Overview

overview

8

Static

static

3

2026-07-05...er.exe

windows10-2004-x64

8

2026-07-05...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_e5a1f606fb14e31c483060637578e2db_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 225KB
  • Sample260705-bfannsfy2s
  • SHA256 e4ddbc65ef189177a2712cd2d5ab5dad1df4dc961c48fc7823bf3f03ecd6bb12
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 62 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 10 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 17 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_e5a1f606fb14e31c483060637578e2db_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_e5a1f606fb14e31c483060637578e2db_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=718 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5624
    • C:\Users\Admin\AppData\Local\Temp\2026-07-05_e5a1f606fb14e31c483060637578e2db_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-05_e5a1f606fb14e31c483060637578e2db_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=108498/cnt=0/dt=3/ct=15/rt=0 --dh 2616 --st 1783213502
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4808
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 79EB967256BADF2AA659F064CCC64F42
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Users\Admin\AppData\Local\Temp\40D8B45F-8556-4AC8-AB57-B572DABD74F3\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\40D8B45F-8556-4AC8-AB57-B572DABD74F3\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:4308
      • C:\Users\Admin\AppData\Local\Temp\131A7E30-E8E5-440A-A10F-4453EEE22774\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\131A7E30-E8E5-440A-A10F-4453EEE22774\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\5328E6D8-22AA-4221-9AEA-9A0E558E967C\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:252
        • C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
          C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3628
          • C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
            C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4636
        • C:\Users\Admin\AppData\Local\Temp\5328E6D8-22AA-4221-9AEA-9A0E558E967C\sender.exe
          C:\Users\Admin\AppData\Local\Temp\5328E6D8-22AA-4221-9AEA-9A0E558E967C\sender.exe --send "/status.xml?clid=2765538-718&uuid=eebdedf5-84f4-4024-be68-89ccb16dbdf7&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A45%0A57%0A61%0A89%0A102%0A103%0A111%0A123%0A124%0A125%0A"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1356
  • C:\Users\Admin\AppData\Local\Temp\{41E6496A-3CAB-4B7E-9735-22594EA95E22}.exe
    "C:\Users\Admin\AppData\Local\Temp\{41E6496A-3CAB-4B7E-9735-22594EA95E22}.exe" --job-name=yBrowserDownloader-{850B468D-DCF0-48F7-AC78-F45DD92877FE} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{41E6496A-3CAB-4B7E-9735-22594EA95E22}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2765520-718&ui={eebdedf5-84f4-4024-be68-89ccb16dbdf7} --use-user-default-locale
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4468
    • C:\Users\Admin\AppData\Local\Temp\yb8FE2.tmp
      "C:\Users\Admin\AppData\Local\Temp\yb8FE2.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\f1645c27-c34e-4be8-87ba-2307b0e7cae3.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=604360514 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{850B468D-DCF0-48F7-AC78-F45DD92877FE} --local-path="C:\Users\Admin\AppData\Local\Temp\{41E6496A-3CAB-4B7E-9735-22594EA95E22}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2765520-718&ui={eebdedf5-84f4-4024-be68-89ccb16dbdf7} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\1aae55b0-c6ee-4755-9870-904e48c1f658.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\f1645c27-c34e-4be8-87ba-2307b0e7cae3.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=604360514 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{850B468D-DCF0-48F7-AC78-F45DD92877FE} --local-path="C:\Users\Admin\AppData\Local\Temp\{41E6496A-3CAB-4B7E-9735-22594EA95E22}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2765520-718&ui={eebdedf5-84f4-4024-be68-89ccb16dbdf7} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\1aae55b0-c6ee-4755-9870-904e48c1f658.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\f1645c27-c34e-4be8-87ba-2307b0e7cae3.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=604360514 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{850B468D-DCF0-48F7-AC78-F45DD92877FE} --local-path="C:\Users\Admin\AppData\Local\Temp\{41E6496A-3CAB-4B7E-9735-22594EA95E22}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2765520-718&ui={eebdedf5-84f4-4024-be68-89ccb16dbdf7} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\1aae55b0-c6ee-4755-9870-904e48c1f658.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=641882242
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Time Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5260
          • C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5260 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff75321a2a0,0x7ff75321a2ac,0x7ff75321a2b8
            5⤵
            • Executes dropped EXE
            PID:2184
          • C:\Windows\SystemTemp\sdwra_5260_1028813571\service_update.exe
            "C:\Windows\SystemTemp\sdwra_5260_1028813571\service_update.exe" --setup
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:804
            • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
              "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --install
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:2788
          • C:\Windows\SystemTemp\scoped_dir5260_4217606\explorer.exe
            "C:\Windows\SystemTemp\scoped_dir5260_4217606\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4952
            • C:\Windows\SystemTemp\scoped_dir5260_4217606\explorer.exe
              C:\Windows\SystemTemp\scoped_dir5260_4217606\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4952 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7c4b3a2a0,0x7ff7c4b3a2ac,0x7ff7c4b3a2b8
              6⤵
              • Executes dropped EXE
              PID:4504
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2340
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source5260_2136419268\Browser-bin\clids_yandex_second.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5516
  • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --run-as-service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4788 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff676453b20,0x7ff676453b2c,0x7ff676453b38
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:4392
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --update-scheduler
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --update-background-scheduler
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:1536
  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=604360514
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=2556 --annotation=metrics_client_id=d8fc5c69bb524ba2be0d6e1953c5d4d8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7ffb0a4657f8,0x7ffb0a465804,0x7ffb0a465810
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4588
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=2084,i,4324692122694958981,7127314553626669653,262144 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1972 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2576
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2144,i,9629752764960903877,16878804423574849900,262144 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2360 /prefetch:6
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1288
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2432,i,12032738520387161461,9231898180338050437,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2352 --brver=26.6.0.1831 /prefetch:11
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:6016
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2916,i,15650777944589999568,14941485384894975886,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3048 --brver=26.6.0.1831 /prefetch:13
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3432
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3688,i,12393940051451651131,10300808056897736795,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3884 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5856
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3596,i,17910789262996607501,3348112012337829834,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3864 --brver=26.6.0.1831 /prefetch:12
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5652
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4268,i,11656173172967479940,16646655847367637760,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4272 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:3568
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --may-use-trampoline-gpu --metrics-shmem-handle=4580,i,4707306354029025252,8442313386196531316,2097152 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4588 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:3680
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --may-use-trampoline-gpu --metrics-shmem-handle=5152,i,9290198443995472043,8752957366339700457,2097152 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5168 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:2460
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5400,i,17243300520873192447,10779165157271082155,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=2072 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5964
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=5836,i,17523495683274250710,13883900522744919881,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5852 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5220
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5520,i,6933341781133419718,9158157232018754648,2097152 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5464 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:5140
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5448,i,5193777737120251073,6739104967668193944,2097152 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6060 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:2432
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6248,i,10533785559345080435,8157805931634119721,2097152 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6252 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Time Discovery
      PID:2396
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7180,i,9823343466638024774,15250005852526605939,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7148 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1160
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7292,i,14999682798825693783,11526506979527918967,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7304 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2144
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7436,i,1009121104569210191,16192460959283832297,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7452 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3680
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7620,i,1001809060475644717,17491346848463259028,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7632 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1480
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7440,i,7976924586133015348,17327821394719713756,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7780 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2524
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7924,i,4445062651977818607,11783083892554644052,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7936 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5352
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7608,i,11708138928491083169,13424401304388262215,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7944 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1320
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7596,i,17100079133302760385,14789157555298788022,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8232 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2780
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7612,i,18052234058953838277,6271101544046022461,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8364 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:2808
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8072,i,5831106623866302207,7178325551859673022,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7916 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:1512
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8220,i,880755142978966937,15351932722729556310,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8612 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:5824
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8764,i,13910547422360058596,17355916437810216243,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8776 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1196
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8616,i,16526878304650585541,5846147085579004656,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8912 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:944
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9048,i,13709321420400806215,6043222209403377743,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=9060 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:4744
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9068,i,173072479907605755,18407218671597579715,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9212 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:3444
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8756,i,10935573437221450940,13092107831376235976,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9232 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:6012
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9200,i,10238893802654543431,6597271343439852575,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9252 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:3556
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9364,i,13990857164147014327,3346587786490971300,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9616 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:2736
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9756,i,12898985752645291849,988193374235796338,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9768 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:5460
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9900,i,5570995584631107262,420394462094719982,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9912 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:3428
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10052,i,14212710511219754185,14219002370809689817,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10064 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:3800
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10188,i,3730393431700281917,2292587135994180219,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10208 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:576
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10356,i,8871785709940034150,8981885842408419094,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10368 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:2960
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10512,i,6185250158351525292,17496342799884588075,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10524 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:4260
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10688,i,1755420561987153028,9046551971610585253,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10728 --brver=26.6.0.1831 /prefetch:14
      2⤵
      • Executes dropped EXE
      PID:6344
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10832,i,5532274428950649777,8311861279129483087,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10868 --brver=26.6.0.1831 /prefetch:14
      2⤵
        PID:6368
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11008,i,13456378170083763789,16149629356180343378,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11020 --brver=26.6.0.1831 /prefetch:14
        2⤵
          PID:6436
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=11180,i,3420274298935112321,13118605343955401063,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11184 --brver=26.6.0.1831 /prefetch:14
          2⤵
            PID:6476
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=11292,i,5893163733910922441,3442065022453087157,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11328 --brver=26.6.0.1831 /prefetch:14
            2⤵
              PID:6732
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=11280,i,4889991216900013487,9958749769198596806,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=8024 --brver=26.6.0.1831 /prefetch:14
              2⤵
                PID:7036
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=11348,i,12813986827401527248,14471178176596641203,2097152 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=8036 /prefetch:1
                2⤵
                • System Time Discovery
                PID:7156
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11196,i,13538478320262027266,16412258498454701085,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11384 --brver=26.6.0.1831 /prefetch:14
                2⤵
                  PID:6332
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=9900,i,6867284033448596015,285192082946452575,2097152 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=8048 /prefetch:1
                  2⤵
                  • System Time Discovery
                  PID:2340
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7976,i,2255045453899448045,10470480560539693353,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=7992 --brver=26.6.0.1831 /prefetch:14
                  2⤵
                    PID:5496
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=11472,i,9127919982504992044,4739325660387910055,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=7960 --brver=26.6.0.1831 /prefetch:14
                    2⤵
                      PID:4716
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8036,i,13606444775692976897,1405932913120918169,524288 --field-trial-handle=1976,i,9269187113349138344,13134685341553826403,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,17070640281360602358,16977798918549450182,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=7996 --brver=26.6.0.1831 /prefetch:14
                      2⤵
                        PID:3996
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:3840
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                        1⤵
                        • Modifies data under HKEY_USERS
                        PID:3632
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3516
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783213591 --annotation=last_update_date=1783213591 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3516 --annotation=metrics_client_id=d8fc5c69bb524ba2be0d6e1953c5d4d8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffb0a4657f8,0x7ffb0a465804,0x7ffb0a465810
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:4236
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={6E111E93-B5A7-461B-95F0-1AFFEF078F1D}
                        1⤵
                        • Drops file in Windows directory
                        • Enumerates system info in registry
                        PID:3560
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783213591 --annotation=last_update_date=1783213591 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3560 --annotation=metrics_client_id=d8fc5c69bb524ba2be0d6e1953c5d4d8 --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x154,0x158,0x15c,0xcc,0x160,0x7ffb0a4657f8,0x7ffb0a465804,0x7ffb0a465810
                          2⤵
                            PID:1520
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={C49AFD14-9546-459D-A7A0-B3C1007BAF20}
                          1⤵
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:6788
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783213591 --annotation=last_update_date=1783213591 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6788 --annotation=metrics_client_id=d8fc5c69bb524ba2be0d6e1953c5d4d8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x158,0x15c,0x160,0x134,0x164,0x7ffb0a4657f8,0x7ffb0a465804,0x7ffb0a465810
                            2⤵
                              PID:6516
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2172,i,14573965091097038504,14993628345582254317,524288 --field-trial-handle=2304,i,278257499159694833,15757088937863377866,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2308,i,7311058193178354690,13657805566160268318,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2336 --brver=26.6.0.1831 /prefetch:11
                              2⤵
                              • System Time Discovery
                              PID:2700
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=eebdedf5-84f4-4024-be68-89ccb16dbdf7 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1960,i,8414541142203866630,5171064344632824991,262144 --field-trial-handle=2304,i,278257499159694833,15757088937863377866,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2308,i,7311058193178354690,13657805566160268318,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2
                              2⤵
                              • Network Service Discovery
                              PID:4464

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Defense Evasion

                                Modify Registry

                                4
                                T1112

                                Subvert Trust Controls

                                1
                                T1553

                                Install Root Certificate

                                1
                                T1553.004

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Network Service Discovery

                                1
                                T1046

                                Peripheral Device Discovery

                                1
                                T1120

                                Query Registry

                                5
                                T1012

                                System Information Discovery

                                4
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                System Time Discovery

                                1
                                T1124

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                e592f66.rbs
                                • Path C:\Config.Msi\e592f66.rbs
                                • Size 912B
                                • SHA256 829f761dded264ede6b3d80c99998aac3093529c540718e041ee6111e934305a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                • Size 1KB
                                • SHA256 4c9ec0521d90e3e12ff084b51520124086f1858eace59a7cff709210fad0e5c1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                • Size 1KB
                                • SHA256 a3a1bdd19c33c84f7891ef37a7d187fc495a59dfa4b2e75e58f03d60510de94e
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
                                • Size 1KB
                                • SHA256 645008b9a92e12247d3a51c2481ac699102404d23c519ee977f6f88396a37b63
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                • Size 1KB
                                • SHA256 94ad2b16eeb45ac3da73e2f8c04ad5a06abf0476ec572ce34c3dfc5fbad53674
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                • Size 4KB
                                • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                • Size 1KB
                                • SHA256 d9fc43639d948cf397696ca3e5ec111c8e1c30edae15ddfd118688ee2663bcb5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                • Size 1KB
                                • SHA256 cb17777ff508f6adbae2f6ebf6cfaf35809bbc2d1e046afa261b16d703a2b16b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                • Size 508B
                                • SHA256 7b439157234beaff8f4f9c823956d8a709696d06cae1863b6fb9fa3fb5cf0da8
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                • Size 536B
                                • SHA256 ff90598ce3d8f2cf1ab87f83a6f612c2198c327672394a73b2f3a1390d7928d2
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
                                • Size 536B
                                • SHA256 b9c15c86687b3ebf32a31908ffeacd27b39438d9243cfc7b44ce8324d32bd13d
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                • Size 536B
                                • SHA256 f254aed9218e82b0928cbec513e003480e10e026b980f74ffd20ce1412e0dd5b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                • Size 342B
                                • SHA256 9ea1fa78a990b565cbb586bbfcf1702229fa7dafe4694ea5b599be451bdfd6a3
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                • Size 536B
                                • SHA256 1acc417de41a26758b41b91de0595e58453359f25bbd6b34ffdd3e596a3df72a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                • Size 506B
                                • SHA256 eeaf9ba6804cb4283e2715a6126152330a631f15597b6dfa94f3b91917fd2f9b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                www.ya.ru.ico
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\www.ya.ru.ico
                                • Size 5KB
                                • SHA256 6bb91f1d74389b18bce6e71772e4c5573648c1a4823338193f700afdf8216be5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                92f10e24b9713769e46130c4702d63ec
                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cyjywaoz.default-release\thumbnails\92f10e24b9713769e46130c4702d63ec
                                • Size 5KB
                                • SHA256 a08d93fef42579ebf000b3496ae50837ba14024fd07df04304534de480c72a1c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                9aa9c377af3bccf4c278b9bf804878ed
                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cyjywaoz.default-release\thumbnails\9aa9c377af3bccf4c278b9bf804878ed
                                • Size 15KB
                                • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                seederexe.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\131A7E30-E8E5-440A-A10F-4453EEE22774\seederexe.exe
                                • Size 8.6MB
                                • SHA256 35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                lite_installer.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\40D8B45F-8556-4AC8-AB57-B572DABD74F3\lite_installer.exe
                                • Size 419KB
                                • SHA256 688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                sender.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\5328E6D8-22AA-4221-9AEA-9A0E558E967C\sender.exe
                                • Size 260KB
                                • SHA256 36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YandexPackSetup.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                                • Size 10.1MB
                                • SHA256 05e7c78141093b0ca5a02cfec727a5ba40002cc731a589a098f46b221c3240d4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                BRAND_COMMON
                                • Path C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\BRAND_COMMON
                                • Size 25.6MB
                                • SHA256 79a756a6076f144000823ab815fddb4ebcae4b7e885218457b61409f6e8300df
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                setup.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\YB_45C55.tmp\setup.exe
                                • Size 7.5MB
                                • SHA256 978e5ca279cf3bbf66abbd562486a7ddc8aa624881018c01fdee1e199c6432b5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YandexSearch00000.log
                                • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                • Size 1KB
                                • SHA256 016a3c3f681c189c1665473e384557272ead13b4503bf79894f1566c9e58b1e5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                clids-yasearch.xml
                                • Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                • Size 711B
                                • SHA256 c8f3e3ce6a8a01e13cbf7ac156457328fdc11c79c4d25e7f9c4ebcf196a11931
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                lite_installer.log
                                • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                • Size 15KB
                                • SHA256 b4bf71389b7b324165597ed27e7f959314db50ae3a2ebd05eb22de1d18584312
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                master_preferences
                                • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                • Size 542B
                                • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                vendor00000.xml
                                • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                • Size 510B
                                • SHA256 1bd0f826e60de8c54b4becd496b5f7b642ec10a3a0c4b827479c7c6e0d50ae00
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                yandex_browser_updater.log
                                • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                                • Size 5KB
                                • SHA256 adc32fd2f8e2404bcb91058687c5f2bb2b2ec11de86c0e273486d3b1b7e67f8c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                {41E6496A-3CAB-4B7E-9735-22594EA95E22}.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\{41E6496A-3CAB-4B7E-9735-22594EA95E22}.exe
                                • Size 12.0MB
                                • SHA256 dcad7380898f693208db1018b4863c6fe1c7909e92f91e21152f12d80fe5d92b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                YandexSearch.msi
                                • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                • Size 9.8MB
                                • SHA256 3274d31cd9e5ee72687e8fc0bd2d53e47cd61301a0a715a572b4c29fcb808ed4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Yandex.exe
                                • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
                                • Size 397KB
                                • SHA256 8c4be5f1bc4e2f73d4396af48a31bf10362006472e9b28f40aa91f73a3815f12
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Yandex.lnk
                                • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
                                • Size 2KB
                                • SHA256 d415df10eedb2e443cfefb6d5127f02f7b65bdb27d4928ec139bc484ef81b85c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                ru.bdic
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\YandexDictionaries\ru.bdic
                                • Size 4.5MB
                                • SHA256 af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                install_state.json
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\install_state.json
                                • Size 1KB
                                • SHA256 1fc6c85ab4c8be41fa4465a7c884165899fda8c19da009d2e79fd4bf37cf02e3
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                brand_config
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\brand_config
                                • Size 6KB
                                • SHA256 799f57c84cd988d1fb653b950548bf2891e1539a10419339ca34b294689e7be0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                partner_config
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\partner_config
                                • Size 341B
                                • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                all_zip
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\resources\configs\all_zip
                                • Size 1.3MB
                                • SHA256 89a48f91ee799d6a571cf9355809abb631848aaae86f60e3a8e7811b830a5509
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                light_static.jpg
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\resources\wallpapers\light.title\light_static.jpg
                                • Size 674KB
                                • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                sea_preview.jpg
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\resources\wallpapers\sea_preview.jpg
                                • Size 59KB
                                • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                sea_static.jpg
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\resources\wallpapers\sea_static.jpg
                                • Size 300KB
                                • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                • Size 48B
                                • SHA256 0895f1002ca99dabdbc77a9fd337e7474a6d0befe0c2503d385e405ed852e9f1
                                • MD5 SHA1 SHA512
                                Submit Download

                                31b54d32-9ad8-4b93-bb55-3ecd0f970783.tmp
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\31b54d32-9ad8-4b93-bb55-3ecd0f970783.tmp
                                • Size 149KB
                                • SHA256 2be7c19b9438729d3a4e148b29b01a2a907e755072edaf66324617f7e25f19fd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                61cb8da0-82c8-49d2-b52f-a4c9b732a301.tmp
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\61cb8da0-82c8-49d2-b52f-a4c9b732a301.tmp
                                • Size 5KB
                                • SHA256 f72f8b6c8c09252c4e1d9678a06937e6fcef4288985caded8668ed5f4cdb703a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                896caf4e-28ef-465f-bb64-137eb6e7aa3c.tmp
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\896caf4e-28ef-465f-bb64-137eb6e7aa3c.tmp
                                • Size 8KB
                                • SHA256 89efa12a42d529626048bd9dbf79a2e28ab6b2da8952b440ec37fa19a2a2b912
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                data_2
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
                                • Size 8KB
                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_3
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
                                • Size 8KB
                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                f_000004
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000004
                                • Size 40KB
                                • SHA256 5895185cf878a38cd172286ed97976e6ab620b2c5fd7f7810f9c9d2f7169da6d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                f_000006
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000006
                                • Size 48KB
                                • SHA256 b3cd587a747007fc5a365ceec5daa964c559e4862ae70aa98f5d0e1849d5ddf0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CURRENT
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extension Rules\CURRENT
                                • Size 16B
                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                • MD5 SHA1 SHA512
                                Submit Download

                                MANIFEST-000001
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extension Rules\MANIFEST-000001
                                • Size 41B
                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                • MD5 SHA1 SHA512
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                • Size 17KB
                                • SHA256 f79d1b8273dfee504bee53347da77beb16b8f6e81abdcae8242eab651521542e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                • Size 17KB
                                • SHA256 998f15fef8a221492f72b2c2b36deeee3133e87941b44a594fef3320d857bee5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                • Size 13KB
                                • SHA256 827a859e145c69e68ad284a2b72f2f4b495fd409b706851b7abe8d1af0aff237
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                • Size 15KB
                                • SHA256 ee034625def84a7e054472dff9e55a94784bbf7fa03bc209f4535a7234b1c43f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                • Size 9KB
                                • SHA256 d0bab34c342bee8db6d4d712197597c96771c03f1e1c0f7d55479eedb336a370
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Secure Preferences
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                • Size 15KB
                                • SHA256 e95cfe5a58fa9b7afa2186187ebfb737ef94cee9786c131308bb6aec7c314d38
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Secure Preferences
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                • Size 15KB
                                • SHA256 924dc8ef3ec62ce24f5403aca509cbcb1dcc85bac115c31217b039fdce4686ad
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                128.png
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir2556_796476528\Trusted Icons\Icons\128.png
                                • Size 6KB
                                • SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                256.png
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir2556_796476528\Trusted Icons\Icons\256.png
                                • Size 5KB
                                • SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                64.png
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir2556_796476528\Trusted Icons\Icons\64.png
                                • Size 3KB
                                • SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                96.png
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir2556_796476528\Trusted Icons\Icons\96.png
                                • Size 5KB
                                • SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                data_0
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GrShaderCache\data_0
                                • Size 8KB
                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_1
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GrShaderCache\data_1
                                • Size 264KB
                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                • Size 235KB
                                • SHA256 5e541a1c203243191cb79b8ce313c6988d0717cb8a0c167a3fd18f3defaf91ce
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                a8cfba04-7f05-46c1-a310-f8ffd0192e44.tmp
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\a8cfba04-7f05-46c1-a310-f8ffd0192e44.tmp
                                • Size 218KB
                                • SHA256 2b4af33dd2270fbc4251b519290d5aa4f3c2f42caed718601d825ebea346eb56
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                • Size 6KB
                                • SHA256 2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                • Size 21.6MB
                                • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                • Size 13B
                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                • MD5 SHA1 SHA512
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                • Size 236B
                                • SHA256 df671539241fbc96e33ab6dbce06498e6dd1a0927a6f4c394b8f86ce27b541db
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Яндекс.website
                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
                                • Size 515B
                                • SHA256 285a4af729723dd0b475e8b68b7159d3f843bda857e033add136cc7ebb9d62b3
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                places.sqlite
                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8ejrm87a.Admin\places.sqlite
                                • Size 68KB
                                • SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Bookmarks
                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks
                                • Size 1KB
                                • SHA256 2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences
                                • Size 318B
                                • SHA256 3d4bfd0df39edd98a3781ab06cae122832782b4d31042e559d3409d70a139caf
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                clids-yabrowser.xml
                                • Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
                                • Size 737B
                                • SHA256 6741a856da51302f073fb72764dd8634ce27362f6194dfe92ff0c467e5bbe2cb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                ui
                                • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                • Size 38B
                                • SHA256 f34a90b8ce3c38415547a258aef952e137cbacf3cbaef71f1ace7550e23af56b
                                • MD5 SHA1 SHA512
                                Submit Download

                                MSI6D95.tmp
                                • Path C:\Windows\Installer\MSI6D95.tmp
                                • Size 181KB
                                • SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MSI6E32.tmp
                                • Path C:\Windows\Installer\MSI6E32.tmp
                                • Size 189KB
                                • SHA256 669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                yandex_browser_installer.log
                                • Path C:\Windows\SystemTemp\yandex_browser_installer.log
                                • Size 6KB
                                • SHA256 bddc78049c366681abb85cb854c275477b11dbf6cd0f8a750f5878759117b366
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                yandex_browser_service_update.log
                                • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                • Size 4KB
                                • SHA256 6e462101762c908da295e2f94a2801e5859a7f6b975596704f24528d852ffd68
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/1288-1382-0x000001B684790000-0x000001B6848A6000-memory.dmp
                                Download

                                memory/2340-1575-0x0000025AA46B0000-0x0000025AA46DF000-memory.dmp
                                Download

                                memory/2396-1435-0x000002965C720000-0x000002965C74F000-memory.dmp
                                Download

                                memory/2432-1434-0x000001ABE8B40000-0x000001ABE8B6F000-memory.dmp
                                Download

                                memory/2460-1389-0x0000026FF1550000-0x0000026FF157F000-memory.dmp
                                Download

                                memory/2576-959-0x00007FFB2C750000-0x00007FFB2C751000-memory.dmp
                                Download

                                memory/2576-1381-0x0000018CC3E50000-0x0000018CC3F66000-memory.dmp
                                Download

                                memory/2576-1616-0x0000018CC3E50000-0x0000018CC3F66000-memory.dmp
                                Download

                                memory/3680-1226-0x0000021B83E70000-0x0000021B83E9F000-memory.dmp
                                Download

                                memory/3680-1095-0x00007FFB2BD30000-0x00007FFB2BD31000-memory.dmp
                                Download

                                memory/3680-1094-0x00007FFB2C920000-0x00007FFB2C921000-memory.dmp
                                Download

                                memory/4464-1565-0x0000024B72620000-0x0000024B72736000-memory.dmp
                                Download

                                memory/5140-1433-0x000002189EC20000-0x000002189EC4F000-memory.dmp
                                Download

                                memory/5856-1383-0x0000018428370000-0x0000018428403000-memory.dmp
                                Download

                                memory/7156-1525-0x0000027303E70000-0x0000027303E9F000-memory.dmp
                                Download