Overview

overview

8

Static

static

3

2026-06-26...er.exe

windows10-2004-x64

8

2026-06-26...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 18:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_15ec283fadd540045427b557ef42449c_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 225KB
  • Sample260629-wlmkmsbt21
  • SHA256 855b23caa26dcf8f1bfbeb41656d89caae82e7515c026b93664e66f18ebc0a04
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_15ec283fadd540045427b557ef42449c_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_15ec283fadd540045427b557ef42449c_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:6108
    • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=9 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1060
    • C:\Users\Admin\AppData\Local\Temp\2026-06-26_15ec283fadd540045427b557ef42449c_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2026-06-26_15ec283fadd540045427b557ef42449c_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=1157980/cnt=0/dt=2/ct=1/rt=0 --dh 2524 --st 1782756045
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4960
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B0BD50C794D8EA569A1644575CE8F3F3
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6436
      • C:\Users\Admin\AppData\Local\Temp\0B455C70-9691-4F18-858E-438F0BDEAA71\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\0B455C70-9691-4F18-858E-438F0BDEAA71\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3964
      • C:\Users\Admin\AppData\Local\Temp\8FCA2DDA-2F16-480F-A07E-7A2B9B1D5D56\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\8FCA2DDA-2F16-480F-A07E-7A2B9B1D5D56\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\24089D66-B079-4B8B-9C62-AF03D4E7112A\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5488
        • C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
          C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3136
          • C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
            C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3200
        • C:\Users\Admin\AppData\Local\Temp\24089D66-B079-4B8B-9C62-AF03D4E7112A\sender.exe
          C:\Users\Admin\AppData\Local\Temp\24089D66-B079-4B8B-9C62-AF03D4E7112A\sender.exe --send "/status.xml?clid=14756030-9&uuid=881bf3bb-e259-4174-922b-ee52222c23ef&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A36%0A40%0A42%0A45%0A57%0A61%0A102%0A103%0A111%0A123%0A124%0A125%0A"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:6616
  • C:\Users\Admin\AppData\Local\Temp\yb10BF.exe
    "C:\Users\Admin\AppData\Local\Temp\yb10BF.exe" --job-name=yBrowserDownloader-708278D8-8599-42AB-A190-457EE249F2CE --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\yb10BF.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14756004-9&ui={881bf3bb-e259-4174-922b-ee52222c23ef} --use-user-default-locale
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\yb1C77.tmp
      "C:\Users\Admin\AppData\Local\Temp\yb1C77.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ccc249e8-bc0b-4828-9926-bacdd117dccc.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=565790309 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-708278D8-8599-42AB-A190-457EE249F2CE --local-path="C:\Users\Admin\AppData\Local\Temp\yb10BF.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14756004-9&ui={881bf3bb-e259-4174-922b-ee52222c23ef} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\d99e3483-5252-4213-806d-498c6db3e679.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:7120
      • C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ccc249e8-bc0b-4828-9926-bacdd117dccc.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=565790309 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-708278D8-8599-42AB-A190-457EE249F2CE --local-path="C:\Users\Admin\AppData\Local\Temp\yb10BF.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14756004-9&ui={881bf3bb-e259-4174-922b-ee52222c23ef} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\d99e3483-5252-4213-806d-498c6db3e679.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\ccc249e8-bc0b-4828-9926-bacdd117dccc.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=565790309 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-708278D8-8599-42AB-A190-457EE249F2CE --local-path="C:\Users\Admin\AppData\Local\Temp\yb10BF.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14756004-9&ui={881bf3bb-e259-4174-922b-ee52222c23ef} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\d99e3483-5252-4213-806d-498c6db3e679.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=587254966
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Time Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2764 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7a96ca2a0,0x7ff7a96ca2ac,0x7ff7a96ca2b8
            5⤵
            • Executes dropped EXE
            PID:3640
          • C:\Windows\SystemTemp\sdwra_2764_176876876\service_update.exe
            "C:\Windows\SystemTemp\sdwra_2764_176876876\service_update.exe" --setup
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4492
            • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe
              "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --install
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:828
          • C:\Windows\SystemTemp\scoped_dir2764_1983994205\explorer.exe
            "C:\Windows\SystemTemp\scoped_dir2764_1983994205\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:7160
            • C:\Windows\SystemTemp\scoped_dir2764_1983994205\explorer.exe
              C:\Windows\SystemTemp\scoped_dir2764_1983994205\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=7160 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff67571a2a0,0x7ff67571a2ac,0x7ff67571a2b8
              6⤵
              • Executes dropped EXE
              PID:3432
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2144
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source2764_1588894247\Browser-bin\clids_yandex_second.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6660
  • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --run-as-service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:6772
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6772 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x23c,0x240,0x244,0x104,0x248,0x7ff6ab0f3b20,0x7ff6ab0f3b2c,0x7ff6ab0f3b38
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:6420
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --update-scheduler
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1779\service_update.exe" --update-background-scheduler
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:1788
  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=565790309
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=3668 --annotation=metrics_client_id=83b465709dc54688833410cf203fd9ba --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff904a357f8,0x7ff904a35804,0x7ff904a35810
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1964
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2100,i,16246362466100000683,17586646693670092859,262144 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2320 /prefetch:6
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4420
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=1972,i,1752121067137852049,16815440052558306098,262144 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2240 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5400
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2480,i,15046174935841069788,1466008060479209444,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2640 --brver=26.6.0.1779 /prefetch:11
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:1580
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2800,i,4729228715276137265,3963977902149798606,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2908 --brver=26.6.0.1779 /prefetch:13
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5596
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3468,i,11559088807422336654,2365136974459506067,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3504 --brver=26.6.0.1779 /prefetch:12
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4496
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3548,i,18321933552924687635,12680078386203330735,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3408 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5996
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4488,i,8247479792569259881,2638032802274654447,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3696 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:6412
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --may-use-trampoline-gpu --metrics-shmem-handle=4632,i,15534021450250770453,17457616560834076809,2097152 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4652 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:6404
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=5228,i,15434028292954106087,6486922696738836800,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5236 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:6316
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4724,i,10313017807861317274,813621054238119176,2097152 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5500 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:7040
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5672,i,8747851860027744751,12787743134283763451,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5664 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1484
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5848,i,7051931446355206738,5102949966262924651,2097152 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5748 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:4432
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6004,i,12160222549419975950,17550660763719162602,2097152 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6000 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:5452
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6296,i,13766914367717271404,11336628979391174734,2097152 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6356 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:5600
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=3408,i,9577848397528061335,1602325113594846444,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=3404 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5808
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=6040,i,6950685697299621794,14731733913465290472,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7288 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1212
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7368,i,14806573601878367962,3048331953069227240,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7448 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:5500
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7380,i,5880770689927980723,7436171163696798805,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7428 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1192
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7332,i,15801514178677877748,7492119774730040994,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7488 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5820
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7416,i,2264916683741964244,5095573287406191786,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7528 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5644
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7344,i,10444295339057331140,8444696087416552743,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7468 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3988
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7320,i,9502016293046655862,5977133137565073628,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7508 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1600
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7552,i,65868339514092661,1568105469253017764,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7480 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5548
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7564,i,11970236901296273722,2903111164968065137,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7644 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3760
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7576,i,13689186472793937028,8871803237206219881,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7664 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5824
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7588,i,7799287006328831743,15196499258785014789,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7684 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1784
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8240,i,2770495575095456082,15369993438695746519,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8836 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:468
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9020,i,3257448316739099771,16445835448022612119,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=9032 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:1564
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8972,i,10799682392233253883,3976518763532312643,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9240 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:1604
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9228,i,11554343978280712383,5635060105757795699,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9260 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:6684
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9244,i,238051178217553992,13606788057340960997,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9512 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:1904
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8992,i,18372137797362281581,6266069008348516468,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9520 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:3928
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9008,i,11344083741584170445,11824970660980134144,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9648 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:2676
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9776,i,14961504055453006938,1431796738173021227,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9908 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:5124
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10044,i,376991523759670551,4237289513218090999,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10056 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:672
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10060,i,1396891171877139457,3736110408932151948,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10192 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:6412
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10336,i,4417655001918949037,8903935638584790780,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10368 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:5396
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=6232,i,5869283545173744032,15783853828958059094,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10348 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:5668
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10616,i,1667095980881452258,15426277069007881232,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10628 --brver=26.6.0.1779 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:7080
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10792,i,5904360958474634579,3584937362339395606,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10804 --brver=26.6.0.1779 /prefetch:14
      2⤵
        PID:5060
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10956,i,6488449239976456323,11248235315975112556,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10968 --brver=26.6.0.1779 /prefetch:14
        2⤵
          PID:2476
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11108,i,5969352744201783338,17355505338476043464,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11120 --brver=26.6.0.1779 /prefetch:14
          2⤵
            PID:2796
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=11300,i,3481313722232934142,11752375856631447993,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11328 --brver=26.6.0.1779 /prefetch:14
            2⤵
              PID:6288
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=3548,i,9578893261485404226,9053667707787249183,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=7956 --brver=26.6.0.1779 /prefetch:14
              2⤵
                PID:6992
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=2756,i,6726634192163790048,10825457294522835809,2097152 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=2736 /prefetch:1
                2⤵
                • System Time Discovery
                PID:5420
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8032,i,11316499124121916304,395353651183587570,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=8040 --brver=26.6.0.1779 /prefetch:14
                2⤵
                  PID:6580
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8140,i,7143688490169716606,15417167928983943316,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=3456 --brver=26.6.0.1779 /prefetch:14
                  2⤵
                    PID:5992
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7908,i,7276467394732041362,8414982001616293824,2097152 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=11476 /prefetch:1
                    2⤵
                    • System Time Discovery
                    PID:5180
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7896,i,550871469404058788,15008036186966132012,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=7696 --brver=26.6.0.1779 /prefetch:14
                    2⤵
                      PID:4384
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7900,i,17681384616168464964,14533175783310767685,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=8052 --brver=26.6.0.1779 /prefetch:14
                      2⤵
                        PID:3860
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=2788,i,4248211855891353760,14815972812995614813,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=8048 --brver=26.6.0.1779 /prefetch:14
                        2⤵
                          PID:5380
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=748,i,16826688536464092851,17523116588688188848,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=1108 --brver=26.6.0.1779 /prefetch:14
                          2⤵
                            PID:3928
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=5440,i,1610779785103342684,6019972305757038162,524288 --field-trial-handle=2244,i,13037037603832749679,4506558686953191652,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2264,i,5505841175466712349,6651917704368802298,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=3036 --brver=26.6.0.1779 /prefetch:14
                            2⤵
                              PID:5280
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:2692
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                              1⤵
                              • Modifies data under HKEY_USERS
                              PID:1700
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:1916
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782756097 --annotation=last_update_date=1782756097 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1916 --annotation=metrics_client_id=83b465709dc54688833410cf203fd9ba --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ff904a357f8,0x7ff904a35804,0x7ff904a35810
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:4596
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={90F469CB-23B4-4150-957F-9064F38CAF7F}
                              1⤵
                              • Drops file in Windows directory
                              • Enumerates system info in registry
                              PID:3920
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782756097 --annotation=last_update_date=1782756097 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3920 --annotation=metrics_client_id=83b465709dc54688833410cf203fd9ba --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ff904a357f8,0x7ff904a35804,0x7ff904a35810
                                2⤵
                                  PID:2456
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={EE3F0C8C-4DEE-4F5F-B5A3-1C595A46B8ED}
                                1⤵
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:6040
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782756097 --annotation=last_update_date=1782756097 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6040 --annotation=metrics_client_id=83b465709dc54688833410cf203fd9ba --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ff904a357f8,0x7ff904a35804,0x7ff904a35810
                                  2⤵
                                    PID:6820
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2132,i,2201205047921505098,632546232071273586,524288 --field-trial-handle=2304,i,2726026118691743234,17285069180473886080,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2308,i,13269583995504038076,2249251326009455548,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2336 --brver=26.6.0.1779 /prefetch:11
                                    2⤵
                                    • System Time Discovery
                                    PID:2632
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1948,i,10893237779490545253,2139579790307516806,262144 --field-trial-handle=2304,i,2726026118691743234,17285069180473886080,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2308,i,13269583995504038076,2249251326009455548,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2
                                    2⤵
                                    • Network Service Discovery
                                    PID:5824
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=dayuse --bits_job_guid={1DEEF73F-7A00-4711-8214-F1F4CC2B0AE1}
                                  1⤵
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  PID:1544
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1782756097 --annotation=last_update_date=1782756097 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1544 --annotation=metrics_client_id=83b465709dc54688833410cf203fd9ba --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1779 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ff904a357f8,0x7ff904a35804,0x7ff904a35810
                                    2⤵
                                      PID:2848
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2140,i,6170872102801992239,17980788271465113164,524288 --field-trial-handle=2304,i,1381085587846240214,16160221954671565569,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2308,i,460652886115655670,1734944574170493736,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2336 --brver=26.6.0.1779 /prefetch:11
                                      2⤵
                                      • System Time Discovery
                                      PID:6356
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=881bf3bb-e259-4174-922b-ee52222c23ef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1948,i,13867334231994634620,16213024772945897032,262144 --field-trial-handle=2304,i,1381085587846240214,16160221954671565569,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2308,i,460652886115655670,1734944574170493736,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2
                                      2⤵
                                      • Network Service Discovery
                                      PID:5920

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Defense Evasion

                                        Modify Registry

                                        2
                                        T1112

                                        Subvert Trust Controls

                                        1
                                        T1553

                                        Install Root Certificate

                                        1
                                        T1553.004

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        1
                                        T1552

                                        Credentials In Files

                                        1
                                        T1552.001

                                        Discovery

                                        Browser Information Discovery

                                        1
                                        T1217

                                        Network Service Discovery

                                        1
                                        T1046

                                        Peripheral Device Discovery

                                        1
                                        T1120

                                        Query Registry

                                        5
                                        T1012

                                        System Information Discovery

                                        4
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        System Time Discovery

                                        1
                                        T1124

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        e58fbc3.rbs
                                        • Path C:\Config.Msi\e58fbc3.rbs
                                        • Size 912B
                                        • SHA256 d5c00ea802f2b9ce16d3f95a8b1234826273ad1ec5889d2ea284ce41a2cadb88
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                        • Size 1KB
                                        • SHA256 1f4884b5e66dbd1f8159838521138a33ce95a21f074e498d50f13211b1ed8382
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                        • Size 1KB
                                        • SHA256 30772f99aef6e0e37912478f165327fb78a41628f0c62c810a180ab61ba1a128
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                        • Size 1KB
                                        • SHA256 87be63930fadd3dc6eb68eecc4b02080c98efc927f6f0a3d0509bc613e952fe7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                        • Size 1KB
                                        • SHA256 978f5c612920c000192c1ba3469e493666c5d05bd639add008c9ba3520f062f6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                        • Size 1KB
                                        • SHA256 204939f68ab9e3ade87f191fbd8f12bc00d84ff3e00334a2908c7c8e8ce7e095
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                        • Size 1KB
                                        • SHA256 8db6767d377ffaca3458ec34263b31d90b2b7cd39f7b88f78644f0eae959a03c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                        • Size 508B
                                        • SHA256 8751e1d3f093a6de7fa5d61a699ed04a01172ed4f18add08754587e8a37120a5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                        • Size 536B
                                        • SHA256 93f31cf4feb9ee77251790114a756f7d924b22ea72ee55d8a96eb5347269e4a3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                        • Size 536B
                                        • SHA256 7ad2af8c38312a60691348389bee75c577400eca9484151a87a77b4cf139d0f6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                        • Size 536B
                                        • SHA256 be91cc832ba52ffd8a3bc72fcbdecc24782c665810aafa7e755d3d0be9c94d35
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                        • Size 536B
                                        • SHA256 8bd902456a990d3f4ff27987324a560364cd976dba11ae4848c8193b06261e61
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                        • Size 506B
                                        • SHA256 a715cb188492ddf3622a3d51c1f019bd5a844825a5fe87dc6fe81aafd8b43d76
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        36b04c242dddcd0716bb35d078f366d3
                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\thumbnails\36b04c242dddcd0716bb35d078f366d3
                                        • Size 15KB
                                        • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        422bc8b54da8d2f796eca147e6eceece
                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\thumbnails\422bc8b54da8d2f796eca147e6eceece
                                        • Size 14KB
                                        • SHA256 a61c9c82b6cf7b583bf6c664b343501fc37ac08fa75bf15b01b3aa4ea11297b5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        lite_installer.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\0B455C70-9691-4F18-858E-438F0BDEAA71\lite_installer.exe
                                        • Size 420KB
                                        • SHA256 abae05f38d9ffda8749f631a868c90a417b5ffb70f4a10ab10a63391588ee2a2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        sender.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\24089D66-B079-4B8B-9C62-AF03D4E7112A\sender.exe
                                        • Size 260KB
                                        • SHA256 4128b1566d599ef2fe9aa4a693fd9e715f45d6a4d1d11d6c31b49cabf804609b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        YandexPackSetup.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                                        • Size 10.1MB
                                        • SHA256 4ebc87110eb920d39e95bc5c8fb9084b08eba1ecd533a1d04e2651189b81d9e2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        seederexe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\8FCA2DDA-2F16-480F-A07E-7A2B9B1D5D56\seederexe.exe
                                        • Size 8.5MB
                                        • SHA256 b06696eca2727f9cb18497c8afd630ab6294eb2f4c690628dffe8826f51ad23d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        BRAND_COMMON
                                        • Path C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\BRAND_COMMON
                                        • Size 25.6MB
                                        • SHA256 f4aee63c565b7129b957f1b32b2189ed6590feda13cf3bf7074c5c7313fb65bd
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        brand_yandex
                                        • Path C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\brand_yandex
                                        • Size 2.5MB
                                        • SHA256 b98f360bb565119fb450627cadaadfb84a3f23f5f092f06b35e9a49e72891624
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        setup.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\YB_C68B5.tmp\setup.exe
                                        • Size 7.5MB
                                        • SHA256 20c55e05a2a458f0b342af6ce480ef6bbbed146b1f68c33271c12e2ecbea10b0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        YandexSearch00000.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                        • Size 1KB
                                        • SHA256 4eab9bd7a6b1c5e5d0d3c94c7a376c1c2b89d61e0c1ccacc9f284b9ba5e5c182
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        clids-yasearch.xml
                                        • Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                        • Size 694B
                                        • SHA256 19f1c05d77369881872a521fd432414bc960d47a9c3d25ae40130e6b29f06001
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        lite_installer.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                        • Size 2KB
                                        • SHA256 6f99205fbdbebcb2997f92a58791f279099302ce6b07f061b6040bf68c094eeb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        lite_installer.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                        • Size 4KB
                                        • SHA256 06e649a1802538e3bdff02aca2251bd5ae3c7c5cdef8e8a644de512fe352d5b9
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        master_preferences
                                        • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                        • Size 542B
                                        • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        tmp5488aaaaaa
                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp5488aaaaaa
                                        • Size 2.5MB
                                        • SHA256 28c615b45bf32be9eff49725dbd31f0309ef71d8d341dffd82c40c81eee211a6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        vendor00000.xml
                                        • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                        • Size 529B
                                        • SHA256 94ea670ec2bdc52217ddb90503277c9dedb4eae2484a2a587a944da247cf3467
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        yandex_browser_updater.log
                                        • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                                        • Size 5KB
                                        • SHA256 8af8de06c67d71cd1d2616a4b660a7075e95652fead5d4634fc9745e87302aef
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        yb10BF.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\yb10BF.exe
                                        • Size 12.0MB
                                        • SHA256 499c4e3ef419c8e1a3f030c2b05f9b6160b8debb6f3e87334dbe451cad3df179
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        YandexSearch.msi
                                        • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                        • Size 9.7MB
                                        • SHA256 56cb451ba4365a80619ac33a64bee59c5864b82ff154bedb05f4e827aa8cf95b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Yandex.exe
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
                                        • Size 395KB
                                        • SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Yandex.lnk
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
                                        • Size 2KB
                                        • SHA256 3ec766953836b0dbfef79699deaee5c65b85c64101adb5fa29bbcb38ae1daf83
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ru.bdic
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\YandexDictionaries\ru.bdic
                                        • Size 4.5MB
                                        • SHA256 af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        brand_config
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1779\brand_config
                                        • Size 6KB
                                        • SHA256 52d136e4afd3cfde1c4f18782ea074e9b9cf2e1a2d90971d0694ecc32841bc05
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        partner_config
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1779\partner_config
                                        • Size 341B
                                        • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        all_zip
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1779\resources\configs\all_zip
                                        • Size 1.3MB
                                        • SHA256 73a9f5d0e8cd304de26c26e0ace558bccee13320c09602ac1bbd287bb4c9847e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        light_static.jpg
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1779\resources\wallpapers\light.title\light_static.jpg
                                        • Size 674KB
                                        • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        sea_preview.jpg
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1779\resources\wallpapers\sea_preview.jpg
                                        • Size 59KB
                                        • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        sea_static.jpg
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1779\resources\wallpapers\sea_static.jpg
                                        • Size 300KB
                                        • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        6182af54-126e-41bf-bff5-f93883439298.tmp
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\6182af54-126e-41bf-bff5-f93883439298.tmp
                                        • Size 217KB
                                        • SHA256 63ba3786c19e2c79ee4653352163bbf7388f5b50a9922a26380cbb89438d2eb7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                        • Size 48B
                                        • SHA256 8896f659c37e9f635a31c314fa51b5019105f731553c42b914e61ec2b5c40c6d
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        679fdf3f-028e-41c6-afc6-70c9672593ae.tmp
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\679fdf3f-028e-41c6-afc6-70c9672593ae.tmp
                                        • Size 8KB
                                        • SHA256 c520764136f641e1c3a0b50e3a413cf29fbcf8c46303724e8ba5f84a7780015b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        86e4e899-3d9a-4bdc-9671-d825a5649cd4.tmp
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\86e4e899-3d9a-4bdc-9671-d825a5649cd4.tmp
                                        • Size 161KB
                                        • SHA256 51d30b85f4d6285192c283fd8fd1ddd87bf80cc5613c72eb1fbe41e36f5ce48d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        data_0
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_0
                                        • Size 8KB
                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_2
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
                                        • Size 8KB
                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data_3
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
                                        • Size 8KB
                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        f_000005
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000005
                                        • Size 40KB
                                        • SHA256 5895185cf878a38cd172286ed97976e6ab620b2c5fd7f7810f9c9d2f7169da6d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        f_000006
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000006
                                        • Size 48KB
                                        • SHA256 b3cd587a747007fc5a365ceec5daa964c559e4862ae70aa98f5d0e1849d5ddf0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        f_000015
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000015
                                        • Size 49KB
                                        • SHA256 71749109108dcaf2c654d92602d94eb6bba92fa59f5d533007254863d5c4ed60
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        f_00002c
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_00002c
                                        • Size 48KB
                                        • SHA256 18539e5632dbeb12467c472ed06bae43a3f893eae4db6daf11d0485585655e44
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        663bce34-926f-43ea-9e11-5ad6c5aabdae.tmp
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\663bce34-926f-43ea-9e11-5ad6c5aabdae.tmp
                                        • Size 48B
                                        • SHA256 0cd2ffcb7c0a1081d72979a081307f4716573fad4b2284d4271a086d6aff5742
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index
                                        • Size 672B
                                        • SHA256 709f233f085e5a1c38561f5413cad00302bb4617c30529f37ec52b64f448329b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extension Rules\CURRENT
                                        • Size 16B
                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        MANIFEST-000001
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extension Scripts\MANIFEST-000001
                                        • Size 41B
                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        42a166f8-ff9c-41e8-9cab-15837fc432b3.tmp
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Network\42a166f8-ff9c-41e8-9cab-15837fc432b3.tmp
                                        • Size 59B
                                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Network Persistent State
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Network\Network Persistent State
                                        • Size 3KB
                                        • SHA256 2d546054887137b2d9d64521977b9eb590399da20e232558196cc90781246898
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                        • Size 17KB
                                        • SHA256 d77c79f6ab94bf3ad66709428741a267f008360ebe5896a5d6be0255496c19a8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                        • Size 18KB
                                        • SHA256 e74930ef6a1560e9aa36ca5562245159fdd36d4f83076c6d5e489d0454d61318
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                        • Size 18KB
                                        • SHA256 29acb2f17b226417a9b2368994b7a2ac8939956cf4f19233b846b5e69f1d39b7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                        • Size 9KB
                                        • SHA256 aa533313735cd66f93bbeaf3e314cf1024808d5707a61d6958a5cd84c25b7ba4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                        • Size 13KB
                                        • SHA256 44c98537a6159dd921499b696bd943fd90fa97812fd76108201a24909f0b442b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Secure Preferences
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                        • Size 15KB
                                        • SHA256 1b4cd936b7b7b214b6e99653a929183a02fbadf4851c3694217c5f430908a551
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Secure Preferences
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                        • Size 15KB
                                        • SHA256 af9f9821ce344139a6c6030dcb75597acf5462ec6be022ac7127569760ca6b7a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        128.png
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir3668_1104458077\Trusted Icons\Icons\128.png
                                        • Size 6KB
                                        • SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        256.png
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir3668_1104458077\Trusted Icons\Icons\256.png
                                        • Size 5KB
                                        • SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        64.png
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir3668_1104458077\Trusted Icons\Icons\64.png
                                        • Size 3KB
                                        • SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        96.png
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir3668_1104458077\Trusted Icons\Icons\96.png
                                        • Size 5KB
                                        • SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        a8098e4d-ae53-4be9-af1b-4419b625ec17.tmp
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\a8098e4d-ae53-4be9-af1b-4419b625ec17.tmp
                                        • Size 5KB
                                        • SHA256 4d301c5d8f78a2a52c0e182ea3235bf8d3318918f6c75dbe0cf1c2144e54e3c6
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        data_1
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GrShaderCache\data_1
                                        • Size 264KB
                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                        • Size 234KB
                                        • SHA256 c6f863e291bbdc28940d56a72a9500ff7f025e8a8375266bb151d9722c9d8a06
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        058c2b49-ff88-4e04-8cdc-c074d270d1ec.tmp
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\058c2b49-ff88-4e04-8cdc-c074d270d1ec.tmp
                                        • Size 124B
                                        • SHA256 ae4ab9e669cdb32b9b7b89c95c8928456bf2ff14e8c2006f08907c95e728ae00
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                        • Size 6KB
                                        • SHA256 2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                        • Size 21.6MB
                                        • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        metadata.json
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                        • Size 236B
                                        • SHA256 df671539241fbc96e33ab6dbce06498e6dd1a0927a6f4c394b8f86ce27b541db
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        metadata.json
                                        • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                        • Size 460B
                                        • SHA256 49d615e6097d003df0da91e0228c83369277fd4a2103ceb056d70392211ea27e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        Яндекс.website
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
                                        • Size 514B
                                        • SHA256 c98726dd05b94407a36bde37eb74d26c6448156a21ca715bde5e7c9dd1a87c45
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        places.sqlite
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7a1q5r94.Admin\places.sqlite
                                        • Size 68KB
                                        • SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        clids-yabrowser.xml
                                        • Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
                                        • Size 720B
                                        • SHA256 7dfe772835035a130038c2f97d6bec23c7e721916fa2f675dfbc20943264a2a0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ui
                                        • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                        • Size 38B
                                        • SHA256 b08ab2af773432583004be8c1bd5769e257a743d719632606bc198601add638a
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        MSIFE50.tmp
                                        • Path C:\Windows\Installer\MSIFE50.tmp
                                        • Size 182KB
                                        • SHA256 17abe207cfb3e461605cc9b9c5deb643c806bde516dab4203d59ed94739ab9d2
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        MSIFEAF.tmp
                                        • Path C:\Windows\Installer\MSIFEAF.tmp
                                        • Size 198KB
                                        • SHA256 8efc2893be422bca1300b507dafda0d62b74cdf9c359ccb2cad354c8353847f8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        yandex_browser_installer.log
                                        • Path C:\Windows\SystemTemp\yandex_browser_installer.log
                                        • Size 5KB
                                        • SHA256 92bc190cc451023b8d201754e15bc4768a7b2c5855affbdfaf850ea23ad75bdf
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        yandex_browser_service_update.log
                                        • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                        • Size 4KB
                                        • SHA256 e4e63d426e94171d301159798bad77a9e64cb64a2f8946ecfdc96c1e7d2df4ed
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        memory/5400-929-0x00007FF927310000-0x00007FF927311000-memory.dmp
                                        Download

                                        memory/6404-1057-0x00007FF927650000-0x00007FF927651000-memory.dmp
                                        Download

                                        memory/6404-1056-0x00007FF926070000-0x00007FF926071000-memory.dmp
                                        Download