Overview

overview

8

Static

static

3

KLSetup v1.39.exe

windows10-2004-x64

8

KLSetup v1.39.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    901s
  • max time network
    911s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 17:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    KLSetup v1.39.exe
  • Size 116.5MB
  • Sample261020-vpd71asycw
  • SHA256 045e9da3fc49792cb481b61e1fa4a087f7c6643944d24902fe34d7e448d2d3fc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 9 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 28 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:572
    • C:\Users\Admin\AppData\Local\Temp\KLSetup v1.39.exe
      "C:\Users\Admin\AppData\Local\Temp\KLSetup v1.39.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:236
      • C:\Users\Admin\AppData\Local\Temp\is-VGI3F.tmp\KLSetup v1.39.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-VGI3F.tmp\KLSetup v1.39.tmp" /SL5="$70232,120878541,930304,C:\Users\Admin\AppData\Local\Temp\KLSetup v1.39.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\bdc903c3e1b51c340893d73b9003b605.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\bdc903c3e1b51c340893d73b9003b605.exe" x "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\37238b4481b3c82f48f270f306a37a7d.7z" -o"C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\KLauncherSetup" -p"Klmpq7rstv3" -y
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3968
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\KLauncherSetup\klaunchersetup.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\KLauncherSetup\klaunchersetup.exe" /S /currentuser --no-desktop-shortcut --vid=224 --D="C:\Users\Admin\AppData\Local\Programs\KLauncher"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq KLauncher.exe" /FO csv | "C:\Windows\system32\find.exe" "KLauncher.exe"
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2684
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq KLauncher.exe" /FO csv
              6⤵
              • Discovers running processes
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:628
            • C:\Windows\SysWOW64\find.exe
              "C:\Windows\system32\find.exe" "KLauncher.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2448
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\bdc903c3e1b51c340893d73b9003b605.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\bdc903c3e1b51c340893d73b9003b605.exe" x "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\63a92f9856066fd88b49019e617938a1.zip" -o"C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp" -p"Klauncher2026Vwx" -y
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3524
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\dly.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\dly.exe" --partner 418804 --distr /quiet /msicl "YABROWSER=y YAQSEARCH=y YAHOMEPAGE=y VID=224"
          4⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
            "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YABROWSER=y YAQSEARCH=y YAHOMEPAGE=y VID=224"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3424
          • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\dly.exe
            C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\dly.exe --stat dwnldr/p=418804/cnt=0/dt=2/ct=2/rt=0 --dh 2500 --st 1792516569
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:5520
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe" "C:\Users\Admin\AppData\Local\Programs\KLauncher\Мир Танков.lnk" 5386
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2592
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe" "C:\Users\Admin\AppData\Local\Programs\KLauncher\Мир Кораблей.lnk" 5386
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3428
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe" "C:\Users\Admin\AppData\Local\Programs\KLauncher\ВарТандер.lnk" 5386
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2768
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe" "C:\Users\Admin\AppData\Local\Programs\KLauncher\Яндекс.Игры.lnk" 5386
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4380
        • C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe
          "C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe" "C:\Users\Admin\AppData\Local\Programs\KLauncher\Warface.lnk" 5386
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3372
        • C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe
          "C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe" --vid=224
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "chcp"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4088
            • C:\Windows\system32\chcp.com
              chcp
              6⤵
                PID:256
            • C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe
              "C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\KLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2068,i,6506463785670927589,6322004727495293782,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:6096
            • C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe
              "C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\KLauncher" --field-trial-handle=2304,i,6506463785670927589,6322004727495293782,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              PID:1532
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:6736
              • C:\Windows\system32\reg.exe
                reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
                6⤵
                • Checks processor information in registry
                PID:7008
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:7160
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4852
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:872
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:6328
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:6316
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:6168
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:6284
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:6288
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:6268
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:6252
            • C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe
              "C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\KLauncher" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2464,i,6506463785670927589,6322004727495293782,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:10
              5⤵
                PID:6492
        • C:\Users\Admin\AppData\Local\Temp\{1639BC12-4836-4B04-BF9B-4F1EEB386F26}.exe
          "C:\Users\Admin\AppData\Local\Temp\{1639BC12-4836-4B04-BF9B-4F1EEB386F26}.exe" --job-name=yBrowserDownloader-{C45FB5D6-C65C-4420-9B72-EF0710928042} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{1639BC12-4836-4B04-BF9B-4F1EEB386F26}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=6035461-224&ui={428aee77-285d-4fa9-afed-f4023f58dfc6} --use-user-default-locale
          2⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4120
          • C:\Users\Admin\AppData\Local\Temp\ybAD6.tmp
            "C:\Users\Admin\AppData\Local\Temp\ybAD6.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\40553008-5d56-417c-975c-71a5a595ed3c.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=958567899 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{C45FB5D6-C65C-4420-9B72-EF0710928042} --local-path="C:\Users\Admin\AppData\Local\Temp\{1639BC12-4836-4B04-BF9B-4F1EEB386F26}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=6035461-224&ui={428aee77-285d-4fa9-afed-f4023f58dfc6} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\e5af4898-e7c7-4466-89fa-3f2fa2ea992d.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4876
            • C:\Users\Admin\AppData\Local\Temp\YB_326C5.tmp\setup.exe
              "C:\Users\Admin\AppData\Local\Temp\YB_326C5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_326C5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\40553008-5d56-417c-975c-71a5a595ed3c.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=958567899 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{C45FB5D6-C65C-4420-9B72-EF0710928042} --local-path="C:\Users\Admin\AppData\Local\Temp\{1639BC12-4836-4B04-BF9B-4F1EEB386F26}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=6035461-224&ui={428aee77-285d-4fa9-afed-f4023f58dfc6} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\e5af4898-e7c7-4466-89fa-3f2fa2ea992d.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:6984
              • C:\Users\Admin\AppData\Local\Temp\YB_326C5.tmp\setup.exe
                "C:\Users\Admin\AppData\Local\Temp\YB_326C5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_326C5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\40553008-5d56-417c-975c-71a5a595ed3c.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=958567899 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{C45FB5D6-C65C-4420-9B72-EF0710928042} --local-path="C:\Users\Admin\AppData\Local\Temp\{1639BC12-4836-4B04-BF9B-4F1EEB386F26}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=6035461-224&ui={428aee77-285d-4fa9-afed-f4023f58dfc6} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\e5af4898-e7c7-4466-89fa-3f2fa2ea992d.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=991443610
                5⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Reads the TCP/IP host and domain name from the registry
                • System Time Discovery
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:6308
                • C:\Users\Admin\AppData\Local\Temp\YB_326C5.tmp\setup.exe
                  C:\Users\Admin\AppData\Local\Temp\YB_326C5.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6308 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.10.0.1796 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7ff9c1ed8,0x7ff7ff9c1ee8,0x7ff7ff9c1ef8
                  6⤵
                  • Executes dropped EXE
                  PID:6608
                • C:\Windows\SystemTemp\sdwra_6308_1657287647\service_update.exe
                  "C:\Windows\SystemTemp\sdwra_6308_1657287647\service_update.exe" --setup
                  6⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:1520
                  • C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe
                    "C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe" --install
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:4888
                • C:\Windows\SystemTemp\scoped_dir6308_93121305\explorer.exe
                  "C:\Windows\SystemTemp\scoped_dir6308_93121305\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Алиса AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:6660
                  • C:\Windows\SystemTemp\scoped_dir6308_93121305\explorer.exe
                    C:\Windows\SystemTemp\scoped_dir6308_93121305\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6660 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.10.0.1796 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff73ef81ed8,0x7ff73ef81ee8,0x7ff73ef81ef8
                    7⤵
                    • Executes dropped EXE
                    PID:1972
                • C:\Windows\SystemTemp\scoped_dir6308_1559499030\explorer.exe
                  "C:\Windows\SystemTemp\scoped_dir6308_1559499030\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
                  6⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:4756
                  • C:\Windows\SystemTemp\scoped_dir6308_1559499030\explorer.exe
                    C:\Windows\SystemTemp\scoped_dir6308_1559499030\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4756 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.10.0.1796 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff753cf1ed8,0x7ff753cf1ee8,0x7ff753cf1ef8
                    7⤵
                    • Executes dropped EXE
                    PID:5612
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1936
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source6308_1526748785\Browser-bin\clids_yandex_second.xml"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:7164
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=958567899
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:6552
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=6552 --annotation=metrics_client_id=4775183b9c8c407d9422baac9397d0b2 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.10.0.1796 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7ffefe4bf380,0x7ffefe4bf390,0x7ffefe4bf3a0
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6276
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2316,i,3588602696754996915,1782009085997679215,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2540 --brver=26.10.0.1796 /prefetch:11
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Time Discovery
            PID:4184
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2088,i,9523496189134152109,5604782589253543074,262144 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2520 /prefetch:6
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3456
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --gpu-process-kind=sandboxed --metrics-shmem-handle=2012,i,1666866068275489401,6046912806546525436,262144 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2424 /prefetch:2
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4664
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=3080,i,8249977632245806031,3919671534407692379,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3092 --brver=26.10.0.1796 /prefetch:13
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6676
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3576,i,2878502469377405496,4339276491212711399,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3592 --brver=26.10.0.1796 /prefetch:12
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6864
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3652,i,8645471724007135750,11370267487489958097,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4124 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:7016
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --may-use-trampoline-gpu --metrics-shmem-handle=4344,i,14703527880164572382,9049243180609425441,2097152 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4372 /prefetch:1
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:4544
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4976,i,853039018593129890,1049547380054732224,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5004 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2404
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=user_data_importer.mojom.BookmarkHtmlParser --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Сервис синтаксического анализа файлов закладок" --metrics-shmem-handle=4980,i,15659903415313157074,5325001470113953604,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5028 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2280
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5628,i,8429276359490757314,18356636892639597341,2097152 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5640 /prefetch:1
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:1228
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5824,i,2784129399682007260,11386740045552697179,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5888 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:892
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=6060,i,11804884761713125306,9410323682026434541,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6072 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4012
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=6080,i,330134960230168266,11375104831911909413,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6204 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5896
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=6212,i,5595700136933625114,4117085793363377605,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6344 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3160
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=3152,i,9981865869393026869,1066143324094644094,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6504 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5792
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6056,i,15419257830043359446,2941673034544576229,2097152 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6324 /prefetch:1
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:1960
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6452,i,4984339518215645272,12274677211976595074,2097152 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=4372 /prefetch:1
            3⤵
            • Executes dropped EXE
            • System Time Discovery
            PID:4148
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6400,i,1257603324450352749,9463181291105738066,2097152 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6384 /prefetch:1
            3⤵
            • Executes dropped EXE
            • System Time Discovery
            PID:2516
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7264,i,3589342667983866715,11095644854953394102,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7248 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            PID:2848
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7232,i,89077277582380084,16759922536408474241,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7380 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            PID:3440
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7388,i,13044662521171053634,9832065803696475894,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7520 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            PID:4832
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7652,i,5558849203338484771,325437375769233089,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7528 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            PID:1200
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7256,i,3924418034668029649,16145711793725827213,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7792 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            PID:3500
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7932,i,26231744130827997,11441831188473826793,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7944 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            PID:4828
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7952,i,3849132718599819960,10096111813862302340,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8084 --brver=26.10.0.1796 /prefetch:14
            3⤵
            • Executes dropped EXE
            PID:2656
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8104,i,14078866012920013302,17881355973831692332,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8240 --brver=26.10.0.1796 /prefetch:14
            3⤵
              PID:4588
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8228,i,4006431901683016514,2731786309485115997,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8260 --brver=26.10.0.1796 /prefetch:14
              3⤵
                PID:1836
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8508,i,1538423242122102443,14778356846187255663,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8528 --brver=26.10.0.1796 /prefetch:14
                3⤵
                  PID:6432
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8724,i,1018729883996257540,3043749658042741364,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8736 --brver=26.10.0.1796 /prefetch:14
                  3⤵
                    PID:2852
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8672,i,14978604682380749295,11352340768554634184,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8884 --brver=26.10.0.1796 /prefetch:14
                    3⤵
                      PID:1536
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8688,i,2940816284224311905,13221457165041530578,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8892 --brver=26.10.0.1796 /prefetch:14
                      3⤵
                        PID:6196
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9020,i,16415980175344661242,17777268196805177200,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9152 --brver=26.10.0.1796 /prefetch:14
                        3⤵
                          PID:4464
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8704,i,15711829072649966869,10526146514245548943,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9308 --brver=26.10.0.1796 /prefetch:14
                          3⤵
                            PID:6376
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9316,i,16936678189636413015,752544222750941995,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9448 --brver=26.10.0.1796 /prefetch:14
                            3⤵
                              PID:1344
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8744,i,5062185611337129735,1382913659309827504,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9572 --brver=26.10.0.1796 /prefetch:14
                              3⤵
                                PID:4340
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9580,i,13928252798391433570,13584863822258141550,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9712 --brver=26.10.0.1796 /prefetch:14
                                3⤵
                                  PID:1452
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9916,i,6972015729283815696,4905178227963303672,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9928 --brver=26.10.0.1796 /prefetch:14
                                  3⤵
                                    PID:1280
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9852,i,14419697286810807516,10448992684645877234,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10064 --brver=26.10.0.1796 /prefetch:14
                                    3⤵
                                      PID:6304
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9868,i,8417470117642835919,1964731439057982351,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=9844 --brver=26.10.0.1796 /prefetch:14
                                      3⤵
                                        PID:6312
                                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10072,i,14659107772514633958,185394514064714404,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10320 --brver=26.10.0.1796 /prefetch:14
                                        3⤵
                                          PID:3340
                                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10328,i,7375977176255560116,1074412226497226582,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10460 --brver=26.10.0.1796 /prefetch:14
                                          3⤵
                                            PID:6296
                                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9884,i,10400787000763355921,3541435871302270914,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=10596 --brver=26.10.0.1796 /prefetch:14
                                            3⤵
                                              PID:620
                                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9900,i,15915461002714145535,18352316442950505852,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=10728 --brver=26.10.0.1796 /prefetch:14
                                              3⤵
                                                PID:1120
                                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9908,i,77621377139041384,15739568847257032213,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=10864 --brver=26.10.0.1796 /prefetch:14
                                                3⤵
                                                  PID:5540
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11088,i,14542162996786759695,14969606766674996477,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=11100 --brver=26.10.0.1796 /prefetch:14
                                                  3⤵
                                                    PID:5212
                                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11084,i,9236608032090562064,15541181908037760778,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11236 --brver=26.10.0.1796 /prefetch:14
                                                    3⤵
                                                      PID:6260
                                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11068,i,5135943042190543939,8939405325603192526,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=11372 --brver=26.10.0.1796 /prefetch:14
                                                      3⤵
                                                        PID:6108
                                                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11076,i,7217525099771163908,3524051921562054065,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=11508 --brver=26.10.0.1796 /prefetch:14
                                                        3⤵
                                                          PID:6328
                                                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=428aee77-285d-4fa9-afed-f4023f58dfc6 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=6436,i,15201050121708177851,9864599908131193020,524288 --field-trial-handle=2428,i,14323996958957824728,3915724922861411746,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge --variations-seed-version --pseudonymization-salt-handle=2488,i,17601145100938505136,7116108331793768916,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=11644 --brver=26.10.0.1796 /prefetch:14
                                                          3⤵
                                                            PID:3164
                                                        • C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe
                                                          "C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe"
                                                          2⤵
                                                          • Reads the TCP/IP host and domain name from the registry
                                                          PID:7128
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /d /s /c "chcp"
                                                            3⤵
                                                            • Executes a command shell one-liner
                                                            PID:1144
                                                            • C:\Windows\system32\chcp.com
                                                              chcp
                                                              4⤵
                                                                PID:4988
                                                            • C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\KLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1688,i,14845937054777361511,15194534313731854970,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:2
                                                              3⤵
                                                                PID:6216
                                                              • C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\KLauncher\KLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\KLauncher" --field-trial-handle=1896,i,14845937054777361511,15194534313731854970,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:11
                                                                3⤵
                                                                  PID:5236
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.klauncher.gg/tanks
                                                                2⤵
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies registry class
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:4836
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff0179c188,0x7fff0179c194,0x7fff0179c1a0
                                                                  3⤵
                                                                    PID:4268
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,11892323603175748350,14704010223924071207,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
                                                                    3⤵
                                                                    • System Time Discovery
                                                                    PID:2248
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,7744053510234560409,15181051102755670030,262144 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
                                                                    3⤵
                                                                      PID:1276
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2748,i,7955242645447643575,8708565764735798147,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
                                                                      3⤵
                                                                        PID:576
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3680,i,8593498266866443947,4224369557143509400,2097152 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:1
                                                                        3⤵
                                                                          PID:3168
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3696,i,3580797646791910041,14091505674608441318,2097152 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
                                                                          3⤵
                                                                            PID:2448
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4424,i,3184399712946678130,17708069278386164963,2097152 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
                                                                            3⤵
                                                                              PID:3272
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4412,i,3988579570214919872,16747734236433960557,2097152 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
                                                                              3⤵
                                                                                PID:1688
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,8007282347193327927,12255752707591934326,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
                                                                                3⤵
                                                                                  PID:6900
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,1446101035349996484,18265799447457776374,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
                                                                                  3⤵
                                                                                    PID:3300
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4052,i,10740918291860062132,8797152275134145551,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
                                                                                    3⤵
                                                                                      PID:1088
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,4761402415697499268,3110086331936198650,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
                                                                                      3⤵
                                                                                        PID:3412
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,4761402415697499268,3110086331936198650,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
                                                                                        3⤵
                                                                                          PID:972
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,10159950103280936364,2584369587151217333,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
                                                                                          3⤵
                                                                                            PID:4436
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6054182744678907024,12040131547553616892,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
                                                                                            3⤵
                                                                                              PID:4476
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,17027672007020469622,14568109432494144145,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
                                                                                              3⤵
                                                                                                PID:3752
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,12786633142161275447,15908561132195935430,524288 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:5780
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6916,i,8821900447113928124,14915791082298375257,2097152 --field-trial-handle=2368,i,4409873674404367852,5720898078391500778,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
                                                                                                  3⤵
                                                                                                    PID:2660
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                    3⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:1344
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff0179c188,0x7fff0179c194,0x7fff0179c1a0
                                                                                                      4⤵
                                                                                                        PID:620
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16424027376492810173,16981781439295918400,262144 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
                                                                                                        4⤵
                                                                                                          PID:3360
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17938300529677315215,5158142855327602326,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
                                                                                                          4⤵
                                                                                                          • System Time Discovery
                                                                                                          PID:1464
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,4632582372494477829,2250591969081258193,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:13
                                                                                                          4⤵
                                                                                                            PID:2628
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,17783763042316569132,17748790406774019530,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
                                                                                                            4⤵
                                                                                                              PID:3732
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,17783763042316569132,17748790406774019530,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
                                                                                                              4⤵
                                                                                                                PID:6712
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5256,i,2028204292867580376,9346417998486822965,2097152 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:4216
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5260,i,5326789718721224681,54976712881441874,2097152 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:2724
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14655364221957122288,6268494350540654460,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
                                                                                                                    4⤵
                                                                                                                      PID:2272
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,17280749885036374560,9339869409918912155,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
                                                                                                                      4⤵
                                                                                                                        PID:4064
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,9959266072646166875,15367926754578954670,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
                                                                                                                        4⤵
                                                                                                                          PID:7116
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,16697753873505388950,13607422126519581416,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
                                                                                                                          4⤵
                                                                                                                            PID:1272
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,7046095420792872239,15711372174208083175,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
                                                                                                                            4⤵
                                                                                                                              PID:1508
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,7943635577112165284,10705129808629559974,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
                                                                                                                              4⤵
                                                                                                                                PID:2324
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,9575152300732150960,2338819477735993365,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
                                                                                                                                4⤵
                                                                                                                                  PID:1928
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,1235349695990181798,827171781063301693,524288 --field-trial-handle=2256,i,6317305821481742671,13160666265345075841,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
                                                                                                                                  4⤵
                                                                                                                                    PID:6968
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.klauncher.gg/warface
                                                                                                                                2⤵
                                                                                                                                  PID:2404
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                1⤵
                                                                                                                                  PID:4792
                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                  1⤵
                                                                                                                                  • Enumerates connected drives
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:1992
                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 8F9EEAC7065694A124977C65EDE16C6E
                                                                                                                                    2⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:3844
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\B73A78E5-D01D-46FA-ACD2-2BDC5613014C\lite_installer.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\B73A78E5-D01D-46FA-ACD2-2BDC5613014C\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
                                                                                                                                      3⤵
                                                                                                                                      • Downloads MZ/PE file
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies system certificate store
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:7080
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\33205D57-E297-4E91-A86C-30B79D668370\seederexe.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\33205D57-E297-4E91-A86C-30B79D668370\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\3C4E0ACA-BAD9-416A-91FE-A4EE68D1F340\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      • Modifies Internet Explorer start page
                                                                                                                                      • Modifies registry class
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:4956
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3C4E0ACA-BAD9-416A-91FE-A4EE68D1F340\sender.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3C4E0ACA-BAD9-416A-91FE-A4EE68D1F340\sender.exe --send "/status.xml?clid=6035492-224&uuid=428aee77-285d-4fa9-afed-f4023f58dfc6&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A45%0A57%0A61%0A89%0A102%0A103%0A111%0A123%0A124%0A125%0A"
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:3560
                                                                                                                                • C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe
                                                                                                                                  "C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe" --run-as-service
                                                                                                                                  1⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:3100
                                                                                                                                  • C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe
                                                                                                                                    "C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3100 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.10.0.1796 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff65a7ca798,0x7ff65a7ca7a8,0x7ff65a7ca7b8
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:3116
                                                                                                                                  • C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe
                                                                                                                                    "C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe" --update-scheduler
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:2864
                                                                                                                                    • C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe
                                                                                                                                      "C:\Program Files (x86)\Yandex\YandexBrowser\26.10.0.1796\service_update.exe" --update-background-scheduler
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:7128
                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                  1⤵
                                                                                                                                    PID:6288
                                                                                                                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:6592
                                                                                                                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1792516647 --annotation=last_update_date=1792516647 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6592 --annotation=metrics_client_id=4775183b9c8c407d9422baac9397d0b2 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.10.0.1796 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffefe4bf380,0x7ffefe4bf390,0x7ffefe4bf3a0
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      PID:6392
                                                                                                                                  • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                    \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:6680
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                      1⤵
                                                                                                                                        PID:6700
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                        1⤵
                                                                                                                                          PID:936
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                          1⤵
                                                                                                                                            PID:4848

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                Reconnaissance

                                                                                                                                                Resource Development

                                                                                                                                                Initial Access

                                                                                                                                                Execution

                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                2
                                                                                                                                                T1059

                                                                                                                                                PowerShell

                                                                                                                                                1
                                                                                                                                                T1059.001

                                                                                                                                                Windows Command Shell

                                                                                                                                                1
                                                                                                                                                T1059.003

                                                                                                                                                Persistence

                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                1
                                                                                                                                                T1547

                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                1
                                                                                                                                                T1547.001

                                                                                                                                                Privilege Escalation

                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                1
                                                                                                                                                T1547

                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                1
                                                                                                                                                T1547.001

                                                                                                                                                Defense Evasion

                                                                                                                                                Modify Registry

                                                                                                                                                4
                                                                                                                                                T1112

                                                                                                                                                Subvert Trust Controls

                                                                                                                                                1
                                                                                                                                                T1553

                                                                                                                                                Install Root Certificate

                                                                                                                                                1
                                                                                                                                                T1553.004

                                                                                                                                                Credential Access

                                                                                                                                                Credentials from Password Stores

                                                                                                                                                1
                                                                                                                                                T1555

                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                1
                                                                                                                                                T1555.003

                                                                                                                                                Unsecured Credentials

                                                                                                                                                1
                                                                                                                                                T1552

                                                                                                                                                Credentials In Files

                                                                                                                                                1
                                                                                                                                                T1552.001

                                                                                                                                                Discovery

                                                                                                                                                Browser Information Discovery

                                                                                                                                                1
                                                                                                                                                T1217

                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                1
                                                                                                                                                T1120

                                                                                                                                                Process Discovery

                                                                                                                                                1
                                                                                                                                                T1057

                                                                                                                                                Query Registry

                                                                                                                                                5
                                                                                                                                                T1012

                                                                                                                                                System Information Discovery

                                                                                                                                                4
                                                                                                                                                T1082

                                                                                                                                                System Location Discovery

                                                                                                                                                1
                                                                                                                                                T1614

                                                                                                                                                System Language Discovery

                                                                                                                                                1
                                                                                                                                                T1614.001

                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                1
                                                                                                                                                T1016

                                                                                                                                                System Time Discovery

                                                                                                                                                1
                                                                                                                                                T1124

                                                                                                                                                Lateral Movement

                                                                                                                                                Collection

                                                                                                                                                Data from Local System

                                                                                                                                                1
                                                                                                                                                T1005

                                                                                                                                                Command and Control

                                                                                                                                                Exfiltration

                                                                                                                                                Impact

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                e5edc86.rbs
                                                                                                                                                • Path C:\Config.Msi\e5edc86.rbs
                                                                                                                                                • Size 912B
                                                                                                                                                • SHA256 000748d8f7612cd43361b26e01997b91939fb2969102e8089f8690834545394d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 e4d81d8e075de16d55f5328e3cf807d4a645c9df741da7e4fa17e5b17c92b005
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 b7b21b5981f80873921a7caa3d5df32ac0eb70d4a37b9cac46071cea637a39ec
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
                                                                                                                                                • Size 536B
                                                                                                                                                • SHA256 d082f6f6f29fbbbbfcab3a4552c2dc34712ab89f3ade3fba1f4f197b0ae038c7
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                                                                                                                • Size 536B
                                                                                                                                                • SHA256 1aee3d6ee4cf5b0130b4b9615927daf8e91bf7c1b5bd464d134f45cd5125f17b
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                03bab2efa10c1294468e5477925fc984.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\KLauncherShortcuts\icons\03bab2efa10c1294468e5477925fc984.ico
                                                                                                                                                • Size 52KB
                                                                                                                                                • SHA256 225f2a4a7c575734b5a32326ddf5148967a0a58bf467e6cea682541872558aef
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                3ca75062d489fe05aadc2b6c560f7ae1.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\KLauncherShortcuts\icons\3ca75062d489fe05aadc2b6c560f7ae1.ico
                                                                                                                                                • Size 194KB
                                                                                                                                                • SHA256 3bc86addc58e91e6d5ce521a36c4d1f21a74fc0bd3b55562ef4ad59c0dee7d2d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                c7133e14770f0012bee0aba7db6bbd78.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\KLauncherShortcuts\icons\c7133e14770f0012bee0aba7db6bbd78.ico
                                                                                                                                                • Size 37KB
                                                                                                                                                • SHA256 1904fa4c151b0e031762d2e1cd76f489fb9be2998f969ea2f53bcdaf43645980
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dea21040dfb31a77b5dec09be9691540.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\KLauncherShortcuts\icons\dea21040dfb31a77b5dec09be9691540.ico
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 ea19fbeebeba82ca0f9e97f6672f5ce93945176a486115c12ee4c0d7b56203c6
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ea2d470c08fbc484e3471f784d45ed23.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\KLauncherShortcuts\icons\ea2d470c08fbc484e3471f784d45ed23.ico
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 ec8fc99d9c00e65e3cfb366c8d3147fe8c45a2ebc717479e0b16ce8f19d27158
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                2c9ef9b3-f3da-438a-8953-7ea2947a828b.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c9ef9b3-f3da-438a-8953-7ea2947a828b.tmp
                                                                                                                                                • Size 34KB
                                                                                                                                                • SHA256 814a56b55c4f1684dc2a64b2c5417d29d1ef43ca9e09259aec4bcfe837acb560
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                3822340c-9736-472d-8dff-74c7b0e39915.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3822340c-9736-472d-8dff-74c7b0e39915.tmp
                                                                                                                                                • Size 43KB
                                                                                                                                                • SHA256 a5c9c52ffdbe23489b319ec2a21660603bc58824dc78c35347832798ff983aaa
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                40136ad7-388c-4409-af5b-6da1b7160fa8.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40136ad7-388c-4409-af5b-6da1b7160fa8.tmp
                                                                                                                                                • Size 34KB
                                                                                                                                                • SHA256 3a35b547d9d86670416879cd21cf28198d60492557df612f265145ef70e93776
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                67ad7457-40de-4586-b975-aeeebd96b1f3.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\67ad7457-40de-4586-b975-aeeebd96b1f3.tmp
                                                                                                                                                • Size 38KB
                                                                                                                                                • SHA256 aa1658060d9dc954f00932034353ea698a0f98eafb8a4b5a61a55ee41da2b3ab
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 bd3d58347f0a51de8ef13df44fe22f9f8278d43ed21023353851cf85ce97fa85
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 be479f4b2c74f102d86dca39bec27a414d97b7118bce8f11f9ec9a394d59f745
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 2f95af5a1b90fb9d524e4a5fc2acdf5ca6f1dfdc67d891ac98e9ee01bed2cfd7
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                175c4614-4e63-46fd-850c-a637f207cced.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\175c4614-4e63-46fd-850c-a637f207cced.tmp
                                                                                                                                                • Size 29KB
                                                                                                                                                • SHA256 d1cf61fc6a61d0e6e0bc0ac8573f80094837bffb2620beacf4151c9e5408a213
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                2d6697b1-4998-42a8-af58-da242f2bbe3b.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d6697b1-4998-42a8-af58-da242f2bbe3b.tmp
                                                                                                                                                • Size 13KB
                                                                                                                                                • SHA256 8ba002171df827fd99b239d0f63dcf32cebfe96c7509ba7bc08ff04c3f8aa9a2
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                56e76022-b6f6-4a0f-8c37-b98429dce2f4.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56e76022-b6f6-4a0f-8c37-b98429dce2f4.tmp
                                                                                                                                                • Size 13KB
                                                                                                                                                • SHA256 6fcae706d04d0a5a44b5d1c46933dc8f2e9222c11e372dc6a286fbea45a68b38
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                759a9093-71f9-48ce-a5ec-3b5eb8c3a7a9.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\759a9093-71f9-48ce-a5ec-3b5eb8c3a7a9.tmp
                                                                                                                                                • Size 12KB
                                                                                                                                                • SHA256 4cb85a5ef9e19c99c52bfc4b406085643be8c079ce1ae1be199e22b4b1a5d886
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                83d5e988-250e-43f5-bad7-ff6898912586.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83d5e988-250e-43f5-bad7-ff6898912586.tmp
                                                                                                                                                • Size 70KB
                                                                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                8690b1bb-1f88-47d0-9fd7-7b745e2b9098.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8690b1bb-1f88-47d0-9fd7-7b745e2b9098.tmp
                                                                                                                                                • Size 14KB
                                                                                                                                                • SHA256 b45dcbd0b55df5348606d5272ea7a806db853a4c2b976c7458936d536caa9937
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                8b5665ef-5d37-419f-8c34-b6a06f80ce4c.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8b5665ef-5d37-419f-8c34-b6a06f80ce4c.tmp
                                                                                                                                                • Size 11KB
                                                                                                                                                • SHA256 9d087a3ff2c07077cb98aed97b0a7157b496675bb9016938d8cfe092ec215ea6
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                9efa08fd-80a0-4e9c-b009-d3c48ba6ce26.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9efa08fd-80a0-4e9c-b009-d3c48ba6ce26.tmp
                                                                                                                                                • Size 414B
                                                                                                                                                • SHA256 5cfc4e56a7e43869c54b240c0c6eb51989cd606b5df6ee65b35b1c554e3a697a
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                f_000071
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
                                                                                                                                                • Size 68KB
                                                                                                                                                • SHA256 f630ad9396c5e8fcd5b55c34879376bc7e5a0216d7fa093b5c97e3713db3054c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                f_00008a
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
                                                                                                                                                • Size 24KB
                                                                                                                                                • SHA256 a30ddcd349703aff7464c34bef3fffdff405ee50c113440d7c8693c02d210972
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                f_000099
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
                                                                                                                                                • Size 119KB
                                                                                                                                                • SHA256 8ac11d9488333098cc4d52523b5320ebab0cc5a5659a4ee27a20018542af5d71
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                temp-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 f26e3e1c559e663075ac2c852034e45c77c879116b8a89791baa8b415e0df84b
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 4d007ca3de165e06f53e0b21565f5e57af83049198866c07abb90d2518f20020
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 a13350beb261a2cc3fa8966c3dee1a6bf2a419b27a4093318490ed003ab16970
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a3fd72df-ad13-49ce-9bec-037214978518.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a3fd72df-ad13-49ce-9bec-037214978518.tmp
                                                                                                                                                • Size 2B
                                                                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                dasherSettingSchema.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                                                                                • Size 854B
                                                                                                                                                • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                MANIFEST-000001
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lesta.ru_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                • Size 23B
                                                                                                                                                • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                1ebf1a07-256c-4567-bfc6-b9b88f584933.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1ebf1a07-256c-4567-bfc6-b9b88f584933.tmp
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 3f9639e9b8d4044ac739884b5c8d25d5ad1c2ee13ec109f14be305f70532a1d8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                8ed00075-9bb1-4329-b1cc-f0c0a4c582b3.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ed00075-9bb1-4329-b1cc-f0c0a4c582b3.tmp
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 0dd8317d9d8cf0f56447af21e0dffecac52d2996e0c77372d1ba330bfbd22c09
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                b647fb41-8214-4020-8262-3e332ae9c51a.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b647fb41-8214-4020-8262-3e332ae9c51a.tmp
                                                                                                                                                • Size 40B
                                                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                e8ac8031-b410-48a1-b3b0-b92397e498a9.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e8ac8031-b410-48a1-b3b0-b92397e498a9.tmp
                                                                                                                                                • Size 2B
                                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                sync_diagnostic.log
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 9ebff9946d8e323c48a452c93d5d4ced76b3c5c402a1e80064bcf65de57e49ad
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                f0c54b63-95d4-499e-baf6-bc7e09a2a46f.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0c54b63-95d4-499e-baf6-bc7e09a2a46f.tmp
                                                                                                                                                • Size 14KB
                                                                                                                                                • SHA256 2dee1456fcc1c2d9629c491171d479601646fe05e9d57686093ed0cc2337b262
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                f38a4943-7fb3-4a97-85cf-e948f69b5ee8.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f38a4943-7fb3-4a97-85cf-e948f69b5ee8.tmp
                                                                                                                                                • Size 6B
                                                                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                bcea26aa-a3c3-4d90-9e12-636daa3982a1.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bcea26aa-a3c3-4d90-9e12-636daa3982a1.tmp
                                                                                                                                                • Size 22KB
                                                                                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a1d45d82-2acb-4805-82f0-f30f2ef148fa.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1d45d82-2acb-4805-82f0-f30f2ef148fa.tmp
                                                                                                                                                • Size 38KB
                                                                                                                                                • SHA256 447e34e5a4d80f382e3abfe1f64a62d071fd0c756f37e5fb56064943ec6a070c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                c5fb07a2-97a1-444d-b238-f50fe8ae9fea.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5fb07a2-97a1-444d-b238-f50fe8ae9fea.tmp
                                                                                                                                                • Size 34KB
                                                                                                                                                • SHA256 66a8d769979a0201aa48946309fe075dce99b2b0f20d60b1a058bf358cf6088c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                86090fe7-dc48-4fab-952a-0c47e5485ac8.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\86090fe7-dc48-4fab-952a-0c47e5485ac8.tmp
                                                                                                                                                • Size 132B
                                                                                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a765e65a-fb5f-48be-932f-2c8d1574f334.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a765e65a-fb5f-48be-932f-2c8d1574f334.tmp
                                                                                                                                                • Size 252B
                                                                                                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                d5cb99c5-2d3a-48ea-871b-14312c00ab58.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5cb99c5-2d3a-48ea-871b-14312c00ab58.tmp
                                                                                                                                                • Size 38KB
                                                                                                                                                • SHA256 f16b939759818e4931d500508cfb4209ad6bec2f8484bab18982cf07b48a67e3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                                                • Size 158KB
                                                                                                                                                • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                metadata.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                • Size 132B
                                                                                                                                                • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                fede5a4d-209d-4e88-9f58-8d8fb71d71ae.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fede5a4d-209d-4e88-9f58-8d8fb71d71ae.tmp
                                                                                                                                                • Size 34KB
                                                                                                                                                • SHA256 8c9c70cbadfd2d1b4c55228c08a26d7c87f29fb5dbf2236d7acc8e04b33569db
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                yandex.ru.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\yandex.ru.ico
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 6bb91f1d74389b18bce6e71772e4c5573648c1a4823338193f700afdf8216be5
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Yandex[1].exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E438JMI2\Yandex[1].exe
                                                                                                                                                • Size 12.4MB
                                                                                                                                                • SHA256 2f38050e5eb753ca8cae523785df165520a41a18210318077fa3b688cc3de394
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a0d507ac3426291a5712ed47083fdbdd.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\abz62oon.Admin\thumbnails\a0d507ac3426291a5712ed47083fdbdd.png
                                                                                                                                                • Size 15KB
                                                                                                                                                • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                b75574f1c28e7363e2403b8622c71f91.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\abz62oon.Admin\thumbnails\b75574f1c28e7363e2403b8622c71f91.png
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 cbd302b0ea2218f495b9f0a814f34733f2c5f13a6634d74c6e85a5c0863b5621
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Warface.lnk
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Programs\KLauncher\Warface.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 64cf283115fe04d079eb75d2ae839e7bc3975cd66a8eb4e31f6dea244931e8ef
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ВарТандер.lnk
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Programs\KLauncher\ВарТандер.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 1d8eef665cf8d01dc617dec61b2c96d53091698784f118bceccf5535cff60b2b
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Мир Кораблей.lnk
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Programs\KLauncher\Мир Кораблей.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 b382908e66b5f05b125ea8e7b4591fd3246516046971b6e2920f257b70759801
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Мир Танков.lnk
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Programs\KLauncher\Мир Танков.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 105c10eed681c3c4327efbd15ff47cadc81834ba8bc25bea905f5c5acf6a8751
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Яндекс.Игры.lnk
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Programs\KLauncher\Яндекс.Игры.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 61dc80bc6598780dcc07cc872f88fe09b4b59b062fd5ccca14f1a718cc14417f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                01033262-b8fc-4e4c-9ef0-97a2d3229462.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\01033262-b8fc-4e4c-9ef0-97a2d3229462.tmp
                                                                                                                                                • Size 1B
                                                                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                YandexPackSetup.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                                                                                                                                                • Size 10.1MB
                                                                                                                                                • SHA256 ead7a779cabae642d09be07283cc99e53c84ecf90349444e0d0ac4bf9901fe47
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                9aea0521-b001-4c95-abc8-0eb787bd5b4a.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9aea0521-b001-4c95-abc8-0eb787bd5b4a.tmp
                                                                                                                                                • Size 10KB
                                                                                                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                YandexSearch00000.log
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 f9fb4b90feb9a514fd1ffa519ae2b92e4d932e375a49c2f9d1edd99b2e60521b
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                __PSScriptPolicyTest_0jgp2blr.mjd.psm1
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jgp2blr.mjd.psm1
                                                                                                                                                • Size 60B
                                                                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                e977ad67-4d8d-45f8-a04a-ec6dcb3ce8f2.tmp.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e977ad67-4d8d-45f8-a04a-ec6dcb3ce8f2.tmp.ico
                                                                                                                                                • Size 42KB
                                                                                                                                                • SHA256 ed1442c2777f5a624355bde9ec677fbe6da949c67c70648f616a04ab4f8e7189
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                3a5306d9e24fad45eac9cd3b333dd1f7.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\3a5306d9e24fad45eac9cd3b333dd1f7.exe
                                                                                                                                                • Size 19KB
                                                                                                                                                • SHA256 a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                63a92f9856066fd88b49019e617938a1.zip
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\63a92f9856066fd88b49019e617938a1.zip
                                                                                                                                                • Size 203KB
                                                                                                                                                • SHA256 1a842c5f1b1dff48eafb7b3911046cb601d072cfbf570d40436f1d38a770f6ed
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                bdc903c3e1b51c340893d73b9003b605.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\bdc903c3e1b51c340893d73b9003b605.exe
                                                                                                                                                • Size 839KB
                                                                                                                                                • SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dly.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-8FV3J.tmp\dly.exe
                                                                                                                                                • Size 203KB
                                                                                                                                                • SHA256 c60c3a7d20b575fdeeb723e12a11c2602e73329dc413fc6d88f72e6f87e38b49
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                KLSetup v1.39.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-VGI3F.tmp\KLSetup v1.39.tmp
                                                                                                                                                • Size 3.6MB
                                                                                                                                                • SHA256 6fadfc34931d39a33250a65844c657b20a8e848d61b9e5b6a55c24d008df043d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                lite_installer.log
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                                                                                                                • Size 15KB
                                                                                                                                                • SHA256 e233e4175c35d405add68c23468ead3dbe9b53d4b40011b16e0ded3a5f9978cc
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                master_preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                                                                                                                                • Size 542B
                                                                                                                                                • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                LICENSE.electron.txt
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\LICENSE.electron.txt
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                LICENSES.chromium.html
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\LICENSES.chromium.html
                                                                                                                                                • Size 9.0MB
                                                                                                                                                • SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                chrome_100_percent.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\chrome_100_percent.pak
                                                                                                                                                • Size 148KB
                                                                                                                                                • SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                chrome_200_percent.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\chrome_200_percent.pak
                                                                                                                                                • Size 223KB
                                                                                                                                                • SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                d3dcompiler_47.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\d3dcompiler_47.dll
                                                                                                                                                • Size 4.7MB
                                                                                                                                                • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ffmpeg.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\ffmpeg.dll
                                                                                                                                                • Size 2.6MB
                                                                                                                                                • SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                icudtl.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\icudtl.dat
                                                                                                                                                • Size 10.0MB
                                                                                                                                                • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                libEGL.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\libEGL.dll
                                                                                                                                                • Size 470KB
                                                                                                                                                • SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                libGLESv2.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\libGLESv2.dll
                                                                                                                                                • Size 7.7MB
                                                                                                                                                • SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                af.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\af.pak
                                                                                                                                                • Size 494KB
                                                                                                                                                • SHA256 e2470090a09ca500679e68bb5e3b1acc35a5873fea4f93af25a23c82122f2c13
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                am.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\am.pak
                                                                                                                                                • Size 800KB
                                                                                                                                                • SHA256 4e15946e86a578eeff41feda808bb291d81e240fbdfc96cbe2efe692ad35eef5
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ar.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ar.pak
                                                                                                                                                • Size 874KB
                                                                                                                                                • SHA256 5cc02570e5f61cbca791309985df3a29584e41583b3344f1d9fb6b04ce423e6f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                bg.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\bg.pak
                                                                                                                                                • Size 913KB
                                                                                                                                                • SHA256 97ef7984074775282b68dca5d5a469efdb2b22474ee6669fdfb5197d3f1b3768
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                bn.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\bn.pak
                                                                                                                                                • Size 1.1MB
                                                                                                                                                • SHA256 1aba82aee8c985e5e370e7cf2b35c9ec20cbe5174db5fcb54ec7d19ec5d79587
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ca.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ca.pak
                                                                                                                                                • Size 556KB
                                                                                                                                                • SHA256 b3d5dfae25427596b1f14a8e13d6bcb58532c82554229c2367779ff5c42b28bb
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                cs.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\cs.pak
                                                                                                                                                • Size 572KB
                                                                                                                                                • SHA256 7d7b701ce510b2e4a18e957e500086db590aad8bf5acd37f82263a676f0b556c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                da.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\da.pak
                                                                                                                                                • Size 518KB
                                                                                                                                                • SHA256 3430c0f1946901dfa24190ca3989f72171ec564bc7c523853e6a1f531b61b5ee
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                de.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\de.pak
                                                                                                                                                • Size 553KB
                                                                                                                                                • SHA256 662496eff49febbe49f0a03cf2c51acaa743cb2237de3c41014556e16f3d8e2b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                el.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\el.pak
                                                                                                                                                • Size 1001KB
                                                                                                                                                • SHA256 162e51bc7d682e223e498f4ff8c81f019d136d857bd25a1c982d4a1084a8c840
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                en-GB.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\en-GB.pak
                                                                                                                                                • Size 450KB
                                                                                                                                                • SHA256 7df934906a61c0ae7a952f9ed058f4a06cd3989663a7d9f50afc3c9f830135bb
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                en-US.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\en-US.pak
                                                                                                                                                • Size 454KB
                                                                                                                                                • SHA256 41123d72bd8e289e85bd35227aabb4cc61fe1de02b5cd7a7834e5ec200bc2078
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                es-419.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\es-419.pak
                                                                                                                                                • Size 547KB
                                                                                                                                                • SHA256 ec922f8ca16b7e7642fc73369ba7b75ec950cafb1dcadc6c88426c034382d483
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                es.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\es.pak
                                                                                                                                                • Size 547KB
                                                                                                                                                • SHA256 0385e6776de5a0d8a3b30b7bad44308ac4cb04e2bcebd573d3c7938b68036573
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                et.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\et.pak
                                                                                                                                                • Size 497KB
                                                                                                                                                • SHA256 ba4ec85d2306a1f1f178a017fef4d340b77b33e10bbee07bd359a8e0ff8ea461
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                fa.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\fa.pak
                                                                                                                                                • Size 813KB
                                                                                                                                                • SHA256 f1a7351bf0d8cad475d2761b9edf970c3098836e38aa98106a5e04a41002b7c8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                fi.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\fi.pak
                                                                                                                                                • Size 508KB
                                                                                                                                                • SHA256 11b0b9b0f74d01f16db7aa49be9dceeb55fde9da56f17419c4bca159cdcae274
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                fil.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\fil.pak
                                                                                                                                                • Size 573KB
                                                                                                                                                • SHA256 d7fdc7fd08dcc421bc8aaae3fdc72599c60a3b96f05989a3e46736f0de06e745
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                fr.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\fr.pak
                                                                                                                                                • Size 591KB
                                                                                                                                                • SHA256 1f6cc56e04bcbd6b6ecbe500bcb0a5702551ec80d79e624642d0c7d9758d4424
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                gu.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\gu.pak
                                                                                                                                                • Size 1.1MB
                                                                                                                                                • SHA256 087e99953eef9b5fd736e3dbd98d702fdb01dc614593a4c575cb619159688118
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                he.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\he.pak
                                                                                                                                                • Size 713KB
                                                                                                                                                • SHA256 20b1c80f8b2bd5130a1fb372814fb9c9ceac15305da3da0cb29923960a94a934
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hi.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\hi.pak
                                                                                                                                                • Size 1.2MB
                                                                                                                                                • SHA256 9c6d8d93278a6e375405142df9829adefbcc8ae9797a4f589591b9784b2b71c8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hr.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\hr.pak
                                                                                                                                                • Size 551KB
                                                                                                                                                • SHA256 afed35643df24709c8c5cc9b8158b3d9a2266fbfeed132e98ff254ced4086c5f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hu.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\hu.pak
                                                                                                                                                • Size 595KB
                                                                                                                                                • SHA256 b4e6a1135de8bdc42c04f4db4eb1ce48256f18eb46a5146a21010b6165a90e7a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                id.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\id.pak
                                                                                                                                                • Size 490KB
                                                                                                                                                • SHA256 a21f9474a19fe2d7f26c59f5ba8d6e72801a8a057b7dbcb8b3f96471043d9059
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                it.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\it.pak
                                                                                                                                                • Size 539KB
                                                                                                                                                • SHA256 33652aae78a486dc3ce4e5affd1b7f72e1248f6f9f3e62188afe3b5d73bd148e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ja.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ja.pak
                                                                                                                                                • Size 659KB
                                                                                                                                                • SHA256 c5692ca739c31569ae2431fd58f1028e6c8c01af278b76656ee0bb65b79e9985
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                kn.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\kn.pak
                                                                                                                                                • Size 1.3MB
                                                                                                                                                • SHA256 a6ecf1dfe4d99f6ba0926c696b5b23b77d234fa8fd03da9825b074ecc640d508
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ko.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ko.pak
                                                                                                                                                • Size 557KB
                                                                                                                                                • SHA256 3fa72d61a997c36f9c093f769f4bba60b290d1fbcb71d5544f85e8e1efe51d07
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                lt.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\lt.pak
                                                                                                                                                • Size 597KB
                                                                                                                                                • SHA256 a1257d10e673311747363e6929832e70f36668b1fc0d6a5ddd550fe88007aa58
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                lv.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\lv.pak
                                                                                                                                                • Size 596KB
                                                                                                                                                • SHA256 33fdf706f6d3f06b485c5115a7c73a571296dac41c582fc9d0dbb371d86e8653
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ml.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ml.pak
                                                                                                                                                • Size 1.3MB
                                                                                                                                                • SHA256 87384db1ddcac012b0b40ec89daf47ebbbcf1497705f023a6983fb2470e4abd6
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                mr.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\mr.pak
                                                                                                                                                • Size 1.1MB
                                                                                                                                                • SHA256 039f4e0176c38867fef57482825d043fa63bf1356c85eab0fc665f118db125e4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ms.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ms.pak
                                                                                                                                                • Size 514KB
                                                                                                                                                • SHA256 2f0c83b5b3bff8f624d78e0670a31c509e7f1d5330f72aaede471b2e97c956e2
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                nb.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\nb.pak
                                                                                                                                                • Size 499KB
                                                                                                                                                • SHA256 887a0278971d6ba61e2f24c62029a3087a46c4962c4357412c28ede12ed6da15
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                nl.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\nl.pak
                                                                                                                                                • Size 516KB
                                                                                                                                                • SHA256 619c61701b3a142733d23ad8c7117bc013867a842d3d1d572faa56895ad8257e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                pl.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\pl.pak
                                                                                                                                                • Size 574KB
                                                                                                                                                • SHA256 f2a7dcb69a433c2a898866c555b82c26e3515c089f500e7748b9b11ec3047786
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                pt-BR.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\pt-BR.pak
                                                                                                                                                • Size 540KB
                                                                                                                                                • SHA256 5ff219be32f9178fee40e8966ac5deff2be1f2ff259a66cb9cdce81c2e90a7e8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                pt-PT.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\pt-PT.pak
                                                                                                                                                • Size 543KB
                                                                                                                                                • SHA256 02ea290fac25b414a1d4ed78cdc159cf6c73fe5350824c2f36f032e426a23364
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ro.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ro.pak
                                                                                                                                                • Size 562KB
                                                                                                                                                • SHA256 655c175903a791d0ff56264a487c53f7bd09ed037cf04cfa6e79eb8be5b677e9
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ru.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ru.pak
                                                                                                                                                • Size 924KB
                                                                                                                                                • SHA256 4babe5f20caafca33867ee263aa9dd55ed271704a062e4372fdd133eb359a558
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sk.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\sk.pak
                                                                                                                                                • Size 580KB
                                                                                                                                                • SHA256 89f984a67cea3997c704005fbfbacd3f6f5652248626945c2ab1c3bcf24e6623
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sl.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\sl.pak
                                                                                                                                                • Size 556KB
                                                                                                                                                • SHA256 458b15bf249c1e6fe9843725c42443274ef6e09dcb15f5288c916c0561aefc47
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sr.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\sr.pak
                                                                                                                                                • Size 859KB
                                                                                                                                                • SHA256 4cea4c83b5e887463dadbf470a9953b8175149f31fd07b83406a6fc59acfde41
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sv.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\sv.pak
                                                                                                                                                • Size 501KB
                                                                                                                                                • SHA256 105460cb717104d82f99cf8c5e2c51ff252211a605bd1c98bf75981f100d619e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sw.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\sw.pak
                                                                                                                                                • Size 529KB
                                                                                                                                                • SHA256 f0fccf2e3ad332846736d816e254028569f5f84918573872442987a8bc9bba58
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ta.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ta.pak
                                                                                                                                                • Size 1.3MB
                                                                                                                                                • SHA256 1cebac8d758298ed2763e62b9bdfb17351831e691ff3e1ba85252c9a66d66242
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                te.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\te.pak
                                                                                                                                                • Size 1.2MB
                                                                                                                                                • SHA256 8264244c6de861817f5b19cef282844a18ed8cb7d4e059451489652749fe931e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                th.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\th.pak
                                                                                                                                                • Size 1.0MB
                                                                                                                                                • SHA256 647ad394e92e7610bd0f6c4e08d28748408fcd5a816a35e4622ea7f71cfa7a9d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                tr.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\tr.pak
                                                                                                                                                • Size 539KB
                                                                                                                                                • SHA256 f58ed19be62706fb4fd797a6bfd3af5c6ad4b39aef994a577cd28968fcac0291
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                uk.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\uk.pak
                                                                                                                                                • Size 923KB
                                                                                                                                                • SHA256 13e40208e2c9f4f4b83dcf422610dc82314a8f99ba50acdbd286c508f92eb232
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ur.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\ur.pak
                                                                                                                                                • Size 808KB
                                                                                                                                                • SHA256 60310f9a3457fae0395b447a30646211ef4160ba84bd7c36d291af4c8ec2b79a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                vi.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\vi.pak
                                                                                                                                                • Size 639KB
                                                                                                                                                • SHA256 fb9463d5655e73fa69cace9800d95f8cd077ee9284fef3bfe162d2bfe220c257
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                zh-CN.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\zh-CN.pak
                                                                                                                                                • Size 460KB
                                                                                                                                                • SHA256 f0c0ba53c954325b3bbefb333ba23f7fb40a7a4e506043e9f7886089f611943b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                zh-TW.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\locales\zh-TW.pak
                                                                                                                                                • Size 455KB
                                                                                                                                                • SHA256 d4033cb3264c7c4cd2636ea2a202421650c449e5bfb10f29949e4c44e91ca93b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                resources.pak
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\resources.pak
                                                                                                                                                • Size 5.3MB
                                                                                                                                                • SHA256 a5908171bfbb738ac015e7c9903c838d93359ed12c3b7d86545514dc1f0e9d62
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                app-update.yml
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\resources\app-update.yml
                                                                                                                                                • Size 102B
                                                                                                                                                • SHA256 c368a90fe55f33633400c50361317a10441087a05e49559bd63eaafda20403a6
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                package.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\resources\app.asar.unpacked\node_modules\@rollup\rollup-win32-x64-msvc\package.json
                                                                                                                                                • Size 391B
                                                                                                                                                • SHA256 1445e0b16eab03aa414eed3c06ac0d4bbbb6f8ec5f8dda04be24ba9353c65d3d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                rollup.win32-x64-msvc.node
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\resources\app.asar.unpacked\node_modules\@rollup\rollup-win32-x64-msvc\rollup.win32-x64-msvc.node
                                                                                                                                                • Size 3.2MB
                                                                                                                                                • SHA256 322819580bcbe8dcf97d3e1b7c747d52cae23e14f9310fd52ca2e897868988e1
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                package.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\resources\app.asar.unpacked\node_modules\@swc\core-win32-x64-msvc\package.json
                                                                                                                                                • Size 618B
                                                                                                                                                • SHA256 0d6b2fc15bd7247774c65009aa118e4ec90ae150ebac13160b41855fb3d783ae
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                swc.win32-x64-msvc.node
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\resources\app.asar.unpacked\node_modules\@swc\core-win32-x64-msvc\swc.win32-x64-msvc.node
                                                                                                                                                • Size 44.0MB
                                                                                                                                                • SHA256 2cdc91a147324fb0f93ea04dc26dee6b0def4629f9ef529439c9aa37064c0ee0
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                elevate.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\resources\elevate.exe
                                                                                                                                                • Size 105KB
                                                                                                                                                • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                snapshot_blob.bin
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\snapshot_blob.bin
                                                                                                                                                • Size 302KB
                                                                                                                                                • SHA256 22a46de643045805a3e588f9a18ebaa377f9fba3dee46b2d60f3ae300a09cc4e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                v8_context_snapshot.bin
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\v8_context_snapshot.bin
                                                                                                                                                • Size 646KB
                                                                                                                                                • SHA256 a8bd22478c4f85afa836c89d3a7f52c606b17872fbbefce268b499bedede10ae
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                vk_swiftshader.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\vk_swiftshader.dll
                                                                                                                                                • Size 5.2MB
                                                                                                                                                • SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                vk_swiftshader_icd.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\vk_swiftshader_icd.json
                                                                                                                                                • Size 106B
                                                                                                                                                • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                vulkan-1.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\7z-out\vulkan-1.dll
                                                                                                                                                • Size 938KB
                                                                                                                                                • SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                StdUtils.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\StdUtils.dll
                                                                                                                                                • Size 100KB
                                                                                                                                                • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                System.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\System.dll
                                                                                                                                                • Size 12KB
                                                                                                                                                • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                WinShell.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\WinShell.dll
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                nsExec.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\nsExec.dll
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                nsis7z.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsb8878.tmp\nsis7z.dll
                                                                                                                                                • Size 424KB
                                                                                                                                                • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                messages.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4836_402327750\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                                                • Size 711B
                                                                                                                                                • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                content.js
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4836_531007950\CRX_INSTALL\content.js
                                                                                                                                                • Size 9KB
                                                                                                                                                • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                vendor00000.xml
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                                                                                                                                • Size 510B
                                                                                                                                                • SHA256 1a855972dc308e47d30d567e1b37fdad349bf555b971bc14ead76e17a8accccc
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                yandex_browser_updater.log
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 977a43b81fbddcbd0ac64e59b74350e18d0b8ca8dcf9489f2ba4998dd7ec5c0e
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                YandexSearch.msi
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                                                                                                                                • Size 9.8MB
                                                                                                                                                • SHA256 b2fda5fb2d8e65fc0448d308647d8afd1e4ecd7bff0103ec3700e0798a7db0a3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                install_state.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\install_state.json
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 783a592441208b1a3468f007fe7696bdb5caf26162fe70dee4a52084bde079f8
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ghjgbemlcjioaaejhnnmgfpiplgalgcl.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\Extensions\ghjgbemlcjioaaejhnnmgfpiplgalgcl.json
                                                                                                                                                • Size 119B
                                                                                                                                                • SHA256 20832de8163d5af0a0c8bda863bcd6083df4f92175d856ce527de1dae1f7c433
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                brand_config
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\brand_config
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 2dde66c51ac013edb2d95ae1d761dcb54500932e845e007f8fcc2c8efd171971
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                partner_config
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\partner_config
                                                                                                                                                • Size 341B
                                                                                                                                                • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                about_logo_en.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\about_logo_en.png
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 c56ae312020aef1916a8a01d5a1fc67ed3b41e5da539c0f26632c904a5e49c62
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                about_logo_en_2x.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\about_logo_en_2x.png
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 fe20d86fd62a4d1ab51531b78231749bd5990c9221eab1e7958be6d6aef292d9
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                about_logo_ru.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\about_logo_ru.png
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 1039ea2d254d536410588d30f302e6ab727d633cf08cb409caa5d22718af5e64
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                about_logo_ru_2x.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\about_logo_ru_2x.png
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 5bb0977553ded973c818d43a178e5d9874b24539dacbd7904cd1871e0ba82b23
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                all_zip
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\configs\all_zip
                                                                                                                                                • Size 1.4MB
                                                                                                                                                • SHA256 00de183799208c56b1b0c40f353aa6bea535e896e131df4379488302eb4be8e1
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                easylist.txt
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\easylist\easylist.txt
                                                                                                                                                • Size 620KB
                                                                                                                                                • SHA256 2f317fee439877eaadb1264bd3d1e153c963ef98596a4ccf227592aea12ae76f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                manifest.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\easylist\manifest.json
                                                                                                                                                • Size 68B
                                                                                                                                                • SHA256 77334f6256abddcc254f31854d1b00aa6743e20aadbb9e69187144847099a66b
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                brand_settings.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\extension\elokbjeafkcggjfjkakpchmcmhkhaofn\brand_settings.json
                                                                                                                                                • Size 379B
                                                                                                                                                • SHA256 4940847c9b4787e466266f1bb921097abb4269d6d10c0d2f7327fde9f1b032b7
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                brand_settings.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\extension\fcgfaidpicddcilhjhafmmcgfodijhjd\brand_settings.json
                                                                                                                                                • Size 316B
                                                                                                                                                • SHA256 de0fbb08708d4be7b9af181ec26f45fccd424e437bc0cfb5cf38f2604f01f7b2
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                brand_settings.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\extension\gopnelejddjjkamjfblkcijjikkinnec\brand_settings.json
                                                                                                                                                • Size 246B
                                                                                                                                                • SHA256 114fd03aa5ef1320f6cc586e920031cf5595a0d055218ce30571ff33417806d3
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                import-bg.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\import-bg.png
                                                                                                                                                • Size 9KB
                                                                                                                                                • SHA256 7573af31ed2bfcfff97ed2132237db65f05aff36637cd4bdeccdf8ca02cd9038
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dictionary-ru-RU.mrf
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\morphology\dictionary-ru-RU.mrf
                                                                                                                                                • Size 1.1MB
                                                                                                                                                • SHA256 1585b1599418d790da830ef11e8eeceee0cbb038876fe3959cc41858bd501dbc
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dictionary-ru-RU.mrf.sig
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\morphology\dictionary-ru-RU.mrf.sig
                                                                                                                                                • Size 256B
                                                                                                                                                • SHA256 151739137bbbdf5f9608a82ec648bdf5d7454a81b86631b53dfc5ad602b207d6
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                stop-words-ru-RU.list
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\morphology\stop-words-ru-RU.list
                                                                                                                                                • Size 52B
                                                                                                                                                • SHA256 cbeec72666668a12ab6579ae0f45ccbdbe3d29ee9a862916f8c9793e2cf55552
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                download.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\safebrowsing\download.png
                                                                                                                                                • Size 437B
                                                                                                                                                • SHA256 3129d9eaba1c5f31302c2563ebfa85747eda7a6d3f95602de6b01b34e4369f04
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                alice.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\shortcuts\alice.ico
                                                                                                                                                • Size 361KB
                                                                                                                                                • SHA256 48a17761bdf5b996edb651c03c82a5a5bf93c054adbded2e0848e9981b5eb5e0
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                alice_desktop.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\shortcuts\alice_desktop.json
                                                                                                                                                • Size 311B
                                                                                                                                                • SHA256 283e7dc6642bc005c6daa0dfbc2b4cc4b717b9ff30bfe8e88d295b839c34ee21
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                alice_taskbar.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\shortcuts\alice_taskbar.json
                                                                                                                                                • Size 341B
                                                                                                                                                • SHA256 14c42a2a483ab3abf4f8c5e3c4c86aa85d87455debf0691b639cceb99f0e1ddc
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sxs.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\sxs.ico
                                                                                                                                                • Size 43KB
                                                                                                                                                • SHA256 ad566a3e6f8524c705844e95a402cdeb4d6eed36c241c183147409a44e97ebcd
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                tablo
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\tablo
                                                                                                                                                • Size 852KB
                                                                                                                                                • SHA256 91fbf98be9a3d5cc97d76d4d540ce1f20ecaca2768f43e24f35c71af8bf6e1b7
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                1-1x.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\1-1x.png
                                                                                                                                                • Size 18KB
                                                                                                                                                • SHA256 a62f9fdf3de1172988e01a989bf7a2344550f2f05a3ac0e6dc0ccd39ed1a697e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                custogray_full.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\custogray\custogray_full.png
                                                                                                                                                • Size 313B
                                                                                                                                                • SHA256 a7cd964345c3d15840b88fd9bc88f0d0c34a18edbf1ce39359af4582d1d7da45
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\custogray\preview.png
                                                                                                                                                • Size 136B
                                                                                                                                                • SHA256 55a236ad63d00d665b86ff7f91f2076226d5ed62b9d9e8f835f7cb998556545f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\custogray\wallpaper.json
                                                                                                                                                • Size 233B
                                                                                                                                                • SHA256 4cd690fb8ed5cd733a9c84d80d20d173496617e8dde6fca19e8a430517349ed5
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dark_preview.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\dark.title\dark_preview.jpg
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 4373e988c7f36efe867c89745469f502ba549ccd68b73d3000cb7231413c4169
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dark_preview_new.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\dark.title\dark_preview_new.jpg
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 c257ddaeab225d79d8024d3f5093e4a8476c647abecd3a93a2ad323dbdcaddd2
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dark_static.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\dark.title\dark_static.jpg
                                                                                                                                                • Size 1.8MB
                                                                                                                                                • SHA256 632435cf4acd1463f0fa2ea2d170347050e154b2a53e35d33ed6c0f0a29ef7e0
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dark_static_new.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\dark.title\dark_static_new.jpg
                                                                                                                                                • Size 222KB
                                                                                                                                                • SHA256 cce65ea98a80455b26492ce241dc3d3dec2d174d13e0923a9414a77a3d8060bd
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                fir_tree_preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\fir_tree\fir_tree_preview.png
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 4c2b561cf301d9e98383d084a200deb7555ec47a92772a94453d3d8d1de04080
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\fir_tree\wallpaper.json
                                                                                                                                                • Size 384B
                                                                                                                                                • SHA256 2cc83bc391587b7fe5ddd387506c3f51840b806f547d203ccd90487753b782f1
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                flowers_preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\flowers\flowers_preview.png
                                                                                                                                                • Size 9KB
                                                                                                                                                • SHA256 70a7a65aa6e8279a1a45d93750088965b65ea8e900c5b155089ca119425df003
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\flowers\wallpaper.json
                                                                                                                                                • Size 387B
                                                                                                                                                • SHA256 70c8d348f7f3385ac638956a23ef467da2769cb48e28df105d10a0561a8acb9e
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                huangshan.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\huangshan\huangshan.jpg
                                                                                                                                                • Size 211KB
                                                                                                                                                • SHA256 713c9e03aac760a11e51b833d7e1c9013759990b9b458363a856fd29ea108eec
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                huangshan.webm
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\huangshan\huangshan.webm
                                                                                                                                                • Size 9.6MB
                                                                                                                                                • SHA256 05e7170852a344e2f3288fc3b74c84012c3d51fb7ad7d25a15e71b2b574bfd56
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                huangshan_preview.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\huangshan\huangshan_preview.jpg
                                                                                                                                                • Size 26KB
                                                                                                                                                • SHA256 649c55ccc096cc37dfe534f992b1c7bda68da589258611924d3f6172d0680212
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                light_preview.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\light.title\light_preview.jpg
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 4fe8b8d7919840d2692b29e80f1c7e9fde7796bfab2c7e90aa480bdad960df76
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                light_preview_new.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\light.title\light_preview_new.jpg
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 b813c976e9db06b810b05fed9686d7934fd6adcb1340d4fc85825729547602d6
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                light_static_new.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\light.title\light_static_new.jpg
                                                                                                                                                • Size 222KB
                                                                                                                                                • SHA256 3bebfa4213bdfe773fa5f1f4127a0e20f4e137b79063059cdee5963232592cb1
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\meadow\preview.png
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 0499c4cc77a64cc89055b3c65d7af8387f5d42399ff2c0a2622eccbd6d481238
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\meadow\wallpaper.json
                                                                                                                                                • Size 439B
                                                                                                                                                • SHA256 c6581e9f59646e0a51a3194798ec994c7c5c99f28897108838aaf4a4e2bda04a
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\misty_forest\preview.png
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 ea340a389af6d7ad760dff2016cf4e79488bda1a45d0a415b3cd02a4430c9711
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\misty_forest\wallpaper.json
                                                                                                                                                • Size 423B
                                                                                                                                                • SHA256 ebe9cadad41bd573f4b5d20e3e251410300b1695dfdf8b1f1f1276d0f0f8fa6d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                mountains_preview.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\mountains_preview.jpg
                                                                                                                                                • Size 35KB
                                                                                                                                                • SHA256 55074794869b59cd5c693dfa6f6615aea068c2cd50cdae6dd69bd0410661ded8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\peak\preview.png
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 f72ea12f6c972edfe3d5a203e1e42cbbaf4985633de419342c2af31363f33dab
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\peak\wallpaper.json
                                                                                                                                                • Size 440B
                                                                                                                                                • SHA256 e491962b42c3f97649afec56ad4ea78fd49845ceb15f36edddd08d9e43698658
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                raindrops_preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\raindrops\raindrops_preview.png
                                                                                                                                                • Size 7KB
                                                                                                                                                • SHA256 1e70fc9965939f6011488f81cd325223f17b07ee158a93c32c124602b506aa6b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\raindrops\wallpaper.json
                                                                                                                                                • Size 385B
                                                                                                                                                • SHA256 bcfea0bebf30ee9744821a61fcce6df0222c1a266e0995b9a8cfbb9156eeeefd
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sea.webm
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\sea.webm
                                                                                                                                                • Size 12.5MB
                                                                                                                                                • SHA256 fa8d0ae53ebdbec47b533239709b7e1514ecb71278907621ca2d288241eb0b13
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sea_preview.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\sea\sea_preview.jpg
                                                                                                                                                • Size 59KB
                                                                                                                                                • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sea_preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\sea\sea_preview.png
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 02d8e450f03129936a08b67f3a50ea5d2e79f32c4e8f24d34b464f2cb5e0b086
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sea_static.jpg
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\sea\sea_static.jpg
                                                                                                                                                • Size 300KB
                                                                                                                                                • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\sea\wallpaper.json
                                                                                                                                                • Size 379B
                                                                                                                                                • SHA256 c2bb1e5d842c7e5b1b318f6eb7fe1ce24a8209661ddd5a83ab051217ca7c3f65
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\stars\preview.png
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 4fa185f67eaf3a65b991cea723d11f78de15a6a9a5235848a6456b98a9d7f689
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\stars\wallpaper.json
                                                                                                                                                • Size 537B
                                                                                                                                                • SHA256 d1bef520c71c7222956d25335e3ba2ea367d19e6c821fb96c8112e5871576294
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wallpaper.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\web\wallpaper.json
                                                                                                                                                • Size 379B
                                                                                                                                                • SHA256 7fdddc908bd2f95411dcc4781b615d5da3b5ab68e8e5a0e2b3d2d25d713f0e01
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                web_preview.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.10.0.1796\resources\wallpapers\web\web_preview.png
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 0bbf72a3c021393192134893777ecb305717ccef81b232961ca97ae4991d9ba8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 48B
                                                                                                                                                • SHA256 97f98dd3ac58f33a84d0612af43e3bbae0cbc2115038785b031b495cb11d9dff
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index
                                                                                                                                                • Size 24B
                                                                                                                                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                temp-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                • Size 504B
                                                                                                                                                • SHA256 e4d19b0ef4e195b051346093837ed4efa344e5b63d7774536273eb89e194da39
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 48B
                                                                                                                                                • SHA256 b0c81d144869e4a03dcdcd611d55979d81f9fa45d431d7806c81ecfaba7e0b89
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                data_1
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\DawnGraphiteCache\data_1
                                                                                                                                                • Size 264KB
                                                                                                                                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                data_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\DawnWebGPUCache\data_0
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                data_2
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\DawnWebGPUCache\data_2
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                data_3
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\DawnWebGPUCache\data_3
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 5bbcb91ad4dbe575bb70f987b0615dcb541c583e2b6bac9444b918ed5b03dc80
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferences4cf990b0-5564-4d69-b314-6e4e25d23e6c.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences4cf990b0-5564-4d69-b314-6e4e25d23e6c.tmp
                                                                                                                                                • Size 9KB
                                                                                                                                                • SHA256 59345fbd7796d88f24388ef9654d1440f34715ed989a784d36c800f6644da11d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferencesc4b0c62b-a0b9-405f-9de1-53a12d30d40e.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferencesc4b0c62b-a0b9-405f-9de1-53a12d30d40e.tmp
                                                                                                                                                • Size 15KB
                                                                                                                                                • SHA256 8be3d512bb49b4bb5105893ab9ff7a81f233472646b76860c98445e2cab0f94c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferencesd5fbddaa-a236-4b37-990c-e1151727b5e7.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferencesd5fbddaa-a236-4b37-990c-e1151727b5e7.tmp
                                                                                                                                                • Size 17KB
                                                                                                                                                • SHA256 d7b8f66483691dbfc03b911a504419b15886d972aba52f5562cfb331b66292b9
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferencese0a99bbb-aa2e-4cce-a0fc-84b351dd9a82.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferencese0a99bbb-aa2e-4cce-a0fc-84b351dd9a82.tmp
                                                                                                                                                • Size 13KB
                                                                                                                                                • SHA256 8565dd1db4eb2060cc868fb90cde9bc58b3fdcb22c2232ce229c41ddbafd3fc1
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Secure Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 c8e07beabc3ca0532c40e2f7c86a2d9602db4423c731cf689f5bb7357438b01b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Secure Preferences19c34d89-6203-4373-a44b-185e145b248c.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences19c34d89-6203-4373-a44b-185e145b248c.tmp
                                                                                                                                                • Size 14KB
                                                                                                                                                • SHA256 7204505ec7bfe1e8dab04b0efdb85508952194a93fef0a87eed7228a74381b79
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Secure Preferences52c35cbe-85dc-4194-a0e4-43ef4142fd6a.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences52c35cbe-85dc-4194-a0e4-43ef4142fd6a.tmp
                                                                                                                                                • Size 13KB
                                                                                                                                                • SHA256 50f39bac4279e0d6ab01fc3b95d19b9dca3cd8974037296d2d6b0d1586792382
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                MANIFEST-000001
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
                                                                                                                                                • Size 41B
                                                                                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                128.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir6552_452871668\Trusted Icons\Icons\128.png
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                256.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir6552_452871668\Trusted Icons\Icons\256.png
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                64.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir6552_452871668\Trusted Icons\Icons\64.png
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                96.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir6552_452871668\Trusted Icons\Icons\96.png
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Yandex Profile.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Yandex Profile.ico
                                                                                                                                                • Size 160KB
                                                                                                                                                • SHA256 0f8234f1be2e9f2fe13431582a47426796d3ded990067fb9af8111d06bbfb99b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State4a38288f-4a2b-46bf-9e3e-5a9ebd362dd7.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State4a38288f-4a2b-46bf-9e3e-5a9ebd362dd7.tmp
                                                                                                                                                • Size 234KB
                                                                                                                                                • SHA256 a3eea9b80341c0459090f8df08593090d6cade4926aa1189b537f5288b0bfb84
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local Statef915a95c-54c2-4c66-9aea-499ed4bf4178.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local Statef915a95c-54c2-4c66-9aea-499ed4bf4178.tmp
                                                                                                                                                • Size 219KB
                                                                                                                                                • SHA256 00ec4fedc4f12a8acba90a7c041acf0cd53e7a57c73ff99a0ea12f3748b24f42
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                metadata.json9d3d4091-660f-4e9d-a0cb-d206fa214109.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\extensions_crx_cache\metadata.json9d3d4091-660f-4e9d-a0cb-d206fa214109.tmp
                                                                                                                                                • Size 13B
                                                                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                CURRENT
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\KLauncher\Local Storage\leveldb\CURRENT
                                                                                                                                                • Size 16B
                                                                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\KLauncher\Network\Network Persistent State
                                                                                                                                                • Size 59B
                                                                                                                                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                fb5884dd-d98b-4bdb-a4a9-87d5d149d858.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\KLauncher\Network\fb5884dd-d98b-4bdb-a4a9-87d5d149d858.tmp
                                                                                                                                                • Size 300B
                                                                                                                                                • SHA256 cd48a90264ccd4be3f6caf7cddadfcb8340882c59ad1c5c04864cbc6710dd5c2
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                config.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\KLauncher\config.json
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 d8f2c15eb3c281ae0f545ac1243161fde643881140d3f08b1406ae753bd63842
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                config.json.tmp-2516572187b28387
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\KLauncher\config.json.tmp-2516572187b28387
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 0b195c7523dc786d773528e9c560b143734f4b8acec705f62345f516b66771cb
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                config.json.tmp-25165722715dc4f3
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\KLauncher\config.json.tmp-25165722715dc4f3
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 5c46e3bce81d9669682f071d78acc7989517f80804eeb54e3c2b19c34ebe3972
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                main.log
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\KLauncher\logs\main.log
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 62c5df949dcb6764fb5a246fbde385ad014e1bb76d1d9ce580cc21fc5327c198
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                default.exc
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                                                                                                                • Size 2B
                                                                                                                                                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                KLauncher.lnk
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KLauncher.lnk
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 8e34f444d2e2889cc26a9dc366f407c82b805abcbd3f32a984106ef55c09c9bf
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                KLauncher.lnk
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KLauncher.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 252bc0e76a917bdcdb697deab69c6cf60472e884194fdae872096ccb6f2005e4
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                places.sqlite
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\abz62oon.Admin\places.sqlite
                                                                                                                                                • Size 68KB
                                                                                                                                                • SHA256 d1d80a75067fa7d9115483b44b14f961d6cd3c50e71f7cfef44f5b6d59d5ec28
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Bookmarks
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 dbbc77604a15f959f8ec84aea5aa5e4cf81154593e5bc85b6cebe28c4043f884
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                BookmarksExtras
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\BookmarksExtras
                                                                                                                                                • Size 19KB
                                                                                                                                                • SHA256 3b1d1519799508c5e8755718a5b4c17cbb96618d86be57eb9d9659f7363cd296
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences
                                                                                                                                                • Size 318B
                                                                                                                                                • SHA256 026152cf85ba2a5592040c55407400916dd97db9f47144491d89c118af5bc690
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                KLauncher.lnk
                                                                                                                                                • Path C:\Users\Admin\Desktop\KLauncher.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 994828e529869e835c37c9f14f41a57ee0554d49642f6aef0f468fb562f3dd72
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Warface.lnk
                                                                                                                                                • Path C:\Users\Admin\Desktop\Warface.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 4e3f4ca6852d0651b805b72de952d9972050e2358973077ec1a7ebb80d01bbd7
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ВарТандер.lnk
                                                                                                                                                • Path C:\Users\Admin\Desktop\ВарТандер.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 978c0830b29ff4fdbf47c3853d5ce966451df7a1fe5d1586b956062c22956666
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Мир Кораблей.lnk
                                                                                                                                                • Path C:\Users\Admin\Desktop\Мир Кораблей.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 153a3a22f6577d15bfda575646d2205ef10209b4935b5d1bcb14869c9be9a4b5
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Мир Танков.lnk
                                                                                                                                                • Path C:\Users\Admin\Desktop\Мир Танков.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 165f51cf514da2adefc172b93f228ad2322b9d545907f0cee7c64938299bfe16
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Яндекс.Игры.lnk
                                                                                                                                                • Path C:\Users\Admin\Desktop\Яндекс.Игры.lnk
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 2f80a2fe1518641f88d348f0b43c012999071bf6bbe856343c38d7246b36fa4d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                MSIDEC5.tmp
                                                                                                                                                • Path C:\Windows\Installer\MSIDEC5.tmp
                                                                                                                                                • Size 181KB
                                                                                                                                                • SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                MSIDF82.tmp
                                                                                                                                                • Path C:\Windows\Installer\MSIDF82.tmp
                                                                                                                                                • Size 189KB
                                                                                                                                                • SHA256 669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                manifest.json
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_578055767\manifest.json
                                                                                                                                                • Size 43B
                                                                                                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                manifest.json
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_628013480\manifest.json
                                                                                                                                                • Size 135B
                                                                                                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                service_update.exe
                                                                                                                                                • Path C:\Windows\SystemTemp\sdwra_6308_1657287647\service_update.exe
                                                                                                                                                • Size 5.5MB
                                                                                                                                                • SHA256 042c1c7ad3eb9b5f22519e8f8617d399987ba7499f476c13e2ee846944d57770
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                yandex_browser_service_update.log
                                                                                                                                                • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 586e383139bb1356eee05521a9afad6669ae1379b5e16372eacb0ada71270dd3
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                yandex_browser_service_update.log
                                                                                                                                                • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 8c00bda1cbaf7e37b80068e9f300a3db633f2f4a6894e573273ca2cf43fe53bc
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                memory/236-0-0x0000000000050000-0x0000000000142000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/236-1427-0x0000000000050000-0x0000000000142000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/236-10-0x0000000000050000-0x0000000000142000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-710-0x0000000008640000-0x000000000864A000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-709-0x0000000003A90000-0x0000000003A9A000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-694-0x00000000092A0000-0x00000000092AA000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-696-0x00000000094A0000-0x00000000094AA000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-690-0x0000000006ED0000-0x0000000006EDA000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-712-0x0000000006ED0000-0x0000000006EDA000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-2551-0x0000000000F80000-0x0000000000F81000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-711-0x00000000092A0000-0x00000000092AA000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-713-0x00000000094A0000-0x00000000094AA000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-1382-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-692-0x0000000008640000-0x000000000864A000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-3378-0x0000000000F10000-0x0000000000F11000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/572-684-0x0000000003A90000-0x0000000003A9A000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/972-3654-0x000001BFDD920000-0x000001BFDDB61000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1228-3061-0x000001E803C00000-0x000001E803CD6000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1960-3063-0x0000021D8CD00000-0x0000021D8CDD6000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2516-3062-0x0000021D322B0000-0x0000021D32386000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3456-2378-0x00007FFF21C10000-0x00007FFF21C11000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3456-2807-0x0000019E8D750000-0x0000019E8D7F7000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4404-12-0x0000000002B60000-0x0000000002B61000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4404-11-0x0000000000430000-0x00000000007E9000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4404-101-0x0000000000430000-0x00000000007E9000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4404-6-0x0000000002B60000-0x0000000002B61000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4404-72-0x0000000000430000-0x00000000007E9000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4404-627-0x0000000000430000-0x00000000007E9000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4404-726-0x0000000000430000-0x00000000007E9000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4404-1425-0x0000000000430000-0x00000000007E9000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4544-2667-0x0000022294AD0000-0x0000022294BA6000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4544-2525-0x00007FFF22550000-0x00007FFF22551000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4544-2526-0x00007FFF22AA0000-0x00007FFF22AA1000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4664-2808-0x000001A871FB0000-0x000001A872057000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4852-1614-0x0000023B7FB50000-0x0000023B7FB74000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4852-1430-0x0000023B7F340000-0x0000023B7F362000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4852-1610-0x0000023B7F640000-0x0000023B7F64A000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4852-1575-0x0000023B7F6C0000-0x0000023B7F6DE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4852-1580-0x0000023B7F6E0000-0x0000023B7F792000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5612-2356-0x0000021E034E0000-0x0000021E03721000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6492-3085-0x0000023B20730000-0x0000023B20731000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6492-3075-0x0000023B20730000-0x0000023B20731000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6492-3077-0x0000023B20730000-0x0000023B20731000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6492-3084-0x0000023B20730000-0x0000023B20731000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6492-3081-0x0000023B20730000-0x0000023B20731000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6492-3086-0x0000023B20730000-0x0000023B20731000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6492-3083-0x0000023B20730000-0x0000023B20731000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6492-3082-0x0000023B20730000-0x0000023B20731000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6608-2156-0x0000017A3A910000-0x0000017A3AB51000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6660-2290-0x000001D3A8310000-0x000001D3A8551000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6712-3932-0x000002B1292A0000-0x000002B1294E1000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/7160-1613-0x000001F84E440000-0x000001F84E46A000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/7160-1540-0x000001F84E300000-0x000001F84E348000-memory.dmp
                                                                                                                                                Download