854d1b00aa6743e20aadbb9e69187144847099a66b
SHA512c2d3778a99af8d8598e653593d5e2d1d0b3b2ace11addd2d3eeb2bf3b57d51bf938ddaf2d2743322e0ce02e291b81f61c319daf34c1cd604ffce1f6407a30b34
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\extension\elokbjeafkcggjfjkakpchmcmhkhaofn\brand_settings.json
Filesize384B
MD54bd2ffe5e645a04d6a7047ac47969fa5
SHA173b988a08b3b1e72a38e4ee0e9813cc09946e555
SHA256a9cf92fb5076df30264c75da6f1b6e41bf592567d5e7bf170c21beba628aafe2
SHA5120125141dc02b40cefa34280311653c1fe0815ecf005d93814f06ceb7f2e2d1789ca7d5907a5cf069880a742db19fc74289467a0538fe329670d9c0397135e1f8
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\extension\fcgfaidpicddcilhjhafmmcgfodijhjd\brand_settings.json
Filesize319B
MD594e409c4948755c18ed015a9ea88194d
SHA19725a6622664ab4332f07e04c4f8a23c86daf695
SHA256ce1e2092945df5b00797e81185cc4db54070583ed92af19dd5d104e1aa4343a9
SHA512e59d6730078b06dcd51a68c1a729244f3af76d97083b75a4fa05ac323d6f6e61c882b41a821c15595c3483b75995bfbdcdbc55bc3609f0d470b8e96ca1c4a196
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\extension\gopnelejddjjkamjfblkcijjikkinnec\brand_settings.json
Filesize250B
MD5338199392c0ee2d8530b8d0516f6d2eb
SHA12ce5daca88f6296335dcd3167a5f54d87687f85a
SHA256c9c85c1fad9bd1e26e42d3b35e7e5ba5d6af4b87e13846b3d71518274896a9cb
SHA5126a89b757abb2e51c46214bf6b111e7ae085ebdef43ce656695e1d7eec91c2f33bfb95868b2cc3749e5e7f3c435bb65d830c96fdd01abee4f9106d1b11ecaf2c1
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\import-bg.png
Filesize9KB
MD585756c1b6811c5c527b16c9868d3b777
SHA1b473844783d4b5a694b71f44ffb6f66a43f49a45
SHA2567573af31ed2bfcfff97ed2132237db65f05aff36637cd4bdeccdf8ca02cd9038
SHA5121709222e696c392ca7bcd360f9a2b301896898eb83ddfb6a9db0d0c226a03f50671633b8bed4d060d8f70df7282ffc2cd7ab1d1449acf2e07a7b6c251aa3a19e
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\morphology\dictionary-ru-RU.mrf
Filesize1.1MB
MD50be7417225caaa3c7c3fe03c6e9c2447
SHA1ff3a8156e955c96cce6f87c89a282034787ef812
SHA2561585b1599418d790da830ef11e8eeceee0cbb038876fe3959cc41858bd501dbc
SHA512dfc0de77b717029a8c365146522580ab9d94e4b2327cef24db8f6535479790505c337852d0e924fbfa26e756b3aec911f27f5f17eba824496365c9a526464072
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\morphology\dictionary-ru-RU.mrf.sig
Filesize256B
MD5d704b5744ddc826c0429dc7f39bc6208
SHA192a7ace56fb726bf7ea06232debe10e0f022bd57
SHA256151739137bbbdf5f9608a82ec648bdf5d7454a81b86631b53dfc5ad602b207d6
SHA5121c01217e3480872a6d0f595ceb1b2242ffe3e1ff8b3fdd76eea13a7541606b94d3ccd69492a88220e0e40c17da5d785e4dba1d7501e6be749b9c46f72572ef6f
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\morphology\stop-words-ru-RU.list
Filesize53B
MD5b255d75a7ee1052a3648bfffd2b31f6b
SHA157a388c0a6f44bacf8576a4d54ae520f649e9990
SHA2560f45d855adcb5517b3e8d747ac385cbd7d493bc0529a7c567c750ba765772040
SHA5129a4cc4a1e6d9c188c24f628ccc109f447a2ebc8b42e5e6daccee0617dcdd3f1cc79206e6278154583c29dd8d1180072c463ed88ac56e87a6de1449f40494c292
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\safebrowsing\download.png
Filesize437B
MD5528381b1f5230703b612b68402c1b587
SHA1c29228966880e1a06df466d437ec90d1cac5bf2e
SHA2563129d9eaba1c5f31302c2563ebfa85747eda7a6d3f95602de6b01b34e4369f04
SHA5129eb45b0d4e3480a2d51a27ac5a6f20b9ef4e12bf8ac608043a5f01a372db5ea41a628458f7a0b02aaba94cd6bb8355a583d17666f87c3f29e82a0b899e9700bd
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\sxs.ico
Filesize43KB
MD5592b848cb2b777f2acd889d5e1aae9a1
SHA12753e9021579d24b4228f0697ae4cc326aeb1812
SHA256ad566a3e6f8524c705844e95a402cdeb4d6eed36c241c183147409a44e97ebcd
SHA512c9552f4db4b6c02707d72b6f67c2a11f1cf110b2c4ac5a1b7ac78291a14bf6eb35a9b4a05bc51ac80135504cd9dcad2d7a883249ee2e20a256cb9e9ceeb0032f
-
Filesize
618KB
MD5bb60da7176a0286e561af09fa0512635
SHA154f8a5d7042b2350848a31bc7f7179d1deb66b6c
SHA256f330378a339e5fe51e54af531b8a53b01c47b4448196c85a166034e44ead625f
SHA512ba51700283f6f50de6da0c1585cca1558600e7cc0eb11ce6ee7a21aab7f1c088f7f589dbdeda5e477548c10b86fcdb821d307f3c8bf512f962eecd6ac0436211
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\1-1x.png
Filesize18KB
MD580121a47bf1bb2f76c9011e28c4f8952
SHA1a5a814bafe586bc32b7d5d4634cd2e581351f15c
SHA256a62f9fdf3de1172988e01a989bf7a2344550f2f05a3ac0e6dc0ccd39ed1a697e
SHA512a04df34e61fd30764cf344b339ba2636b9280a358863f298690f6a8533c5e5dfa9773a14f8d16a5bb709ea17cf75e1da6302335aa9120009892e529bfad30df9
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\abstract\light.jpg
Filesize536KB
MD53bf3da7f6d26223edf5567ee9343cd57
SHA150b8deaf89c88e23ef59edbb972c233df53498a2
SHA2562e6f376222299f8142ff330e457867bad3300b21d96daec53579bf011629b896
SHA512fef8e951c6cf5cec82dbeafd306de3ad46fd0d90e3f41dcea2a6046c95ab1ae39bf8a6e4a696580246c11330d712d4e6e8757ba24bbf180eec1e98a4aec1583b
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\abstract\light_preview.jpg
Filesize5KB
MD59f6a43a5a7a5c4c7c7f9768249cbcb63
SHA136043c3244d9f76f27d2ff2d4c91c20b35e4452a
SHA256add61971c87104187ae89e50cec62a196d6f8908315e85e76e16983539fba04b
SHA51256d7bd72c8a380099309c36912513bcafbe1970830b000a1b89256aae20137c88e1e281f2455bb381ab120d682d6853d1ef05d8c57dd68a81a24b7a2a8d61387
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\custogray\custogray_full.png
Filesize313B
MD555841c472563c3030e78fcf241df7138
SHA169f9a73b0a6aaafa41cecff40b775a50e36adc90
SHA256a7cd964345c3d15840b88fd9bc88f0d0c34a18edbf1ce39359af4582d1d7da45
SHA512f7433d17937342d9d44aa86bcc30db9ae90450b84aa745d2c7390ff430449e195b693a8ae6df35d05fee2d97149a58a7d881737d57902d9885c6c55393d25d6f
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\custogray\preview.png
Filesize136B
MD50474a1a6ea2aac549523f5b309f62bff
SHA1cc4acf26a804706abe5500dc8565d8dfda237c91
SHA25655a236ad63d00d665b86ff7f91f2076226d5ed62b9d9e8f835f7cb998556545f
SHA512d8e3de4fea62b29fd719376d33a65367a3a2a2a22ed175cc1eeff3e38dfbaac448c97a6fbea55bc6159351d11a6aad97e09cb12548cf297e01bd23bf6074de08
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\custogray\wallpaper.json
Filesize244B
MD519feb60966afbb9d1b797a050278f13e
SHA19874bcea4222a8f56d59c91b7abe603687a4f67d
SHA25694cf5e38c38f78a42d70599c469a3969e4b3feb292da450a947d8463a57bfb9d
SHA5122abd6fb2bd126ef99a7f0bb79072fdcdea2670d1b296ace2b4f9ebbabb343594b140b6c2728c31af339465619a8ee9faa2e3d64e1847e9557c50a79144d24196
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\fir_tree\fir_tree_preview.png
Filesize8KB
MD5d6305ea5eb41ef548aa560e7c2c5c854
SHA14d7d24befe83f892fb28a00cf2c4121aeb2d9c5d
SHA2564c2b561cf301d9e98383d084a200deb7555ec47a92772a94453d3d8d1de04080
SHA5129330009997d62c1804f1e4cf575345016cda8d6a1dd6cb7d2501df65ea2021df6b8a5bc26809ddfc84e6ff9450f1e404c135561b1b00b9e4915c69e84f89cfec
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\fir_tree\wallpaper.json
Filesize396B
MD531b6342128a20e38a224a3c395f1d5d8
SHA1afea42f96d007c0d02d90a2cf7d3486c73969d9e
SHA256a135978536ba7409f381fcac3befed527e6d310fd4fb6a9e567adbb22e84ef2d
SHA5125b53e2a4c66d81f4e3aec91be650c4b151812d7ea8a6ef1ff911dd56933f8153ccf4a9883e406b2a9cf59056037a1e7434ed9c6c102ad446db5b42e1af93ea64
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\flowers\flowers_preview.png
Filesize9KB
MD5ba6e7c6e6cf1d89231ec7ace18e32661
SHA1b8cba24211f2e3f280e841398ef4dcc48230af66
SHA25670a7a65aa6e8279a1a45d93750088965b65ea8e900c5b155089ca119425df003
SHA5121a532c232dd151474fbc25e1b435a5e0d9d3f61372036d97bcaab3c352e7037f1c424b54a8904ef52cf34c13a77b7ab295fb4fd006c3ab86289577f469a6cd4c
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\flowers\wallpaper.json
Filesize399B
MD5db5d85343264fe69c9452cf6bbddb10c
SHA182d97c05c2ee2374a9343f10db78e0ad232ac2aa
SHA256c15d588d418a5bfc7caa62b62a3e4df7f67990f6912aeda133e616ab0738401d
SHA5123aa27652f9decf1315630ef83302355065e8c43297c0d8c891295a855499e81d9cfef2767490c2992b3103e44d7f16825e65e9bf2d994d17811f49be9eb37307
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\huangshan\huangshan.jpg
Filesize211KB
MD5c51eed480a92977f001a459aa554595a
SHA10862f95662cff73b8b57738dfaca7c61de579125
SHA256713c9e03aac760a11e51b833d7e1c9013759990b9b458363a856fd29ea108eec
SHA5126f896c5f7f05524d05f90dc45914478a2f7509ea79114f240396791f658e2f7070e783fab6ac284327361dc2a48c5918b9f1c969b90795ceacce2c5c5bfa56ca
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\huangshan\huangshan.webm
Filesize9.6MB
MD5b78f2fd03c421aa82b630e86e4619321
SHA10d07bfbaa80b9555e6eaa9f301395c5db99dde25
SHA25605e7170852a344e2f3288fc3b74c84012c3d51fb7ad7d25a15e71b2b574bfd56
SHA512404fb2b76e5b549cbcba0a8cf744b750068cbd8d0f9f6959c4f883b35bcaa92d46b0df454719ca1cef22f5924d1243ba2a677b2f86a239d20bfad5365dc08650
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\huangshan\huangshan_preview.jpg
Filesize26KB
MD51edab3f1f952372eb1e3b8b1ea5fd0cf
SHA1aeb7edc3503585512c9843481362dca079ac7e4a
SHA256649c55ccc096cc37dfe534f992b1c7bda68da589258611924d3f6172d0680212
SHA512ecd9609fbf821239ddcbdc18ef69dade6e32efd10c383d79e0db39389fa890a5c2c6db430a01b49a44d5fa185f8197dbbde2e1e946f12a1f97a8c118634c0c34
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\meadow\preview.png
Filesize5KB
MD5d10bda5b0d078308c50190f4f7a7f457
SHA13f51aae42778b8280cd9d5aa12275b9386003665
SHA2560499c4cc77a64cc89055b3c65d7af8387f5d42399ff2c0a2622eccbd6d481238
SHA512668e1a70a50a0decf633167ac23cba6916d0e05d0894daae1f7e3d487519f0a126abd4298430b38f52746a5c3b83ccd520b3d9b0ae1a79f893e36821a0458566
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\meadow\wallpaper.json
Filesize451B
MD51a8908826d2efe5fa817ce6bf474700a
SHA1f25ed2de494bae4ffeca33071e5c2dc034c863f7
SHA2569c75f591907f6a631ba583bce6ddcaafa6f89a84a4bec8108637f7f471e821cf
SHA5121b68183bd466d01ec25b1281737ac4e752263cd88b64e16324244812d46f8f985ebdeb35d065c7aabc7abcb93286e92b0f3d5b0b7173f5aa6e33891c417b6fc8
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\misty_forest\preview.png
Filesize5KB
MD577aa87c90d28fbbd0a5cd358bd673204
SHA15813d5759e4010cc21464fcba232d1ba0285da12
SHA256ea340a389af6d7ad760dff2016cf4e79488bda1a45d0a415b3cd02a4430c9711
SHA512759519b8822a6a4b88fc9ba47fa9d5d898b2f5a0f359acfbefc04809e6d7f5df86fb130f191eb6f63322792a18c0e7170aedf3ce7060fd9ad7e1bec2e686c3b2
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\misty_forest\wallpaper.json
Filesize435B
MD5ea6753f7a10f9f92b7790c93f8ea2411
SHA10cb570e8ecc34e16017b920fbcf1036cf1508ab4
SHA256b1f9aebdb9333b4b15c2a9339d18e974205cbd4a61d2a0b4d34a25b384a0de7c
SHA512f7974e99c58696a4d739c4d590f5f50094082473754e6b1fb8a82c76566cf3b5713b1e013126f8fbef0f0c8af2e08d09b32307958c9ed1a1007c04ce89539ec7
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\mountains_preview.jpg
Filesize35KB
MD5a3272b575aa5f7c1af8eea19074665d1
SHA1d4e3def9a37e9408c3a348867169fe573050f943
SHA25655074794869b59cd5c693dfa6f6615aea068c2cd50cdae6dd69bd0410661ded8
SHA512c69bf39362658dd6cbd827cf6db0f188a9c4410b3c6b7b532595fd5907974e2141d857942ffb2497282e31eaa33c71240c2c2bd8721046df55e3358e8b76c061
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\peak\preview.png
Filesize5KB
MD51d62921f4efbcaecd5de492534863828
SHA106e10e044e0d46cd6dccbcd4bae6fb9a77f8be45
SHA256f72ea12f6c972edfe3d5a203e1e42cbbaf4985633de419342c2af31363f33dab
SHA512eec8171bd3bea92e24066e36801f334ac93905b7e8e50935f360e09fa8c9b9f848c4c62b687299e8297c0693d6dbaf9c6035b471e6345d626510b73e3606ee4d
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\peak\wallpaper.json
Filesize452B
MD5dabb663536eef90a540783e707a311d6
SHA19659fe0463435f3281983ce306ff22fc101f6e57
SHA256d1c971a197cb79f1df640994465aa7543bada90059f5b2768967d2b57c6afd2d
SHA512ed6b4090eba519f2814dc51fccb92cdb703656c77be741f07753f9c84d09394d080158e04bba1ca9dee501b0dff2a21020883e538a6c0ced6a12602b7098676b
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\raindrops\raindrops_preview.png
Filesize7KB
MD528b10d683479dcbf08f30b63e2269510
SHA161f35e43425b7411d3fbb93938407365efbd1790
SHA2561e70fc9965939f6011488f81cd325223f17b07ee158a93c32c124602b506aa6b
SHA51205e5b5e9c5ef61f33a883b0286c2239cb2a464581d6e8a86d7b179b1887b4cb2cd7304e0821cdd3208501421c44c63c248a5166c790792717a90f8ac528fbf2f
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\raindrops\wallpaper.json
Filesize397B
MD569472b2b8eb07ec616a8e94a492c6c5b
SHA1aec5df4e15d292a360a5dd6125217ef063ebe65e
SHA2566e9ef0bb0853c6c898ec033d54d9d5cfcb68a5f52cd8f9bfff3528a02c73e06c
SHA512e355958272292bcd7d767af692fb33941ad469809abb6366b1aff2bd4585de6a18b290258799e943f9a53416c9f5c139ccabc47cb337d0e6e4f5d499f2e27aa4
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\sea.webm
Filesize12.5MB
MD500756df0dfaa14e2f246493bd87cb251
SHA139ce8b45f484a5e3aa997b8c8f3ad174e482b1b9
SHA256fa8d0ae53ebdbec47b533239709b7e1514ecb71278907621ca2d288241eb0b13
SHA512967670863f3c77af26fa1d44cd7b4fe78148d2ba6ea930b7b29b9f35d606554d664c0577068e0c26fa125d54627d7e7543360bce4acee0af17783b07450b5f52
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\sea\sea_preview.png
Filesize3KB
MD53c0d06da1b5db81ea2f1871e33730204
SHA133a17623183376735d04337857fae74bcb772167
SHA25602d8e450f03129936a08b67f3a50ea5d2e79f32c4e8f24d34b464f2cb5e0b086
SHA512ff0e60c94fc3c0c61d356a26667c5170256e1143b29adf23d4e7d27012da72ed8865ef59dc2046314c7335b8d3d331e5fd78f38b9b92f6af48729dae80f85b15
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\sea\wallpaper.json
Filesize391B
MD5a79af1c34d9d4fcc609e57fbd387924b
SHA16ae1f8730d03cbca17a1c368da8a600157e0ea49
SHA2568c60b18ca1810a5e75950095cb0dfb4bb9c32a18f99e5505cf40c39840b8a633
SHA512b95aef743acb3c6890e3ca74fc260a8fdeb134ba399f6e9851d34a47fb2cad9791a64d6214acb956ba4c8b51dd710f8f10fa8c3e88fb1a0f52a7e2214eca16fe
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\sea_preview.jpg
Filesize59KB
MD553ba159f3391558f90f88816c34eacc3
SHA10669f66168a43f35c2c6a686ce1415508318574d
SHA256f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
SHA51294c82f78df95061bcfa5a3c7b6b7bf0b9fb90e33ea3e034f4620836309fb915186da929b0c38aa3d835e60ea632fafd683623f44c41e72a879baf19de9561179
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\sea_static.jpg
Filesize300KB
MD55e1d673daa7286af82eb4946047fe465
SHA102370e69f2a43562f367aa543e23c2750df3f001
SHA2561605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
SHA51203f4abc1eb45a66ff3dcbb5618307867a85f7c5d941444c2c1e83163752d4863c5fc06a92831b88c66435e689cdfccdc226472be3fdef6d9cb921871156a0828
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\stars\preview.png
Filesize6KB
MD5ed9839039b42c2bf8ac33c09f941d698
SHA1822e8df6bfee8df670b9094f47603cf878b4b3ed
SHA2564fa185f67eaf3a65b991cea723d11f78de15a6a9a5235848a6456b98a9d7f689
SHA51285119055ddfc6bc4cca05de034b941b1743cbb787607c053e8c10309572d2ef223786fc454d962fbb5e3cde5320117f9efe99041116db48916bc3d2fcd4ffa25
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\stars\wallpaper.json
Filesize550B
MD58571306e9021fc89eff3c5ced3e02098
SHA149d6a7baa6ab4182c4b38c95be4bef1b243fc594
SHA2560529c0be39bdcb289bf29e6a9c774d907b444857cfaa47d3942e5dae1b75531c
SHA5127657c0e48b4cfa3025bc33b0decacc22646bde2cedda7f51b98b19a17a91461ebee57f054b64edc58318ef6caef7227ac21b740527144f3fb0bc0a2e7b9fef19
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\web\wallpaper.json
Filesize391B
MD57b00cfeccb0f471865d2ef08fa1d1222
SHA11881d5a29dfe86d6d19cac14a1a4b95b05494830
SHA25622557386855643b706808ea9aed33ac22fa26f58d2fc281fb0ba917cf55f990a
SHA512b7d80dccfa5f051b1ec8987193857aad83c7365e12f12fa68b8edc6ae0dca1d8a4d846e284fb8e15715b5ce7478dae334da5651b97a68189cb43c74e7fdf7177
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\24.4.2.885\resources\wallpapers\web\web_preview.png
Filesize8KB
MD53f7b54e2363f49defe33016bbd863cc7
SHA15d62fbfa06a49647a758511dfcca68d74606232c
SHA2560bbf72a3c021393192134893777ecb305717ccef81b232961ca97ae4991d9ba8
SHA512b3b458860701f3bc163b4d437066a58b5d441d8a427a8b03772c9c519c01983e3d3fdb8da20f6a53ad95c88dcdd0298f72822f39bc3672cb6f1d77fcc3f025a9
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\1df5a2d2-d962-4a04-a3ba-7af887dcb1e8.tmp
Filesize184KB
MD5d32fcda5a77fd3373d8fad1e2232b27d
SHA199d932cb26a2da19c30cabf4163a70d21f1e53b1
SHA2566fdab8393612314875789c155e6c6d2efbd020b43bcd8a3720c71139b1ebbcb5
SHA5121a64a218a9baf783f708583ad29fac40d480fd44fedf94fcf4b52550ff3147b12473a73583585a56fc4262e36cfc137e3c3b531272563bc07d147422fca66aae
-
Filesize
48B
MD5cc040ac848653687d8b7a7bc7345795e
SHA1f02041c2e026b1293f2fb7023d09939efdd6fbd3
SHA25699f386caa5bcd8799d8b825b2e973bb9ae217ab1a4fa788125acfe87b880a19e
SHA5123d59a70bb73ec328a4378833b64ca791c80feadd3328e7c656fcd292971ab449d2cee1f5e747d627fc76f58316e591aef074b4dd0899a5ad052d401a3b7571b5
-
Filesize
23KB
MD521315034bf0f628cde156b0be3b01b73
SHA1760e872c16563351952f01ea4b74d9a9b2727266
SHA256747874ede1e3500f251309fcb4108a7219e621beec23cf7f55695f7e11bc3cff
SHA512a7ca6b4e05ecf1aa8798afa3531f46146539f776b9cdea5e79f85553dc7dc9557dfb9a9ff84ba9f1e0a995a19afa5438a65546a39225aae7ea4baa1ecb7bfae9
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize624B
MD55243693aead2873d4e3284b8bb4a2823
SHA1e3e04dd8b593542011d375edc8189723e3f566d5
SHA256229881415c3fb3fbff02596c2701034ab636982ddd5bdecb17fa54cf307b9db1
SHA51258daf7d03de0950933a6bc0d21da6e1747639936e7bfbedb357e91df422acde81acff88db122c730a3e7fc363dfde994f93db0469348839822c67adc6b280c16
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c3d8.TMP
Filesize48B
MD506663888a6e756771041929bf47c6488
SHA1af3e72de051ac79d735387c82f05b569b2722a96
SHA256a8822f1bf04891477c95dff76985ed7e9417f0e1f54ca96552fe6bf1bdf470fd
SHA512b3b3e6f2f1c124816e26de00fc4d28c5f1380a0664ae36ec2c3629aa328042bf57772f80393d407cc551b70dd26a03a7ae6fbeacf789499fc7189bfd44db17dd
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Network\SCT Auditing Pending Reports
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5301de2a6e85cbcdaa16389ff0fce49c0
SHA1f52a1b5d9ae2dde9dc1cbc4315f285c1cb70400c
SHA2569db0e7db11c314fea6ae919f2fc3de4e72d400867750e03f7adc40a0f6f73a66
SHA512ba71579c759219826886cd2a3c077e7d7b8e7ccf2ffd20bb40101b64948443f713098ae033a6091b5525f532ec7a8860102db7de8880700cc3f9b1c41bb60caf
-
Filesize
1KB
MD510dd0f70dd3bdccd877aff82641e4012
SHA167973f2e80979bfceab297713363dd4ca243a348
SHA25620833190dc3f6fffd532cff1228e61eb6c22a1d1dee5026c884f9713f71ed70f
SHA51287345dffe1cff15b8e80d08e6f2d75ae80d8d864a51381b1e658019114e0df2642a4552f36459b5d90785689905e1ee7ba8f1a04908879ed87abd80f51f756ed
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Network\TransportSecurity~RFe588e7f.TMP
Filesize1KB
MD5569c9b556ac1ab4a0bca7af705c62b18
SHA1576b72c9896ae5ce766e8007a791534e4064c2bb
SHA256d2903f328ff2883d8ce9b5d79579d5cee43e777779b3e5d1fee8f87bc76dc6f2
SHA512f91389dd1c159ec40e5e0b965012bd7ca0cbd1574205b072f31411e5a22aff3a86463085297b46f50005b2ab4ca5c21e1c2c59a3f4576d977cca451d4c609c15
-
Filesize
10KB
MD571931d425738318efd63bee33fe07454
SHA15994944a6770feeceb35c009df13414bbed7f492
SHA25657bc75bbadfb8c3f5a8c1ce892512326e5a4dd6e19ca161ee4b4f1efa69e1c42
SHA5126870adfd6e47739ce23f853840d2c16d19045e24275267c1aae94e22f721819a02c6cba8658edc40da20bf1152f30d138f5441dc9a3b5ff6d8cd051df87958d5
-
Filesize
14KB
MD51ddce94c2ec044fab4e3d37448bdf699
SHA1b2a5fddb71f870455f7f7592573161b9446371d7
SHA256429f3a89f35753926ebed9f71fda63c289566fc7a96b1d61bf46b419ada41f8e
SHA51289e0b091dd22f1c69f91932e8273f3cdeed523353f5e90b18cb1e31878c5371374b9f51c0da64d6a0cea3d06a28cada14817ea284613e237b07af2781b016598
-
Filesize
14KB
MD5ca9039f8d17f008bbdbad289ba86ea6f
SHA15800c69054aab9adebaee21b28531ba20e507bec
SHA256d05b4e2f3437d9ad2eb3170088878e42a5e409f726e3fd04b91e32a23a2b97eb
SHA5128a235f817ca094dca54767dcf48aac8b2414fdb704dbb65e59bb00fe26c58f5731825ef9d38a29432250bc6c327926da89be9ac95dcb6be243aa069319ab3149
-
Filesize
7KB
MD55d505dae34130bccaf084736e84afbbe
SHA106e0fb6f191d8dc4b06a9be3fe6c6c086b6bdc2f
SHA256385a0c177e4aa0a8e739c2772edbb3a51a452350e66a179a6d44efecd845c213
SHA5126b15b955c8a3f7d7ef3cb4803e9616a6dce5587815f71fbb27d71144900af102da716fbe1217b280bfdf6767b3c3ef210203080434dcd8f75de6cb41b303798b
-
Filesize
14KB
MD5a14f5344c4572639a6f23832ff451cf3
SHA1f83d010dc12c59f2064fe182a7dd3010989367a5
SHA256b88e76537a023459762c7aaf92fcdfe9cefe4718b12f754cec8ef90c01e8a615
SHA51290430c34bc13db401a862629bd59b76f76f0b15c4667f6fdadaf68f3abb702be21c6af2eb1f59406b47e97e639149b9622c409ee561d25b79c75f96074ee9d8a
-
Filesize
3KB
MD50978cea73864a4fe8f109785e05853ff
SHA1a4b794d6f4a575ce0e6e45fa94986e474fe018c9
SHA256e11d9d50ee97f22ac1fdf7d2f056f5c715ae6300808a51171760014a305e64f2
SHA51258402cfcdd120c46043dc2c1b37f34f2bf185d44c1a5fcfd31560d358c6c0c04c45bca52928a6f021de6a13f0eb417c849a0dbb6d36c7673ac050019ad2aac8c
-
Filesize
10KB
MD570233001792ac3565126117bacc5e919
SHA191ffbd945784f8ab9a42563accbb90f31909a904
SHA2569d28223f01599741be89fcd5992ced45020cdde5b0370ffd4de7199b9b046028
SHA512dc83bd3179f52b590c1c86062ba87c7db0d7a57cd5a967cfbff7f3dacc6ce73a8caae3b4740c3fc301b3d37dd4fbffe54205b37614b101995e061d708674b7a6
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences~RFe583a45.TMP
Filesize1KB
MD53f07564f9748ac1b925ef9f47a5282e1
SHA1d0ad4dc0c0f3be8d2f41a8950cabd3ba0bef35af
SHA25642f51c616ae0a9d17d2fd98e8c6b3383f68eee436ecbb1457a89a220f69b6124
SHA512db0d8976e85590cbb7f537df44725c16e075464a8f71bca3f60beaf39591bfd7727c63ed4b893c6863a0b18d944c63e2b31d0b46c20e14caff0642288ec8af02
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
118KB
MD562e99e6a6dc13bf14220a1411587f34f
SHA19cf81a3283cddbf05ce5ef11ced7f011dee2fbe5
SHA25692a3f9d117456f5825c9ae39c3b10f57172424962b7ab16cb1542969add7320d
SHA51271d4cb99f55c7b365eca4a234701635c43ff75847ff902649341d8d53c88df46780f101a6f68905a257b69a949c7eab6d5b52f2471e734b5751e0464db5168fd
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
116KB
MD52876e5eb9a5c4c4bf8e8816021651ec4
SHA10f18a9d4d5b8c92f873a48c0e4df49495c0ec268
SHA256c9c882a66c16001482c3fd6331fb2a3ca3fc7fd3a4b0d79987945384bcef38ad
SHA512e217838970a875959b2eea46a044392a8f558a7d84a4fe955d6eb10db9aed6f6cf9d81309f199de766ea2f95df9fb8c45795889ef2bef0972141433f1ec04bde
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\11b2a035e28b3e94_0
Filesize545B
MD5813361932b486b0dcc95b6ccdac636bd
SHA1544e770f3050fe551f2b027fcfcea75d7945bc2b
SHA256383836a0a9b32d9dd4994ed625fdc3b0b5106fc4895a520f05b0f5572dcb8009
SHA512421144f48f7972ddbffd709bd5acde5ca0de25060e46a09ec64fdefa71e2bb6a8b98fbf98ca65a5635364e68014818dd1c5fb170c0daef8e75be609fd15e2eff
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\1ad10c4bb9e37138_0
Filesize44KB
MD5e57ebaa421abb69c998b1c801b8a213e
SHA1386a3166fd447d1ec8bf1f8daf51d81b4f9020d6
SHA256fe43fa74b6a6c370af142d7ab14d8d89e610923ff0a00a5a777920e4c9d6fcff
SHA5125ffbfee9970bfa19ff9242b08870ad1b4d3690363f05d7af792cabced98cb27fdafba3f1161f4fc1544ca34da1fa3ac418131f5210e3452e376456ed57377cb4
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\25fecb7eba1124c3_0
Filesize586B
MD5df5239903c20374d11f3c757a1bbbcfd
SHA17bd4c2d2a26cc4f06aac6089d84822f7e5298d2f
SHA256bc1738ff3d35f86808babcdd3d8a11603cf213e3abc907b8a9df133d9630856a
SHA512f4561d450735f614cb4a2f14b23fc6298124f060106a1ad6df1176edc908cc40c91a69baff848f37ebd0c3abd8fe8709fd52d7c7d38fb07b2dfea5fb4c87dd3c
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\26986cc774600b65_0
Filesize541B
MD5e639c233ce080d788d8f0e6a3477fa48
SHA13a27ce65eef3d1461e157291d45aeab1bc7b0438
SHA2565711ea052329a3a27a73fd195d33f4f1016649e6383167bb0626b07a070034f0
SHA51255320631d4496c4320b1728ab4273cb263983b3d5ff423a9876fef2a2bc86f247f5c4bc4c756485609f2ab3b25ed64ad0421912b43257ba875df210c20450a90
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\28a3f6e1c82d785f_0
Filesize36KB
MD54bf895ab990bf262894caa3724383736
SHA159d1e2a803bc156385aac4072f8f8ce5564fb0e1
SHA256f5d0f720d26907aaa0d53aecad5898edb07fe1de59df0199f843cfd56caac6b0
SHA51263c35706f2bff195e1c6031f27f7318399bfc3c78d19d5d6f2c706dae4ae0e61c2d3416958ff8aa0bbdbc3685a5e758a4bd7c2910d21204672e688952617ac3f
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\292fbdd019f435bf_0
Filesize1KB
MD5ce49ffd96f3a0f37fd409db959c5542c
SHA13603990c7bac5671509d136950c14e43bdf10db4
SHA2568775e72567355d67ab5d1103b497b20fad47c61be6ca754e58f69633891a59f1
SHA5125d150812ecb4e6b38343be33784da153c21a7b8cd6593398cb2b2857e300d9e1496d0ece9cdc600f8ad482e184e784d20420cfbd2add6187bcf41d7659aa2042
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\2a9877b782e7616c_0
Filesize42KB
MD539846803ac3f83839365ce751d1870e7
SHA11eac7e342ae8a1cbb09e01c2f2e658b06f45458d
SHA25635a82e2e896ab0129a3a01aba72f20af0a5d09dc351c6d0250cd849c15dc090c
SHA512063dd219c835a58206254301a7ac896580efdb6f762e0f1d81a9ebb56a19eb1bb842f87d1e233ca42d712f30881d9657c98edc3a1b0cb351ac986cb29444647d
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\4ccca982aa3d0c02_0
Filesize18KB
MD5fd07467bd0e732679c508bc5e638f74d
SHA1dff3108e67adc60b1dbb9102b05fd4f33e44e746
SHA256925209fff507cce70e8262d186eac98e95301bcdb3f677aa10820ce8100c7a4d
SHA51231cc3d58a851b61d636d442fead0afebd0428678a4bc3a0cd950b83a8c8a28b6adee25a26010c8185404ea9ea2f49e0ce5d193ec17915c2bd45366b8a5193477
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\5128ede85833242e_0
Filesize4KB
MD5bee1c94006f703548bd3eb0ba17230e4
SHA11f6a91404255ddd024e35048772bfa57396590c2
SHA256d0f016d16bb9faee831f2713c2b2f6b2ea40ce29990a0e9f25c8e10f24de5fc7
SHA5127a6face339d3f3934d78bbcbb11e4f716130e51d806eddc8b57502acef0b434f34a8d92c02815ef7fbdbcf7785af0183ed8761e190ee6e449de2ebcb1e342e29
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\6d861d3c5a9afc0c_0
Filesize4KB
MD5d256f73305bf5d044358e64ce8986a2f
SHA1e28faba7f00fe14ab0642b19af0e4833bbe05514
SHA2566cc735cdc0f34a8ed614d884f8df4adc1c50d7afffad3668747103090a0d9cf7
SHA5122a9d0b0b7185e6be42a8d365813e2cc9d2a012e392c69bd1972a7a3437511dabe37054c8c4f98a0e9bbbf23fd7f80766be858b39d75b9273a3a16e88d7104154
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\6e50ac22c49916cc_0
Filesize27KB
MD57f6290e383626d792f3b0f06d3c0cc13
SHA1a3fd7af5898d69e774d078a2b066244cb2d47bac
SHA25618790319a50aaccb93841ac7a4ee62c7b100d97c01334e1ab1eff6fc23792f5b
SHA5129607454ae7dc7b4e5e0b3e2ec0be452eb3f3e1b3d62a4f7eece08e56282b27ffa99ab25d36adf336956d08bc44da50bacd812a110ca8cb47affec0468e677a5a
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\72c2e20ca5d250b9_0
Filesize13KB
MD5fe144e8a946692c1fdbbc1e94d5aab9e
SHA18e93027375dce95f4373e2c38aa3c57634240d48
SHA256e9532c23d55b0620c0a6dee30de083b2993c5fbf497fec4de854cfb1262077af
SHA512815b2ee2e1ab7c5bd4098555ca948b37e473671d6189d1aa8fe6ed381453555b80fd4f118c74cf58e581c33d4066eab4552673da52f5aebb1fe87c1099cd885b
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\8026096bf5034c1d_0
Filesize557B
MD545cf7dc5468df71d8e4e45655ea90fe1
SHA19f3a0f868166d14e68bed63bd5e92daf7f258d33
SHA2564c09566012826f6b72fecb92ca57fd9dd8bb8c605cf39c409c72ff4b5c50ef16
SHA512c7ba38d00cc0a5a8b2ed9d2a22070a124b3dcba6e9ad43b10e8dc2623ce02a745b1b55364f660031f496b02042bcfc63cb7ae30c5ab84f5f6fe58920db76b783
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\88a052183f2a4b12_0
Filesize480B
MD5a24ec308005470ad8ebf021f60f34c4e
SHA173d84ddf6a6dcf42cde5ca155efd7c2495aaee58
SHA256a9500fc6c51d69be22f6c594dbe92c0eac32a505737120663cdad7096fc6b721
SHA5123fb3d6187fd1cb40997b1124c0d3d9d6e64f77a465a439bd49d47c0556c28c35e226049f48d1dd46ff9bee810ab788f6131d522c86c7a31c1a6dfb97ff8a7998
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\960f96cb6df57eb4_0
Filesize15KB
MD5aa6dc811c468ab02bb0dea730fd6077a
SHA1b17f82e1d473bb752c3d0b7482b8e9583e558518
SHA256b280b6b01b4546f22893670b4c4c5dd776764d21650c31a18aefdff053746b95
SHA512aaea2fc67e2d048fd2eb1188f857e9dbc726cfac97050d6aefd1d0f4ec9d0cac07d0bc32fac3584b24631dfe86ea8d54f06758bf8c42f0894ad3ef906501c2d5
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\9c1d7216fb32fb2b_0
Filesize14KB
MD5c79374430f99c63078cd9dea8669d627
SHA1081ab48ee9093d1b0eb1cc5e773a81a2a3c431ea
SHA256a2b872d715662ed1b369c06b4ee179dee8036e65dadab70f7753f8cfa143392b
SHA512bdba70c40a19dc1a47e2c2efaf866d8547f810bbec627956652a301df789e46aee9f50be1a5fa89f447f89febd829404cfed35a60706733dc2122e5306add136
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\a37f0d2250c0b06b_0
Filesize648KB
MD5f2600cd84f7d6fe528ebba040ce8c407
SHA134d115ecb1f22cd86923d79b275f17dff29077a5
SHA256a8c67e2cf51cd5844eed68683d1445ef17cb69f57a1eac18a37aa32214a57e55
SHA512563b8b60f7f1050a918d1c4544e3125e2d6cf5560f8df714c6f5489ffc38c861beacc01485fdfe6640f382729fa232919405e36d999bb42c8889dbc0852b2dc6
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\a81966f4be168991_0
Filesize1KB
MD53ae0f5a4fd05d891bff56d4c0f41d325
SHA12f3915d6c7d452f9c75b088076bd22309549fdf0
SHA256a69351d19806788f8c0e768cef3cc8574cefc855ebfbcd3f655de010def8519a
SHA512853c1905cc18e534c8d73829d6278c33571cd41639e02a52e7453d97039d4fee5c50a6c5b53cbe5900db53d02abe0ec5dd896d9e93959ea29afd12ff8ec01bf2
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\ae662e046f7b3fd9_0
Filesize3KB
MD5bca4c558f9dc9d4becb164bfefb0b8f8
SHA1a735452410f3b870f7017d0579fea61b3326046f
SHA2562f2d589a50f51e990d758f9d552076e0fde5f9ce9b8be781465f86c3fe1dc810
SHA512e85c68f22871ebda2d559a22ed0056afd3631f75b4ca09e89da73fca2f9499df7e32e106b3f7227db2529ac93fe375316ec8f3c0501fa794ca60ceed4b645798
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\cd4004d6793712fa_0
Filesize295KB
MD5d8b4c2d97d843da3f576599122e45bf6
SHA133423ee82244450056292e4d46a0ce2c8abd545b
SHA2561dc739f09ae3c59b424c64ce51e701117cb878852a337095309c4589c0b4b8f5
SHA51206d8324a1e1e7516d45c6c825468a326286ff47cf5a85007cbbcee64643264b0e8243abebd290c2b5b45526aaf677d5176481c98625e0a22ed58bc62f95e9bbf
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\dcd100f566d000a0_0
Filesize11KB
MD5aa44ff5d3fc20a45b973649d2804ef6c
SHA1dbf61de0d2a646df9c9cf4307c23f867d5f45648
SHA2568c44591d4861f4a2377b41396d7219201bcecb733678889213fa57ab89042cdf
SHA5127e1d16fbdf5c39b4968cdf74ecc797c3db3bf1d6a0629fbacf51e7333570e0980792bddace388b964a3494afc001f02d97620bdfb2c2c20a368fbade29a487b1
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\de3b030126695833_0
Filesize436B
MD545d06d56086c9b67cfb8b52c8d806ba7
SHA1a86a2333ec99715ca6352e423a74a84d13b13036
SHA2568aaefaa38fa069c69851f3261fbd6234352c358baefc9c0c1427d1483e2ef667
SHA5128c263d46a5384923f5b71e73da8fdd34814b59fbd22f48c60867a68951161af24be6283bab67b68c86ee0ad725ad7e8c30c79b5449de3a7071c9538925b54283
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\e7d083353a620397_0
Filesize777B
MD5400d22f91fdbd17ad45b1a39743c69dd
SHA1fa38d5d97dda5336895e593dd029d224006b242a
SHA256f3f3a7cd6966e3aec87065042f6b1efac1747fe68d3f676c9a16b86c2dd03fa3
SHA5126ec61a1a277acd448a7bc0c8539aa06819edff1eeab5153e1a6f758309d93d1715bb3d3fdd1c8b01a101203c2a09d356efc2690f47db27ce08eb014d685d68ae
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\fd41ca2a883063a6_0
Filesize9KB
MD533904d82f43c90b5e9ffb866e4066b7c
SHA1ce9ec159724ee3d72e3299fad2d63bd1a5add7e6
SHA256986899c2b72631e9299c4147d5312dcc8a2417a27a22739c81041ebbc32f75d8
SHA512862d44599fd039e1d5d7319e3100642e89f0aa1da9cd629ed2ec9cda09543665d64d201039ecc77d49bd4961b9534304d156141c2d73e3bed3d698247ff9073e
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\fef132170d47887d_0
Filesize2KB
MD55670cfc378b86ac23f487ecbf660beeb
SHA1a45b1a23c2810d4585f95a54b0150243963a39f8
SHA256e45bdd7888acaa1b61b00e7e51761fdca472ccbfc99b9f7458093abb1bf9123c
SHA51227b9c243598b86f291e3240ab60d6afeaa7891e2a0264f6034aa0376e665214ff7439a4fd358159f8ecc264fbf400e9b38f4830e61da6d75e8a4f017507070b3
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\index-dir\the-real-index
Filesize3KB
MD5c1d975e90d43c297599cececcdd9d5d2
SHA1019a9149ee559d3a5c2199027219fa377a3286d0
SHA256bf4a401043b3bdeaf0d0a38c275d6343a6c44c4b329952f72e9b10683e654a48
SHA5129700ff8d26d43e8e19aca85f8f7c55582bc2ca281dbe41c2b499030a24be8daaf26f494ab63ba4c78dff28f636853745c0ffb4bef8236c5be062b74c7af62819
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\index-dir\the-real-index
Filesize3KB
MD5a221651fe53979a319fe9eec28cd96be
SHA1cd5861d1fff7b114d6d7c7a5058cebece55313d5
SHA256e6bdda957d91d8051cf496d5e6def670eb8a5e7aa30140cb7f12ea35b9cbdeda
SHA5127aed58de9f56940afa00dba418c552314ff285761570eb53642c4242c9a1972e8583c0528d2c6fdc7af46991d14f72029cd66bda666b6c12ac29e33a89d8b121
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\d62d4852-31ec-4500-ab1a-477b1416f1b8\index-dir\the-real-index~RFe58a880.TMP
Filesize3KB
MD5da5e7f2c665e27717ca72d68a566d420
SHA16e27d85e992f8d6f7687d631fb9ee1e62c9539d7
SHA2563bf344c14e9566e9d08df9e8ded674b6dc64b490d9a920f78209c587a44a1cc8
SHA512d0b3d6e207dac93f8ccf94e1dfa1e636f13716e0a73401e0393eef6c835e27558a664bca7b3834163e761293ea91ef50c5d0b39a0dc6bce6956536701009dce1
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\web_ntp_cache\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\128.png
Filesize11KB
MD5363bbbffe31e45e3945aa0ff3b8cdd1d
SHA1f223255a82218ddd45bdf54a0cf1e8b438a67edc
SHA25639b835c3dcf4261025de83d49ab151f5af0bc1ed8845932065aa1a333f026684
SHA5127bbfb3810a2bed3d2a8a899afa95412cca95fa6916b1684ae3182bd0ad28faa7076fdf328281d106a53c10385667729b4089b0050610e87eadef2f3ff54e80be
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\16.png
Filesize699B
MD5238b0e7dc06028db4b6aba8078740ffb
SHA15fd2309587993b371beabb7a9d039e0dba3006ba
SHA256d159e510392f6da58c4d15cc098171d45c7b02a1362cbf7be7a2d47a1a10e7fc
SHA5121dda4de21be647067c04dfc47174df39d0c6c1eeee3e9005211f908351b69d6a27ed268b5ec7480285fb203a95136a3a205f7bafb7eb5223a3dcbab0dadc0e5d
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\256.png
Filesize24KB
MD5a363094ba5e40a4760a9bf566e5defd3
SHA11e74e20f48ec878bd0b76448c722168879c5b387
SHA25605ae2d6161a3acd83798ec56dbc45087e6aeb0a1376401f55aa46539b1d95559
SHA512ce30f312cc08366aa588e75b229c178a83cf6d464a1051bd1118b81e5166085a2b1bcfbff97804f3e8662366b59f43a659e4b0e315dabad125f16ec9ad9ac379
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\32.png
Filesize1KB
MD5d2e7ab79b45eda7c4421f296abf37c52
SHA18490f4e098d50ec161e64db912f8430826daf2bc
SHA256ded3490683fcf3c5b87803bb1835759df2b65831a6257a326709a708a1dd45ac
SHA512094c2150f872e727980f84b6c011f13210d43cbfd9437825b3b014211c69d7bd3f6367e9913370b624ddad270cfe91c190ebf2c5f5fd4e082b5d6c85199cb6b1
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\48.png
Filesize2KB
MD57cf35c8c1a7bd815f6beea2ef9a5a258
SHA1758f98bfed64e09e0cc52192827836f9e1252fd1
SHA25667c320fa485a8094fc91cd3fcd59a7c75d2474e3046a7eb274b01863257fbe01
SHA5120bbebde654c9f44cf56b74fc1a9525b62c88724ec80658efede3cbb370c3a6d4f3e78df459bbd0559a51838f4a172bdfcd370bd5477038309024b77cd69f2a15
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\64.png
Filesize4KB
MD56f5486bcca8c4ce582982a196d89ece5
SHA14648ae13d71b2ff681cabc5d0b5b4bb242cb78a2
SHA256c870819a5c73e2ea5f94312bdf10fc56668d3311ef2eab6509b659efb456bb8d
SHA5129a36d519a9cadf5b464a98082511906cc5f24c4218f6bc2ae323f6b38bf5fd413614807ef0d442801bfbc3b2ce2a0527b0f7be24fd51f49cbde6b5dfe2cafd7c
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\96.png
Filesize7KB
MD5115decbc3eb53574b2582f15a0996e83
SHA1598a1d495135f767be6d03cf50418615b22146b6
SHA25607fbfbda84eb5467b120fb3f9b4e028077303098bac8c2934635b14bbda847e0
SHA512af237ddb585ad38fd0fc3d0f0b75c60d0117e965a548bda055b2625f86ee7d91fedc840e1afa2fe80814f152732371255133faa21c3d774ca9691446541cf46c
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\b25e30b7-4acc-4bc6-bdec-a5bd3a441cbf.tmp
Filesize160KB
MD5e83f8ddcd8a44db1f17574eb0f501331
SHA10b30ec881ad62158f896ea47f5c70db3806aefd6
SHA2563bae34ca8c4ca34ad7177a57d3934891651bea573f72a7da8cdf004f897ffee3
SHA5128a246ea1417825e1de0ee26af667c849175659441dac4c9f115d58ebb68abaac9245b231d787edfa72384ebdf0f170e871fca352b441faa41bc2984bc1a56223
-
Filesize
31KB
MD50f8b1053967ebc7a99cae39f0e3871b2
SHA1804c9e8158d13030de28ae7399bd76aa76dfba4f
SHA256feea4e1c8e921901af2601340a64e727d26d221b9cf995d6cd6cd07e94085a3d
SHA512385c7d8621b956acdaddfc41135d9e7b670cb24da04fa1eca45f639276d0e75acb478eff32441265032c7fe2efb2c2b998e32701819f7cc40496afa392f88844
-
Filesize
31KB
MD5c3050297ada5cfbfbf577205ccadedfe
SHA1a20574146359a2b95ad7f3cf2bd049c809a76787
SHA256129b05926e5b668184bff79cbf289b0d9197e46bfdaff14d9a927185a65ea7ea
SHA512a0ffef0e520645399e21e75c7865d8f8de13ca7dec1f03efbca6b3715e9addcaabc0034eca8ea46db1df5039033990ed7308bc3b467eec11c4daf6790d908821
-
Filesize
19KB
MD505eed26ed2ef58c663275a023e45b54f
SHA1ed55f31d5dc9a414791177669b0464c7e1d3b185
SHA256d3eebc2395b71a9031e7c399d69e2a32b5b2d1003f062fb4c03e0f545cd1d23e
SHA5126db2645077681cce97552158db60e455534184e4bef14feac087e34b6d904c9674f1b57d5b7c5974784ff71b26cd5d5f6f028150745ee370e4f907bd95af8ab5
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\oimompecagnajdejgnnjijobebaeigek_1.2903aec9f77378fa19280af8ff89294fb9ce2caf8e0092c69e19973c0a9cc6fe
Filesize13.5MB
MD55d9ad58399fbef9be94190d149c2f863
SHA145f3674f0425d58d9ffc5d9001ff6754f357543c
SHA2562903aec9f77378fa19280af8ff89294fb9ce2caf8e0092c69e19973c0a9cc6fe
SHA5129a9532cce2de086d5934235d21d27b8a0863ae902a81151a728364aebe044faef5e5805d64efe68d67a5a5aaf408f74954d08f10c6a011dc9ea82c629339d3b0
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\google_import_script\24.4.23.0\_metadata\yandex\verified_contents.json
Filesize990B
MD5683c4594670f2cfde98a198091bf1889
SHA13d6e271a452024422213183980bcf510226648ec
SHA256d38c186b9c02f7db4aeaa4326e5012470c3eaffc1f40553761b5db62f6c1d344
SHA51262a24ff8f7d2fe1f5fe1793719b2e3f964ab97552e0c75835f299c8ae3cdd4f92ab71c3c4baead8d234176e96672baa787fdc043ebc2686f6639cbf494c7ab4c
-
Filesize
4KB
MD5b807ebd3002f71c1de6deb285528a920
SHA114b2c18684174abd078600bc9ac95628c00ea952
SHA2568b44c53ea53b3ff1465263dec2380c68e88e4964984dbdc1497ff2aeedb010d6
SHA5122885e6e91a8ddb346b15ee22f8bd0ea4735314d16a7a480c999b890fc3fcf68e5ab7ee137c7e788f1652f889f23ed920e70cd58bd9300a1e0af44babeeb9fdab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс Маркет.website
Filesize541B
MD561c191aec023403becf8a753c5829761
SHA111ffe9dac32beb0e31bebea55a3940fc28bf42c1
SHA256da9d9a792722721309faa017c7e9502d6d1b22160f1c5839b7f19e3b4fe4aec2
SHA512fa65dcea26a1a4f8b7ae9a2e839e5219d562b5915dbc18a772d9a0e7d0b5910785b162b596938c18b413de71f80dedd356b66b49a4adbec8543fcb3b8e59d666
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
Filesize514B
MD56c7e35a88aa39e053a8ee1eab8fe370e
SHA1e46249372f9a82412533db22f858c082070daff2
SHA2561f722e19eb0d08ad19d5a180f90056f2d0083d3df9657adc1e2cb5934bf0a0d2
SHA5120f461a366510bde348e1f19ec37eb513e249adc253fc1565d88bbd9465c584d5d2ade349a06beed2cad8540a44860d6a22ac6039a3b3e83b734f63b4801d1c9b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4yypthkk.Admin\places.sqlite-20240508225859.740131.backup
Filesize68KB
MD5314cb7ffb31e3cc676847e03108378ba
SHA13667d2ade77624e79d9efa08a2f1d33104ac6343
SHA256b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
SHA512dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
-
Filesize
1KB
MD53adec702d4472e3252ca8b58af62247c
SHA135d1d2f90b80dca80ad398f411c93fe8aef07435
SHA2562b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
SHA5127562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
-
Filesize
18KB
MD5f0f17e0a46c9642db3a52bdd665bf569
SHA1bce22555fca6dc519932fb495e72b4b965fb4bb5
SHA2567baddf6caa7f70ea49d6626eb98d8b32d69da393d248e1f93011561c857298a7
SHA51230c1a6a2a8692dc36a90833baafd31209ae0131fb0e262c4874d00f657a90522f0eff312e56e6935a284b9aabce2a2856cfc6510d88907bced8933e218e2ec7c
-
Filesize
317B
MD598427f7b713b75dc446b374f270dd38b
SHA1b091233cee42c66331267d714dfac61964c56f3e
SHA256321831ec8411b8fe7731ea7d4b08a33ffad1af5c0aa40a336e6ae4eb96997cf6
SHA512007ea81579ee781019de64597153ee98c4b16e31022b129acd5fe9606e1b1b239cb76521aa8dd65d6537391a138b92323ef08ddba1b3ec6d7e1b543ce47f52b5
-
Filesize
719B
MD5e66f574c72e325c081f415c97df79c0b
SHA14db0987704741d82c331eb830121609b7bc15ab9
SHA2564d3d96c1959a4f967e4f789cbdd5d69b94bc8aabe2a658f9dc0319907d32252d
SHA512011e6d5d235cfacd7f2de3d426e5d8dc11520ba17d42fca12192d7b2d510fc7979fa464e7d269c0e1aa4e0fefedf6574a4e2c8139629e4a8a9d1bd3d6060e8ea
-
Filesize
38B
MD5b2f20f4668d28f262ba7e8f02509e344
SHA1696ad9d0f7505bb179f44801c195a0861e154c73
SHA25607759a401b2d4c73fc0d3c7bdd3089ec7fbc6f51198830492a5045df9cbf06c6
SHA5128f94cd1897b352f2726b7d048af0e58c8f12872e5a8d7078cdbe144ada44889d959e7b7257e1fd7f8a4f9a1abb404fc65e9df1c4414d975854581a11a8fe449a
-
Filesize
181KB
MD5b502c676e82cb196e20db36601a08ace
SHA1391e219b99b9eccecfa8f866baa9bd09671c3a3e
SHA256bca6f0bec828d4f1d9748e78de826c327a853bdceb3c432426f1d53994c0d88f
SHA5127488451baccd548601a3c69105066842bf47e8e5dd2680b1a8caa50390a7fd6c8e666c603b7a9fef0ad5a0b41f8bd302f69c50f231e95c8ea6e8da98c3de7816
-
Filesize
188KB
MD5748143dd96f1e6e67e14384d2edf4daf
SHA106928cf9e39b00b654adec334709559ad4e01110
SHA256ea551d91b1ddb00a266831438b7b0ba4119d479a38bd5fdc254d47bb520a04b9
SHA5127c9d15ea8ba34a7a6492a83139def07489c236cca1372a5d66eff50b77b38ba8927a305bd460c75676b36ba0ff0f85b841fc835d102ee13b000068fd14e8bc9b