d868cb49c7ac1a7c0261bb3764f39a34264d0cdfb4460d4119029e66e3cb39f6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 225KB
Sample260701-lvtefaaz5r
SHA256 d868cb49c7ac1a7c0261bb3764f39a34264d0cdfb4460d4119029e66e3cb39f6
MD5 51622ca2eec05ef83363d64645569290
SHA1 609dcb88fd924abd81a2b04082fd37b39f2f14ea
SHA512 708247f91fe976c09b1fd8dc5b51322b47c4301453e8c3802af050ff8a3e52367cfa97f2a83efa873fe2cbb2a7b70e62c5f95ace4ee52fc572819db3b2192a9d
SSDEEP 3072:E6GEtNEXN4wCq5/v46QC2mCm/lY9Kkj3c6QQaWAk0Ag5qAWKGETBKnF58it3kzMx:hGYk4wCq5x+9T3bQQaNlTwNt3kz
TLSH
T1953459217C81C032C1B31934C9E5D2F06A7CBD708E658A8F63987F2F7A771926625E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	5752	2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
20	3384	lite_installer.exe

Executes dropped EXE 30 IoCs

pid	Process
4132	YandexPackSetup.exe
3384	lite_installer.exe
364	seederexe.exe
3024	Yandex.exe
4820	explorer.exe
5500	sender.exe
3876	yb5D39.exe
1448	yb17A0.tmp
1368	setup.exe
5616	setup.exe
2188	setup.exe
6076	service_update.exe
5952	service_update.exe
1624	service_update.exe
2956	service_update.exe
424	service_update.exe
5816	service_update.exe
6048	explorer.exe
3280	explorer.exe
3056	clidmgr.exe
5724	clidmgr.exe
5176	browser.exe
4384	browser.exe
5700	browser.exe
620	browser.exe
4660	browser.exe
5412	browser.exe
5956	browser.exe
796	browser.exe
696	browser.exe

Loads dropped DLL 22 IoCs

pid	Process
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
5176	browser.exe
4384	browser.exe
5176	browser.exe
5700	browser.exe
5700	browser.exe
620	browser.exe
620	browser.exe
4660	browser.exe
5412	browser.exe
4660	browser.exe
5412	browser.exe
5700	browser.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Yandex\ui	service_update.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe	service_update.exe
File opened for modification	C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\debug.log	service_update.exe

Drops file in Windows directory 46 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AB4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B80.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	service_update.exe
File opened for modification	C:\Windows\Installer\MSI45FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47C3.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	service_update.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	service_update.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	service_update.exe
File opened for modification	C:\Windows\SystemTemp	service_update.exe
File opened for modification	C:\Windows\SystemTemp	service_update.exe
File opened for modification	C:\Windows\Installer\e5941a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4745.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4822.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB6F92C679374D11A.TMP	msiexec.exe
File created	C:\Windows\Tasks\Update for Yandex Browser.job	service_update.exe
File created	C:\Windows\SystemTemp\scoped_dir5616_855826297\explorer.exe	setup.exe
File opened for modification	C:\Windows\SystemTemp	explorer.exe
File created	C:\Windows\Installer\e5941a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI456D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48CF.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	service_update.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	service_update.exe
File created	C:\Windows\SystemTemp\~DF0E44DE8E8961E645.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	service_update.exe
File opened for modification	C:\Windows\SystemTemp	browser.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp	service_update.exe
File created	C:\Windows\Tasks\Repairing Yandex Browser update service.job	service_update.exe
File created	C:\Windows\SystemTemp\sdwra_5616_1751880449\service_update.exe	setup.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4697.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE301F6EB9C70609.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	service_update.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_installer.log	explorer.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	service_update.exe
File opened for modification	C:\Windows\Installer\MSI44CF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF170C94EE302AEF92.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	service_update.exe
File created	C:\Windows\Tasks\System update for Yandex Browser.job	service_update.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lite_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yb5D39.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clidmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YandexPackSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seederexe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yandex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clidmgr.exe

System Time Discovery 1 TTPs 7 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5672	browser.exe
2556	browser.exe
5708	browser.exe
4180	browser.exe
5616	setup.exe
4660	browser.exe
5272	browser.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	browser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	browser.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	browser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	browser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	browser.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Yandex	service_update.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Yandex\UICreated_SYSTEM = "1"	service_update.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexBrowser.crx\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\",0"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexCSS.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\AppUserModelId = "Yandex.O2X2UYO6AR6JJMCOYRRQLTQF6I"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexFB2.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexSVG.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexSVG.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationDescription = "Яндекс\u00a0Браузер – это быстрая и\u00a0удобная программа для\u00a0работы в\u00a0интернете и\u00a0просмотра веб-страниц."	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexSWF.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexWEBM.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\AppUserModelId = "Yandex.O2X2UYO6AR6JJMCOYRRQLTQF6I"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexCSS.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexXML.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.fb2\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.js\OpenWithProgids\YandexJS.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.tif\OpenWithProgids\YandexTIFF.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.html\OpenWithProgids\YandexHTML.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.pdf	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexFB2.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationName = "Яндекс Браузер с Алисой AI"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexPNG.O2X2UYO6AR6JJMCOYRRQLTQF6I\AppUserModelId = "Yandex.O2X2UYO6AR6JJMCOYRRQLTQF6I"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexTIFF.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationName = "Яндекс Браузер с Алисой AI"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexWEBP.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationCompany = "Yandex"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.crx	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexGIF.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationName = "Яндекс Браузер с Алисой AI"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexJPEG.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexJPEG.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexXML.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexXML.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexPDF.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.jpeg	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexBrowser.crx\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexJPEG.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\AppUserModelId = "Yandex.O2X2UYO6AR6JJMCOYRRQLTQF6I"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.epub\OpenWithProgids\YandexEPUB.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.tif\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.mhtml\OpenWithProgids\YandexHTML.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\yabrowser\URL Protocol	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexHTML.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexHTML.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\AppUserModelId = "Yandex.O2X2UYO6AR6JJMCOYRRQLTQF6I"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexEPUB.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexJPEG.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationCompany = "Yandex"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexYPROTECT.O2X2UYO6AR6JJMCOYRRQLTQF\Application\AppUserModelId = "Yandex.O2X2UYO6AR6JJMCOYRRQLTQF6I"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexYPROTECT.O2X2UYO6AR6JJMCOYRRQLTQF\Application\ApplicationCompany = "Yandex"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.html	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexCRX.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexCRX.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\AppUserModelId = "Yandex.O2X2UYO6AR6JJMCOYRRQLTQF6I"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexEPUB.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexTIFF.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.tif	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.webp\OpenWithProgids\YandexWEBP.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\yabrowser	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexGIF.O2X2UYO6AR6JJMCOYRRQLTQF6I\ = "Yandex Browser GIF Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexSVG.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.png\OpenWithProgids\YandexPNG.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.html\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexFB2.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexPNG.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexSWF.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationCompany = "Yandex"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexWEBP.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexYPROTECT.O2X2UYO6AR6JJMCOYRRQLTQF\shell\open\command	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.infected	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\.xml\OpenWithProgids\YandexXML.O2X2UYO6AR6JJMCOYRRQLTQF6I	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexHTML.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexINFE.O2X2UYO6AR6JJMCOYRRQLTQF6I\ = "Malware Infected File"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexPNG.O2X2UYO6AR6JJMCOYRRQLTQF6I\Application\ApplicationCompany = "Yandex"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexTXT.O2X2UYO6AR6JJMCOYRRQLTQF6I\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\YandexYPROTECT.O2X2UYO6AR6JJMCOYRRQLTQF\Application\ApplicationName = "Яндекс Браузер с Алисой AI"	setup.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F	2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\SystemCertificates\CA\Certificates\C10BB76AD4EE815242406A1E3E1117FFEC743D4F\Blob = 030000000100000014000000c10bb76ad4ee815242406a1e3e1117ffec743d4f140000000100000014000000259dd0fc59098663c5ecf3b1133b571c039236116b0000000100000020000000cd0e144dd10bac221fe2fb901058d16450a0578b3c47c770908f2e9ada28ef120f0000000100000020000000d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe1900000001000000100000008050a1c09667687456bd1c63be8f6fcb5c0000000100000004000000001000001800000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b44b0000000100000044000000390043004200340033003700330041003400320035003200440045003800440032003200310032003900320039003800330036003300300034004500430035005f0000002000000001000000ec060000308206e8308204d0a003020102021077bd0e05b7590bb61d4761531e3f75ed300d06092a864886f70d01010b05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303732383030303030305a170d3330303732383030303030305a305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e67204341203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100cb20ef971eb9013243a05ba98a23fd205eae38128bca2cd4ff41d81a55d41953b7fda317e77a395cc0f7ce11a3f9a5ed01fab5ba93efaf93dcf8e2b3194c83b04a4450047884106aa4d696908e81f87cab2fb5a35733d2587b940e6d0fa591262ab3834f72b18a7b6492d0f0b4555f960b11e59ab52cb211cf251b7d512b981f49a35ff8139e35b80302daa4132f854aefc42f700ec1d4cc3312ecbd4095d311cae6cdb3059cc853eb52d7784c51019282de13f3078e74ba84809fd2a4150ee8afebf789f6df71f0d1bea7b241332075ccb1d5ed1d0719c4eb2677f2ab6d179349a9b7e6c3909cc6b8ecccc97b9a5ec5c52493636f7e108b61cf9855a324a28836f2f99fbe932eb2069f26c00c015612e1b28a9f0e1edc988b2ecfdae28934a61f26a0a8ae786deca188153cc2eaeeb7d8ad61a5af7036a2798edc0d73c0f1e42cab94ec5806393648d63b5ae822ce740eaf2cf115dad1b495e8acd5496de5afdd9b6b63205d8e7e3bb243d8623a94e5cdb498b3371924127273ab04b009dc85e6d42204ef402a1d2e6dc769d36eb7016c0de097a716e6268b88f70344865f62674cb5a737a855dc03368c6ecf6d3626f10e8fb03d71c0e132a782e4b6320232307cb593c821fd3c88e66963f8ee75c98bc2abefba3afde95ebfb611f1bef03dca323e6e7dde0f7e9b95c41287e71ab84eee2cc1dfa165e82483c92ac2fdb9530203010001a38201ad308201a9300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030330120603551d130101ff040830060101ff020100301d0603551d0e04160414259dd0fc59098663c5ecf3b1133b571c03923611301f0603551d230418301680141f00bf46800afc7839b7a5b443d95650bbce963b30819306082b06010505070101048186308183303906082b06010505073001862d687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f74723435304606082b06010505073002863a687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f636f64657369676e696e67726f6f747234352e63727430410603551d1f043a30383036a034a0328630687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f636f64657369676e696e67726f6f747234352e63726c30550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c0103300d06092a864886f70d01010b050003820201002575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5	2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	lite_installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	lite_installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	lite_installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 6b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	lite_installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff16b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	lite_installer.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4132	YandexPackSetup.exe
4132	YandexPackSetup.exe
5832	msiexec.exe
5832	msiexec.exe
3384	lite_installer.exe
3384	lite_installer.exe
364	seederexe.exe
364	seederexe.exe
364	seederexe.exe
364	seederexe.exe
364	seederexe.exe
364	seederexe.exe
364	seederexe.exe
364	seederexe.exe
364	seederexe.exe
364	seederexe.exe
5500	sender.exe
5500	sender.exe
3384	lite_installer.exe
3384	lite_installer.exe
5616	setup.exe
5616	setup.exe
5616	setup.exe
5616	setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5176	browser.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4132	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	4132	YandexPackSetup.exe
Token: SeSecurityPrivilege	5832	msiexec.exe
Token: SeCreateTokenPrivilege	4132	YandexPackSetup.exe
Token: SeAssignPrimaryTokenPrivilege	4132	YandexPackSetup.exe
Token: SeLockMemoryPrivilege	4132	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	4132	YandexPackSetup.exe
Token: SeMachineAccountPrivilege	4132	YandexPackSetup.exe
Token: SeTcbPrivilege	4132	YandexPackSetup.exe
Token: SeSecurityPrivilege	4132	YandexPackSetup.exe
Token: SeTakeOwnershipPrivilege	4132	YandexPackSetup.exe
Token: SeLoadDriverPrivilege	4132	YandexPackSetup.exe
Token: SeSystemProfilePrivilege	4132	YandexPackSetup.exe
Token: SeSystemtimePrivilege	4132	YandexPackSetup.exe
Token: SeProfSingleProcessPrivilege	4132	YandexPackSetup.exe
Token: SeIncBasePriorityPrivilege	4132	YandexPackSetup.exe
Token: SeCreatePagefilePrivilege	4132	YandexPackSetup.exe
Token: SeCreatePermanentPrivilege	4132	YandexPackSetup.exe
Token: SeBackupPrivilege	4132	YandexPackSetup.exe
Token: SeRestorePrivilege	4132	YandexPackSetup.exe
Token: SeShutdownPrivilege	4132	YandexPackSetup.exe
Token: SeDebugPrivilege	4132	YandexPackSetup.exe
Token: SeAuditPrivilege	4132	YandexPackSetup.exe
Token: SeSystemEnvironmentPrivilege	4132	YandexPackSetup.exe
Token: SeChangeNotifyPrivilege	4132	YandexPackSetup.exe
Token: SeRemoteShutdownPrivilege	4132	YandexPackSetup.exe
Token: SeUndockPrivilege	4132	YandexPackSetup.exe
Token: SeSyncAgentPrivilege	4132	YandexPackSetup.exe
Token: SeEnableDelegationPrivilege	4132	YandexPackSetup.exe
Token: SeManageVolumePrivilege	4132	YandexPackSetup.exe
Token: SeImpersonatePrivilege	4132	YandexPackSetup.exe
Token: SeCreateGlobalPrivilege	4132	YandexPackSetup.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe
Token: SeRestorePrivilege	5832	msiexec.exe
Token: SeTakeOwnershipPrivilege	5832	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6048	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5832	msiexec.exe
4424	MsiExec.exe
5176	browser.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5752 wrote to memory of 4132	5752	2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 5752 wrote to memory of 4796	5752	2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	89
PID 5832 wrote to memory of 4424	5832	msiexec.exe	92
PID 4424 wrote to memory of 3384	4424	MsiExec.exe	93
PID 4424 wrote to memory of 364	4424	MsiExec.exe	95
PID 364 wrote to memory of 3024	364	seederexe.exe	97
PID 3024 wrote to memory of 4820	3024	Yandex.exe	98
PID 364 wrote to memory of 5500	364	seederexe.exe	99
PID 3876 wrote to memory of 1448	3876	yb5D39.exe	101
PID 1448 wrote to memory of 1368	1448	yb17A0.tmp	102
PID 1368 wrote to memory of 5616	1368	setup.exe	103
PID 5616 wrote to memory of 2188	5616	setup.exe	104
PID 5616 wrote to memory of 6076	5616	setup.exe	105
PID 6076 wrote to memory of 5952	6076	service_update.exe	106
PID 1624 wrote to memory of 2956	1624	service_update.exe	108
PID 1624 wrote to memory of 424	1624	service_update.exe	109
PID 424 wrote to memory of 5816	424	service_update.exe	110
PID 5616 wrote to memory of 6048	5616	setup.exe	111
PID 6048 wrote to memory of 3280	6048	explorer.exe	112
PID 5616 wrote to memory of 3056	5616	setup.exe	114
PID 5616 wrote to memory of 5724	5616	setup.exe	116
PID 5176 wrote to memory of 4384	5176	browser.exe	120
PID 5176 wrote to memory of 5700	5176	browser.exe	121
PID 5176 wrote to memory of 5700	5176	browser.exe	121
PID 5176 wrote to memory of 620	5176	browser.exe	122
PID 5176 wrote to memory of 620	5176	browser.exe	122
PID 5176 wrote to memory of 4660	5176	browser.exe	123
PID 5176 wrote to memory of 5412	5176	browser.exe	124
PID 5176 wrote to memory of 5412	5176	browser.exe	124
PID 5176 wrote to memory of 5956	5176	browser.exe	125
PID 5176 wrote to memory of 5956	5176	browser.exe	125
PID 5176 wrote to memory of 796	5176	browser.exe	126
PID 5176 wrote to memory of 696	5176	browser.exe	127
PID 5176 wrote to memory of 5272	5176	browser.exe	128
PID 5176 wrote to memory of 5272	5176	browser.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=213 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-01_51622ca2eec05ef83363d64645569290_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=1095462/cnt=1/dt=2/ct=0/rt=0 --dh 2484 --st 1782899529
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4796

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E489002F2C0508352D69017D45B1AF95
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Users\Admin\AppData\Local\Temp\1815E847-CD9B-4E3F-9784-2E7C27D9E709\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\1815E847-CD9B-4E3F-9784-2E7C27D9E709\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\B22A29A4-BDDA-48DE-9E6C-F605129866F7\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\B22A29A4-BDDA-48DE-9E6C-F605129866F7\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\4D444CC3-B72E-4EB3-BA4C-69970F082334\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
      C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
        
        C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\4D444CC3-B72E-4EB3-BA4C-69970F082334\sender.exe
      C:\Users\Admin\AppData\Local\Temp\4D444CC3-B72E-4EB3-BA4C-69970F082334\sender.exe --send "/status.xml?clid=14237140-213&uuid=f077acc1-9a33-4f8f-b0dd-dc695bc21af0&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A36%0A40%0A42%0A45%0A57%0A61%0A102%0A103%0A111%0A123%0A124%0A125%0A"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5500

C:\Users\Admin\AppData\Local\Temp\yb5D39.exe
"C:\Users\Admin\AppData\Local\Temp\yb5D39.exe" --job-name=yBrowserDownloader-F1743869-ED68-4850-81FE-989448AB9400 --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\yb5D39.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237136-213&ui={f077acc1-9a33-4f8f-b0dd-dc695bc21af0} --use-user-default-locale
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\yb17A0.tmp
  "C:\Users\Admin\AppData\Local\Temp\yb17A0.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\a473fe14-ff82-42cf-8786-3a4f231797cd.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=637834502 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-F1743869-ED68-4850-81FE-989448AB9400 --local-path="C:\Users\Admin\AppData\Local\Temp\yb5D39.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237136-213&ui={f077acc1-9a33-4f8f-b0dd-dc695bc21af0} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\dcda42e3-8f6b-4f3c-a05a-36a536df5aea.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\a473fe14-ff82-42cf-8786-3a4f231797cd.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=637834502 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-F1743869-ED68-4850-81FE-989448AB9400 --local-path="C:\Users\Admin\AppData\Local\Temp\yb5D39.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237136-213&ui={f077acc1-9a33-4f8f-b0dd-dc695bc21af0} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\dcda42e3-8f6b-4f3c-a05a-36a536df5aea.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\a473fe14-ff82-42cf-8786-3a4f231797cd.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=637834502 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-F1743869-ED68-4850-81FE-989448AB9400 --local-path="C:\Users\Admin\AppData\Local\Temp\yb5D39.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237136-213&ui={f077acc1-9a33-4f8f-b0dd-dc695bc21af0} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\dcda42e3-8f6b-4f3c-a05a-36a536df5aea.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=666351977
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Time Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5616 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1816 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff69401a2a0,0x7ff69401a2ac,0x7ff69401a2b8
        5⤵
        Executes dropped EXE
        
        PID:2188
    - - C:\Windows\SystemTemp\sdwra_5616_1751880449\service_update.exe
        
        "C:\Windows\SystemTemp\sdwra_5616_1751880449\service_update.exe" --setup
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:6076
      - C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe
        
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe" --install
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5952
    - - C:\Windows\SystemTemp\scoped_dir5616_855826297\explorer.exe
        
        "C:\Windows\SystemTemp\scoped_dir5616_855826297\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6048
      - C:\Windows\SystemTemp\scoped_dir5616_855826297\explorer.exe
        
        C:\Windows\SystemTemp\scoped_dir5616_855826297\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6048 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1816 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7ce74a2a0,0x7ff7ce74a2ac,0x7ff7ce74a2b8
        6⤵
        Executes dropped EXE
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
        
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
        
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source5616_1204585745\Browser-bin\clids_yandex_second.xml"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5724

C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe
"C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe" --run-as-service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe
  "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1624 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1816 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6f2a73b20,0x7ff6f2a73b2c,0x7ff6f2a73b38
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2956
- C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe
  "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe" --update-scheduler
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1816\service_update.exe" --update-background-scheduler
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5816

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=637834502
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5176
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=5176 --annotation=metrics_client_id=bb1c036291ad448cb56d70e2269ef069 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1816 --initial-client-data=0x15c,0x160,0x164,0x138,0x168,0x7ffdc04f57f8,0x7ffdc04f5804,0x7ffdc04f5810
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4384
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=2016,i,16556003802373218676,5007182317444353482,262144 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5700
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2156,i,10599590146018009802,9276070743186135412,262144 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2272 /prefetch:6
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:620
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2512,i,10045308744260651078,12574071749046116112,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2660 --brver=26.6.0.1816 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Time Discovery
  PID:4660
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2956,i,5985299234347838250,18198630249979669302,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3116 --brver=26.6.0.1816 /prefetch:13
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5412
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3444,i,10366974623720361094,1086539944504528239,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3452 --brver=26.6.0.1816 /prefetch:12
  2⤵
  - Executes dropped EXE
  PID:5956
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3552,i,436258816822576912,14376416193228087531,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4352 --brver=26.6.0.1816 /prefetch:14
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4372,i,2341767999936263732,17861413458907188626,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4584 --brver=26.6.0.1816 /prefetch:14
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --may-use-trampoline-gpu --metrics-shmem-handle=4552,i,14227887879985724916,17192666347035245779,2097152 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  - System Time Discovery
  PID:5272
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --may-use-trampoline-gpu --metrics-shmem-handle=5260,i,6057639590080127017,18421360770956197216,2097152 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  - System Time Discovery
  PID:5672
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5512,i,8541942504094579481,8988165604588400049,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5504 --brver=26.6.0.1816 /prefetch:14
  2⤵
  PID:4236
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=4964,i,11619560844846426983,16860467749317025857,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4968 --brver=26.6.0.1816 /prefetch:14
  2⤵
  PID:1792
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4724,i,2360471825623149789,5783204439630163661,2097152 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  - System Time Discovery
  PID:2556
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6000,i,4403861225130138307,13423798245996281909,2097152 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  - System Time Discovery
  PID:5708
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6276,i,16954454064002263966,8644400225091448743,2097152 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  - System Time Discovery
  PID:4180
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7228,i,7405315941328589664,16706022149738812538,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7252 --brver=26.6.0.1816 /prefetch:14
  2⤵
  PID:6060
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7464,i,1677871740762645901,18109600136793441662,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7452 --brver=26.6.0.1816 /prefetch:14
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9236,i,3009768879455467412,6459619173649825098,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9264 --brver=26.6.0.1816 /prefetch:14
  2⤵
  PID:1880
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9252,i,593129324384438228,10419320678170317640,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9284 --brver=26.6.0.1816 /prefetch:14
  2⤵
  PID:4188
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=f077acc1-9a33-4f8f-b0dd-dc695bc21af0 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9396,i,4963243101750961682,2064922005469766455,524288 --field-trial-handle=2176,i,853673218310697117,9047025547788967216,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2020,i,4808554463870910259,7888982768988580495,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9536 --brver=26.6.0.1816 /prefetch:14
  2⤵
  PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5196

C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
1⤵
PID:4948
- C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
  C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782899641 --annotation=last_update_date=1782899641 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4948 --annotation=metrics_client_id=bb1c036291ad448cb56d70e2269ef069 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1816 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffdc04f57f8,0x7ffdc04f5804,0x7ffdc04f5810
  2⤵
  PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5941a6.rbs

Path C:\Config.Msi\e5941a6.rbs
Size 912B
SHA256 d9ca95917f02a5c5e84d2f6bc6373b9c853dfcf30ed3038c7a277a09d45a3c27
MD5 13316e1d9e4e4ddb5ff82e75e438d978
SHA1 34b8032d6816181d38ea1b271300286a448d1fa1
SHA512 9bfc753823292480c9695685df6fcc6d305a8ebb62a4af69da1d01466b6e2498378d10c1f1f69f406144c6a322b88fe3d8299158f6094478c4c3a1e6428b9513
TLSH
T13011CC4F977D92C6C841C0329B966DDAA46BF524AB2F0494DA0B6D29305E1303F18187
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 54ce40639641fcbe598aa60e95884b9037e5ffea6dd153ccbbf32bc8c37d42ca
MD5 dd6f18295a91039643d3851866d6e3c4
SHA1 d50c2521536941c2056d66b4635c338692b6d6a2
SHA512 e28e3b96ccde9969a93b868792b53b0060f8c60848de16fa8e45068059000e2740717fc9c3d7b297f9e44c47d08f2fc32d958d0a5ca970d415ab5091ea8cda66
TLSH
T12D21E9894A564DC2BB971E6337C0D43FBCA18BC0A8943826631B449D1AD03B81F2A64C
MD5 SHA1 SHA512 TLSH

Submit Download

349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
Size 1KB
SHA256 0ae5e4eb7b6d2d8b1f9a19f069b5a25bd48270ecbbe4ecf6f46e7b61fa07f5a5
MD5 63172b0b82a8e8c681b76d816126d66c
SHA1 4d46768f9f7c5f2ea4c3707e48bcf699c01b75b2
SHA512 491c6f62001a789cb12474f9d44ebeb94b3159ef9856dce0181659503f4795cbbdaf978613b21ecbcea76952ccdd14413a950b440479052a592061200f1312a8
TLSH
T10221C9C36FB4A8066B83D97F90C4573379F095E94CBDA0E574B9885AA1497505F046CC
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
Size 1KB
SHA256 58710eb257129ce0d3445b80a068b20a6c4115182c489f43541fab834fff027e
MD5 b97b431a2ab82c79740775ae62dd8d4b
SHA1 f9791178ffeb66048de8894aca03cd9a28983e98
SHA512 8173b857ea3e88474ea2a3df6b6ae40b937eca0b88f162d46602a8c87e60b934a1af0f93e3cf0e10e7198d6680d00d3fe6ec0c8519d0bd4cd2079c7ff29d27d1
TLSH
T17631DA95121C1D472ADBCF286CC7C5196E3571D06A7D6521027B8135AE103D36BB642A
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
Size 1KB
SHA256 aa9d23fd19043fdbf7e0ffa0f4f0732582d92cb0434758c54ade949f9632ab3e
MD5 2abe6fa4a0b842cda8e6e87e808fd380
SHA1 3d8c633b5827987d1daefbf4c3e24866db62b0ee
SHA512 cea9c3c6ec4b0a3eff1c82bcc844b2cd06d68774535cd9245c248f09127e358c99317841818e26d78b60339c0ddc411ca45057a1b03f7f26bb4b76b898789c49
TLSH
T18B311ACA152C1C866EC7CF544CC3DA0A2D29A4D06EBC5432123B8131B5003D35B7743A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 3f4fae8cb83a957ba2f7e87d194a6b2f3f16bfcb5d5270e7ba79bf9474653efe
MD5 766a36ead4d7c27dc02c4f267240414c
SHA1 3926358f4f8f5d1e6140fa7c8f4c4013c15213a1
SHA512 1f837318f04f87b2e6f7fdb2a6b87fad726dbe8803fb8c0b8c9dfa442de9aa0cfcdf735c8ed438ee3864ef1729b2bc6f1d70cc137aad249dd42a9294eca5eb04
TLSH
T10931D8375E6C6020DE13CD9429CCFA7219B495D12C9A54763228961F6884B779E1A41F
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Size 1KB
SHA256 c4aba615399f76e9139d0741c97137d2e5a76c8b4d5e0a069ee9da635abb7d11
MD5 e46ce546b976d6d77d45363e31e31d03
SHA1 b76832536a5b7413c1aed8be24053f97326b4957
SHA512 f36465fd6aeeeee8dc2261f1b2e4fa5b6bf23e4978a7629d0367d8abfad85fca9c9ff75250f26b35a7c4c1663de01c7c1838325cbf41ff69df4f5bafca6a7c10
TLSH
T16E21B98BD9B94C4A2E1E8E550EDCD7B6BCEA83C408DC04BDE10BE635780639A0F5352D
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 1f3bfae5ae443f6d634013696540c9ce699c219a263dcb626d4f74998c554d8f
MD5 dec8806390ba0d998d5cea5a39ddf9e2
SHA1 88599b045a9ee1a40b3e1a33b8a78d060d519842
SHA512 941c56737f7fad8d0a68fd94f3de3618d4c64abe7fc57e7bbe3f45f2cc10783707fab9029b55959786ad39d40c8c85c9f2defb085c9668113ba8760a84e217b2
TLSH
T109F05C1C5979403BF171DE3E0BCA36A2EF7BE6163806066116E5870CAA14F057C0273E
MD5 SHA1 SHA512 TLSH

Submit Download

349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
Size 536B
SHA256 86a77cb06b888d377536d57aab6c94bd868b3d4b1e69a987d39f6121c5cf9c59
MD5 ac5d17c1241c190978b3b3ebd1cfcb94
SHA1 119543a0b4eb9e568b3417bf198f87a7f1a6ad0b
SHA512 7f53a38971258293fea90924a88a95b5a26275aad9981c8d0703a08488516b0fe5e5d7886e736473eb531ab0b916bbfda6aa8ce6dd1e1ff102b2114bedddf968
TLSH
T109F02E3C0ABE411AF431DF7857C5A5F19C95EC165C4046B71AD5830C7B26C01FDB5611
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
Size 536B
SHA256 bd3211806aed6223dd2124ae8695274b848460671c6faf2018dcbf0526be56e1
MD5 9b235464fcc848aad6e5d8c28ee5ac19
SHA1 b9b7abb7f69e75ebcbdd0f9bb717cbb876f09e6b
SHA512 fa2cde793cb2b563f7a8eecfe4c080bfc14969f9061ed934295835dd2d1cbf67bbf0d209a92544094cd57eec6a47a0045491220465a465f14e0da52ec2a8c336
TLSH
T14AF09E3068FA002EF136DE384BC1A5C51D69FA16141256542AA98309AC22E81DD12A36
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
Size 536B
SHA256 f3d95835fe350bad4b59f336a07edf5b93f0d8925496df18c64af8d7d3634243
MD5 d9d9c85c5d47042bb4eb4fce66d97931
SHA1 86dacddcbec4acca66d41f35abece0c2d3feb6e5
SHA512 93837b867737d32244b598f82aae918c250966756f74dcc44884469f5106d492a9a0c871c141472580a55b6ea5313952bee8e5d6112945ad9239568a1bbb5498
TLSH
T1A3F09E3455FE001FF075CA344FD094E92C64F91634265A780AE943096D16F406C53E3A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 f90adcaed577d52ea94d55d162ab670d8510d3a82c6d36b5b2c21ea263d58afc
MD5 6916edfda61ea51dead7d788c0edd2f6
SHA1 8d7a2b2e34716bce68c29515552ad6b312f3c962
SHA512 83774e2a8d87556740500ba679efcf97b5d1444e171caea29029b760721a8d1ccf3561d683124f96d7d135a794d6c7bcaba062d6f1341875f1bb597d3b50500d
TLSH
T161F0DC0808F4022EF4BADA384FD860DAA566F9131C199BA603A54B0FBD21F41CD26A3D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
Size 506B
SHA256 2ffb05db16dbee2abfb96046f3702a80e622fe11d2533f292431659142485908
MD5 6477df29559d4da20512e0fc8c728644
SHA1 b15cf34f7773d00e92bae02b65bf73c99d96a461
SHA512 9247991521992d8a637bf59d57543b808221c2a7010737100275f3ce317fb787ac3a684606c7dbc2a90b95b11a6c5bf73675a688eae9542140bb485105048cf1
TLSH
T1FCF05C2C70FCD669F1F2CF3556D126E0E7AABA0B741506FA6AE607082D94F10AC8053E
MD5 SHA1 SHA512 TLSH

Submit Download

76effe79d80f660e454b3d072a4381ad

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s9p00y6l.default-release\thumbnails\76effe79d80f660e454b3d072a4381ad
Size 15KB
SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
MD5 af80a936c10e18de168538a0722d6319
SHA1 9b1c84a1cf7330a698c89b9d7f33b17b4ba35536
SHA512 9a1325c8ce05806e5c161a4cf47239f62baad8f79650fbd713e74928fce8171ced10ba7f24fac46c548e1dbf3f64106270cb25ca88c836c870107f5dc1f97879
SSDEEP 384:XJ9H3UgBY5QpDWZoc94ukwZ8UI9wujvkJL:XJWn5SWNVnI2/t
TLSH
T14862AE03295E87F5984CD6DABD8307AA6F69392EE8E2722E465B0C8738507714F4E07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lite_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\1815E847-CD9B-4E3F-9784-2E7C27D9E709\lite_installer.exe
Size 420KB
SHA256 985d3c2eb69a9f681c876d7a3d28b53f177ebcde90af9ca9d1d8d8be79b03a31
MD5 181e732cddb8038d4c4809385a30c763
SHA1 663a5311f39a85be33eef795ef7b163a32a9633f
SHA512 5b8489da63787c6ae4e9e05394427363162a4948cccab336d7d9625e7158f46664450efc7579115368327792711c99cdd326816f8c1468943dc6b90c1010e93e
SSDEEP 6144:BfOp2iUyj02j+DUa1/MHexK3zXrBQWjEcNvFVwl9WWYjWCGck1DbH+Y:B02iN0heGqzXrBQqEcRP/8ZbH+Y
TLSH
T160948D227682D032E56206715F7ECB7B186CBB311F7148CBB7E81A6C6A744C19631F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sender.exe

Path C:\Users\Admin\AppData\Local\Temp\4D444CC3-B72E-4EB3-BA4C-69970F082334\sender.exe
Size 260KB
SHA256 e249d09956aa2ef44db6a3cdab525abb73d01e7ad46bd83984e0d22d71c9dcc6
MD5 1dfca51cbbccb7bc6396fe0e4cb7428f
SHA1 f728e0b3c034b586fdfe20aa63d7e855645fd472
SHA512 2a6d6c86e0d69bc11a4fe7b88f8d3000013e37b814fab70ec26af50a58dd4b3fe0268a3539e3637f6762ddcc93733398c271143a750a01fc60eb78c88f850edf
SSDEEP 6144:dCD1AbclqCKv3v0Z3Ii+9T2F7QwnESA6iGx7BUz1Vv:dkAYlq3v3v0RdVM+ESAe7BY1Vv
TLSH
T176448D21B992C832E573053259B8CB76697CBD310F3489C7A3DC1A6D9E741C2A635F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexPackSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
Size 10.1MB
SHA256 d6622353f41b0e8f66a6c35e4efc1c122171f476c602b905223c584d3a4c08e5
MD5 6a631c33f6905fa535a1030710a71a91
SHA1 187c4f529d2c0d76c57b5e412bd566d166265ff6
SHA512 5f1b110780342002f3c2b8f9123d6065559c1ff063aa7261cd55f5d02f4819506340620890189c01fc02db0c37afb98f402f61e0e3a20b49290f0ad042e64994
SSDEEP 196608:ZV7wdiFsUCrGias6+sND6ZbHDLzl1vWrqufezv:rss+sND6ZbH/DvW2uGz
TLSH
T182B6D001B742C0B1EAD101B116BEABBA493D9E144B7189C7A7C43E7DDD312D2273BB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

seederexe.exe

Path C:\Users\Admin\AppData\Local\Temp\B22A29A4-BDDA-48DE-9E6C-F605129866F7\seederexe.exe
Size 8.5MB
SHA256 a2f5780c9d334c42323ae2cf3328227e7d04a5f6983ff862dc73627f1e970431
MD5 a700ed49dff143167d75c8fc1d4cb2cc
SHA1 defed1bc20884f2d368f34911fc8c1a8c3a9f929
SHA512 9cc1058fbefe173afa45c4f9db10d1d12802d66b06530f241baa43f294232a2b90ff419c894cdbac6f77cba20f8022b43a76f24e68b67c8dc693fd9d491f7f2b
SSDEEP 196608:ZdiFsUCrGias6+sND6ZbHDLzl1vWrqufezvi:Zs+sND6ZbH/DvW2uGzq
TLSH
T1E696D101B752C1B1EEC151F116BA6BBE497D8E148B7189C3D7C01E79D9323E2263BB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PartnerFile

Path C:\Users\Admin\AppData\Local\Temp\PartnerFile
Size 1.4MB
SHA256 4ff50f563d244343665ecb73cf841ccc9df8469d3d4ee3c1dd6e4c5198328c46
MD5 e2331dab8e47e81fc34b988838872f99
SHA1 256c3cf7b104fbd989b964bf38b308dbdb41d490
SHA512 bedcd0411bfd56f9c2f0940304f8dd3c18b9a643d1e0a1f458f79909ec640e63ecb99fe299ad73621b665aa109a439ea13384aad63afe69670373a67343afc37
SSDEEP 24576:pgWYJ4bjkFs2tNwhwhNiAXTmRUjWt7ty//f6xRFS2JUS5CPDPSU5lfsTwgqzd:GDJQjky2khwhNiNRUjAq/0Iv6sSUPfs+
TLSH
T1AD6533B272BECE5D354C0E75F3862AD12961E5B9E931F5F8663D8C08330A6B5093AD0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BRAND_COMMON

Path C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\BRAND_COMMON
Size 25.6MB
SHA256 8ee1f2b2597e18c901d27dd3bc04c2d698a95ab9dd3b2a153f5a3f9274bba4bd
MD5 8ad7158986958c3e427cd01cf54cae5c
SHA1 bc01ff6fffdbf921d4b2d351c23cfb8a7872f36f
SHA512 b56c0a5a273be3ea0ffd8590574258ce654859173a42615187e2a31708c9b7c1afc3d560d94a269a89966ebd6a1f67c475b5fd30df6c3413c6de77c28e7ffcf6
SSDEEP 786432:hbu82OC+XXVrRtEhhxz2GjJW4bxbt1jsz:Vu8g+nVrRtEhhxzjftxNi
TLSH
T1E34733B2459D9615AFD902F7594D7FD40C80BFE49DF429A884A28E04235FBAFC8DE039
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

brand_yandex

Path C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\brand_yandex
Size 2.5MB
SHA256 3676ec957ab38ca77c613e13aab1fa477b4555f7af631a11d7d31200e2e54100
MD5 6247f5bb3e6678ac4538380a3c680047
SHA1 79791ad3b7afd3e361318d9edbf379b7a4f87957
SHA512 d874cab5eaa32a1ce25b9e515c1ec8230fa75eec84098dbc3ff49218515dc83a329c0bcfc84c5b85e3519dbafca0ccc2bffcb83b457ce9e26f0d9cd96707805b
SSDEEP 49152:+otthChweHPjsg5SzcpWNZong1uN2T30v5Uufs9D1TKsSlQ/ZGUVxCUvC8:Pgw+B5S2WNKg16ckvmuEDcOoEt
TLSH
T196C533B312EEA3CD824C27B74481BE9D2D70FAF5D0639839B66DA843731E371714A860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\YB_73605.tmp\setup.exe
Size 7.5MB
SHA256 e877c9e8ab5ba82f3c6e54e4c9e8410d428277005c7dec2d570144601262470a
MD5 60a75239185697728c3a04acf21140a8
SHA1 cfed5cd4945a2f3a89ec0fe795d354518b442756
SHA512 048d5e233c2997cece67b4f6864624f25974e51c891015a24f8a3aea21e3a5844c36d5f8b5a3b46648abae1c835753f36d93cacb8bf9a808ee2928ebd5a8bba4
SSDEEP 49152:8GackvO4s20JpzYi7G7/1BPA88abq3dmntGWQ+vPR8+cVDnLQwH4XNtWZU0ACKc1:uCtOgDnukJ44/f19byfwCPGn/dUoII
TLSH
T153866C53F2A611F8C01EC9B4876A5632A9757C4A0B34A3EF0AE47A211E75FD46B3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch00000.log

Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
Size 1KB
SHA256 0ce2d5c196155fddbebe0eaa2d43f0d55eda982dc7c5a0b1bd345d64bf94436e
MD5 282ed63a23bbcf72a36eb50c809270ce
SHA1 e6c54b71de1d5918d193b30312d8233ef6c6ad88
SHA512 3c28a70155a98734c472860520c2f9e6f51c8f45c5bc06675dc8f4d4460b335ab2bbdef4e4e5f8d9834441b6efb7d7333d0e36a7dcf37e2d2c01072cd0bda40b
TLSH
T18B41F8692ED54845F1BAA707DEF3C4525A73FDC268349B0C23C5C61D0A67D0A786C3AE
MD5 SHA1 SHA512 TLSH

Submit Download

clids-yasearch.xml

Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
Size 730B
SHA256 1d184226d7c7bb3829e7eb4e2941c67dc5fe0643019134e5b27bc270fa8b3b38
MD5 487180e1c4ec149d94187944d0a5c3f5
SHA1 9481167c8445e3c79e8ea5ddf4cde9c33e80e337
SHA512 bd4eb05d2d21a5cb7ee1de9011975042bdacfb46a321fad2c2b9ab028f5b6daa9ce8bf56b9d0303439f1d2f6bbf3bbae3b194498c2e0cecd379c050dd1132fa8
TLSH
T18F0148CB538EDCEA5FA80B3705BC1594E3F43EC524601F786D8836E3A52E639CA48360
MD5 SHA1 SHA512 TLSH

Submit Download

lite_installer.log

Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
Size 15KB
SHA256 2707a6cb9636cdd09b8638c9fb3c128344a5df697227b087ca208e0495300291
MD5 6dccdc8abcb3078b0795b1a322d22865
SHA1 babb6574812b8f5654a5a49ecaee661d2a5712b9
SHA512 995b900da93dcfda8be5829e2911f7533a49bcd23ca1d796756fd1634032c3bf7cd2c1e1519c017d426c2fbe13e58789305b00a52ad3ffb2593d889eed83b09d
SSDEEP 384:uFgdGtfpTuydvsV+UtLl+DHQ39YYGFpgfTUyscV:XAX4
TLSH
T1586260482958897D36AE728ED0BD3DD18DD8F045FD144BB177CB99E02BD3402ADAE0A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

master_preferences

Path C:\Users\Admin\AppData\Local\Temp\master_preferences
Size 542B
SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
MD5 eab7dbafdb0a88e2963d969906f76a4f
SHA1 c048162b14ae21361e6e4c3d665f19ef1719c49b
SHA512 9179bef77b1b8bce884558481b3e711cc3c08f15f236306298649c3d5b9665e0c3f222ec96349325c13b029a1d97c0b44e6cde56f88feeb45e160f101be1d4e8
TLSH
T1A8F0E917C152BCAB04F6B7E078791696E94187734051AC353CFE102D1F3EB581285E6D
MD5 SHA1 SHA512 TLSH

Submit Download

vendor00000.xml

Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
Size 529B
SHA256 1e15adab0d9556fbf7067feccb3175c0788b8db0ab100a7c93394014f4b5a4b8
MD5 e868c066688555905251db7a1e77ccdc
SHA1 fcfd7470d081985164c3c6b056ef75f6bdd9acf9
SHA512 3bcfff250ff066976de1dc8ef9eed7176e0b7f5c12dda5844002253c625c4519887babedebdad25854740cc69f37782a8384a29dab92958f3ec67da2640ba107
TLSH
T1DCF0668355ACEE217FF50301853C6AD8F7E83CC814A06E8DB29CA2B19826376CF08370
MD5 SHA1 SHA512 TLSH

Submit Download

yb5D39.exe

Path C:\Users\Admin\AppData\Local\Temp\yb5D39.exe
Size 12.0MB
SHA256 9d2a9adfea9d6c52eca609a717cfc1ca802369336ab199cb140144fb46c81d89
MD5 ef166669391a5e29fe5965b853d7cccc
SHA1 e39dedd6c47bf6e3a2b577e172e776e3076ae244
SHA512 71842ed35b28540e2fd09fae397e587477d74582c18d8dda880e0303bb5472897e5ca3add322b0344e78256fb74bed5325cc7ae646202526c702e10a8957f05c
SSDEEP 196608:MIGPODP/vbsSQNYdC3hNlVd+cNTx9Pe20/xniu6E:M9ODnvb3HCJVd+CdCxnie
TLSH
T1A7C6D04BDB853129DD296A31252C3CAB9225ADC91B704BDBD7E97CA405707C31C3EB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YandexSearch.msi

Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
Size 9.7MB
SHA256 a0093634c803116c31a1abe9ffd2189893245ec26362574c5905c5c1467f9a46
MD5 dea8b46313f6b449c21211c449a95269
SHA1 a76dbace4d3a5a97827a621a93e145774fbe8fdc
SHA512 ff6485c3843776095816a45eee10b1d38a8cbcd9cb1f9eb6a016458b00067fe8deef7ae697422c02fb72427825631b7f0e1ac187245462daa460105d60b464b0
SSDEEP 196608:gV7wdiFsUCrGias6+sND6ZbHDLzl1vWrqufezv/:Kss+sND6ZbH/DvW2uGzH
TLSH
T13FA6D001B742C0B1EED101B116BEABBE497D9E144B7189C3A7C42E7D9D312D2273BB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex.exe

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
Size 395KB
SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
MD5 2d28975e84027e1fac0eb563b7d300da
SHA1 bd8e7ead4957c14cedc4c56df5127f70bb746ded
SHA512 7ddbfa54807207b8408e26610cc85d844705e1815b14f1172f1c39a04aeecf1b0f3b14371d6c00ce55437830c00173b219edf1a6e391152615f9bc33bc659b6e
SSDEEP 6144:AqVM7FLycoeASFgYif5GvPahcSp/AOEUwu1j/ra0nNX2dp:/VM7FLyzba1eOPa/mUwULhnNX2dp
TLSH
T1CE843AD1B591C171D17E0531C8E8FAF255AEBD244B644ADB63843E2FBA303D1A931EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yandex.lnk

Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
Size 2KB
SHA256 0f75f3ffde7ebda9fa2b56dae9aea6b66d00a79bbab368ce67f67f72f82e49bb
MD5 8bceb1e61497f4eccb6b9821668ff2a3
SHA1 8a2e4d18b509634df44183f9248ec11ee12ed745
SHA512 f1a0d69c62cb199e73ac0b88ee8bcb5b69c4efea39459f9b09c0abad8bbcdf02166de365ad7a2ced902b94ac2b5ec1d20c155ccca96b8dca5a8e7b8af0645e7a
TLSH
T18D41200434CB0B05DBABE1F392FF1B15D679F899A7411A1E0294924A2C92791FD24B3F
MD5 SHA1 SHA512 TLSH

Submit Download

brand_config

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1816\brand_config
Size 6KB
SHA256 c8464cea88059a29b67316176d805be9f6c0b06331e316935b6687a56af7a12b
MD5 9311c858bc514ba135d78edf6cd187fd
SHA1 5cf7b8d3132239bc8e0cac68cf0279ad79e3201b
SHA512 0a2d6fe0a6d683d1631b1cd3abdd0a6208b230fba378d42f3708e4d646ce189918930ae719f8387673ad3f3ede98ed1871b812cc763697c582cfdc10deddea3b
SSDEEP 96:LT63FEiE1M8Tt4vxObHASqfHSw9UjtlPuniIBdorZnl2NuE5lCEMjMcnQMS5X2Gy:iVEiE1JtoxObHGBkuuk4Ra2Gy
TLSH
T118D1BB7BC05C5C774A7932F6D0393E9AFA06132F88D0580BBA7D408C0FF6662694E92D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

partner_config

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1816\partner_config
Size 341B
SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
MD5 977bc7b2384ef1b3e78df8fbc3eeb16b
SHA1 7ee6110ca253005d738929b7ba0cc54ed2ed0a2e
SHA512 4d154832ef3ac05abb1499a5bc8235d72f64cdaa3e6870206a6363c1d85d821604ae8a96850c2c8bd540d479b8dd5f3ce032472ed96bbf7eddb168ea3d2d1cf6
TLSH
T173E0C0B0C288A4722C2F0030C49861FD984343270341485578D9568C4F700336509E68
MD5 SHA1 SHA512 TLSH

Submit Download

all_zip

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1816\resources\configs\all_zip
Size 1.3MB
SHA256 7fc86a50ef740e3e24170305530f4b078ab2777dea37ab335348914f198973d8
MD5 c0d8cc5b4e764b0e779875f1e5741d6a
SHA1 ab525ab892b615870dfb01b71072e456d8f1c97d
SHA512 03da093b09c6f028c23c429bdc5c044dc65175711d5876457aafe8b5cd84e1099adbe059e337db59e4d3843201a9766c70fc922205b447cb56c2ea162b3c4f21
SSDEEP 24576:8qjn0mTCUVqmOrcpqNilmmKiG0yMAeYaIlQlllC9NlPC5IllllC+llllPlCSllR1:8qjnhT4mQcpqNiLGxM5YRlQlllCTlPCU
TLSH
T1245523A3EEAE8E0BDD740B35BE9401B112387778B0725CF7D521DA6426404F5A707AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

light_static.jpg

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1816\resources\wallpapers\light.title\light_static.jpg
Size 674KB
SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
MD5 e896ab28a0c2928dbf22337ed30744e9
SHA1 5f2793de79b83c543786f2db019b8849007a0521
SHA512 a051c4f6e2aba2af86098f397ea28a3b562b3d7ee64cce823a8f4f479e6520b4099a3a6ff0579a4842c2600cf533db281548d90791e9a88d13e924a3ac3b6bb9
SSDEEP 12288:XOsIL00uQvkvdLvyFxdz/0MFrjKk1hEFZFUgrxVgxEWKG59nFLtD:XOD00RaZvyFxdQMFqkUfi6ngNKG5Z
TLSH
T1C3E4CEB5FFC3D71A0B1F2269D47EBD7B4B4106C854E45DCA84438D2AA190FB28A935BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sea_preview.jpg

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1816\resources\wallpapers\sea_preview.jpg
Size 59KB
SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
MD5 53ba159f3391558f90f88816c34eacc3
SHA1 0669f66168a43f35c2c6a686ce1415508318574d
SHA512 94c82f78df95061bcfa5a3c7b6b7bf0b9fb90e33ea3e034f4620836309fb915186da929b0c38aa3d835e60ea632fafd683623f44c41e72a879baf19de9561179
SSDEEP 1536:9AfzTfXKxW0L7s7cLKX9GQOpjl3VOpuIKd30y:WFPALKt7yVOOEy
TLSH
T128430233CD213C1A7DF9D674F599E338190EA729D9836D3115EA4043AB0D09CF9B4A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sea_static.jpg

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1816\resources\wallpapers\sea_static.jpg
Size 300KB
SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
MD5 5e1d673daa7286af82eb4946047fe465
SHA1 02370e69f2a43562f367aa543e23c2750df3f001
SHA512 03f4abc1eb45a66ff3dcbb5618307867a85f7c5d941444c2c1e83163752d4863c5fc06a92831b88c66435e689cdfccdc226472be3fdef6d9cb921871156a0828
SSDEEP 6144:5zDnbkgvXDoyTO9jnrCtMwk4OKEI77XlxLyxHMXipCqE+e:1DnogzDTO9jK0KEq71xLyxHzCqM
TLSH
T17564121B83B48F86CCF4A17EC6A30726BE1951A6EA8CB54FD250D026D1D67F4BC9B0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2879e533-0f3e-413f-9494-0be9f1d8b642.tmp

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\2879e533-0f3e-413f-9494-0be9f1d8b642.tmp
Size 218KB
SHA256 22dc6d47c0480f26756111f192e8a7983831bde42b75bb3f751ad9e1b96814ef
MD5 9cf5d280069d93cbbdd35e0c97060133
SHA1 c36bae2c89a8b9ed6300f3a04e43f6cff3355b67
SHA512 6c47e69f0b4da66da7a4bc509108cf57bd54d418630fcf3d3f2460205c9ce7765b13ad31aacd3470148fbaf07c3905053ea315a9448d999092e56df77060aea3
SSDEEP 6144:CVFVG5faqKD8YeM4rBEyC+pId4v/57vfmc:xxaX8YvVyHvx7Xmc
TLSH
T18624F193A7EECE5F49067722A1563A70F4C8C9D648D8F3705D0B7A04804F7AA4D7A92F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47499da3-0b24-4360-8700-4d979d7bc22c.tmp

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\47499da3-0b24-4360-8700-4d979d7bc22c.tmp
Size 8KB
SHA256 866b097a5846096a22c15e15790e72ac758ecad2a8a57a542226282df130210b
MD5 83c8881f422c0baf0164b729e9551f0e
SHA1 bed4b34eaebf6386323fcc19628d2c2b6a683f3d
SHA512 c8700ee17aad905c10ab6fb67df49c4a9344be94a53f54d3bb234d4972fc5cf048fe9fa08c40887d4ce415887181e7ade7502e5868cf640e464afff6eeb75e08
SSDEEP 192:05opQPAg75dUYsv7hg4KzgjAPsgAYs4egZoRHJZOdW4F/AcG3RPuJu2QggYAQzeI:mAkHTSR3aVEE66zp
TLSH
T1C202D6F4EE7C5E231A5EF0AC3F6AFA27DAC85E59824E7E42115B234804467467211FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58db5d35-80fb-44f1-91a7-0552b6f46840.tmp

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\58db5d35-80fb-44f1-91a7-0552b6f46840.tmp
Size 5KB
SHA256 3cdeb4a2cbb65bfe1e7ebe9bbd18afcf31bd1cd88f6c5492c861811c1dc763fc
MD5 7dcdde96ce922a34ec7a7109c2751697
SHA1 cc3e7ee524fa5842349f97c59c8a3be4f6d56c93
SHA512 f8adec1a9a88b3159f5b9d0b21523fd5dda5f2640679efe5c32f4e638ad4181b812c26b5c7571370a101d954980715a9ad41abace65c299def08f58bc9fa7caa
SSDEEP 48:tyfJN7StDPYRHqaAGV3+mXe/DlTHqCHpYGXol8lYua/R1RfjOy3ImEaj769nSvjv:ZDwvAzoe/QCNXolEmRffyyYVo1I2ea
TLSH
T171B1512AE5A15CA719F5B36878391B82FE41873F05502C1B397E118D1F7BA1B8181FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
Size 15KB
SHA256 783e441da8944a942452b5706465c86a6a1cbb1bdae6a193ccf3d911f32007b6
MD5 fd4fa31d1841155594347f20dee314b4
SHA1 839245d3c33d64b2ae3d65e39fd4cea0e0ce8577
SHA512 4569b4d8ee23c5b636490b7d8c993e15cf45641fb186d7dc644655ae9a7acbf0e58f6f20e9d292685af0396ae166c4055e3d142a28775cdec38124025124490b
SSDEEP 384:zRTqAN9DQ+oRX9Ih0IcLRYygOxH5I6sQ+x2xMGG9:Y6NWX9eFcLuql5DsQVxbG9
TLSH
T10762181AAD289CBB4DDAE318ED15BB42DBF6112131D03D48EBFC8A1C19D76CC521B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
Size 17KB
SHA256 4cd6d58d2495da29608c2e09f6df8025e0b51409de7ac2636f19d6bc1f876307
MD5 d8d59d4faafe1d49b286adf9685b225e
SHA1 5152b8f6133635b8d3383330d064ef8e103b8404
SHA512 1d2e2f877ff24c6153bb95cad2a6aa83bba4bcb55472835a7d4b34c7a5723a6a23aaf60ea11ede8dd44c01eec716730348839017c54cd366b0670fd55764aa94
SSDEEP 384:zR1qAN9DQ+rqQLPX9IfU0IcLRYyENO86PqI6Q+x2BWBMGI9:m6NrqQDX9hFcLubU8SqxQVBGbI9
TLSH
T1ED82E62A6D54EC7B4DD6E348FD14BB52EBE5212161D03E48EAFC9A0C19D76CC620F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
Size 9KB
SHA256 862fa5d56172f86502ae8714c09e23c6393549de47fb16617290042ec748616b
MD5 e83d8e4f1a969f93daa60e4aedd7310c
SHA1 16c9d965c82646db12081777fc0699234d0929be
SHA512 c8be859c79464e455f0d282568d288ae31e945052ba498a4d6a1116b4d2f8c432df0938ba5dcf00c66c198e5e0356a46d7f4d5ab122de4f8691d88b67c930896
SSDEEP 192:zIqYy3N9FleHXc6+WNINJ0IqBAyRDsfIXbVKCFyYmC5YR:zbJN9DEX9In0IcLRY4sfzR
TLSH
T1FE121A07FE259DB38DC6D218BD20BB82EEE2112115D52D5CABF8890C0DDABCD510781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
Size 13KB
SHA256 46532754fdc5a012d6a57f1bdad85bf56806eb36407934ab29f265b7dff41ac4
MD5 8de142107d930f6e7059f2cff732966a
SHA1 b2ce3847c5c813198025e201ed41c0611c7656ab
SHA512 c7461e2b1a7aaf7a9176e7d0e8923f74932008235e8e70eef4e5ff620cdb538837ef082c7e58fa3e0660999416aff65c70f9b3da9316d49cf090f89ddee8217b
SSDEEP 384:zRMqAN9DQ4oRX9IZ0IcLRYHBdstI6p+x2xMGZ9:96VWX9QFcLuhdstDpVxbZ9
TLSH
T1A652F81AAD259CBB8DDAE358FD10BB82DBE5212134D03D5CEBF8890C19E76CC511B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
Size 15KB
SHA256 3adac48d9cfbf851d3e1d801785a0281bd053f35b48f4aae496ee992c8697930
MD5 ee479ba9f0b66e492c863e0089071b69
SHA1 aa5b6a02ebca09d32abde7d325731ad72bc532c9
SHA512 d732c8155c1bb9d9b127df3e39ba23b370299de60de7a619f713253c84d908de319c57370b0c9541177a9f2472f8bceb9333ff4444c446bc6bff689955e2b39f
SSDEEP 192:RjMYJNqsMYGT2xMYDUq7MYMlgLuRWIvAgV5qTz1XvsEWLOXXESfULzgwPXosNu23:SYc/DTfDrlbAyGvDWebaPpeRw8SchZLi
TLSH
T140622AF16C6DCE731F9ED668EE22EE47DDD4151892582D1496F7824D03C378A230BA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
Size 15KB
SHA256 468151f8788678e67f30abce7f92c2bb780295bf05c4eb42f5ccd73d6d47b90e
MD5 d2bcb48c8b4376672caa39388b7b6b62
SHA1 41b5ac6509b81f27f2d6bb2d07b9870cdf75c746
SHA512 2f4a7bf044fca83d7384a613182f951cacc07511c5953d3cba95a08e5af1585b6227da51fa103873df6466dd9c9a51b957e2879bb6fed69fd684632fc70deb30
SSDEEP 192:ejMYJNqsMYGT2xMYDUq7MYMlgRnwz5Agj51H4jkKsHHgrIqGgzgQPss0YjwjQhxt:BYc/DTfDrlHAYfYprNkEwFDRBWbZ
TLSH
T181621AE26D5EDF731F9DD568ED26EE57CDE80618A2982D1456F2520C03C3B46230BAD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5176_498727231\Trusted Icons\Icons\128.png
Size 6KB
SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
MD5 98af80a8ac6eaaa581ac6a35a6040e3a
SHA1 bcc72c0cdf0f820143815200a6df89edfd049338
SHA512 18bc993cb66034481c95bcb47289a27d762fab391f9782672460e85edab70314f82e3ad1c2113d10565890062dc0d7383f7b15c1340a1858808348f3a99c5e4c
SSDEEP 192:4vEprLVcIHZTzraPxX0OXn70CbgSoJsNz83O/ixkfgFnum1Ux:48p/TnaPxX0OL0CsSgezkOgKNaUx
TLSH
T1BBE18E93F87E93A33E86795531974849DCCC3FF959E48F924A43449E68265D8F1CC340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5176_498727231\Trusted Icons\Icons\256.png
Size 5KB
SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
MD5 a7157e4338675f69c670e0c41f715fa0
SHA1 e763d4afb89be94c792292a5d4d759f5c366dda0
SHA512 a511a759c897362b963463d9397616d3cadb1f6ef1cd8d8fb17127c8a3089a75d2649ab2fed3f99caac68460f0d0c90ed5806df422a7273e9a9d6db9a34b9059
SSDEEP 96:A5Km6lOe95ki5kMyiCktoP85BXoL+C1voChQBzHqTfdxUcOMvA3PAY4INaDOWtZ+:Ak6e48SiCW+OCt8q0SvjY4EaDxmAJcFV
TLSH
T14AC16C653CA61B4FD813329943CFC26CD12A19F4236A32B02C22F9B56796B876803691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5176_498727231\Trusted Icons\Icons\64.png
Size 3KB
SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
MD5 e3ce94cd7f48844a5bcbac3627982743
SHA1 c1d05121b889d0a0170d78336c4042016def972f
SHA512 2786ddb007e36602aba9d74fac3048a0b3d4fb8b5c166052cbfc703ae4c300b93aa8b719af9701fa0ac123ecb7243d941326a025474d3eb4ebf9701306909318
TLSH
T18C615CA093A66E730BCC4041E29CC56A9A7855B7223E864FC926F8D41DC0B54B879F54
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5176_498727231\Trusted Icons\Icons\96.png
Size 5KB
SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
MD5 4dd17d632873159a8e6b3a3413ce37b0
SHA1 f31aa3afafafa453530c18b63b58382ba64831ad
SHA512 b29485fe17dda457487a7aa0d3411b29f59a1f1a27900872ab2263c5f04ac4d7e23b855b65b3ed15c1717f32413657e8f0ece90123ce69514cc4ef32541f303e
SSDEEP 96:TU+uAOCIEUwARPra4PtoDgE/ziWn+8gA/Lm2PXZAEX8TMFX1k:TWASEUwAh2ot6gE/zP+85/CIipYFC
TLSH
T16CB17D6166DBFFD8E2B76AD51FF812383AD3A414C8C593985D84FD2C1A201C19C8BBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Яндекс.website

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
Size 516B
SHA256 da6cbf3ef822503fc4765d17adf21494c0268c1b5c116311ff2003b70f02b47d
MD5 7652f3ce0dbd0c179a3c86df145e220d
SHA1 fc19e70bc68145da80804740a0f4a62aa2bd19ea
SHA512 7a771bd136df3219b565760d222963bb916a319f9373c423ab1c4ccf1af80575757097cb5fc5f8652f22c2458c256feeee7cda4f4d2fb0d1bef034f8e3e01bd4
TLSH
T17DF09E14C0AE447DD099D1473A38FEC4590B34567EC5DA39869BC8ACFF99494C808A15
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lchdz19z.Admin\places.sqlite
Size 68KB
SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
MD5 314cb7ffb31e3cc676847e03108378ba
SHA1 3667d2ade77624e79d9efa08a2f1d33104ac6343
SHA512 dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
SSDEEP 48:TV6UcMtYJqqEgbEwq3hF+gBNxw2BAl7FdickdaxL5HoVQJlu:x6HkTBB2ljvoS0
TLSH
T19363DD5B1A343122D8EA90737EE2506E093CF13A8F6776513DF010A6CCA1D62E5799FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clids-yabrowser.xml

Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
Size 756B
SHA256 ace8c2cec47ffdfa177dfcb19fe19c4719e3945ae67d2112c779475e6356307d
MD5 b67fdcffc2f7f18c9123165f701d4008
SHA1 596ec588554846acd4791631eb56bb8703542f63
SHA512 7799c6b67852aa5fdf0696f6d00232e96f4f0fb0458479114a085c94b12513982ceba3bb79ac4feb111fbf2d89ebfe8578e73c40ed03e5057d5782488d1fdc50
TLSH
T11F019D876B8ECEEE5F681B3745AC25D4E3F03EC504601F352C887AE7A91E679CA44320
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Yandex\ui
Size 38B
SHA256 14dcdc19d0d0e9cf47f302280e052d496962410a655f5ce7a4f5fcf1a5c06101
MD5 4875f77268915febcfd2fb10a3b79ba6
SHA1 f1ccd4bed10e21bf8eec943ca9bbd16b571e8762
SHA512 deb9de86a3ed7da7790c493b8a7a3d52fe1cf438c6cbd81a8e662c849c2603e19f004c9f20fa9ae65375d7f9e0a98ebd9a81c859e0de4ac3343322c4662cedcd
MD5 SHA1 SHA512

Submit Download

MSI44CF.tmp

Path C:\Windows\Installer\MSI44CF.tmp
Size 181KB
SHA256 1ad18330acc4f254d8a37ffdf6d14283e1617b1e163ee8d05c876bb41ac6f316
MD5 84d5435930d114587007a51fd8e74799
SHA1 6fa830add05231685c16911b9eca73a4914c35d0
SHA512 9c51450a4036fdb7de1fdadc8a08f264bd55c63a8e159fcafd03786b82a447bde99da756a12f6c1762066c863f7953e1e48a9bc79344588986fbf9b180eefc98
SSDEEP 3072:aQ//vtlwlXrVgrmqImWSUfkSspqkND1vvJWs3aZjBbby5ppL+kEx0PWjcmgd0nv2:aQ3vtlkX5gNNhUqpqkNDtJWZZjB6Wu0O
TLSH
T1F4048D127180C075E6BF163C4578DAB65A7E79301B74C8DF63948E2A2E702C1AB39B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI456D.tmp

Path C:\Windows\Installer\MSI456D.tmp
Size 197KB
SHA256 c149276c0b4427c1149fc5a85dc42b4c71c027c2b5fcbc73e6e659f7b3a75562
MD5 a3e005e83f177f7f24c173f8909bcf11
SHA1 fd45815f40f07f544129f1e8f881cdbb18af83ef
SHA512 2f5b250e3525715f5b1ebe629e8578613d9e0818cb3dc3c7776ff451b05c0e1e91ee123a9e5e4c6283ab0df66db3e738da4ac0503a86252ee247752ccf5124b7
SSDEEP 3072:ik7GJVXkOk//9Y74H6bCfnjnv3H73Y1ttJDRz2NvQbj6x1eZYxUoYLxZiEgZ9wRH:iDXJWm4H6bCfnjD3YjXRzXj+7lY6bQRH
TLSH
T10F148C01B881C03AE1BF1A30557ADB72597DB9301BB4CCDFA7849D681E706C2A739B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yandex_browser_installer.log

Path C:\Windows\SystemTemp\yandex_browser_installer.log
Size 6KB
SHA256 0bbaa1fc339b729ab9dbbae6593b5a1b2f265afb78764c6ea2c16992c5bd742c
MD5 ddc52da95f9fb76ae55f39482939e582
SHA1 207a4daaedb76340b8fcea116e9b564306b6a372
SHA512 5e177fdd3ea5f5c80689fa6dd5bfcb7d1649ed4242b185c21ffde2f364758dfa0e73cdc6dfcc95b06eeb962c63dd84ccd29ec410a63cd7f3cc2e28ce16732d29
SSDEEP 96:pV+QnY5eeb3ESRMoqnCLwj29N+PV+QnY5eeb3ESRMoqnCLwgsrV+QnY5eeb3ESR+:XY40M9a0Y40M9IWY40M9I37a
TLSH
T177D15415A1C78B3A6D09443FB5726BCCBCB0095C5BD87EB086A1D61D61D2A0EB9CB507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yandex_browser_service_update.log

Path C:\Windows\SystemTemp\yandex_browser_service_update.log
Size 4KB
SHA256 bd319b4f7dccb37ec9d486b11ef019ba3740071e3d8560587151b35a31a21939
MD5 071f96855c904de796c98a64b62976ba
SHA1 058958fd69b17552d1bb5bec7917bdc0f5b98ce6
SHA512 b9d8bb36aa1f5853724d1670e25f1ca04bd6f6942ead11f7770d34e35e5ce680a682598f5a4f7ef3f73ce8b73765df5c2dbcb4a3900a0af8d256366ed84fea65
SSDEEP 96:KRohHfS6HyG3vBHfG6HyiZ7wwcevFAHfm6Hy3Ad9Vi/RbhHOitHfo6HyPfLGYOvn:CoCMVeG7wwcetw+wd7i/RbkiZoXCBvXX
TLSH
T13CA10F6C10D88DFDA50B025FF44639D11E09F01AAA0D61943BEDEF980FD282DAE7E4A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5272-1065-0x00007FFDE3260000-0x00007FFDE3261000-memory.dmp

Download

memory/5272-1066-0x00007FFDE3A00000-0x00007FFDE3A01000-memory.dmp

Download

memory/5700-926-0x00007FFDE2EB0000-0x00007FFDE2EB1000-memory.dmp

Download