Analysis
- geolocation tags
- user interaction
yes - max time kernel
656s - max time network
659s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 17:17
General
- Target https://yandex.ru
- Sample260629-vt8bmscs2m
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 15 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Drops file in System32 directory 1 IoCs
- UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 52 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 47 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies Control Panel 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 11 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: LoadsDriver 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 54 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 24 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yandex.ru1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffebc34c188,0x7ffebc34c194,0x7ffebc34c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,15832450509219738963,7703081470922468068,524288 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,16593654104193665177,16148985823006850325,262144 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,6663168703942213340,12094242763572846353,524288 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,538248095788932570,15268979984701154089,2097152 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,15056389342977401568,15532420568542194249,2097152 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,10694049420953714112,7863676860448208627,2097152 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,9156636703100064867,16285503175885584453,2097152 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3756,i,6957519369474914374,11331705586480048110,2097152 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,2565514117486879226,15822659784559951469,524288 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,6911522657571453552,426550222454917233,524288 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,3340611279679759305,13377624628101053969,524288 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,3340611279679759305,13377624628101053969,524288 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6564,i,12519760627465325084,17666938023046450006,2097152 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3700,i,17293803813152934590,14147419156123457951,2097152 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7176,i,10711652848292276933,15590473870795325158,2097152 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,4062636737931009150,12032374488833424105,524288 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,7775824605982280719,10732071337151195791,524288 --field-trial-handle=2316,i,14424495173343411951,15585145665353673985,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x2c8,0x7ffebc34c188,0x7ffebc34c194,0x7ffebc34c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,3078058449719299160,5622377303189738465,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,12175882592667600019,3929893706943204753,262144 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,7090873280779780526,6043273576418063445,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,10937763532556849199,17424660996474431220,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,10937763532556849199,17424660996474431220,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,15802841196657460438,6563503195044718836,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,7608368361004794037,3481262319702200575,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,9720889111242212390,18428917192013086669,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,16775294111995999825,18068796357596785617,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,14028360784452285482,18217512412725088561,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,5129770953210056356,17906511325535592330,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,12234817841670957489,3332481555525985063,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,15769930600227083562,3059201423806350386,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,16462842814528768791,16489772626144523856,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,16282991035495738922,6433920644113495366,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4380,i,16279761736158361052,18000507059512530351,262144 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,10447733166159281994,14316180339070620527,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,3083683045203422944,1767557479349451446,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,10919189695172270034,15088396978516318997,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,13449660478566927147,2451737569424352092,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,14646081194093337506,6380626140076428399,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9590930642829738105,2470711934436009562,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,4953660066602494534,12290833841195951529,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,5853809412567502712,12755411811723447043,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,10715790160092150529,16019889388815704262,524288 --field-trial-handle=2500,i,2271144965583642963,18393204477970072566,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270331 -ipcHandle 2044 -initialChannelId {0bc96f47-115d-4187-b2ac-b94c890f2dde} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270331 -ipcHandle 2420 -initialChannelId {3f7d3e48-544b-46f7-b80c-9c986f49a417} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27274 -prefMapHandle 3788 -prefMapSize 270331 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {fb97c789-e902-44c9-b2ed-98d5afafeb27} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270331 -ipcHandle 4080 -initialChannelId {24bcf802-bcd1-4575-bdc3-06b1d716103b} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2784 -prefsLen 34773 -prefMapHandle 1632 -prefMapSize 270331 -jsInitHandle 4224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3076 -initialChannelId {86e45319-46e0-4492-b4e9-ce679cedfa25} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2800 -prefsLen 34876 -prefMapHandle 2804 -prefMapSize 270331 -ipcHandle 2888 -initialChannelId {55805d58-e5e9-431a-9d3a-32f07a1abbea} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5416 -prefsLen 32950 -prefMapHandle 5348 -prefMapSize 270331 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5352 -initialChannelId {8436be0b-a9d2-46dd-a490-ff52f6311129} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32950 -prefMapHandle 5824 -prefMapSize 270331 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {cdc617f4-a5a0-4f2e-8b65-7aa59dcc450c} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5988 -prefsLen 32950 -prefMapHandle 5984 -prefMapSize 270331 -jsInitHandle 6004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6024 -initialChannelId {81d5b166-a9a4-42fd-bd0b-a255b53e0e9a} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6412 -prefsLen 32950 -prefMapHandle 6392 -prefMapSize 270331 -jsInitHandle 6396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6400 -initialChannelId {383137ff-0ee9-4f52-b466-b6de8cf36a4d} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6468 -prefsLen 32950 -prefMapHandle 6472 -prefMapSize 270331 -jsInitHandle 6476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6484 -initialChannelId {8b4e6d96-326e-4d58-9159-d55c8c21839f} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2820 -prefsLen 32950 -prefMapHandle 1416 -prefMapSize 270331 -jsInitHandle 1420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2828 -initialChannelId {9aac1c76-7ec2-49a9-b43e-125f94447982} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3116 -prefsLen 32992 -prefMapHandle 3192 -prefMapSize 270331 -jsInitHandle 2976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3184 -initialChannelId {26443e5f-1e6c-42a0-a70e-2b94fe80e90a} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6440 -prefsLen 32992 -prefMapHandle 6788 -prefMapSize 270331 -jsInitHandle 6920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3116 -initialChannelId {7f806d2f-a78a-4655-8f3c-6c65c3586619} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 33503 -prefMapHandle 7032 -prefMapSize 270331 -jsInitHandle 6932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4360 -initialChannelId {9783ae76-01f0-47ee-9b23-8e9b3629a32b} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 8084 -prefsLen 36267 -prefMapHandle 8088 -prefMapSize 270331 -ipcHandle 8096 -initialChannelId {f029a729-982e-468b-8124-c8a498bb9a36} -parentPid 2316 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2316" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 utility3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\Yandex.exe"C:\Users\Admin\Downloads\Yandex.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Yandex.exe"C:\Users\Admin\Downloads\Yandex.exe" --parent-installer-process-id=4168 --run-as-admin --setup-cmd-line="fake_browser_arc --abt-config-resource-file=\"C:\Users\Admin\AppData\Local\Temp\abt_config_resource\" --abt-update-path=\"C:\Users\Admin\AppData\Local\Temp\3d5ec35a-f9ae-413e-a489-5834cae68b24.tmp\" --brand-name=yandex --browser-present=none --distr-info-file=\"C:\Users\Admin\AppData\Local\Temp\distrib_info\" --installer-brand-id=yandex --make-browser-default-after-import --ok-button-pressed-time=605372211 --program-files-installation --progress-window=1245734 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --variations-resource-file=\"C:\Users\Admin\AppData\Local\Temp\variations_resource\" --variations-update-path=\"C:\Users\Admin\AppData\Local\Temp\ddfcb937-c435-4484-a97f-f04fe64c431b.tmp\" --verbose-logging"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\ybA4B2.tmp"C:\Users\Admin\AppData\Local\Temp\ybA4B2.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\3d5ec35a-f9ae-413e-a489-5834cae68b24.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --browser-present=none --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=37 --install-start-time-no-uac=605753647 --installer-brand-id=yandex --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=605372211 --program-files-installation --progress-window=1245734 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --source=lite --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\ddfcb937-c435-4484-a97f-f04fe64c431b.tmp" --verbose-logging5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\YB_1FA15.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\YB_1FA15.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_1FA15.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\3d5ec35a-f9ae-413e-a489-5834cae68b24.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --browser-present=none --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=37 --install-start-time-no-uac=605753647 --installer-brand-id=yandex --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=605372211 --program-files-installation --progress-window=1245734 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --source=lite --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\ddfcb937-c435-4484-a97f-f04fe64c431b.tmp" --verbose-logging6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\YB_1FA15.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\YB_1FA15.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_1FA15.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\3d5ec35a-f9ae-413e-a489-5834cae68b24.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --browser-present=none --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --distr-info-file="C:\Users\Admin\AppData\Local\Temp\distrib_info" --histogram-download-time=37 --install-start-time-no-uac=605753647 --installer-brand-id=yandex --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --make-browser-default-after-import --ok-button-pressed-time=605372211 --program-files-installation --progress-window=1245734 --send-statistics --shortcut-name-with-alice-for-new-users-enabled --source=lite --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\ddfcb937-c435-4484-a97f-f04fe64c431b.tmp" --verbose-logging --verbose-logging --run-as-admin --system-level --child-setup-process --restart-as-admin-time=6440234877⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\YB_1FA15.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\YB_1FA15.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5244 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x294,0x298,0x29c,0xa4,0x2a0,0x7ff79188a2a0,0x7ff79188a2ac,0x7ff79188a2b88⤵
- Executes dropped EXE
-
-
C:\Windows\SystemTemp\sdwra_5244_813225073\service_update.exe"C:\Windows\SystemTemp\sdwra_5244_813225073\service_update.exe" --setup8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --install9⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Windows\SystemTemp\scoped_dir5244_17425099\explorer.exe"C:\Windows\SystemTemp\scoped_dir5244_17425099\explorer.exe" --pttw1="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemTemp\scoped_dir5244_17425099\explorer.exeC:\Windows\SystemTemp\scoped_dir5244_17425099\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=7112 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff67224a2a0,0x7ff67224a2ac,0x7ff67224a2b89⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exeC:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\pin\explorer.exeC:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Yandex\YandexBrowser\Application\clidmgr.exe"C:\Program Files\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\clidmgr.exe"C:\Program Files\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Program Files\Yandex\YandexBrowser\Temp\source5244_1816374810\Browser-bin\clids_yandex.xml"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --run-as-service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5496 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x230,0x234,0x238,0x1f0,0x23c,0x7ff6cb403b20,0x7ff6cb403b2c,0x7ff6cb403b382⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --update-scheduler2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --update-background-scheduler3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --progress-window=1245734 --ok-button-pressed-time=605372211 --install-start-time-no-uac=6057536471⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=2904 --annotation=metrics_client_id=8d804c1cda92484c8b7304abfa2d35a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x15c,0x160,0x164,0x138,0x168,0x7ffeb81057f8,0x7ffeb8105804,0x7ffeb81058102⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2188,i,11642524407747281278,9863365526381526423,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2712 --brver=26.6.0.1779 /prefetch:112⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=1944,i,10652892584670629587,12242720428395594107,262144 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2656 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2000,i,7486927657302378005,9980321364828511596,262144 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2692 /prefetch:62⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=2608,i,2513260261670047751,11403081639648475801,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3244 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=2584,i,5193502523359465239,5539424582117918733,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3224 --brver=26.6.0.1779 /prefetch:122⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2440,i,15489980659315553293,6791752964276798020,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3176 --brver=26.6.0.1779 /prefetch:132⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4368,i,6086569253813548522,10994615202017122579,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4376 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --may-use-trampoline-gpu --metrics-shmem-handle=4312,i,4840451178859985155,8130734165336225831,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4320 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\26.6.0.1779\Installer\setup.exe"C:\Program Files\Yandex\YandexBrowser\Application\26.6.0.1779\Installer\setup.exe" --system-level=true --set-set-as-default-browser --set-as-default-browser2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Program Files\Yandex\YandexBrowser\Application\26.6.0.1779\Installer\setup.exe"C:\Program Files\Yandex\YandexBrowser\Application\26.6.0.1779\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5544 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff78724a2a0,0x7ff78724a2ac,0x7ff78724a2b83⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_426459656\w.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1993763469\d.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1993763469\w.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_413984855\d.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_413984855\w.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_826343018\d.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_826343018\w.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_311728424\d.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_311728424\w.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1694263099\d.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1694263099\w.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_2053258833\d.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_2053258833\w.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_134753724\d.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_134753724\w.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_572534248\pp.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_572534248\ww.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_150233501\pp.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_150233501\ww.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1383817130\pp.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1383817130\ww.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_389243735\pp.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_389243735\ww.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1127609479\pp.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1127609479\ww.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1267302173\pp.bin"3⤵
-
-
C:\Windows\SYSTEM32\regini.exeregini.exe "C:\Windows\SystemTemp\scoped_dir5544_1267302173\ww.bin"3⤵
-
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --may-use-trampoline-gpu --metrics-shmem-handle=5168,i,9809062887614004811,2090243658500044817,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5172 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5500,i,7037083341526261575,16538469754659481000,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5520 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=5812,i,17674435784490829230,6976290783074975209,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5192 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5672,i,7837473129117928095,14798345238049017633,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5668 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6096,i,16970756200199038303,1632543119835306264,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6140 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --yagp --mse-video-buffer-size-limit-mb=10 --mse-audio-buffer-size-limit-mb=1 --enable-ignition --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --skia-resource-cache-limit-mb=10 --skia-font-cache-limit-mb=1 --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6344,i,8722756668191102467,9409952006781978181,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6356 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6452,i,14724497743331613980,5382163660698592579,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6488 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6724,i,14400616094033062985,10356840623889892860,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=3488 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6872,i,17888187936089690207,3962024304827107692,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6900 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7704,i,13439276328949946175,15267012781976401417,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7724 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7852,i,16527240786803032671,6574755974000341061,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7880 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7876,i,13910245029534296031,13822581427133435810,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=8048 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8016,i,16410083814549295996,6156691145629274530,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=8024 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8004,i,9658218664598384836,4733548962151767716,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8076 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8460,i,2795389079433215829,18407151832550693538,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8524 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8472,i,11003293587012985515,10169714121250176701,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8544 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8508,i,14589978377185082806,785771567008423698,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8560 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8436,i,12636945929970557391,4195113027657795904,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8620 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8452,i,8563666267204477846,5753428826009361319,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8640 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8484,i,9245371548160049248,11904724834470691009,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=9096 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8500,i,18109771187517944058,4034981911777757463,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9144 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8492,i,12951683314940292938,834805920429582192,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9124 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8844,i,15566157643186175347,2686732966312266479,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9616 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9756,i,18057795669292475821,8413864480571717450,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9736 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9884,i,8587484340281368647,13625738088772582036,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9876 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10020,i,7235257023247479631,10074480938044548461,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=10096 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10032,i,13237371566271196031,4054759026934530705,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10224 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10364,i,6391598484446666127,567216368531642139,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10376 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10048,i,3891553553122914988,15169498984308591259,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10508 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9908,i,11072941727248915087,9715438907600250232,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10072 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10748,i,12285751139666127893,17998849543411504176,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10760 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10892,i,3693689530357351320,3742662617160352946,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10900 --brver=26.6.0.1779 /prefetch:142⤵
- Executes dropped EXE
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10908,i,18071475676360546917,16441067634698577556,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11060 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10928,i,1641499814953976867,9430619218784620821,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11068 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11412,i,2134851980442619065,4763880971931047835,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11440 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11428,i,1995427099900772345,12821010955607749049,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=11460 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=11724,i,14017871628717387589,16500168532089908855,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=11728 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=11808,i,13670867314799293126,5809399714924883024,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11828 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=12408,i,4578559351121860639,3106984723289556870,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=6332 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=12348,i,2251067450164659601,9342465995278548214,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=12608 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\26.6.0.1779\Installer\yndxstp.exe"C:\Program Files\Yandex\YandexBrowser\Application\26.6.0.1779\Installer\yndxstp.exe" --configure-user-settings --verbose-logging --system-level --shortcut-name-with-alice-for-new-users-enabled --force-configure-user-settings2⤵
- Drops file in Program Files directory
-
C:\Program Files\Yandex\YandexBrowser\Application\26.6.0.1779\Installer\yndxstp.exe"C:\Program Files\Yandex\YandexBrowser\Application\26.6.0.1779\Installer\yndxstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5136 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff65188a2a0,0x7ff65188a2ac,0x7ff65188a2b83⤵
- Drops file in Windows directory
-
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10164,i,18049980839909570060,11160813511493015903,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=10028 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=4836,i,14033976715515993324,11156683059568473725,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=10104 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=12916,i,11982289857752485107,5297165074388052289,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=12936 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8308,i,15091185872321342761,12685631773675228731,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=8280 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8292,i,343150958230075249,13108193003645299259,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=10372 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8296,i,1793789248567085402,4949917253175996669,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=8236 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=8252,i,7935353361946676688,7630645086349878267,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=8308 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8276,i,4243784925714471675,5284541280842246512,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=10372 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=file_rating.mojom.FileRating --lang=ru --service-sandbox-type=utility --utility-enable-file-rating --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="File Rating Service" --metrics-shmem-handle=6796,i,23736165573604339,10024131014613901603,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=6892 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=10320,i,8614771398206783045,2345058451956562582,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=7812 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Quarantine Service" --metrics-shmem-handle=6512,i,4627366654936707710,13581890545195573465,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=7804 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=4408,i,10944691975538502314,12836676573983757261,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=3500 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=1160,i,9358638312492181984,14473337579315083963,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=1132 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --yagp --mse-video-buffer-size-limit-mb=10 --mse-audio-buffer-size-limit-mb=1 --enable-ignition --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --skia-resource-cache-limit-mb=10 --skia-font-cache-limit-mb=1 --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=2624,i,2203044804367818575,5275754738868647868,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=5936 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=7728,i,3803359070767903224,10614960225914259831,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=10024 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=5956,i,15037203996772414430,15948980091836713066,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=11400 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=7796,i,358657226021483831,9268031380174329103,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=7832 /prefetch:12⤵
- System Time Discovery
-
-
C:\Windows\explorer.exeexplorer.exe /select, "C:\Users\Admin\Downloads\Firefox Installer.exe"2⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=deep_links_provider.mojom.DeepLinksProvider --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="DeepLinks service" --metrics-shmem-handle=10320,i,14980157501132605834,6839801331021466282,524288 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709051904800924 --mojo-platform-channel-handle=11092 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --yagp --mse-video-buffer-size-limit-mb=10 --mse-audio-buffer-size-limit-mb=1 --enable-ignition --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --skia-resource-cache-limit-mb=10 --skia-font-cache-limit-mb=1 --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=3368,i,3170361361761166194,87392077578255423,2097152 --field-trial-handle=2660,i,10508509635702497023,5679930624639842166,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2664,i,1913629030110901478,8586195664376050203,4 --trace-process-track-uuid=3190709052841842773 --mojo-platform-channel-handle=12768 /prefetch:12⤵
- System Time Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782753622 --annotation=last_update_date=1782753622 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=7088 --annotation=metrics_client_id=8d804c1cda92484c8b7304abfa2d35a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffeb81057f8,0x7ffeb8105804,0x7ffeb81058102⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={35B6F82B-8E23-4AD5-BB4E-F39B2D7DD47F}1⤵
- Drops file in Windows directory
- Enumerates system info in registry
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782753622 --annotation=last_update_date=1782753622 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5784 --annotation=metrics_client_id=8d804c1cda92484c8b7304abfa2d35a8 --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffeb81057f8,0x7ffeb8105804,0x7ffeb81058102⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={187247D6-B7D3-4D69-B736-975CA20C4094}1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782753622 --annotation=last_update_date=1782753622 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3256 --annotation=metrics_client_id=8d804c1cda92484c8b7304abfa2d35a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffeb81057f8,0x7ffeb8105804,0x7ffeb81058102⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=2016,i,6068591430071030059,4829730894431564569,262144 --field-trial-handle=2212,i,4000184123668770579,11848196052322125663,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2316,i,7562338256116938943,4442076662305214765,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2308 /prefetch:22⤵
- Network Service Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2192,i,6433131273853443064,10496495061126384909,524288 --field-trial-handle=2212,i,4000184123668770579,11848196052322125663,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2316,i,7562338256116938943,4442076662305214765,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2400 --brver=26.6.0.1779 /prefetch:112⤵
- System Time Discovery
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=dayuse --bits_job_guid={914202E9-A228-40C9-B2CC-CBDB86A94D56}1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782753622 --annotation=last_update_date=1782753622 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4908 --annotation=metrics_client_id=8d804c1cda92484c8b7304abfa2d35a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffeb81057f8,0x7ffeb8105804,0x7ffeb81058102⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=2056,i,13460117683103555141,1676790640317685923,262144 --field-trial-handle=2336,i,3757623764353235834,1719778572958421982,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2276,i,9005492972130931655,13334761094710351338,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2332 /prefetch:22⤵
- Network Service Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2240,i,4222786920895597463,1896955110912370868,524288 --field-trial-handle=2336,i,3757623764353235834,1719778572958421982,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2276,i,9005492972130931655,13334761094710351338,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2372 --brver=26.6.0.1779 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782753622 --annotation=last_update_date=1782753622 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2596 --annotation=metrics_client_id=8d804c1cda92484c8b7304abfa2d35a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffeb81057f8,0x7ffeb8105804,0x7ffeb81058102⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=1832,i,10285648148413813154,9208108097516216092,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2100 --brver=26.6.0.1779 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=1568,i,4316289380117128879,14212450748872659660,262144 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1952 /prefetch:22⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=1624,i,14441461427903220781,11537482631622141247,262144 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2080 /prefetch:62⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2516,i,13735023356803095699,4151585608887144958,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2528 --brver=26.6.0.1779 /prefetch:132⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --may-use-trampoline-gpu --metrics-shmem-handle=4120,i,11473293335258053206,1277064623263686207,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4228 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=4892,i,3554072574909878586,3266441777810503661,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=2576 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5012,i,7834726973336500094,4997642775982706562,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5208 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4156,i,14806622363859631921,12915688592045188427,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4548 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5484,i,766110855183944814,13765329084948657105,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5524 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5640,i,519230788154265884,3326879266405034134,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5644 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5864,i,10915087386235326889,4983124310077961397,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5868 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=6632,i,14130708361166327777,5338914028826499483,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6656 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6780,i,14679849330473287182,9258894565741885549,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6784 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6908,i,7799741705807340551,12203496690853864261,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6680 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7052,i,10164365683268800778,11022538546807584431,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6832 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6864,i,15878050634407837254,14914183293348036606,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5908 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=5428,i,1383341142571193950,1513382990648400048,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7144 --brver=26.6.0.1779 /prefetch:122⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=7300,i,1033525967014871357,7457073124874045613,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7304 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7368,i,3915582195738068097,8575033306588276757,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7384 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7524,i,14866982605123522967,5859738721602752627,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7552 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7676,i,10830772239054199916,9338098180585537326,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7664 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7308,i,10182923188279220363,1479422074944105739,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7408 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7852,i,859874408196266210,8242098138594847251,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7856 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8104,i,5757563833295260858,14541128699304588123,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8084 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=text_detector.mojom.TextDetectorService --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Text Detector Service" --metrics-shmem-handle=8024,i,6504390985545847332,8744734929910085089,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8156 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8016,i,9461331468530726147,14067998463246374384,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8264 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --yagp --mse-video-buffer-size-limit-mb=10 --mse-audio-buffer-size-limit-mb=1 --enable-ignition --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --skia-resource-cache-limit-mb=10 --skia-font-cache-limit-mb=1 --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8224,i,7498054324327811200,4786432258663924138,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8384 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8240,i,13563145708721798554,1836762176442376779,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8524 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8212,i,9827155079902590225,11674966958514233804,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=8536 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8512,i,260258519990572338,8937441401194641271,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=8572 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=2372,i,7756312256151524784,2128933160713444959,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=7568 --brver=26.6.0.1779 /prefetch:142⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=deep_links_provider.mojom.DeepLinksProvider --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="DeepLinks service" --metrics-shmem-handle=2368,i,6804223415327699954,5141397176300899367,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=7368 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Quarantine Service" --metrics-shmem-handle=8512,i,8694014903162170049,1653250707935999002,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=8728 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=300,i,15577326852821036779,17057612075536980004,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=7592 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=2368,i,2476287454754875381,8070727974985953299,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=8728 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=2080,i,1191027075520511043,999509741962936469,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=4944 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=spell_checker.mojom.SpellChecker --lang=ru --service-sandbox-type=utility --utility-enable-offline-spellchecker --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Проверка правописания" --metrics-shmem-handle=4912,i,2210855237154721768,11220410437253049522,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=8888 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=4948,i,8712866552172291449,12286333473493587781,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=8876 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=qr_code.mojom.QRCodeService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="QR code service" --metrics-shmem-handle=8976,i,13507371899505475886,10526447363094570741,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=9008 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=9084,i,9197292815404240800,7315179184267726874,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=8412 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7716,i,703740920513910990,13134396180042558613,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=1640 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --yagp --mse-video-buffer-size-limit-mb=10 --mse-audio-buffer-size-limit-mb=1 --enable-ignition --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --skia-resource-cache-limit-mb=10 --skia-font-cache-limit-mb=1 --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8492,i,17244158572870976364,5398796890229147511,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=8404 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=7616,i,8261499774081172030,7922251184422142140,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=9012 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=file_rating.mojom.FileRating --lang=ru --service-sandbox-type=utility --utility-enable-file-rating --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="File Rating Service" --metrics-shmem-handle=9008,i,2099473919562983084,15309705083482102131,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=8300 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Quarantine Service" --metrics-shmem-handle=8432,i,3038958129536501665,9446015623043045874,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=8364 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=8432,i,14846204442333915570,2100530162948354666,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=8824 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=deep_links_provider.mojom.DeepLinksProvider --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="DeepLinks service" --metrics-shmem-handle=8060,i,424745733253275858,15094927669508046469,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=9004 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=8968,i,3263707423043546007,4036918355932893294,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=8216 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=info-collection --metrics-shmem-handle=7600,i,7832517169379993157,17743594924350863429,262144 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=8152 --enable-elf-protection /prefetch:102⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=9308,i,2970630454698806938,16425262724398814629,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=8104 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=qr_code.mojom.QRCodeService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="QR code service" --metrics-shmem-handle=8108,i,8461683128986491933,6459678630917420078,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=9208 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=deep_links_provider.mojom.DeepLinksProvider --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="DeepLinks service" --metrics-shmem-handle=5732,i,12063563095728010628,17269991324071893851,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=5664 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=4880,i,4855153514729286334,14621000607944558623,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=4248 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=9464,i,1031256658253053418,13283308612900454587,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=9492 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=9512,i,15158382333588801077,14524269552274494865,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=8316 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=9060,i,548281689075530294,8368870127466682185,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=9504 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=9652,i,13458124532625315507,4320338010762724093,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=8304 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9656,i,8614511223353011299,13365685010318454988,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709049093675377 --mojo-platform-channel-handle=9672 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=9804,i,7285768424878568084,3582286752104932400,2097152 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709050030717226 --mojo-platform-channel-handle=4964 /prefetch:12⤵
- System Time Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=file_rating.mojom.FileRating --lang=ru --service-sandbox-type=utility --utility-enable-file-rating --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="File Rating Service" --metrics-shmem-handle=9756,i,8737498977842252,3989295863348817157,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709050967759075 --mojo-platform-channel-handle=9656 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Quarantine Service" --metrics-shmem-handle=8308,i,16816416602275118113,1747294729604236628,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709051904800924 --mojo-platform-channel-handle=9820 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=deep_links_provider.mojom.DeepLinksProvider --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="DeepLinks service" --metrics-shmem-handle=2912,i,6123810198960472225,11582633521608746902,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709052841842773 --mojo-platform-channel-handle=8264 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\ZapretX.exe"C:\Users\Admin\Downloads\ZapretX.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\openglmodfix.bat" "3⤵
-
C:\Users\Admin\Downloads\zapret.exezapret.exe4⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe"C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\OfficeClickToRun.exe"C:\Program Files\Yandex\YandexBrowser\Application\OfficeClickToRun.exe" -6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe"C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe" -6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=deep_links_provider.mojom.DeepLinksProvider --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="DeepLinks service" --metrics-shmem-handle=7604,i,14936641053414745662,8052244865914584583,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709053778884622 --mojo-platform-channel-handle=8256 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=4804,i,7880468960655452007,3162700220959910658,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709054715926471 --mojo-platform-channel-handle=9808 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=deep_links_provider.mojom.DeepLinksProvider --lang=ru --service-sandbox-type=none --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="DeepLinks service" --metrics-shmem-handle=9720,i,7605153015784708082,13353078917662219012,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709055652968320 --mojo-platform-channel-handle=9452 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=9468,i,6565454567290780710,802753782589675984,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709056590010169 --mojo-platform-channel-handle=9700 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=5532,i,8402114907709218750,17226757282133123556,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709057527052018 --mojo-platform-channel-handle=9752 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=2404,i,2189447645247700880,14453829776238671413,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709058464093867 --mojo-platform-channel-handle=8436 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=8300,i,16722458681770713258,14779534769533310258,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709059401135716 --mojo-platform-channel-handle=5532 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=9436,i,2136902203669854646,5743866587486169785,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709060338177565 --mojo-platform-channel-handle=5692 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Program Files\Yandex\YandexBrowser\Application\browser.exe"C:\Program Files\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=550F7F98-F522-4649-8FD3-349200E55656 --brand-id=yandex --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=4928,i,11372948741749217765,17183468497586248880,524288 --field-trial-handle=1956,i,17471274596433082691,8214869863461589948,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=1964,i,11429036697244838515,7622072948019429314,4 --trace-process-track-uuid=3190709061275219414 --mojo-platform-channel-handle=9784 --brver=26.6.0.1779 /prefetch:142⤵
-
-
C:\Users\Admin\Desktop\Zapret-For-Discord-Telegram-Flowseal-Main-Pubs\Zapret.exe"C:\Users\Admin\Desktop\Zapret-For-Discord-Telegram-Flowseal-Main-Pubs\Zapret.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Seat\Cost\lady.exe"C:\Users\Admin\AppData\Roaming\Seat\Cost\lady.exe" "C:\Users\Admin\AppData\Roaming\Seat\Cost\resista.bin"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Major\CreationMinuteUpdate\AutoIt3.exe' -Argument ('"' + 'C:\Users\Admin\AppData\Local\Major\CreationMinuteUpdate\LossVote.a3x' + '"');$t1=New-ScheduledTaskTrigger -AtStartup;$t2=New-ScheduledTaskTrigger -AtLogOn;$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -TaskName 'Major_CreationMinuteUpdate_Startup' -Action $a -Trigger $t1,$t2 -Principal $p -Settings $s -Force -ErrorAction Stop"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\perflog2012.db"C:\Users\Admin\AppData\Local\Microsoft\Windows\perflog2012.db"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Major\dwm.exeC:\Users\Admin\AppData\Local\Major\dwm.exe4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
-
C:\Users\Admin\AppData\Local\Major\CreationMinuteUpdate\AutoIt3.exe"C:\Users\Admin\AppData\Local\Major\CreationMinuteUpdate\AutoIt3.exe" "C:\Users\Admin\AppData\Local\Major\CreationMinuteUpdate\LossVote.a3x"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\indexidx41199.db"C:\Users\Admin\AppData\Local\Microsoft\Windows\indexidx41199.db"2⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Yandex\svchost.exe"C:\Program Files (x86)\Yandex\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\svchost.exe" -4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Yandex\YandexBrowser\Application\svchost.exe"C:\Program Files\Yandex\YandexBrowser\Application\svchost.exe" -4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004FC1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe"C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\MSBuild\SecurityHealthSystray.exe"C:\Program Files (x86)\MSBuild\SecurityHealthSystray.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
4Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
OfficeClickToRun.exe
ru.bdic
install_state.json
brand_config
all_zip
light_static.jpg
sea_preview.jpg
sea_static.jpg
sppsvc.exe
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
data_0
data_1
data_2
data_3
the-real-index
the-real-index~RFe5925af.TMP
SiteList-Enterprise.json
Edge Profile.ico
LOG
EdgeHubAppUsageSQLite.db
000003.log
LOG
ExtensionActivityEdge
Favicons
History
000003.log
LOG
Cookies
Network Persistent State
Network Persistent State
Reporting and NEL
SCT Auditing Pending Reports
Sdch Dictionaries
TransportSecurity
Preferences
Preferences
Preferences
Secure Preferences
LOG
000003.log
LOG
000003.log
LOG
sync_diagnostic.log
sync_diagnostic.log
CURRENT
MANIFEST-000001
Web Data
000003.log
000003.log
LOG
000003.log
LOG
OperationConfig
OperationConfig~RFe5a1a30.TMP
data_1
data_1
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
campaign_history
data_1
Variations
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
iconcache_idx.db
03100235E7AEBB25C597DD91664A8F544DDFC529
5D446E0CC00D7E51E0E1A2593CEE825C89A23EE4
6DED9FE7A50E8290358DC1D8C755B05692CB9E36
7C318D7D9A64FC0603AFA149A7B03C39F422908C
BE39524F63C82E3CA65768EA2EB53643ADF20519
E044175DA1D0251A11AB07AC42ECEAE0335B87B3
spoolsv.exe
20336e08-28ea-43a6-a936-849c73c5eadb.tmp
3422709087
3858960971
935117664
__PSScriptPolicyTest_xyehtv2g.2qu.ps1
lite_installer.log
master_preferences
content_new.js
tmpaddon
tmpaddon
yandex_browser_updater.log
Yandex.lnk
9f5ae6b4-9336-4d88-bc07-b1d2ebb6c79f.tmp
settings.dat
17c7e731-ac07-43f2-8214-73ce38b37370.tmp
73d842b2-fd7e-4142-b7d2-2354b6183321.tmp
Alice Cheaper Urls
data_0
data_2
data_3
f_000005
f_000006
f_000007
f_000024
f_00002d
f_00002f
f_000030
f_000031
f_000032
f_000033
f_000034
f_000035
f_000037
f_000038
f_00003e
f_00003f
f_000041
f_000042
f_000043
f_00004e
f_000053
f_000054
f_00007c
f_00007d
f_0000b1
f_0000b2
f_0000b3
f_0000b4
f_0000b5
f_0000cb
f_0000f5
f_000109
f_00010c
f_00010f
f_000124
f_000136
f_000139
611fc759e69abc6e_0
9c47f4a4f1742144_0
f0b64d9c-96c8-4535-b6a1-74d431c770ad.tmp
the-real-index
the-real-index
the-real-index
the-real-index
.usage
MANIFEST-000001
000003.log
000014.ldb
000015.log
000017.ldb
LOG
MANIFEST-000001
2a889ec9-1466-4501-87af-7c51347dee96.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
84c809a9-1dfd-4170-9bbe-83dd8feed778.tmp
temp-index
the-real-index
the-real-index
the-real-index
index
6f1287a9-2fcc-4186-9181-7096b8042e69.tmp
fdd6bab9-c8a6-4aa2-aa9d-b54735973494.tmp
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
72e66567-0396-4e7b-973e-63ed741c5694.tmp
8d4bd14f-eb9d-4bdf-bae3-348c3abd79cf.tmp
the-real-index
index.txt
d3ec6677-fce7-4fb2-9056-d65b7fb70da0.tmp
the-real-index
the-real-index
0486084c-c8be-42e6-866d-7df5ee4109f5.tmp
the-real-index
Tablo
128.png
256.png
64.png
96.png
da45f414-f668-4d57-9e6d-6f59b6e6d303.tmp
Local State
Local State
Local State
2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
a0540571-cb9d-4ecb-ad4f-15ccb112fc04.tmp
1eb48a72-a67b-4750-a2ad-f5e39956910a.tmp
data.safe.tmp
data.safe.tmp
events
141ebad4-7443-4a32-9ef4-eb8d088a8cbc
30e4e2a8-6188-4b9d-ba00-79cf86bcda0d
67c06cc0-9f70-4eee-87a9-dd63f8cd0118
6ade9453-8dd3-4174-b51e-b6aaeea54523
a9a6fd0c-2587-4a13-a824-aa3aa00ef113
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE.tmp
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
recovery.baklz4
sessionstore.jsonlz4.tmp
3285085342rcbn_ys.sqlite
3870112724rsegmnoittet-es.sqlite
ui
Yandex.h0Y9uM7O.exe.part
openglmodfix.bat
Не подтверждено 190984.~
Не подтверждено 511174.~
Не подтверждено 556627.~
settings.dat
.gitignore
2020_2_3.json
video_summarization_www_pornhub_com
widevinecdm.dll.sig
yandex_browser_service_update.log
yandex_browser_service_update.log
memory/1104-5253-0x0000017968A40000-0x0000017968AD3000-memory.dmp
memory/1108-2866-0x00007FFEDD240000-0x00007FFEDD241000-memory.dmp
memory/1124-3182-0x000001C7CB9D0000-0x000001C7CBA63000-memory.dmp
memory/1612-7272-0x0000000000400000-0x0000000001019000-memory.dmp
memory/1612-7116-0x0000000000400000-0x0000000001019000-memory.dmp
memory/1612-7002-0x0000000000400000-0x0000000001019000-memory.dmp
memory/2596-5005-0x0000022F305D0000-0x0000022F30811000-memory.dmp
memory/2596-6509-0x0000022F305D0000-0x0000022F30811000-memory.dmp
memory/2904-3321-0x0000021AE8550000-0x0000021AE8791000-memory.dmp
memory/2904-4666-0x0000021AE8550000-0x0000021AE8791000-memory.dmp
memory/3524-6987-0x0000000000400000-0x0000000001019000-memory.dmp
memory/3524-6944-0x0000000000400000-0x0000000001019000-memory.dmp
memory/3644-6469-0x0000000005740000-0x0000000005D8A000-memory.dmp
memory/3644-6482-0x0000000006AD0000-0x0000000006AF0000-memory.dmp
memory/3644-6487-0x0000000007B30000-0x0000000007BC6000-memory.dmp
memory/3644-6486-0x00000000078C0000-0x00000000078CA000-memory.dmp
memory/3644-6485-0x0000000007850000-0x000000000786A000-memory.dmp
memory/3644-6476-0x00000000064E0000-0x00000000064FE000-memory.dmp
memory/3644-6484-0x0000000007ED0000-0x000000000854C000-memory.dmp
memory/3644-6483-0x00000000077A0000-0x0000000007843000-memory.dmp
memory/3644-6471-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/3644-6479-0x0000000070450000-0x000000007049C000-memory.dmp
memory/3644-6468-0x0000000002FF0000-0x0000000003026000-memory.dmp
memory/3644-6475-0x0000000006150000-0x00000000064AB000-memory.dmp
memory/3644-6488-0x00000000078E0000-0x00000000078F1000-memory.dmp
memory/3644-6472-0x0000000005F60000-0x0000000005FC6000-memory.dmp
memory/3644-6478-0x0000000006AF0000-0x0000000006B26000-memory.dmp
memory/3644-6477-0x0000000006560000-0x00000000065AC000-memory.dmp
memory/3644-6470-0x0000000005D90000-0x0000000005DB2000-memory.dmp
memory/3952-7330-0x0000000000190000-0x0000000000DE7000-memory.dmp
memory/3952-7290-0x0000000000190000-0x0000000000DE7000-memory.dmp
memory/3952-7217-0x0000000000190000-0x0000000000DE7000-memory.dmp
memory/4140-8000-0x0000000000120000-0x0000000000D77000-memory.dmp
memory/5216-7488-0x0000000070750000-0x0000000070AAB000-memory.dmp
memory/5216-7487-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/5680-7472-0x00000000077A0000-0x00000000077C2000-memory.dmp
memory/5680-7354-0x0000000006230000-0x000000000627C000-memory.dmp
memory/5680-7420-0x0000000007170000-0x0000000007213000-memory.dmp
memory/5680-7417-0x0000000070750000-0x0000000070AAB000-memory.dmp
memory/5680-7416-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/5680-7473-0x0000000008520000-0x0000000008ADA000-memory.dmp
memory/5680-7364-0x0000000006D10000-0x0000000006D58000-memory.dmp
memory/5680-7349-0x0000000005800000-0x0000000005B5B000-memory.dmp
memory/6308-7273-0x0000000000400000-0x0000000001019000-memory.dmp
memory/6308-7322-0x0000000000400000-0x0000000001019000-memory.dmp
memory/6640-2245-0x000001F1A8A90000-0x000001F1A8A91000-memory.dmp
memory/6640-2246-0x000001F1A8A90000-0x000001F1A8A91000-memory.dmp
memory/6640-2243-0x000001F1A8A90000-0x000001F1A8A91000-memory.dmp
memory/6640-2247-0x000001F1A8A90000-0x000001F1A8A91000-memory.dmp
memory/6640-2248-0x000001F1A8A90000-0x000001F1A8A91000-memory.dmp
memory/6640-2244-0x000001F1A8A90000-0x000001F1A8A91000-memory.dmp
memory/6640-2239-0x000001F1A8A90000-0x000001F1A8A91000-memory.dmp
memory/6640-2237-0x000001F1A8A90000-0x000001F1A8A91000-memory.dmp
memory/6720-7491-0x0000000000BF0000-0x0000000001847000-memory.dmp
memory/6976-2934-0x00007FFEDDFA0000-0x00007FFEDDFA1000-memory.dmp
memory/6976-2933-0x00007FFEDD240000-0x00007FFEDD241000-memory.dmp
memory/7064-8001-0x0000000000970000-0x00000000015C7000-memory.dmp
memory/7312-6510-0x0000000000400000-0x0000000001019000-memory.dmp
memory/7312-6631-0x0000000000400000-0x0000000001019000-memory.dmp
memory/7312-6943-0x0000000000400000-0x0000000001019000-memory.dmp
memory/7648-7448-0x0000000000400000-0x0000000001019000-memory.dmp
memory/7648-7513-0x0000000000C70000-0x00000000018C7000-memory.dmp
memory/7648-7446-0x0000000000400000-0x0000000001019000-memory.dmp
memory/7680-7363-0x0000000000400000-0x0000000001019000-memory.dmp
memory/7732-7362-0x0000000000970000-0x00000000015C7000-memory.dmp
memory/7732-7329-0x0000000000970000-0x00000000015C7000-memory.dmp