Overview

overview

8

Static

static

3

abf0945060...62.exe

windows10-2004-x64

8

abf0945060...62.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    abf09450604cfc4453fcfc49f7b1a076acdb25d934a93339da60c7c4b0bcb762.exe
  • Size 10.4MB
  • Sample260703-fd4aesbv7x
  • SHA256 abf09450604cfc4453fcfc49f7b1a076acdb25d934a93339da60c7c4b0bcb762
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 43 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 41 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 45 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\abf09450604cfc4453fcfc49f7b1a076acdb25d934a93339da60c7c4b0bcb762.exe
    "C:\Users\Admin\AppData\Local\Temp\abf09450604cfc4453fcfc49f7b1a076acdb25d934a93339da60c7c4b0bcb762.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6060
    • C:\Users\Admin\AppData\Local\Temp\abf09450604cfc4453fcfc49f7b1a076acdb25d934a93339da60c7c4b0bcb762.exe
      "C:\Users\Admin\AppData\Local\Temp\abf09450604cfc4453fcfc49f7b1a076acdb25d934a93339da60c7c4b0bcb762.exe" --parent-installer-process-id=6060 --run-as-admin --setup-cmd-line="fake_browser_arc --abt-config-resource-file=\"C:\Users\Admin\AppData\Local\Temp\abt_config_resource\" --abt-update-path=\"C:\Users\Admin\AppData\Local\Temp\ce0ed40c-09e7-4071-8c43-68892df290e0.tmp\" --brand-name=int --browser-present=none --disableyapin --distr-info-file=\"C:\Users\Admin\AppData\Local\Temp\distrib_info\" --installer-brand-id=int --make-browser-default-after-import --ok-button-pressed-time=575403711 --progress-window=459332 --send-statistics --server-config-bundle-path=\"C:\Users\Admin\AppData\Local\Temp\f25cc27f-60f7-47aa-9f50-5a61e1dc4094.tmp\" --variations-resource-file=\"C:\Users\Admin\AppData\Local\Temp\variations_resource\" --variations-update-path=\"C:\Users\Admin\AppData\Local\Temp\31e77fdb-28c3-4be6-bb17-5464833a6fbf.tmp\" --verbose-logging"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Users\Admin\AppData\Local\Temp\yb11E8.tmp
        "C:\Users\Admin\AppData\Local\Temp\yb11E8.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ce0ed40c-09e7-4071-8c43-68892df290e0.tmp" --brand-name=int --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --browser-present=none --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --disableyapin --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=49 --install-start-time-no-uac=575716913 --installer-brand-id=int --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=575403711 --progress-window=459332 --send-statistics --server-config-bundle-path="C:\Users\Admin\AppData\Local\Temp\f25cc27f-60f7-47aa-9f50-5a61e1dc4094.tmp" --source=lite --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\31e77fdb-28c3-4be6-bb17-5464833a6fbf.tmp" --verbose-logging
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ce0ed40c-09e7-4071-8c43-68892df290e0.tmp" --brand-name=int --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --browser-present=none --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --disableyapin --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=49 --install-start-time-no-uac=575716913 --installer-brand-id=int --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=575403711 --progress-window=459332 --send-statistics --server-config-bundle-path="C:\Users\Admin\AppData\Local\Temp\f25cc27f-60f7-47aa-9f50-5a61e1dc4094.tmp" --source=lite --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\31e77fdb-28c3-4be6-bb17-5464833a6fbf.tmp" --verbose-logging
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1192
          • C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ce0ed40c-09e7-4071-8c43-68892df290e0.tmp" --brand-name=int --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --browser-present=none --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --disableyapin --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=49 --install-start-time-no-uac=575716913 --installer-brand-id=int --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=575403711 --progress-window=459332 --send-statistics --server-config-bundle-path="C:\Users\Admin\AppData\Local\Temp\f25cc27f-60f7-47aa-9f50-5a61e1dc4094.tmp" --source=lite --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\31e77fdb-28c3-4be6-bb17-5464833a6fbf.tmp" --verbose-logging --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=620760534
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1716
            • C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\setup.exe
              C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1716 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.3.1.954 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6895cf830,0x7ff6895cf83c,0x7ff6895cf848
              6⤵
              • Executes dropped EXE
              PID:5628
            • C:\Windows\SystemTemp\sdwra_1716_1041730917\service_update.exe
              "C:\Windows\SystemTemp\sdwra_1716_1041730917\service_update.exe" --setup
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:5768
              • C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe
                "C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe" --install
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                PID:3920
            • C:\Windows\SystemTemp\scoped_dir1716_1969061258\explorer.exe
              "C:\Windows\SystemTemp\scoped_dir1716_1969061258\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex.lnk"
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2836
              • C:\Windows\SystemTemp\scoped_dir1716_1969061258\explorer.exe
                C:\Windows\SystemTemp\scoped_dir1716_1969061258\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2836 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.3.1.954 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff68af9f830,0x7ff68af9f83c,0x7ff68af9f848
                7⤵
                • Executes dropped EXE
                PID:5712
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5640
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source1716_333800676\Browser-bin\clids_yandex.xml"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4284
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yandex.com/legal/browser_agreement/?lang=en
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5140
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd8d94c188,0x7ffd8d94c194,0x7ffd8d94c1a0
        3⤵
          PID:4080
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,9794691961223561663,1504473765011089011,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
          3⤵
          • System Time Discovery
          PID:5608
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,8318199304882810900,3180908984998787998,262144 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
          3⤵
            PID:2016
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,2240363980050926668,4976489866953172505,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
            3⤵
              PID:3020
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12297816794041714955,15640288210690797973,2097152 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
              3⤵
                PID:4852
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,17950556781225969458,14396944773039487429,2097152 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
                3⤵
                  PID:4296
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,2826663469057108844,13612765579376097991,2097152 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
                  3⤵
                    PID:4164
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,5546184843806341288,16036441518961267108,2097152 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:9
                    3⤵
                      PID:1380
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,1846074822558720935,6019364784600390805,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
                      3⤵
                        PID:4832
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,9991706575108588876,15759750711881041069,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
                        3⤵
                          PID:5968
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,5301927233243015375,17704529535386996552,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
                          3⤵
                            PID:3208
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14643374771801831544,90760034569336481,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
                            3⤵
                              PID:4672
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14643374771801831544,90760034569336481,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
                              3⤵
                                PID:1920
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,9270328519063922235,17682721299088918980,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
                                3⤵
                                  PID:1672
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,1161879296129459787,11470937434116461594,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
                                  3⤵
                                    PID:5624
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,12554235747259597659,838866535038443288,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
                                    3⤵
                                      PID:2716
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,1563099461747350285,8118901654930085281,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
                                      3⤵
                                        PID:4292
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,13191063597806609403,3724839113952925650,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
                                        3⤵
                                          PID:1384
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,9569975756451131370,2446520419295307125,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
                                          3⤵
                                            PID:5536
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,8259464566051479550,9656094297121638590,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:14
                                            3⤵
                                              PID:7036
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,3337993993203554660,15835925827553299961,524288 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
                                              3⤵
                                                PID:1388
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,4139540707533661397,12065719389104819399,262144 --field-trial-handle=2532,i,5276320526421245925,14937754611938009098,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:10
                                                3⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2556
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                            1⤵
                                              PID:4684
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                              1⤵
                                                PID:4668
                                              • C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe
                                                "C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe" --run-as-service
                                                1⤵
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Drops file in Program Files directory
                                                • Drops file in Windows directory
                                                • Modifies data under HKEY_USERS
                                                • Suspicious use of WriteProcessMemory
                                                PID:4728
                                                • C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe
                                                  "C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4728 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.3.1.954 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff655160160,0x7ff65516016c,0x7ff655160178
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  PID:932
                                                • C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe
                                                  "C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe" --update-scheduler
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1264
                                                  • C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe
                                                    "C:\Program Files (x86)\Yandex\YandexBrowser\26.3.1.954\service_update.exe" --update-background-scheduler
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    PID:5728
                                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=459332 --ok-button-pressed-time=575403711 --install-start-time-no-uac=575716913
                                                1⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • Drops file in Windows directory
                                                • Enumerates system info in registry
                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:5172
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=5172 --annotation=metrics_client_id=d76e4f7954bf43f9a5e919b7a8b67700 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.3.1.954 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffd8aa75bb0,0x7ffd8aa75bbc,0x7ffd8aa75bc8
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:4796
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=2096,i,12408939856383388384,8720740032437073716,262144 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2472 /prefetch:2
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:1488
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2152,i,15226590525212102351,10673300451145935180,262144 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2624 /prefetch:6
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:3468
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2284,i,6484541682290509707,3865922422956536535,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2644 --brver=26.3.1.954 /prefetch:11
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Time Discovery
                                                  PID:3900
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2748,i,4175461372262722872,117492519691423668,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3660 --brver=26.3.1.954 /prefetch:13
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:6192
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=2936,i,16192329597273163211,9204516236467557092,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3720 --brver=26.3.1.954 /prefetch:12
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:6200
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=2948,i,4752282281394751481,1338760739428466852,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3604 --brver=26.3.1.954 /prefetch:14
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:6208
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name="Profile Importer" --metrics-shmem-handle=3504,i,4027721596052832184,14154771096121710638,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3536 --brver=26.3.1.954 /prefetch:14
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Drops file in Windows directory
                                                  PID:6216
                                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --chrome-session-import="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default" --chrome-session-import-result="C:\Windows\SystemTemp\scoped_dir6216_1928634165\yandex_imported_session_file"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Drops file in Windows directory
                                                    • Enumerates system info in registry
                                                    PID:6300
                                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                      C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783054067 --annotation=last_update_date=1783054067 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6300 --annotation=metrics_client_id=d76e4f7954bf43f9a5e919b7a8b67700 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.3.1.954 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffd8aa75bb0,0x7ffd8aa75bbc,0x7ffd8aa75bc8
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:6708
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --help-url=https://api.browser.yandex.com/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --may-use-trampoline-gpu --metrics-shmem-handle=4240,i,1317548833235435955,6639263702540804774,2097152 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4336 /prefetch:1
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Time Discovery
                                                  PID:6400
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=4856,i,6240996610297390844,14362187630412255466,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4872 --brver=26.3.1.954 /prefetch:14
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:6984
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --help-url=https://api.browser.yandex.com/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3500,i,7378831519730382824,2579422878598800677,2097152 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5148 /prefetch:1
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Time Discovery
                                                  PID:6180
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5292,i,9606019001264620492,6829141449679888079,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5276 --brver=26.3.1.954 /prefetch:14
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:6392
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name="Windows Utilities" --metrics-shmem-handle=1144,i,237683163569357807,14383643502305449478,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4628 --brver=26.3.1.954 /prefetch:14
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:6564
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name="Windows Utilities" --metrics-shmem-handle=4616,i,3076359068923065191,11685371737841545730,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=4612 --brver=26.3.1.954 /prefetch:14
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:7108
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-id=175FDE09-9000-4650-AD2C-4C12B32B2646 --brand-id=int --force-high-res-timeticks=disabled --process-name="Windows Utilities" --metrics-shmem-handle=5152,i,5486409960139892451,3900429869274327688,524288 --field-trial-handle=2476,i,13044115952275707519,237539451923656647,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=4560 --brver=26.3.1.954 /prefetch:14
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:7120
                                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                                                1⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:6148
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783054067 --annotation=last_update_date=1783054067 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6148 --annotation=metrics_client_id=d76e4f7954bf43f9a5e919b7a8b67700 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.3.1.954 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd8aa75bb0,0x7ffd8aa75bbc,0x7ffd8aa75bc8
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:4260

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Privilege Escalation

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Defense Evasion

                                                    Modify Registry

                                                    2
                                                    T1112

                                                    Subvert Trust Controls

                                                    1
                                                    T1553

                                                    Install Root Certificate

                                                    1
                                                    T1553.004

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Unsecured Credentials

                                                    1
                                                    T1552

                                                    Credentials In Files

                                                    1
                                                    T1552.001

                                                    Discovery

                                                    Browser Information Discovery

                                                    1
                                                    T1217

                                                    Query Registry

                                                    3
                                                    T1012

                                                    System Information Discovery

                                                    2
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    System Time Discovery

                                                    1
                                                    T1124

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Command and Control

                                                    Web Service

                                                    1
                                                    T1102

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                    • Size 1KB
                                                    • SHA256 93065c9fc717c9117e6b1441fb4ba417cc8963e8790e4b11dc8c64fa5ef0297a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                                    • Size 1KB
                                                    • SHA256 0ed0b0fcbf9c32361b065bfdfc6a3eb0520fbee427f85ccdefa51c507a5ed900
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                    • Size 1KB
                                                    • SHA256 71332c6e432322e1f2cb5b5efd4a6cc6723281e6e237e430f6f80981a86323a6
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864
                                                    • Size 1KB
                                                    • SHA256 12ffa76ebb8c1aa89d65802ce6b230568b3e327e8c2e138247cccfbbd523fd2e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    48B35517638A85CA46010B026C2B955A_7B1A0B83FEDB976F620CFD7925C2C915
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\48B35517638A85CA46010B026C2B955A_7B1A0B83FEDB976F620CFD7925C2C915
                                                    • Size 1KB
                                                    • SHA256 c049afd9ec861779a3885eb14f8cb75d1bf3bf0cd33faaa8ccdeb81cc1b46fcb
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                    • Size 1KB
                                                    • SHA256 f3e69f0ce2e2013ddcc5e943eba6b2743d86a7eb08e1cb72ed00d246a1181899
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                    • Size 1KB
                                                    • SHA256 884be7b6ea0e60eb0cb1f9bd38a2952de3be8bccd1148d5332f09368452586fb
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                    • Size 508B
                                                    • SHA256 a59491ddabd8a8add8b05f9f98c59f147b3cd172d5b618e679c87beec319ddad
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                                    • Size 536B
                                                    • SHA256 dc1e1d5c24e89769c73d9e78aaaab01a205dd9fbedb7e07722d695ef027feeb0
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                    • Size 536B
                                                    • SHA256 d255057f26a1dc0c0da4c2083d70f66da61872acfd44422dd8ca6962a12a6852
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864
                                                    • Size 502B
                                                    • SHA256 d64e554e62d1a4af31ada994d53035fb59826b4cc1950f4237b0a4120f5943f2
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    48B35517638A85CA46010B026C2B955A_7B1A0B83FEDB976F620CFD7925C2C915
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48B35517638A85CA46010B026C2B955A_7B1A0B83FEDB976F620CFD7925C2C915
                                                    • Size 536B
                                                    • SHA256 5dd2a4b19cbdce5258bdcf04a77c5892210cff358172bbed93e5e8d7bc38c4d6
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                    • Size 536B
                                                    • SHA256 da76508c2754159f658faa846bacfcd7fb36bd208c43d94a05e802e31c584473
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                    • Size 506B
                                                    • SHA256 811d6cfd3ea5da321cfb298a3edbd67f0cbdaab770efa5a34f6440f220df15cc
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 9ee8b00c5eccab84404f41fa5a938e6b9e2129213bd97cde6c60973bfccf9540
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 85900118c71217b605d5ac64fa104d9bdf3a2ae1825187ef3a6a9c3ea75946b8
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    temp-index
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                    • Size 3KB
                                                    • SHA256 d7fa36c090ade048d554f5c8fe5e09f88eae83897309e49cc896cd2a817b5b8a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    the-real-index~RFe59af22.TMP
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59af22.TMP
                                                    • Size 3KB
                                                    • SHA256 b557af9b7e93a11313f082289184d119de4ab26189a03a46b934c003df1a0331
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    SiteList-Enterprise.json
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                    • Size 2B
                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Edge Profile.ico
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                    • Size 70KB
                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    CURRENT
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
                                                    • Size 16B
                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Network Persistent State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                    • Size 2KB
                                                    • SHA256 8dde9ab09d68d33a100caa901d9dcbd2d4109ebbf6119e27b21f4d3a0e60592a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Sdch Dictionaries
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                    • Size 40B
                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 14KB
                                                    • SHA256 ccc22a021543045b7fba0241bfe98cfa029dda4be339062cc08c6321c6e6c8d2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 14KB
                                                    • SHA256 49a3732acd24ac1d2ba83f7451f40b713460daec26860e895e61e61f69e5fc59
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 15KB
                                                    • SHA256 7145004daa1d835cca5d598d42c46642bdce8bf5d913231e9b2bb1b67d0e2a63
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 15KB
                                                    • SHA256 0649461ab8b9cde5ac3c935d3c9bcd8fe90bd97a751d0d9d7ea140960d521d81
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                    • Size 30KB
                                                    • SHA256 ef6fd6d4e2a6c4d729b628d687f2338d5258a616bb5e457fd73d839aa74c6441
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    44643aa8-ebd3-4923-b829-6218d477fa3e.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\44643aa8-ebd3-4923-b829-6218d477fa3e.tmp
                                                    • Size 22KB
                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 35KB
                                                    • SHA256 968c0a05d8eabafd9d9664164969a42ee9e40a5c7369c47733dddb607b75d03c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 38KB
                                                    • SHA256 8b4fefafaaf68b1748a695d4c1c0033be96768910030a74b0c2cf0550d0cb399
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 44KB
                                                    • SHA256 602c01178b5c44ef484ca85868ead239f5dd6a13b9fd4991d00078e9737e30a4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 39KB
                                                    • SHA256 b6587530e3e7da12decec5ccc30f61c0eab258ecc8bff598adaff241bea91bf9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 38KB
                                                    • SHA256 5bb3ca836b1a3211cb3bb7d8f4b4dcfaeb662e0192e58d3881237c0237f79379
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 35KB
                                                    • SHA256 4ed96e8f91a49bf4ed9c020a455aeae3ec2850f7c06b4c762ff8a17696ccf901
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    metadata.json
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                    • Size 132B
                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    metadata.json
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                    • Size 252B
                                                    • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    543718d7-facc-457c-a9f0-1cd7604115d0.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\543718d7-facc-457c-a9f0-1cd7604115d0.tmp
                                                    • Size 13B
                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    BRAND_COMMON
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\BRAND_COMMON
                                                    • Size 25.4MB
                                                    • SHA256 3d6c013783a24f511680540bbd086a7050af780e38ab4c8f9a4edfb8065e4285
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    brand_int
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\brand_int
                                                    • Size 6.6MB
                                                    • SHA256 7b15772e27532206af741386ba5d998f1ff92a3dbf871a071e8debe462b72a0b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    setup.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YB_5B075.tmp\setup.exe
                                                    • Size 6.2MB
                                                    • SHA256 8c92a2b83bc68ecd2589c958fb6ae4fee0b8d5b776228c0b8676004158ea94f4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    distrib_info
                                                    • Path C:\Users\Admin\AppData\Local\Temp\distrib_info
                                                    • Size 376B
                                                    • SHA256 b033f8d6e5b4841f1b59b66249b95a4552aefd75062e31097f6d1a29aa4ede85
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    lite_installer.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                    • Size 7KB
                                                    • SHA256 b692d1f6d4dcdf6ea91d5ba816631ae4b43e2e43aa43896e2c55ccacfade4f48
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    lite_installer.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                    • Size 21KB
                                                    • SHA256 18b7524a38b229ae69edb8ec33a183e6915e4fdf218843fa1f3b60379638af15
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    lite_installer.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                    • Size 22KB
                                                    • SHA256 ea11f70c3da7063ae78a4738a0cbb07d73721446500e3106009250b34f7ad0d1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    lite_installer.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                    • Size 39KB
                                                    • SHA256 6a6dd43a503d135c3cfff2d0d05e7bd39c8c3556bdc49c363baa044fcdf0c0fa
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    lite_installer.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                    • Size 39KB
                                                    • SHA256 015c16b047ed6d9cee6361a4bedfbc2f7e13d70a53d0c45a8cfe91a6ba7d18fe
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    master_preferences
                                                    • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                                    • Size 791B
                                                    • SHA256 13566583a6b6d97234025a12a9161a5a2b70968bf7f14a992ed8388bda8e1768
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    content_new.js
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5140_1604815860\CRX_INSTALL\content_new.js
                                                    • Size 10KB
                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    install_state.json
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\install_state.json
                                                    • Size 1KB
                                                    • SHA256 b41f78dca639a94fc0cbcd9c1fc4ce6ac0bd4106a81d6cfdbaa113b3c73c3742
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    brand_config
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.3.1.954\brand_config
                                                    • Size 5KB
                                                    • SHA256 a3dfe69d0e2d2c5b9a9a515bcc5d5d3439654ff317dcede42822ada020ab3245
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    all_zip
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.3.1.954\resources\configs\all_zip
                                                    • Size 1.1MB
                                                    • SHA256 6d887aec09d6c7f9d2b03cd4459411b43ee1d4df7285e3a7e27ee6f51824b7ed
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    tablo_ES_
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.3.1.954\resources\tablo_ES_
                                                    • Size 527KB
                                                    • SHA256 e60f38def5e81c8784a6e09c61bb9577e3bba62a959d01a1a858f1ac30b61643
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    tablo_PT_
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.3.1.954\resources\tablo_PT_
                                                    • Size 523KB
                                                    • SHA256 8acb93ee7331e6b12feb81102b435c4bc044c614ef0fb8e69d2a0116bfe33d40
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sea_preview.jpg
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.3.1.954\resources\wallpapers\sea_preview.jpg
                                                    • Size 59KB
                                                    • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sea_static.jpg
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.3.1.954\resources\wallpapers\sea_static.jpg
                                                    • Size 300KB
                                                    • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data_0
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_0
                                                    • Size 44KB
                                                    • SHA256 c79849a2a5af35bdf4768df88b1ebddcf3b540cea8d26bdee0a47c71a5177a29
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_1
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_1
                                                    • Size 264KB
                                                    • SHA256 89a24eaf207ad0c95348542a0ef2820e836f12f3b680d9e354ad6fafb1bfe690
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data_2
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
                                                    • Size 8KB
                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_3
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
                                                    • Size 8KB
                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    MANIFEST-000001
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extension Rules\MANIFEST-000001
                                                    • Size 41B
                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 8KB
                                                    • SHA256 b6ee5f71369a02ce76019a39eb20db1a835b8f203c5cead37e0e69cfca96e294
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 13KB
                                                    • SHA256 1ce5475f57545db5b6214da4a1bf9961b7825b165285e1c0d9678b2f22e85105
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 15KB
                                                    • SHA256 e61ded47247f12f1a6f0ae3122baefaad1f777d163534493adcd12350e39bc11
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 15KB
                                                    • SHA256 73c3f25296ba351957a9f5b55115b2cb26fcf847e4bfb695ad5f894a738de29f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences~RFe5a5f38.TMP
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences~RFe5a5f38.TMP
                                                    • Size 5KB
                                                    • SHA256 ef89e5ce7d2069080704f566d5f46c852de7adb5b6a49e4ddcb3557fc7044470
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                                    • Size 15KB
                                                    • SHA256 883cd9e5539de91f4061f29771b6e21364fb3ea48f58d0a5441709e6fa7f8a3c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                                    • Size 15KB
                                                    • SHA256 26d98e1bf67673a6e856a7a10ef8c6f3204d4aa671e2cb4d2559c88fe0c74403
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences~RFe5a5fb5.TMP
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences~RFe5a5fb5.TMP
                                                    • Size 8KB
                                                    • SHA256 5797266f635fd00c808349d5deb2a0d479ffb876a773e69799c3d1ccf80fc325
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    turboapp_db.json
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\turboapp_db.json
                                                    • Size 52KB
                                                    • SHA256 26db4c2a062b379085a547ad1022950bc12f80c424a0afba4f89542962bfa92f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    turboapp_db.json~RFe5a6061.TMP
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\turboapp_db.json~RFe5a6061.TMP
                                                    • Size 32KB
                                                    • SHA256 6c962bf251ea41d95d5a2fb4a7aee0c1d9b8784dc906059b79b64a22465d772b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    a232e589-0750-4f0c-8c24-6eafdb020e9e.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\a232e589-0750-4f0c-8c24-6eafdb020e9e.tmp
                                                    • Size 215KB
                                                    • SHA256 dcedd80680a19ac24d6b6b5ec89c35b24251ce1bfcc197d6c1891fd5941155e9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ui
                                                    • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                                    • Size 38B
                                                    • SHA256 378ef74635447407ac2638729900c8ead41ce431abb3c17beeed2c11c9e87c9e
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    service_update.exe
                                                    • Path C:\Windows\SystemTemp\sdwra_1716_1041730917\service_update.exe
                                                    • Size 4.2MB
                                                    • SHA256 903354aafcd2ce6b159d9f666c2a35689c0a01f0570dbdc243555e968cc4da1d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yandex_browser_installer.log
                                                    • Path C:\Windows\SystemTemp\yandex_browser_installer.log
                                                    • Size 8KB
                                                    • SHA256 3daf1d01fd480e756b6209c0e9b1985c492b5c02d6012747963afee473ba0ab5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yandex_browser_service_update.log
                                                    • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                    • Size 1KB
                                                    • SHA256 dd68c352965eaabefa40e050d9d409e4d5312a4b30c08500e927f85ee7b51c05
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    yandex_browser_service_update.log
                                                    • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                    • Size 3KB
                                                    • SHA256 0c8192b3294cdc7b7b97aac7e138b6b460a80f4fb5bd2789731154f6f3b501f2
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    yandex_browser_service_update.log
                                                    • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                    • Size 6KB
                                                    • SHA256 daea16e99380db52a585d5d21198447815bfb734dec3c1e27394c6685470d007
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    memory/1488-1501-0x000002402E5D0000-0x000002402E769000-memory.dmp
                                                    Download

                                                    memory/1488-1267-0x00007FFDAEA30000-0x00007FFDAEA31000-memory.dmp
                                                    Download

                                                    memory/3468-1502-0x000001B0E6AA0000-0x000001B0E6C39000-memory.dmp
                                                    Download

                                                    memory/6400-1300-0x00007FFDAE8A0000-0x00007FFDAE8A1000-memory.dmp
                                                    Download

                                                    memory/6400-1301-0x00007FFDAF4D0000-0x00007FFDAF4D1000-memory.dmp
                                                    Download