Overview

overview

8

Static

static

3

SecuriteIn...81.exe

windows10-2004-x64

8

SecuriteIn...81.exe

windows11-ltsc_2024-x64

8

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

3

$TEMP/ChromeSetup.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    132s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 08:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Trojan.Gozi.2177.22380.17981.exe
  • Size 2.8MB
  • Sample260722-j38szsysbx
  • SHA256 32b222165a61978b9d981cbd77eee2c24d7d366021ad3abfcfcd052d7a6e8d4e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 63 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 16 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Gozi.2177.22380.17981.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Gozi.2177.22380.17981.exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5716
    • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
      C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\Windows\SystemTemp\Google3196_1397252467\bin\updater.exe
        "C:\Windows\SystemTemp\Google3196_1397252467\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7CE1A3BF-8CB5-0868-5AE3-3E79944A9662}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2320
        • C:\Windows\SystemTemp\Google3196_1397252467\bin\updater.exe
          C:\Windows\SystemTemp\Google3196_1397252467\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x133e5fc,0x133e608,0x133e614
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4608
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.182 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff1dcfba50,0x7fff1dcfba5c,0x7fff1dcfba68
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4748
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1608,i,3903105488122726589,996265655361400011,262144 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1860 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4928
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,16305432559308045283,1263847143269125273,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2196 /prefetch:11
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:5124
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,5705676329644565962,1414647733451532036,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2576 /prefetch:13
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5944
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,10619066155465463433,16910106210749116203,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3192 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5008
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,5378618366856156611,13348967110126991579,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3236 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2712
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3840,i,6774019509388790998,4948931972802363866,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4036 /prefetch:9
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3012
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3900,i,3168460688794285504,8770827224844153164,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3164 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5684
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3924,i,9279033369310364826,14474153750463024699,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4136 /prefetch:9
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:704
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,6934764357931266241,1604560319651538568,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5056 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1212
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5144,i,8317898229880143211,5674161932587332803,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5168 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5880
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,5502639953929388852,3797522941801758062,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5836 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5796
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5888,i,14294303032815266197,1815984171815605406,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5932 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:856
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5904,i,18392133520929807575,12234756982349916762,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5952 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5368
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6196,i,11361745605981076207,16148021398093035592,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6188 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2788
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6172,i,5829485680915417543,11848007637747238289,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6164 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4644
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,693429814779753276,6147707950121449281,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6500 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5068
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5792,i,3507893233651874439,13211214647552560391,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6672 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4408
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6476,i,12885046947589886583,12248884094623948299,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6288 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4912
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6916,i,3960210162725154104,15573584384169096597,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5792 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5760
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5904,i,2372990875759861687,1103694806720650641,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6476 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3608
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7036,i,2159366962734573773,6873694012963638674,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5160 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4624
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,9473609570992052215,14585965859172409245,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6872 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4680
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6984,i,3780601241933266243,7980150361474758827,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6952 /prefetch:9
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4624
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6928,i,3886257735402649349,365816690833709477,2097152 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6988 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2792
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6936,i,13230610835599278362,12226561316518886263,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=6372 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4356
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7172,i,3469297858438506190,10193993246519400081,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6068 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2024
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6908,i,7348567643257472357,1399933347582779681,524288 --field-trial-handle=1880,i,12388333041419902955,115287011297568747,262144 --variations-seed-version --pseudonymization-salt-handle=1888,i,13847679023698415337,13591235519856874878,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6136 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2052
    • C:\Users\Admin\Downloads\YandexFull.exe
      "C:\Users\Admin\Downloads\YandexFull.exe" -silent
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6824
      • C:\Users\Admin\AppData\Local\Temp\yb18A5.tmp
        "C:\Users\Admin\AppData\Local\Temp\yb18A5.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\5238be87-c899-4e60-a3c4-73f523f4631e.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=700516921 --installer-brand-id=yandex --installer-partner-id=723633 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=full --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\32f46a1b-8950-42ad-9aee-a058d714ee38.tmp" --verbose-logging --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
          PID:3848
          • C:\Users\Admin\AppData\Local\Temp\YB_CEC15.tmp\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\YB_CEC15.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_CEC15.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\5238be87-c899-4e60-a3c4-73f523f4631e.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=700516921 --installer-brand-id=yandex --installer-partner-id=723633 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=full --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\32f46a1b-8950-42ad-9aee-a058d714ee38.tmp" --verbose-logging --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
            4⤵
              PID:4896
              • C:\Users\Admin\AppData\Local\Temp\YB_CEC15.tmp\setup.exe
                "C:\Users\Admin\AppData\Local\Temp\YB_CEC15.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_CEC15.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\5238be87-c899-4e60-a3c4-73f523f4631e.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --install-start-time-no-uac=700516921 --installer-brand-id=yandex --installer-partner-id=723633 --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=full --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\32f46a1b-8950-42ad-9aee-a058d714ee38.tmp" --verbose-logging --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=703977835
                5⤵
                  PID:2404
                  • C:\Users\Admin\AppData\Local\Temp\YB_CEC15.tmp\setup.exe
                    C:\Users\Admin\AppData\Local\Temp\YB_CEC15.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2404 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.2.960 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff68a0ca218,0x7ff68a0ca224,0x7ff68a0ca230
                    6⤵
                      PID:5552
                    • C:\Windows\SystemTemp\sdwra_2404_339021856\service_update.exe
                      "C:\Windows\SystemTemp\sdwra_2404_339021856\service_update.exe" --setup
                      6⤵
                        PID:4272
                        • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe
                          "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe" --install
                          7⤵
                            PID:2192
                        • C:\Windows\SystemTemp\scoped_dir2404_1848804161\explorer.exe
                          "C:\Windows\SystemTemp\scoped_dir2404_1848804161\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
                          6⤵
                            PID:7140
                            • C:\Windows\SystemTemp\scoped_dir2404_1848804161\explorer.exe
                              C:\Windows\SystemTemp\scoped_dir2404_1848804161\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=7140 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.2.960 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6ea4ca218,0x7ff6ea4ca224,0x7ff6ea4ca230
                              7⤵
                                PID:7012
                  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update-internal
                    1⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3420
                    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:2940
                  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                    1⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3116
                    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                      2⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      PID:1244
                    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1888
                      2⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1288
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xf5e5fc,0xf5e608,0xf5e614
                        3⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        PID:5172
                    • C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\150.0.7871.182_chrome_installer_uncompressed.exe
                      "C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\150.0.7871.182_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\aba1746f-108a-48ce-b4fd-695e73ccca93.tmp"
                      2⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4264
                      • C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe
                        "C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe" --uncompressed-archive="C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\aba1746f-108a-48ce-b4fd-695e73ccca93.tmp"
                        3⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4364
                        • C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe
                          C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.182 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff778219980,0x7ff77821998c,0x7ff778219998
                          4⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          PID:1340
                        • C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe
                          "C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                          4⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of WriteProcessMemory
                          PID:2964
                          • C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe
                            C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.182 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff778219980,0x7ff77821998c,0x7ff778219998
                            5⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            PID:3048
                    • C:\Program Files\Google\Chrome\Application\150.0.7871.182\os_update_handler.exe
                      "C:\Program Files\Google\Chrome\Application\150.0.7871.182\os_update_handler.exe" --channel=stable --force-install --system-level
                      2⤵
                      • Executes dropped EXE
                      PID:468
                    • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                      "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=1988
                      2⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3360
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xf5e5fc,0xf5e608,0xf5e614
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3388
                    • C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_606594089\platform_experience_helper.exe
                      "C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_606594089\platform_experience_helper.exe" --install
                      2⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      PID:2800
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                    1⤵
                      PID:2480
                    • C:\Program Files\Google\Chrome\Application\150.0.7871.182\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\150.0.7871.182\elevation_service.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:3624
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:3964
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                        1⤵
                        • Modifies data under HKEY_USERS
                        PID:3068
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:6692
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:6728
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:6896
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:7032
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2560
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:5556
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3476
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:3868
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5380
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:360
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:6360
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:6372
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:6524
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:6496
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1588
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:4172
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Checks whether UAC is enabled
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:6688
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:5540
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Checks whether UAC is enabled
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4152
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:2648
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                        • Checks whether UAC is enabled
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4804
                        • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                          "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xf5e5fc,0xf5e608,0xf5e614
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:6796
                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                        1⤵
                          PID:2996
                          • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                            "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x294,0x2b0,0x2b4,0x290,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                            2⤵
                              PID:2164
                          • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                            "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                            1⤵
                              PID:3952
                              • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                                2⤵
                                  PID:3492
                              • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                                1⤵
                                  PID:6632
                                  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                                    2⤵
                                      PID:6616
                                  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                                    1⤵
                                      PID:4284
                                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                                        2⤵
                                          PID:1284
                                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                                        1⤵
                                          PID:6988
                                          • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                            "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0xe8,0x2c0,0x2c4,0xe4,0x2c8,0xf5e5fc,0xf5e608,0xf5e614
                                            2⤵
                                              PID:6772
                                          • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                            "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                                            1⤵
                                              PID:6304
                                              • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0xf5e5fc,0xf5e608,0xf5e614
                                                2⤵
                                                  PID:6308
                                              • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                                                1⤵
                                                  PID:7044
                                                  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xf5e5fc,0xf5e608,0xf5e614
                                                    2⤵
                                                      PID:6924
                                                  • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                    "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                                                    1⤵
                                                      PID:2948
                                                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                                                        2⤵
                                                          PID:5572
                                                      • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                        "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                                                        1⤵
                                                          PID:2392
                                                          • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                            "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xf5e5fc,0xf5e608,0xf5e614
                                                            2⤵
                                                              PID:6204
                                                          • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                            "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
                                                            1⤵
                                                              PID:6260
                                                              • C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
                                                                "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xf5e5fc,0xf5e608,0xf5e614
                                                                2⤵
                                                                  PID:5764
                                                              • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe
                                                                "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe" --run-as-service
                                                                1⤵
                                                                  PID:6736
                                                                  • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe
                                                                    "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6736 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.2.960 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6c8043a98,0x7ff6c8043aa4,0x7ff6c8043ab0
                                                                    2⤵
                                                                      PID:4368
                                                                    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe
                                                                      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe" --update-scheduler
                                                                      2⤵
                                                                        PID:4672
                                                                        • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe
                                                                          "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.2.960\service_update.exe" --update-background-scheduler
                                                                          3⤵
                                                                            PID:4828

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Reconnaissance

                                                                            Resource Development

                                                                            Initial Access

                                                                            Execution

                                                                            Persistence

                                                                            Boot or Logon Autostart Execution

                                                                            1
                                                                            T1547

                                                                            Active Setup

                                                                            1
                                                                            T1547.014

                                                                            Event Triggered Execution

                                                                            1
                                                                            T1546

                                                                            Component Object Model Hijacking

                                                                            1
                                                                            T1546.015

                                                                            Privilege Escalation

                                                                            Boot or Logon Autostart Execution

                                                                            1
                                                                            T1547

                                                                            Active Setup

                                                                            1
                                                                            T1547.014

                                                                            Event Triggered Execution

                                                                            1
                                                                            T1546

                                                                            Component Object Model Hijacking

                                                                            1
                                                                            T1546.015

                                                                            Defense Evasion

                                                                            Modify Registry

                                                                            1
                                                                            T1112

                                                                            Credential Access

                                                                            Credentials from Password Stores

                                                                            1
                                                                            T1555

                                                                            Credentials from Web Browsers

                                                                            1
                                                                            T1555.003

                                                                            Unsecured Credentials

                                                                            1
                                                                            T1552

                                                                            Credentials In Files

                                                                            1
                                                                            T1552.001

                                                                            Discovery

                                                                            Browser Information Discovery

                                                                            1
                                                                            T1217

                                                                            Query Registry

                                                                            4
                                                                            T1012

                                                                            System Information Discovery

                                                                            4
                                                                            T1082

                                                                            System Location Discovery

                                                                            1
                                                                            T1614

                                                                            System Language Discovery

                                                                            1
                                                                            T1614.001

                                                                            System Network Configuration Discovery

                                                                            1
                                                                            T1016

                                                                            Internet Connection Discovery

                                                                            1
                                                                            T1016.001

                                                                            System Time Discovery

                                                                            1
                                                                            T1124

                                                                            Lateral Movement

                                                                            Collection

                                                                            Data from Local System

                                                                            1
                                                                            T1005

                                                                            Command and Control

                                                                            Exfiltration

                                                                            Impact

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            settings.dat
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad\settings.dat
                                                                            • Size 40B
                                                                            • SHA256 6286478c3926c07db162dc55ac2a1a5427f111bde8376d4bbf432d9e77d652c1
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
                                                                            • Size 248B
                                                                            • SHA256 c28104156ccabe1ec4d8ed525e34a7c1a03577eb1021d3f9ac3fdcccda08fb86
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\metadata.json
                                                                            • Size 130B
                                                                            • SHA256 9b61ec0d20b5b48e941032252c14f8ca9bd7f5665bec8dd81082fe92d3dae148
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 421B
                                                                            • SHA256 9c1ed48b68d10a8c39189d53fb9635b9660b36ef76bbd38be7b60ac752b2ecae
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 827B
                                                                            • SHA256 9dca7cc11eba4717ec6959c07a0a3ba0558064b36d12abd35170010ed41b0328
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 779B
                                                                            • SHA256 63bdd453b4b0a48ff184a9065850d462e796858a56cc184a99b974c17b164375
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 827B
                                                                            • SHA256 5fe86095e8426a7745c801bc024f9fdafd2be6644b0b5d88ae6b9a9c68c23398
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 559B
                                                                            • SHA256 fbbbdb13ad93f3590f79da735c6551a4f66008b15ab0b227e06cbcd052c2f8a8
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 58ca04bd8efb0023a4008d950c02ab70941226181955247e07e01f47e76a1eab
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 827B
                                                                            • SHA256 c15d35a34cc41ad67be89999648ca3c9f8b73a330fd0ca17ef79374ff6f6d2b2
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 827B
                                                                            • SHA256 f19f569ec9121728cc7c6f37917d0e62181e16e65e2814954b007589946ef26e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 5350e9b1a9b7f2ff9fa14f6f42b3815de63c86ef2bec1390f2a1601546d47a04
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 827B
                                                                            • SHA256 7ee803d4c1972e385fb0b58eb31763781c3834de36be9652381e3e2a4e7b7684
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 292882b3079593303134ada5608e8d97c39968c9ea979bcf89f8ad727a06104f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 22800ce1e0cb1fe4406731c521f1c1f3e901cf94f27004330eb262a94f8ebb8a
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 f17e052810f811b5c998ed0af7732c948f926525de7a999f0e180af8ca3fec4c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 525B
                                                                            • SHA256 a0e0fdd67854e0e29f6a0de962e5e6140646b9fc242bb54ec29a377f3495a7e6
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 827B
                                                                            • SHA256 ab483f5e536c9bee43c04f14e20b4a7f0ce1fa103e2f7b3c795dec832d992014
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 59e2da5a575269d540338e351d42fa5b8ca5809814cb063a4bdee9c8d32d8db5
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 ce21821b0921a717c6c2cf6492e7adb240b8133d10f6f917ffb09c84d94f1ea7
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 420B
                                                                            • SHA256 41252ff467477dd298dd1b2305b5753b4a979f499f7f086156fa4787ad93e1da
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 05f07d039d8d749df68e8470f567dbf7084ac5c92210d283f39472d7a4a5e487
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 64d658e2071615b98035beb4e36d590b915d85f291c041af360fcc01aa36fedb
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 dc0a7029b6e07bd9798f91bd48c0395d1cc898b2775110f296d69ee2f342f9ac
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 d1e8e63917c3ea2cc3b3da656b9c3ad1572bfd94552442ae370809f296c31b15
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 827B
                                                                            • SHA256 89edea6ee2e13cbbc70081d98e527b8d823a77e4bfdbf6389f3eefd1e59f1f78
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 535233fb5267f964c3fad2b5fb2f8678beac6919fbd56414510aaddef4847a58
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 827B
                                                                            • SHA256 26c84570b6ae9c5033356a1dcc6b9c8c52bacf031f0a2153581729d1ec60be91
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 dbbce0055e01cc430fff20ca1faacfedb3330a67c084c25b13b7f928a2d88897
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            prefs.json
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
                                                                            • Size 828B
                                                                            • SHA256 995899e282308d6d68d9fe3bb47cabf4deb0146c4e2c15a7a1172e73d3d7ecff
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            updater.log
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                                                            • Size 28KB
                                                                            • SHA256 db39ef05543ad212d6daa2370ee73ad53797fad622278ec8658814a6d172bc00
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater.log
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                                                            • Size 29KB
                                                                            • SHA256 382fe2e0f9acaf8854ad6c75a0b403eb2212fec89249a5f0264b12bc71b38754
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater.log
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                                                            • Size 32KB
                                                                            • SHA256 9b40167476427f304ab686a7f03619d8161a01959e217278e71013fe7f43d3c8
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater.log
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                                                            • Size 38KB
                                                                            • SHA256 eb16b52416d88f02f5f8880724f60cdad37a7f7fd92ea3567572e0c03c810618
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater.log
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                                                            • Size 40KB
                                                                            • SHA256 fb2b639b125c6c31aaf406ee4b6f75f982e4f51563b9005ac32cc89274166ccb
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater.log
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                                                            • Size 458KB
                                                                            • SHA256 3a4e441cd59e520aef8a5bc6d115b24354f173f43a00c36c3f83fb66f0dd2a36
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater.log
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
                                                                            • Size 460KB
                                                                            • SHA256 7d6181b08e5ad3f85e24a43446df0a1f115766d959977d3ebd288b305ff79133
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater_history.jsonl
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                                                            • Size 1KB
                                                                            • SHA256 00ab3c7c44d8d032226a3523030615448b77f2ed73b7cceceed46ad701a7db56
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            updater_history.jsonl
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                                                            • Size 2KB
                                                                            • SHA256 73ded381646857bbca4caa931b672bfebc8a9040d9d950267bc8711e1a7cd16e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            updater_history.jsonl
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                                                            • Size 3KB
                                                                            • SHA256 9f4894ae05aaab8b8f1197567cb7ae4d44cdc55d54c1aaf3f1d1f8c1fd6dead4
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            updater_history.jsonl
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                                                            • Size 4KB
                                                                            • SHA256 9526e82f46ec2d8d356bd9be5b58aed58b796e0f7e81da352951317d1f88c0ae
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater_history.jsonl
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                                                            • Size 546KB
                                                                            • SHA256 d5d3fc2bf3627b5e3773df24531976a79ce8e2f8f1ab030fe2b33ee5a764c173
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            updater_history.jsonl
                                                                            • Path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
                                                                            • Size 547KB
                                                                            • SHA256 c5d7f4a3f9980aa0243214d14a29abb60ec73db1745ce5c8a84db67ff8b62ae3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            D3DCompiler_47.dll
                                                                            • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\D3DCompiler_47.dll
                                                                            • Size 4.5MB
                                                                            • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            chrome_100_percent.pak
                                                                            • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\chrome_100_percent.pak
                                                                            • Size 1.0MB
                                                                            • SHA256 7eb0ef02ebafb7801142b7e98d60ee30afa20cf3c1b5ef0ca005f71f2b2e94d5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            chrome_200_percent.pak
                                                                            • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\chrome_200_percent.pak
                                                                            • Size 2.1MB
                                                                            • SHA256 28ae89830f39125bcc2df11f8a20e3f0d1d2e589bc30bb2cd41cd0000c1d14bf
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            chrome_elf.dll
                                                                            • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\chrome_elf.dll
                                                                            • Size 2.6MB
                                                                            • SHA256 761413a9efa7aaffb6d8fdfa8c2088b111af637f292a213317c2e7dab4c34a6e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            icudtl.dat
                                                                            • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\icudtl.dat
                                                                            • Size 10.4MB
                                                                            • SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            en-US.pak
                                                                            • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\locales\en-US.pak
                                                                            • Size 509KB
                                                                            • SHA256 10ddb6c3bc2c191f371120bc67a4e54e5bfe9fa62b48028306fbada83b2029d8
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            resources.pak
                                                                            • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\resources.pak
                                                                            • Size 16.7MB
                                                                            • SHA256 dd13eddcbc6e5ffb51826cd588f86f395c9247d75b16bbaea575617a163f128a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            v8_context_snapshot.bin
                                                                            • Path C:\Program Files\Google\Chrome\Application\150.0.7871.182\v8_context_snapshot.bin
                                                                            • Size 722KB
                                                                            • SHA256 c0ff4064b06dd098b3cad8df083fba40607855df7b8af5263c603ecad614e2cd
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            chrome.exe
                                                                            • Path C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            • Size 3.8MB
                                                                            • SHA256 4fb07e3572e6f750c24f3ed49594ec0d6321c489500482b22666acb414b8b722
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            am_MASCULINE.pak
                                                                            • Path C:\Program Files\Google\Chrome\Temp\source4364_1873970931\Chrome-bin\150.0.7871.182\Locales\am_MASCULINE.pak
                                                                            • Size 18B
                                                                            • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            BookmarkMergedSurfaceOrdering
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                            • Size 6B
                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 05428b211349d957ccec56edfb610be5e18ec2c4c61907a2663328dff4f8d9e7
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            messages.json
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                            • Size 593B
                                                                            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            craw_background.js
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                            • Size 531KB
                                                                            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            CURRENT
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                            • Size 16B
                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            MANIFEST-000001
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
                                                                            • Size 41B
                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            SCT Auditing Pending Reports
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                            • Size 2B
                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 12KB
                                                                            • SHA256 759e6863cb7c3fe244c391f086a4d9e0efc468a4d8147febe16252fadc5d25cb
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Secure Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                            • Size 17KB
                                                                            • SHA256 331c3cc02eeedd3d4ffda4d567017a5eab0529ab88678b8993809a3399be2de5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                            • Size 48B
                                                                            • SHA256 7a50811d7d7181990afb01756091d3e1fbd3635dab23892d03654a0e9c7d8581
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 c0391077470d15b1a2122d1228f9e28e04cd41191ca5651290e75844ba8dadf4
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            data_0
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                            • Size 8KB
                                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                            Submit Download

                                                                            data_1
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                            • Size 264KB
                                                                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                            Submit Download

                                                                            data_2
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                            • Size 8KB
                                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                            Submit Download

                                                                            data_3
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                            • Size 8KB
                                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                            Submit Download

                                                                            192.png
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1432_1329832456\Trusted Icons\Icons\192.png
                                                                            • Size 5KB
                                                                            • SHA256 1ad1a4f19ee8e5e3789ba4fd6c97c619f74bc8a1a45ab5eb8f48b58f9f3ac3ee
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            192.png
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1432_931677870\Trusted Icons\Icons\192.png
                                                                            • Size 1KB
                                                                            • SHA256 9b63a81a19ac89d558a8cd7ebbe9d76acccaa2dcb28da6c71efdb7795dd968bc
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            trusted_vault.pb
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
                                                                            • Size 84B
                                                                            • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 4KB
                                                                            • SHA256 b36753a35916d2643adaccbc60311711066c6b01489a6846c2eccf8bcb93c1ea
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 69KB
                                                                            • SHA256 a094de98cf848f07f14ce1f6ae3400be879f98894ddabaed393b924ae9e5db5d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 69KB
                                                                            • SHA256 307254dd14a4de22e7dc541d7d1ee1fb5217ce429bea379a6e67264a95657004
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ChromeSetup.exe
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                                                                            • Size 10.3MB
                                                                            • SHA256 9c0acb85737434d8d32093f3fe759e918ed1568170c7997e5716636f29ac0faf
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            lite_installer.log
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                                            • Size 1KB
                                                                            • SHA256 ad99e2a6f1b14884e26e6c7bece13f73c0a5ab3e861ea154278c0630d771257e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            lite_installer.log
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                                            • Size 4KB
                                                                            • SHA256 943054b8a51cd7059b9f285d01bc2199742a78b8df7c51089386913972e2d0ec
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            master_preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                                                            • Size 542B
                                                                            • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            messages.json
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1432_1627604521\CRX_INSTALL\_locales\en\messages.json
                                                                            • Size 450B
                                                                            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            brand_config
                                                                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.2.960\brand_config
                                                                            • Size 6KB
                                                                            • SHA256 5a5ce3d78b63342ed92aaa55a642247bff8a270b3f207c18a7bb355d8247396b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            partner_config
                                                                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.2.960\partner_config
                                                                            • Size 208B
                                                                            • SHA256 c570726cf24ed488c1990849d9a7a3a6ca9b68cbf8395e0900e664ced7c4bfb4
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            all_zip
                                                                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.2.960\resources\configs\all_zip
                                                                            • Size 1.4MB
                                                                            • SHA256 63beea67e56d13a961cdb616ea42b3807de3f149c980ae3badb71e13318ae3d9
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            light_static.jpg
                                                                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.2.960\resources\wallpapers\light.title\light_static.jpg
                                                                            • Size 674KB
                                                                            • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            sea_preview.jpg
                                                                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.2.960\resources\wallpapers\sea_preview.jpg
                                                                            • Size 59KB
                                                                            • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            sea_static.jpg
                                                                            • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.2.960\resources\wallpapers\sea_static.jpg
                                                                            • Size 300KB
                                                                            • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            ui
                                                                            • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                                                            • Size 38B
                                                                            • SHA256 ba093b435e103716134690c014229037bc70f24b8a306d404c443990c0591dae
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            settings.dat
                                                                            • Path C:\Windows\SystemTemp\Crashpad\settings.dat
                                                                            • Size 40B
                                                                            • SHA256 57162cf625ae86a9833556a246551d05d5c43dc93cdf2eeac65b34edc711758d
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            uninstall.cmd
                                                                            • Path C:\Windows\SystemTemp\Google3196_1397252467\bin\uninstall.cmd
                                                                            • Size 653B
                                                                            • SHA256 099592ffa867124d16c0c6d868af1214fd2b7180fa76e4eee01abf2a5cf8f044
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            updater.exe
                                                                            • Path C:\Windows\SystemTemp\Google3196_1397252467\bin\updater.exe
                                                                            • Size 5.8MB
                                                                            • SHA256 810e9879fdb18d0a5d68cd455b7187c62eb44fe585346a34f17b8802ad065482
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            chrome_installer.log
                                                                            • Path C:\Windows\SystemTemp\chrome_installer.log
                                                                            • Size 31KB
                                                                            • SHA256 1ecb43fe34b5a3e3aa99d8ac99d64b124b9b2409ffcd00a030c9d9341cafc750
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            setup.exe
                                                                            • Path C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\CR_0FE2D.tmp\setup.exe
                                                                            • Size 7.3MB
                                                                            • SHA256 864b0e1dd281e4503bf4dcdf084d7269dbd8173c3fcbc1f2b38261ab990f1698
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            aba1746f-108a-48ce-b4fd-695e73ccca93.tmp
                                                                            • Path C:\Windows\SystemTemp\updater_chrome_Unpacker_BeginUnzipping3116_1728724680\aba1746f-108a-48ce-b4fd-695e73ccca93.tmp
                                                                            • Size 393KB
                                                                            • SHA256 233fdb8a65c0bcdc4015e2674d679aec5da7d059391fdaf9ffb4dc995cd9baa5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            yandex_browser_service_update.log
                                                                            • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                                            • Size 4KB
                                                                            • SHA256 389c9260d402fc9de78b4355cd6e9525e187aee9292e7892681a3a5085e9af5a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download