Overview

overview

8

Static

static

3

2026-05-03...er.exe

windows10-2004-x64

8

2026-05-03...er.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/05/2026, 10:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-03_bf371540e43af6ffd178bade02963b66_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
  • Size 369KB
  • Sample260503-msad8aax4k
  • SHA256 d309a4b5cf79ebb94fee4624e64264ede29fc1796aa820b4a407192733280afa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 21 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 9 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-03_bf371540e43af6ffd178bade02963b66_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-03_bf371540e43af6ffd178bade02963b66_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "BANERID=1314580321 CLID1=14580320 CLID5=14580318 CLID6=14580325 CLID8=14580326 VID=18 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1336
    • C:\Users\Admin\AppData\Local\Temp\2026-05-03_bf371540e43af6ffd178bade02963b66_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-03_bf371540e43af6ffd178bade02963b66_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe --stat dwnldr/p=946133/locale=us/vmajor=10/vminor=0/vbuild=19041/tz0/tzid2/cnt=1/dt=1/ct=12/rt=0 --dh 2064 --st 1777805050
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      PID:2212
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CE48C9233D443BE8FBF8822E474E87DF
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Users\Admin\AppData\Local\Temp\924111C4-2115-45DB-9D76-BA11020A4A95\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\924111C4-2115-45DB-9D76-BA11020A4A95\lite_installer.exe" --use-user-default-locale --silent --banerid=1314580321 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:4116
      • C:\Users\Admin\AppData\Local\Temp\3C18D6FC-58E5-4A95-815C-40769D997F15\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\3C18D6FC-58E5-4A95-815C-40769D997F15\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\A4087376-E104-41BB-8B98-12A037B5ED47\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
          C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3980
          • C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
            C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:4960
        • C:\Users\Admin\AppData\Local\Temp\A4087376-E104-41BB-8B98-12A037B5ED47\sender.exe
          C:\Users\Admin\AppData\Local\Temp\A4087376-E104-41BB-8B98-12A037B5ED47\sender.exe --send "/status.xml?clid=14580320-18&uuid=7fd86087-162f-467a-aedf-5036dc619bdd&vnt=Windows 10x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A36%0A40%0A42%0A45%0A57%0A61%0A102%0A103%0A111%0A123%0A124%0A125%0A"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4848
  • C:\Users\Admin\AppData\Local\Temp\yb5F9B.exe
    "C:\Users\Admin\AppData\Local\Temp\yb5F9B.exe" --job-name=yBrowserDownloader-C1720581-1E67-45C5-B611-77FEFB00D256 --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\yb5F9B.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --banerid=1314580321 --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14580320-18&ui={7fd86087-162f-467a-aedf-5036dc619bdd} --use-user-default-locale
    1⤵
    • Downloads MZ/PE file
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\yb6BDF.tmp
      "C:\Users\Admin\AppData\Local\Temp\yb6BDF.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\cab514c9-33d0-4ed3-a81f-3699c1ab0dc9.tmp" --banerid=1314580321 --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=596093815 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-C1720581-1E67-45C5-B611-77FEFB00D256 --local-path="C:\Users\Admin\AppData\Local\Temp\yb5F9B.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14580320-18&ui={7fd86087-162f-467a-aedf-5036dc619bdd} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\916953e4-fce8-4d1d-980b-52f840ed9f90.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:10580
      • C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\cab514c9-33d0-4ed3-a81f-3699c1ab0dc9.tmp" --banerid=1314580321 --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=596093815 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-C1720581-1E67-45C5-B611-77FEFB00D256 --local-path="C:\Users\Admin\AppData\Local\Temp\yb5F9B.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14580320-18&ui={7fd86087-162f-467a-aedf-5036dc619bdd} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\916953e4-fce8-4d1d-980b-52f840ed9f90.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:10664
        • C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\cab514c9-33d0-4ed3-a81f-3699c1ab0dc9.tmp" --banerid=1314580321 --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=596093815 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-C1720581-1E67-45C5-B611-77FEFB00D256 --local-path="C:\Users\Admin\AppData\Local\Temp\yb5F9B.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14580320-18&ui={7fd86087-162f-467a-aedf-5036dc619bdd} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\916953e4-fce8-4d1d-980b-52f840ed9f90.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=619750027
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Time Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:10728
          • C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=10728 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.4.0.2116 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff7459cf970,0x7ff7459cf97c,0x7ff7459cf988
            5⤵
            • Executes dropped EXE
            PID:10772
          • C:\Program Files\sdwra_10728_400412226\service_update.exe
            "C:\Program Files\sdwra_10728_400412226\service_update.exe" --setup
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:14608
            • C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe
              "C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe" --install
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:14704
          • C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\Temp\scoped_dir10728_1087334569\explorer.exe
            "C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\Temp\scoped_dir10728_1087334569\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4996
            • C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\Temp\scoped_dir10728_1087334569\explorer.exe
              C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\Temp\scoped_dir10728_1087334569\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4996 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.4.0.2116 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6e6a9f970,0x7ff6e6a9f97c,0x7ff6e6a9f988
              6⤵
              • Executes dropped EXE
              PID:1180
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4988
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source10728_1508061760\Browser-bin\clids_yandex_second.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4208
  • C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe" --run-as-service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:14744
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=14744 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.4.0.2116 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ff6b5cce250,0x7ff6b5cce25c,0x7ff6b5cce268
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:14760
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe" --update-scheduler
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:14836
      • C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe" --update-background-scheduler
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        PID:14912
  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=596093815
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5932
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=5932 --annotation=metrics_client_id=efe946fdb7e24d0685da8334de9a1909 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.4.0.2116 --initial-client-data=0x148,0x14c,0x150,0x124,0x154,0x7ffbbd80bbf8,0x7ffbbd80bc04,0x7ffbbd80bc10
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5900
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2352,i,13561462418144832443,8665201462691859363,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2464 --brver=26.4.0.2116 /prefetch:3
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:11796
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=2148,i,1728255206079973095,9186052908059393659,262144 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2396 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:11804
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2216,i,1341115332816784958,18211285135586690667,262144 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2444 /prefetch:6
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:11812
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2928,i,3192824554470475206,9124956340119539442,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3124 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:11948
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3376,i,1080782121013120575,9046577840935369811,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3408 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:11960
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3256,i,3141006827473842822,15828075903380708412,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3392 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:11976
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4688,i,11706872596602059385,11057090520585845580,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4696 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:15992
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4792,i,1043871090588949126,1116243607434724007,2097152 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4800 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:16024
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5300,i,2399127678461705234,15352122785159526875,2097152 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5336 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:7308
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5504,i,8804546047503578927,18420025179414265844,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5520 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:7336
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=5272,i,12088828744291003458,4322030173760649895,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5080 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:7708
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6008,i,10614771229683843769,2077310653976649460,2097152 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5568 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:12508
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5940,i,11540423787505610170,10583992334191510449,2097152 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5928 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:12772
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6196,i,9390605355139907700,12520200396759744324,2097152 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6272 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:13140
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7156,i,17105337323190880770,13851920409519861507,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7160 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:13288
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=7272,i,15797120038656610356,609005448109657224,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7276 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:7872
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7452,i,7264988849809384119,3176226083223488884,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7476 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:8040
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7552,i,5839676083615316819,890131923243566022,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7564 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:8084
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7696,i,11799618562240472997,10609714561984837980,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7708 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:8096
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7844,i,5990869451605528049,3576360897507356372,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7856 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:8108
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7864,i,1390979237876130855,6554145717450412043,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=8000 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:8120
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7464,i,8975472668495532739,12236031852727077622,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8144 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:8132
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8292,i,5679569495984393494,17611958729853876254,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8304 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8144
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8288,i,11187324620615564117,17538743066436259785,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8452 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8156
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8604,i,17314927790280471850,3677434735521100132,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8280 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8168
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8740,i,5158159992580693831,10546354823060495601,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8752 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8180
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8908,i,6085336119278686286,2161553955330680818,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8892 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8196
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8912,i,6307349917642200037,6444348853146345142,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8896 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8208
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9192,i,3155975907771847038,16240448006284701359,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9312 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8716
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9184,i,9755480241342283279,10384841017332834907,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9332 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8720
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9220,i,15412555838955274485,8704289181179598270,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9340 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8732
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9180,i,15639047030002081244,1856323823924478283,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9292 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8736
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9232,i,18404365795465220236,12148209162474251617,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9368 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8744
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9968,i,6233257748283289548,15431458319463260586,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9980 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:8812
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10136,i,13190857572148885575,12416374710913094486,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10148 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:13336
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10288,i,8471632077884307762,17023281018471143962,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10300 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:13356
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10436,i,5319300540598387516,15255874422724726039,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10448 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:13368
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10308,i,4850261485956802125,6505165752257831948,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10596 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:13388
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10744,i,11304268766176718567,2091566400381540991,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10756 --brver=26.4.0.2116 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:13496
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10892,i,9478284187688500020,13817296745079157290,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10904 --brver=26.4.0.2116 /prefetch:8
      2⤵
        PID:13508
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11060,i,7055088964686390031,533384126752152250,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11072 --brver=26.4.0.2116 /prefetch:8
        2⤵
          PID:13644
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11228,i,11910846268410199726,17725767010029340101,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11240 --brver=26.4.0.2116 /prefetch:8
          2⤵
            PID:13720
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=10736,i,15863621073122369623,1877739240497687269,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11252 --brver=26.4.0.2116 /prefetch:8
            2⤵
              PID:13812
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=11336,i,17989261214498649674,5241457395144134108,2097152 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=4036 /prefetch:1
              2⤵
              • Checks computer location settings
              • System Time Discovery
              PID:14132
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5664,i,5430067001854325014,13038969915020508099,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=11356 --brver=26.4.0.2116 /prefetch:8
              2⤵
                PID:9008
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7484,i,3363533778599359755,1647003859496363368,2097152 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=2648 /prefetch:1
                2⤵
                • Checks computer location settings
                • System Time Discovery
                PID:9060
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=1020,i,3248039757330683763,5602920697687481674,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=4036 --brver=26.4.0.2116 /prefetch:8
                2⤵
                  PID:5292
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=2436,i,10363125465509608864,4247617049526244352,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=2684 --brver=26.4.0.2116 /prefetch:8
                  2⤵
                    PID:5312
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7184,i,14131813072309786509,14998703798369822480,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=2472 --brver=26.4.0.2116 /prefetch:8
                    2⤵
                      PID:5300
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=7fd86087-162f-467a-aedf-5036dc619bdd --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=2460,i,9755645803043634804,3004526307164992944,524288 --field-trial-handle=2400,i,4212116402079562632,1376234768715175129,262144 --enable-features=ShortcutNameWithAlice --variations-seed-version --pseudonymization-salt-handle=2404,i,9276601575484135556,4482289154947871518,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=2672 --brver=26.4.0.2116 /prefetch:8
                      2⤵
                        PID:5284
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:6464
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:12452
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1777805106 --annotation=last_update_date=1777805106 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=12452 --annotation=metrics_client_id=efe946fdb7e24d0685da8334de9a1909 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.4.0.2116 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbbd80bbf8,0x7ffbbd80bc04,0x7ffbbd80bc10
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:12564

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Defense Evasion

                            Modify Registry

                            2
                            T1112

                            Subvert Trust Controls

                            1
                            T1553

                            Install Root Certificate

                            1
                            T1553.004

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            1
                            T1120

                            Query Registry

                            6
                            T1012

                            System Information Discovery

                            5
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Time Discovery

                            1
                            T1124

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            e594501.rbs
                            • Path C:\Config.Msi\e594501.rbs
                            • Size 911B
                            • SHA256 1dc99439be5dd0c7aa9dd1c9b8fb9e99e8a718da542cc91f8aa69dc327b55e4a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            service_update.exe
                            • Path C:\Program Files (x86)\Yandex\YandexBrowser\26.4.0.2116\service_update.exe
                            • Size 4.7MB
                            • SHA256 004bdc7bd14c010c475005d3af8c2ef837b30a1112b72e4cc14f8ff9c64e6870
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            yandex_browser_installer.log
                            • Path C:\Program Files\yandex_browser_installer.log
                            • Size 6KB
                            • SHA256 8aac03e32c43c4f6888ff55355c0dce4eb5fd151bb1b8ee16d14b756e1094159
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            yandex_browser_service_update.log
                            • Path C:\Program Files\yandex_browser_service_update.log
                            • Size 3KB
                            • SHA256 06d36107480ff56767f59bb4a8daf0f95451b0e155761b2e7c07d1467cdeac28
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            yandex_browser_service_update.log
                            • Path C:\Program Files\yandex_browser_service_update.log
                            • Size 4KB
                            • SHA256 86c943a68a7b62605f2af42caa0b7cb08a6acdf65287cc44431515b535407826
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                            • Size 1KB
                            • SHA256 55345a9f34f9db755dbc41fdb6aab4314b85fda99795ef783f3a881e2d69e6d6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                            • Size 1KB
                            • SHA256 752619b66f7b99694494e9515709045560cc3802d68264ffac52a1071c980d95
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                            • Size 1KB
                            • SHA256 70846eed3e7e1369ecf97c07bfda9f5dc6b80689e5dd7b59252b74265ff9a61b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                            • Size 1KB
                            • SHA256 abd774cbd6be805de154298e5a586ee2a254236c3ee0585e60cb89b1ee28bfc1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                            • Size 1KB
                            • SHA256 8575f40ec48b28202946540d2adb601c15cc75515f1f9dffaa110da78b3e83b0
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            BD92F95DED26541D3AF7F44DC7914843
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843
                            • Size 721B
                            • SHA256 4900b7c4a1e108d5f6230e5db947856d9497c66edbd68cde74583fc7451e96cd
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                            • Size 508B
                            • SHA256 1e4a6f3dfbcf1ddfc5f9dbd95236cd0b5b7971dfea2fca563e68a891da6ece1c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                            • Size 536B
                            • SHA256 d0204ad94c10ea3616fafb9e1c59a44cac2011736346fd22a8d5671bc2fcf054
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                            • Size 536B
                            • SHA256 f3d5390b30d620fc37449a628f76a399cb95138606a2e0ddd7c6dd3a93bff8f6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                            • Size 536B
                            • SHA256 f289198f7578c4d78683f62fca3552da8a2f7a0d72dc8cefa1dce6f0d6b0949c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                            • Size 506B
                            • SHA256 ea690b22876b43ea49f1ada014c0970d4727e8fa7fd1b2fff588d4b683ee5424
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            BD92F95DED26541D3AF7F44DC7914843
                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD92F95DED26541D3AF7F44DC7914843
                            • Size 214B
                            • SHA256 d81537932565bf31b0f40eb96c99198c918d59ef644919f9f887efc143235929
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            cb6b69a1b6d3a0917f371eb3d862b368
                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\14tbp3gd.default-release\thumbnails\cb6b69a1b6d3a0917f371eb3d862b368
                            • Size 15KB
                            • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            seederexe.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\3C18D6FC-58E5-4A95-815C-40769D997F15\seederexe.exe
                            • Size 8.5MB
                            • SHA256 b06696eca2727f9cb18497c8afd630ab6294eb2f4c690628dffe8826f51ad23d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            YandexPackSetup.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                            • Size 10.1MB
                            • SHA256 8b14e2fc8875af2848b0cac5cbb0d564e3f6bc41e5bedb101b153fa966a55e4d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            lite_installer.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\924111C4-2115-45DB-9D76-BA11020A4A95\lite_installer.exe
                            • Size 420KB
                            • SHA256 abae05f38d9ffda8749f631a868c90a417b5ffb70f4a10ab10a63391588ee2a2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            sender.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\A4087376-E104-41BB-8B98-12A037B5ED47\sender.exe
                            • Size 260KB
                            • SHA256 4128b1566d599ef2fe9aa4a693fd9e715f45d6a4d1d11d6c31b49cabf804609b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            BRAND_COMMON
                            • Path C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\BRAND_COMMON
                            • Size 25.4MB
                            • SHA256 ccb340791320deb3a70daf7b6b175a5bf631d973160385afc3bb0665487b87ce
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            setup.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\YB_B1275.tmp\setup.exe
                            • Size 7.2MB
                            • SHA256 1e60954058df68a420af526fb9b4181d99106c89826c7cee3547183eab0ac466
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            YandexSearch00000.log
                            • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                            • Size 1KB
                            • SHA256 99006bb07a6bd77cbfde806023512c4e76dafaa43809ea3c487ece250358747a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            clids-yasearch.xml
                            • Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                            • Size 711B
                            • SHA256 7fd8d1fae3d385d660383bbd4b3f6c61ee58c21fd9c385f240bd3f627f1499a3
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            distrib_info
                            • Path C:\Users\Admin\AppData\Local\Temp\distrib_info
                            • Size 24B
                            • SHA256 4774e6a00e1ad2a83d4d5016cf494d7afcda4f013c69cc5a000a05095f6340c3
                            • MD5 SHA1 SHA512
                            Submit Download

                            lite_installer.log
                            • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                            • Size 9KB
                            • SHA256 9e355cec8d663e1e51e91eff8410c1af79b3865d401e054e2d020594610f2332
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            master_preferences
                            • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                            • Size 542B
                            • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            omnija-20264403.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\omnija-20264403.zip
                            • Size 45.1MB
                            • SHA256 7d5072b7fa0880c245cb54a627474b67df7b4f3f33a7ae828b39417f9621eef0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            tmp4608aaaaaa
                            • Path C:\Users\Admin\AppData\Local\Temp\tmp4608aaaaaa
                            • Size 2.5MB
                            • SHA256 28c615b45bf32be9eff49725dbd31f0309ef71d8d341dffd82c40c81eee211a6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            vendor00000.xml
                            • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                            • Size 528B
                            • SHA256 198b62613830567e10b433bf745fa611e8f935f48001b8c0f5d3714104ce0bb1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            yandex_browser_updater.log
                            • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                            • Size 5KB
                            • SHA256 6d916b2a742ca76063544fd307df17c355b0ea344b39ecff1f52552064facdd6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            yb5F9B.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\yb5F9B.exe
                            • Size 11.7MB
                            • SHA256 998cf0097f430f16a0bf351ce5f574f3798fb09156b30a30fad18302c50783b3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            YandexSearch.msi
                            • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                            • Size 9.7MB
                            • SHA256 58b9e36d9fe3f1bdeb78ac8ce52b4f382d4e0efef3d4ab9d2b7744003fd60830
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Yandex.lnk
                            • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
                            • Size 2KB
                            • SHA256 82a08909f7d5297713d3817df4894fd37735a6cde4ab4eb92fd4538d323a507b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            YandexWorking.exe
                            • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\YandexWorking.exe
                            • Size 395KB
                            • SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            brand_config
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\26.4.0.2116\brand_config
                            • Size 6KB
                            • SHA256 e3211849d31f85d3eab094fb662713205705d96642a3f5f038ab470aa7813fe2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            partner_config
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\26.4.0.2116\partner_config
                            • Size 341B
                            • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            huangshan.webm
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\26.4.0.2116\resources\wallpapers\huangshan\huangshan.webm
                            • Size 9.6MB
                            • SHA256 05e7170852a344e2f3288fc3b74c84012c3d51fb7ad7d25a15e71b2b574bfd56
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            manifest.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\Temp\chromium_chrome_Unpacker_BeginUnzipping5932_1850506141\manifest.json
                            • Size 1001B
                            • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            manifest.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\Temp\chromium_chrome_Unpacker_BeginUnzipping5932_831161067\manifest.json
                            • Size 159B
                            • SHA256 4a8c3b43a7ff3147ac5b305770ac0ac90ab4150a5e5132c896ae90f34fea51e2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ru.bdic
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\YandexDictionaries\ru.bdic
                            • Size 4.5MB
                            • SHA256 af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            browser.exe
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            • Size 5.6MB
                            • SHA256 95e3cf6e3546d66e0eb529bdadac9511a83acc4cd7e24dbfed7dbf950f0466b2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            install_state.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\install_state.json
                            • Size 1KB
                            • SHA256 a0d30b28882b0ea3a78bd1486d0cce22cf6c04c967f7124ad4424ed0dc20aabc
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ghjgbemlcjioaaejhnnmgfpiplgalgcl.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\Extensions\ghjgbemlcjioaaejhnnmgfpiplgalgcl.json
                            • Size 119B
                            • SHA256 20832de8163d5af0a0c8bda863bcd6083df4f92175d856ce527de1dae1f7c433
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            about_logo_en.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\about_logo_en.png
                            • Size 1KB
                            • SHA256 c56ae312020aef1916a8a01d5a1fc67ed3b41e5da539c0f26632c904a5e49c62
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            about_logo_en_2x.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\about_logo_en_2x.png
                            • Size 3KB
                            • SHA256 fe20d86fd62a4d1ab51531b78231749bd5990c9221eab1e7958be6d6aef292d9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            about_logo_ru.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\about_logo_ru.png
                            • Size 1KB
                            • SHA256 1039ea2d254d536410588d30f302e6ab727d633cf08cb409caa5d22718af5e64
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            about_logo_ru_2x.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\about_logo_ru_2x.png
                            • Size 3KB
                            • SHA256 5bb0977553ded973c818d43a178e5d9874b24539dacbd7904cd1871e0ba82b23
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            all_zip
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\configs\all_zip
                            • Size 1.2MB
                            • SHA256 d868f9149e86f32791a8985be711d5ff05cbffa2ac6cb43850d7e6d409b67ed7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            easylist.txt
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\easylist\easylist.txt
                            • Size 620KB
                            • SHA256 2f317fee439877eaadb1264bd3d1e153c963ef98596a4ccf227592aea12ae76f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            manifest.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\easylist\manifest.json
                            • Size 68B
                            • SHA256 77334f6256abddcc254f31854d1b00aa6743e20aadbb9e69187144847099a66b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            brand_settings.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\extension\elokbjeafkcggjfjkakpchmcmhkhaofn\brand_settings.json
                            • Size 379B
                            • SHA256 4940847c9b4787e466266f1bb921097abb4269d6d10c0d2f7327fde9f1b032b7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            brand_settings.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\extension\fcgfaidpicddcilhjhafmmcgfodijhjd\brand_settings.json
                            • Size 316B
                            • SHA256 de0fbb08708d4be7b9af181ec26f45fccd424e437bc0cfb5cf38f2604f01f7b2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            brand_settings.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\extension\gopnelejddjjkamjfblkcijjikkinnec\brand_settings.json
                            • Size 246B
                            • SHA256 114fd03aa5ef1320f6cc586e920031cf5595a0d055218ce30571ff33417806d3
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            import-bg.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\import-bg.png
                            • Size 9KB
                            • SHA256 7573af31ed2bfcfff97ed2132237db65f05aff36637cd4bdeccdf8ca02cd9038
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dictionary-ru-RU.mrf
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\morphology\dictionary-ru-RU.mrf
                            • Size 1.1MB
                            • SHA256 1585b1599418d790da830ef11e8eeceee0cbb038876fe3959cc41858bd501dbc
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dictionary-ru-RU.mrf.sig
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\morphology\dictionary-ru-RU.mrf.sig
                            • Size 256B
                            • SHA256 151739137bbbdf5f9608a82ec648bdf5d7454a81b86631b53dfc5ad602b207d6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            stop-words-ru-RU.list
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\morphology\stop-words-ru-RU.list
                            • Size 52B
                            • SHA256 cbeec72666668a12ab6579ae0f45ccbdbe3d29ee9a862916f8c9793e2cf55552
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            download.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\safebrowsing\download.png
                            • Size 437B
                            • SHA256 3129d9eaba1c5f31302c2563ebfa85747eda7a6d3f95602de6b01b34e4369f04
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            sxs.ico
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\sxs.ico
                            • Size 43KB
                            • SHA256 ad566a3e6f8524c705844e95a402cdeb4d6eed36c241c183147409a44e97ebcd
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            tablo
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\tablo
                            • Size 617KB
                            • SHA256 1313aa26cc9f7bd0f2759cfaff9052159975551618cba0a90f29f15c5387cad4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            1-1x.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\1-1x.png
                            • Size 18KB
                            • SHA256 a62f9fdf3de1172988e01a989bf7a2344550f2f05a3ac0e6dc0ccd39ed1a697e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            custogray_full.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\custogray\custogray_full.png
                            • Size 313B
                            • SHA256 a7cd964345c3d15840b88fd9bc88f0d0c34a18edbf1ce39359af4582d1d7da45
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\custogray\preview.png
                            • Size 136B
                            • SHA256 55a236ad63d00d665b86ff7f91f2076226d5ed62b9d9e8f835f7cb998556545f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\custogray\wallpaper.json
                            • Size 233B
                            • SHA256 4cd690fb8ed5cd733a9c84d80d20d173496617e8dde6fca19e8a430517349ed5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            dark_preview.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\dark.title\dark_preview.jpg
                            • Size 1KB
                            • SHA256 4373e988c7f36efe867c89745469f502ba549ccd68b73d3000cb7231413c4169
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            dark_static.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\dark.title\dark_static.jpg
                            • Size 1.8MB
                            • SHA256 632435cf4acd1463f0fa2ea2d170347050e154b2a53e35d33ed6c0f0a29ef7e0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            fir_tree_preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\fir_tree\fir_tree_preview.png
                            • Size 8KB
                            • SHA256 4c2b561cf301d9e98383d084a200deb7555ec47a92772a94453d3d8d1de04080
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\fir_tree\wallpaper.json
                            • Size 384B
                            • SHA256 2cc83bc391587b7fe5ddd387506c3f51840b806f547d203ccd90487753b782f1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            flowers_preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\flowers\flowers_preview.png
                            • Size 9KB
                            • SHA256 70a7a65aa6e8279a1a45d93750088965b65ea8e900c5b155089ca119425df003
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\flowers\wallpaper.json
                            • Size 387B
                            • SHA256 70c8d348f7f3385ac638956a23ef467da2769cb48e28df105d10a0561a8acb9e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            huangshan.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\huangshan\huangshan.jpg
                            • Size 211KB
                            • SHA256 713c9e03aac760a11e51b833d7e1c9013759990b9b458363a856fd29ea108eec
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            huangshan_preview.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\huangshan\huangshan_preview.jpg
                            • Size 26KB
                            • SHA256 649c55ccc096cc37dfe534f992b1c7bda68da589258611924d3f6172d0680212
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            light_preview.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\light.title\light_preview.jpg
                            • Size 1KB
                            • SHA256 4fe8b8d7919840d2692b29e80f1c7e9fde7796bfab2c7e90aa480bdad960df76
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            light_static.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\light.title\light_static.jpg
                            • Size 674KB
                            • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\meadow\preview.png
                            • Size 5KB
                            • SHA256 0499c4cc77a64cc89055b3c65d7af8387f5d42399ff2c0a2622eccbd6d481238
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\meadow\wallpaper.json
                            • Size 439B
                            • SHA256 c6581e9f59646e0a51a3194798ec994c7c5c99f28897108838aaf4a4e2bda04a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\misty_forest\preview.png
                            • Size 5KB
                            • SHA256 ea340a389af6d7ad760dff2016cf4e79488bda1a45d0a415b3cd02a4430c9711
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\misty_forest\wallpaper.json
                            • Size 423B
                            • SHA256 ebe9cadad41bd573f4b5d20e3e251410300b1695dfdf8b1f1f1276d0f0f8fa6d
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            mountains_preview.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\mountains_preview.jpg
                            • Size 35KB
                            • SHA256 55074794869b59cd5c693dfa6f6615aea068c2cd50cdae6dd69bd0410661ded8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\peak\preview.png
                            • Size 5KB
                            • SHA256 f72ea12f6c972edfe3d5a203e1e42cbbaf4985633de419342c2af31363f33dab
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\peak\wallpaper.json
                            • Size 440B
                            • SHA256 e491962b42c3f97649afec56ad4ea78fd49845ceb15f36edddd08d9e43698658
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            raindrops_preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\raindrops\raindrops_preview.png
                            • Size 7KB
                            • SHA256 1e70fc9965939f6011488f81cd325223f17b07ee158a93c32c124602b506aa6b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\raindrops\wallpaper.json
                            • Size 385B
                            • SHA256 bcfea0bebf30ee9744821a61fcce6df0222c1a266e0995b9a8cfbb9156eeeefd
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            sea.webm
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\sea.webm
                            • Size 12.5MB
                            • SHA256 fa8d0ae53ebdbec47b533239709b7e1514ecb71278907621ca2d288241eb0b13
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            sea_preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\sea\sea_preview.png
                            • Size 3KB
                            • SHA256 02d8e450f03129936a08b67f3a50ea5d2e79f32c4e8f24d34b464f2cb5e0b086
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\sea\wallpaper.json
                            • Size 379B
                            • SHA256 c2bb1e5d842c7e5b1b318f6eb7fe1ce24a8209661ddd5a83ab051217ca7c3f65
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            sea_preview.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\sea_preview.jpg
                            • Size 59KB
                            • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            sea_static.jpg
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\sea_static.jpg
                            • Size 300KB
                            • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\stars\preview.png
                            • Size 6KB
                            • SHA256 4fa185f67eaf3a65b991cea723d11f78de15a6a9a5235848a6456b98a9d7f689
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\stars\wallpaper.json
                            • Size 537B
                            • SHA256 d1bef520c71c7222956d25335e3ba2ea367d19e6c821fb96c8112e5871576294
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            wallpaper.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\web\wallpaper.json
                            • Size 379B
                            • SHA256 7fdddc908bd2f95411dcc4781b615d5da3b5ab68e8e5a0e2b3d2d25d713f0e01
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            web_preview.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.4.0.2116\resources\wallpapers\web\web_preview.png
                            • Size 8KB
                            • SHA256 0bbf72a3c021393192134893777ecb305717ccef81b232961ca97ae4991d9ba8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            52975b8d-fdf9-4dd5-b1f8-b9b5eb0353fe.tmp
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\52975b8d-fdf9-4dd5-b1f8-b9b5eb0353fe.tmp
                            • Size 234KB
                            • SHA256 b7a3e89f82c3d12203d664c217c80cb4474633d7f04fd21677880ceb3382f2ff
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            f_000004
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000004
                            • Size 40KB
                            • SHA256 5895185cf878a38cd172286ed97976e6ab620b2c5fd7f7810f9c9d2f7169da6d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            f_000006
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000006
                            • Size 48KB
                            • SHA256 b3cd587a747007fc5a365ceec5daa964c559e4862ae70aa98f5d0e1849d5ddf0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            the-real-index
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index
                            • Size 792B
                            • SHA256 2d1fa5a2ec0f32605042ddcb31d448d4fdf568f52891dc0e9c847e216bc4e261
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            the-real-index~RFe5a9c41.TMP
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a9c41.TMP
                            • Size 48B
                            • SHA256 8e6170eb84a7e31b3a286c2e0c9e2a13572a1f0409e5bbcf97cdc1e67873a23f
                            • MD5 SHA1 SHA512
                            Submit Download

                            data_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\DawnWebGPUCache\data_0
                            • Size 8KB
                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_1
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\DawnWebGPUCache\data_1
                            • Size 264KB
                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_2
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\DawnWebGPUCache\data_2
                            • Size 8KB
                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_3
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\DawnWebGPUCache\data_3
                            • Size 8KB
                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            SCT Auditing Pending Reports
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512
                            Submit Download

                            CURRENT
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Platform Notifications\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512
                            Submit Download

                            MANIFEST-000001
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Platform Notifications\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512
                            Submit Download

                            Preferences
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                            • Size 9KB
                            • SHA256 f45f2fe60e2331d66a84301b76eb7e779e1de882d30cbb1fd0b5414d1b80c951
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Preferences
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                            • Size 13KB
                            • SHA256 d3c8b902aca363e7a814c414d7168b63378ae36fb69da1bd15d112cee9968b30
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Preferences
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                            • Size 18KB
                            • SHA256 d6199a865f0273b0f266e6f47135a49514b5f5b069171aaf09ab6e3d1728ef22
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Preferences~RFe5a1cb1.TMP
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences~RFe5a1cb1.TMP
                            • Size 5KB
                            • SHA256 d5cbe61849dca459ac637e335a7cf5c59199aa15249c4d3ab1ce5e366be5fa46
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Secure Preferences
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                            • Size 15KB
                            • SHA256 a9e86bd6085fbbbec5dcdb0e22becbebade68a3c584914144a0155113b8d1aed
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Secure Preferences
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                            • Size 15KB
                            • SHA256 3265f82d998c08bf6ea72251b3cd7eae6730140974b04f5792392efb93d7318e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Secure Preferences~RFe5a1d8c.TMP
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences~RFe5a1d8c.TMP
                            • Size 8KB
                            • SHA256 d090785fc983420bf26c2f4923071e1fa22b05e26f3ea07b3e754d7303ae2eac
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            058060ba448ded6b_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\058060ba448ded6b_0
                            • Size 11KB
                            • SHA256 b5ea6a007a70063849fe77fe1bed1d6a8f6ecc8b72fdb4e60eed882273aa65d5
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            08e93dfa8f5f29ce_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\08e93dfa8f5f29ce_0
                            • Size 2KB
                            • SHA256 32d92699637360e0e25634604f0027516d369fae8b00e0802e64b6b2e70e93e7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            0e66ae940b1388e9_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\0e66ae940b1388e9_0
                            • Size 2KB
                            • SHA256 f12a9b06aa3a4c6cdadf1aa41d0f233bd49343c870f52fa49c2bd70269bea8ad
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            101657c141ba71fe_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\101657c141ba71fe_0
                            • Size 7KB
                            • SHA256 a7e179e40dbfa22da368783d785de38e293ec839fdab0ab44baa5af063282d72
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            17936a4cabd112cf_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\17936a4cabd112cf_0
                            • Size 27KB
                            • SHA256 f122c4a792d9ca85862c9fccf7e4c17ecac409077b07652f6a22f4fd8b683de2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            239ee388cb8c2a22_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\239ee388cb8c2a22_0
                            • Size 30KB
                            • SHA256 f07cc8a669ed635ce345ad187a01d9b84d1edd8d5ffd0b4f5179a0ef7b4f72cb
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            2a9877b782e7616c_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\2a9877b782e7616c_0
                            • Size 42KB
                            • SHA256 2386e27ef6cc2a0dfe26433c28d200a018bece90d6ec8ac5c60016f72ade8fc5
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            326b3dfe88d978d3_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\326b3dfe88d978d3_0
                            • Size 3KB
                            • SHA256 25e12c686a61b0a5bf6fed8ad572c34655d6adb4e27e844363664f246d3d36d6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            328f28cfa3c26dcd_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\328f28cfa3c26dcd_0
                            • Size 594B
                            • SHA256 ac0a4780f0b9921dce6d34fd78f013d03839548154455597a969cacfb76b03da
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            3cc6acf275cc5ece_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\3cc6acf275cc5ece_0
                            • Size 2KB
                            • SHA256 be4ac3e3d47dd91e4e709c828957d61b6b4abd11ce656e48a90b7935476d5977
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            79d4fa5f979d0a01_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\79d4fa5f979d0a01_0
                            • Size 44KB
                            • SHA256 387e10c4b3dac60e675f53f108ad03bc11e58026acffd051b4b84420b19d2bc4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            87843e74cb7ea42b_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\87843e74cb7ea42b_0
                            • Size 3KB
                            • SHA256 f039c9974c3a3e8912ddbaac159bd12c5792b789a9c71016b43dc71c71fd4c5c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            8974b9206743c9a5_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\8974b9206743c9a5_0
                            • Size 1KB
                            • SHA256 03380bae4d34e82401e8b7e276504b76f102abce60867ab1c0279ebd5838beef
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            8cd89c4f91987d97_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\8cd89c4f91987d97_0
                            • Size 737B
                            • SHA256 bf1c9b75c496925a5a294c2517db5c66233b06d9100a74198d95159dbf6de380
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            8fa485f96cd80a78_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\8fa485f96cd80a78_0
                            • Size 29KB
                            • SHA256 70c937f2790da8c31be70f44fffdec6164de1babb2409391a1814cbec65e8ad4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            b3f0dc54e2b61fc9_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\b3f0dc54e2b61fc9_0
                            • Size 1KB
                            • SHA256 2f3def8a2e06a6f245aecef2ea9616a6f95439abc86d09b1d500d9230a997c5c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            bd94c4a078cc79b8_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\bd94c4a078cc79b8_0
                            • Size 1KB
                            • SHA256 a3b54a9f766c881934f1eff5e1ad34fec018ba323b2c8224ae33d71ffdc9baec
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            c8a82016ba4aa56d_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\c8a82016ba4aa56d_0
                            • Size 640B
                            • SHA256 7288bea1b112e34f11d905f496aa8a79395c9752a0363459998d96053bf1fd74
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            cd4004d6793712fa_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\cd4004d6793712fa_0
                            • Size 295KB
                            • SHA256 e6e27edffbd4839b7de87517f17a70ce0c51b1d06a962264db96778a259cff0a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            d1c7b3b5b346fb96_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\d1c7b3b5b346fb96_0
                            • Size 31KB
                            • SHA256 96c1a1ff18369956a88b0201adfb45f5c045793130f64f77a6ef595dd8bfaf7d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dca84599e1ca05d5_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\dca84599e1ca05d5_0
                            • Size 2KB
                            • SHA256 15c9e43033644660458f33d14dd8050a22f66201cd7d6ee6d5b81e168fbfc491
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            e7d083353a620397_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\e7d083353a620397_0
                            • Size 789B
                            • SHA256 2d94b8125c2438115453503528d258e10d9e3353fef49bf4595683e3f09bd957
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            e9c2d8ed4b6db546_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\e9c2d8ed4b6db546_0
                            • Size 619B
                            • SHA256 658bedb6c575580ea48847a4a5d0ee418825a7d8c5c96ba4c62f6d00a2183236
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            f26868f0d4afa00a_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\f26868f0d4afa00a_0
                            • Size 1KB
                            • SHA256 a6a411ef31bc0406d4eb2f110ca7229e73667548820e4efed0051bb449254c27
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            f51d5af08878d17b_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\f51d5af08878d17b_0
                            • Size 6KB
                            • SHA256 af9e2d2288543e6a658513996ca44003d6a726dcf5a73364f8a1336b2a387343
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            f55f00a9a3efca75_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\f55f00a9a3efca75_0
                            • Size 556B
                            • SHA256 9a173f80102eebcf872d207cf9469192d76dba471bb3a854380f6c5ea81a2a2e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            f723260d632382d6_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\f723260d632382d6_0
                            • Size 1.0MB
                            • SHA256 a2122aa75ddf9485456b995e1f0c1e9beda022dc0c348b9feff6f80b561827d7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            f7b211d5ce775d4c_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\f7b211d5ce775d4c_0
                            • Size 2KB
                            • SHA256 94326013c62b413737379da60b74b9c814d8a2cbe0ed2c80a5caae3e1f870a5d
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            fd41ca2a883063a6_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\fd41ca2a883063a6_0
                            • Size 9KB
                            • SHA256 10173664abb0e0b6a578200f4ed9aa89d32ce8293e2fa0df379f23f27c29b1d7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            fd7f6b854deb6dae_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\fd7f6b854deb6dae_0
                            • Size 1KB
                            • SHA256 c27d48840b2a12a5e9fb54350e8993b7a6a7bcc0b6b2953cbbf17aa8ce8a4183
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            fef132170d47887d_0
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\fef132170d47887d_0
                            • Size 10KB
                            • SHA256 78b736231c3e1948e51221959152b7eddf0bf4b83d6dc71692ca196aed101011
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            the-real-index
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\index-dir\the-real-index
                            • Size 5KB
                            • SHA256 7c2abd032c4a30a779550b2ff45ad4e136789d4bb665bb28c2aa7a406b5f9bdb
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            the-real-index
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\index-dir\the-real-index
                            • Size 5KB
                            • SHA256 c20f25da23337851fa5abebb4c1c4ad12da1e21cb807c4c1c363f2ed710162a2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            the-real-index~RFe5a7cd2.TMP
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\37ff5155-4e23-4df4-b00f-082329da08d4\index-dir\the-real-index~RFe5a7cd2.TMP
                            • Size 5KB
                            • SHA256 ba60fb01a2eeb7c1ac53593b9f2e37aab071a291de72560cff3ab78508df0183
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            index
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\TurboAppCache\Nativecache\web_ntp_cache\index
                            • Size 24B
                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                            • MD5 SHA1 SHA512
                            Submit Download

                            32.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\32.png
                            • Size 945B
                            • SHA256 e5a96d5629ea34804a4a32831e8bc009ace619ec2212f39e8a9016e8d46828cf
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            48.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Icons\48.png
                            • Size 1KB
                            • SHA256 eb059e050755973503570f847a1919b4fb6943c5ed2b697c82f9feca5c5b8085
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            32.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Trusted Icons\Icons\32.png
                            • Size 1KB
                            • SHA256 1bde2abef411c44e842a39bae58279b17167d6082202831f18aaf5f0150c7994
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            48.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Manifest Resources\bcadigmkecmhhknameopgaidphameinh\Trusted Icons\Icons\48.png
                            • Size 2KB
                            • SHA256 fcc94342dd2083912720efb31d568b8247e2a7e73432c8984be2e54739e25006
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            128.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5932_298029983\Trusted Icons\Icons\128.png
                            • Size 9KB
                            • SHA256 371fd6e312b931971cb05dfc65a77f692a3537003d839354f6cea63dc5c7007b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            256.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5932_298029983\Trusted Icons\Icons\256.png
                            • Size 7KB
                            • SHA256 ff068f5b44c89bdf2b33d3d2f70617fded8a7bbf898aa17afdfd7bc3c11c7b98
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            64.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5932_298029983\Trusted Icons\Icons\64.png
                            • Size 4KB
                            • SHA256 62b1ad1311a5f5983f1e21547dd29ff7a2a33bbeb0b55a69c3d950f214810c45
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            96.png
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5932_298029983\Trusted Icons\Icons\96.png
                            • Size 6KB
                            • SHA256 bf8699aa97e9f37e8302b25324cc2868f63809f7fecde663fe8bc5e8c33a0ce4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            turboapp_db.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\turboapp_db.json
                            • Size 55KB
                            • SHA256 494795ca88dabe73239498612c4e2f901a3303c958e606ceaa1bf5832787ed4b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            turboapp_db.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\turboapp_db.json
                            • Size 55KB
                            • SHA256 c54da7100da0911ed5d46a5da3ba3608ced370ff3860882998677936a313b99f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            turboapp_db.json~RFe5a201c.TMP
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\turboapp_db.json~RFe5a201c.TMP
                            • Size 34KB
                            • SHA256 887520b0e343be4ce56b0743ff20252dd0ba9f8733840a7c164c444a472b6211
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                            • Size 253KB
                            • SHA256 b58022a7559330e6290f3feb7f1d73415e4ff39de7f1cdf9787c93da2b1690d2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                            • Size 6KB
                            • SHA256 2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            92ac4503d850d61341c2b89b0ca25ae45a875f85e7ab7018354cef9a0b37bba7
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\92ac4503d850d61341c2b89b0ca25ae45a875f85e7ab7018354cef9a0b37bba7
                            • Size 18.9MB
                            • SHA256 92ac4503d850d61341c2b89b0ca25ae45a875f85e7ab7018354cef9a0b37bba7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            verified_contents.json
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\google_import_script\25.12.3.0\_metadata\yandex\verified_contents.json
                            • Size 990B
                            • SHA256 128ee9930635d572ac94cef6a2b3b6ae65fdfef5ddc54c6c100e2dac13c7d0dc
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            script
                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\google_import_script\25.12.3.0\script
                            • Size 4KB
                            • SHA256 8b44c53ea53b3ff1465263dec2380c68e88e4964984dbdc1497ff2aeedb010d6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Яндекс Браузер с Алисой AI.lnk
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс Браузер с Алисой AI.lnk
                            • Size 2KB
                            • SHA256 a8aa1ee434b9bb077dd06da84d672db384d2b3b7d28ae9620caf75318d1fcd19
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Яндекс.website
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
                            • Size 515B
                            • SHA256 697b17db7e4cf792853e7b978511ab11d29122ded909fca826f456996c74c132
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            places.sqlite-20260503104416.358455.backup
                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yst4f00o.Admin\places.sqlite-20260503104416.358455.backup
                            • Size 68KB
                            • SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            clids-yabrowser.xml
                            • Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
                            • Size 737B
                            • SHA256 1cd4aaf35c40002f0dabc6783a9fe4ae027a0b1765b0cdc612b80e15847fa2c7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ui
                            • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                            • Size 38B
                            • SHA256 2bb408b15c16ac533c1f3d8930fed74aac993ed8d10867f824ad17de225e294e
                            • MD5 SHA1 SHA512
                            Submit Download

                            MSI478E.tmp
                            • Path C:\Windows\Installer\MSI478E.tmp
                            • Size 182KB
                            • SHA256 17abe207cfb3e461605cc9b9c5deb643c806bde516dab4203d59ed94739ab9d2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            MSI47FD.tmp
                            • Path C:\Windows\Installer\MSI47FD.tmp
                            • Size 198KB
                            • SHA256 8efc2893be422bca1300b507dafda0d62b74cdf9c359ccb2cad354c8353847f8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/1748-9304-0x0000020E97EF0000-0x0000020E97EFC000-memory.dmp
                            Download

                            memory/2128-9331-0x0000000003990000-0x00000000039F3000-memory.dmp
                            Download

                            memory/2128-9896-0x0000000003990000-0x00000000039F3000-memory.dmp
                            Download

                            memory/2212-1765-0x0000000002AE0000-0x0000000002B43000-memory.dmp
                            Download

                            memory/2800-36-0x0000000002F10000-0x0000000002F73000-memory.dmp
                            Download

                            memory/2800-1-0x0000000002F10000-0x0000000002F73000-memory.dmp
                            Download

                            memory/2800-18-0x0000000002F10000-0x0000000002F73000-memory.dmp
                            Download

                            memory/4116-9165-0x0000000002990000-0x00000000029F3000-memory.dmp
                            Download

                            memory/4608-9142-0x0000000001650000-0x00000000016B3000-memory.dmp
                            Download

                            memory/4608-9143-0x00000000031E0000-0x0000000003204000-memory.dmp
                            Download

                            memory/4608-9144-0x00000000033B0000-0x00000000033C8000-memory.dmp
                            Download

                            memory/4848-9148-0x0000000003480000-0x00000000034E3000-memory.dmp
                            Download

                            memory/5932-11456-0x000001EE25BA0000-0x000001EE25BAC000-memory.dmp
                            Download

                            memory/7308-11521-0x0000021783FB0000-0x0000021783FBC000-memory.dmp
                            Download

                            memory/9060-11633-0x000001C605510000-0x000001C60551C000-memory.dmp
                            Download

                            memory/11804-9910-0x00007FFBD7BC0000-0x00007FFBD7BC1000-memory.dmp
                            Download

                            memory/11948-9954-0x00007FFBD97D0000-0x00007FFBD97D1000-memory.dmp
                            Download

                            memory/11948-9955-0x00007FFBD8E20000-0x00007FFBD8E21000-memory.dmp
                            Download

                            memory/12508-11540-0x000002E8C9760000-0x000002E8C976C000-memory.dmp
                            Download

                            memory/12772-11541-0x000002838F0B0000-0x000002838F0BC000-memory.dmp
                            Download

                            memory/13140-11545-0x000001586B920000-0x000001586B92C000-memory.dmp
                            Download

                            memory/14132-11585-0x0000024961440000-0x000002496144C000-memory.dmp
                            Download

                            memory/16024-11169-0x000001C520CE0000-0x000001C520CEC000-memory.dmp
                            Download