Overview

overview

8

Static

static

3

2026-07-06...er.exe

windows10-2004-x64

8

2026-07-06...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 05:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_17a31ee7fe079141ac42f7e595f42511_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 225KB
  • Sample260707-ft7yjsav2t
  • SHA256 7d8ea759ae602e953551ca14e5318ffb8b938f5823a848f40b10fc7c5a6b56ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 62 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 10 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_17a31ee7fe079141ac42f7e595f42511_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_17a31ee7fe079141ac42f7e595f42511_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=461 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2104
    • C:\Users\Admin\AppData\Local\Temp\2026-07-06_17a31ee7fe079141ac42f7e595f42511_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-06_17a31ee7fe079141ac42f7e595f42511_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=1157980/cnt=0/dt=3/ct=0/rt=0 --dh 2484 --st 1783401064
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4732
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8A9CA8E7119069923EC1B92D99C9F60D
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Users\Admin\AppData\Local\Temp\3F532C0C-7C95-46F6-8A56-4694E7EDC9BB\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\3F532C0C-7C95-46F6-8A56-4694E7EDC9BB\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:1132
      • C:\Users\Admin\AppData\Local\Temp\DE83D09D-BE0A-4A1A-AB18-520A1F9AD45E\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\DE83D09D-BE0A-4A1A-AB18-520A1F9AD45E\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\CDF37583-C295-43FD-B753-9829F8038804\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5420
        • C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
          C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4684
          • C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
            C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1072
        • C:\Users\Admin\AppData\Local\Temp\CDF37583-C295-43FD-B753-9829F8038804\sender.exe
          C:\Users\Admin\AppData\Local\Temp\CDF37583-C295-43FD-B753-9829F8038804\sender.exe --send "/status.xml?clid=14756030-461&uuid=e8b9c843-82f5-4228-b818-fe544410860d&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A36%0A40%0A42%0A45%0A57%0A61%0A102%0A103%0A111%0A123%0A124%0A125%0A"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5396
  • C:\Users\Admin\AppData\Local\Temp\yb4740.exe
    "C:\Users\Admin\AppData\Local\Temp\yb4740.exe" --job-name=yBrowserDownloader-BD77366B-43AF-416F-98BA-98A69502F262 --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\yb4740.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14756004-461&ui={e8b9c843-82f5-4228-b818-fe544410860d} --use-user-default-locale
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Users\Admin\AppData\Local\Temp\yb5673.tmp
      "C:\Users\Admin\AppData\Local\Temp\yb5673.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\55e29adc-f4ab-4ceb-9a3e-c524eeb6f0e9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=590994266 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-BD77366B-43AF-416F-98BA-98A69502F262 --local-path="C:\Users\Admin\AppData\Local\Temp\yb4740.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14756004-461&ui={e8b9c843-82f5-4228-b818-fe544410860d} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\238d5ac3-95c6-42ba-9727-7253f6c75973.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\55e29adc-f4ab-4ceb-9a3e-c524eeb6f0e9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=590994266 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-BD77366B-43AF-416F-98BA-98A69502F262 --local-path="C:\Users\Admin\AppData\Local\Temp\yb4740.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14756004-461&ui={e8b9c843-82f5-4228-b818-fe544410860d} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\238d5ac3-95c6-42ba-9727-7253f6c75973.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\55e29adc-f4ab-4ceb-9a3e-c524eeb6f0e9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=590994266 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-BD77366B-43AF-416F-98BA-98A69502F262 --local-path="C:\Users\Admin\AppData\Local\Temp\yb4740.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14756004-461&ui={e8b9c843-82f5-4228-b818-fe544410860d} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\238d5ac3-95c6-42ba-9727-7253f6c75973.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=652993765
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Time Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2916 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6a72da2a0,0x7ff6a72da2ac,0x7ff6a72da2b8
            5⤵
            • Executes dropped EXE
            PID:4312
          • C:\Windows\SystemTemp\sdwra_2916_1651586422\service_update.exe
            "C:\Windows\SystemTemp\sdwra_2916_1651586422\service_update.exe" --setup
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:608
            • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
              "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --install
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:3988
          • C:\Windows\SystemTemp\scoped_dir2916_130399468\explorer.exe
            "C:\Windows\SystemTemp\scoped_dir2916_130399468\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1124
            • C:\Windows\SystemTemp\scoped_dir2916_130399468\explorer.exe
              C:\Windows\SystemTemp\scoped_dir2916_130399468\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1124 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x290,0x294,0x298,0x238,0x29c,0x7ff7faffa2a0,0x7ff7faffa2ac,0x7ff7faffa2b8
              6⤵
              • Executes dropped EXE
              PID:1760
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4652
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source2916_618330959\Browser-bin\clids_yandex_second.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3948
  • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --run-as-service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1100 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6a0d93b20,0x7ff6a0d93b2c,0x7ff6a0d93b38
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:4280
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --update-scheduler
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.0.1831\service_update.exe" --update-background-scheduler
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:1060
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5800
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=590994266
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=4760 --annotation=metrics_client_id=e4a161855f0847719dbe30273261a0fb --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7ff8740757f8,0x7ff874075804,0x7ff874075810
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5976
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=2076,i,14089861142993407819,13290023874313382911,262144 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2292 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2412
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2140,i,6796946668818779954,11877053330933168076,262144 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2328 /prefetch:6
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2500
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2516,i,5901419960050454792,3255912059673881151,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2768 --brver=26.6.0.1831 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:2936
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3312,i,7021078967280307284,8545733419797646930,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3532 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5100
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2892,i,11572183106907922306,6860349050356257152,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2136 --brver=26.6.0.1831 /prefetch:13
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2520
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3212,i,15631053407144150044,14319972092549155198,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3512 --brver=26.6.0.1831 /prefetch:12
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3208
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4488,i,8037100432416534170,9459551154150399936,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4632 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1336
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --may-use-trampoline-gpu --metrics-shmem-handle=4616,i,2299938793457362212,10136963341063937836,2097152 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3552 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:2600
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --may-use-trampoline-gpu --metrics-shmem-handle=5292,i,16806987849070933430,15060554603011183822,2097152 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5300 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5416
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5532,i,8005974366146148629,3569856554628061596,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5556 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5600
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=4500,i,5397290030124613501,8066095339332461283,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4404 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3988
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4772,i,6323561031281156677,6557327643212303182,2097152 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4740 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5656
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5768,i,7584355624781540146,5208107111228678583,2097152 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5748 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:1084
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6228,i,17717299480834364043,3839749430089685583,2097152 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6284 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:3780
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=6612,i,2647756484404638150,18251049675879638854,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6656 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5320
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7448,i,8507329593743053763,4239968197418264956,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7424 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4984
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7504,i,17670157695839878706,5730628678835540024,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7516 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1192
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7648,i,8639174459545685884,17256764308818629965,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7660 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5964
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7680,i,4956279049630262954,6562910855011146790,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7804 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2808
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7460,i,13971566730529266604,6943205986934801527,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7932 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4948
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7388,i,12188360902612934062,13388608590903584328,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=8104 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3980
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8068,i,4490884931842081552,244252715609586305,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8276 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1964
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8284,i,5672514912011112773,6649845917124087167,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8416 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4296
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8424,i,5094305013359598847,7388612105178006523,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8556 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:6128
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8256,i,1117842735450400603,12371113647217717937,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8564 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5860
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8096,i,9408934505063509301,1450717539805125026,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8264 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4956
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8088,i,10845285146601835272,9307101054790744795,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8948 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4652
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9092,i,16135180440545091889,5463863852599492417,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=9116 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4860
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9280,i,16522298333707818444,6925226951138228179,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9304 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3492
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9292,i,17886250684980107850,6898538431020782665,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9324 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4872
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9276,i,2536485645966652278,4000330010656740892,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9568 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5336
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9240,i,5453847867875339657,9937349281496952485,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9708 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5188
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9856,i,15353151922462443246,6788240217780166887,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9868 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3108
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10004,i,8317742165275778883,16585411455953208456,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=10016 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5388
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10152,i,11131690630580745942,14968833254484357024,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10164 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5764
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10316,i,12785916026977319520,16609167869561988030,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10328 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3532
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10336,i,6207026507995109085,14249880674075904889,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10356 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2788
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10364,i,11890189651035747081,18146358185053314309,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10608 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:1168
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10768,i,14876388698200739350,14290894012115895509,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10780 --brver=26.6.0.1831 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2960
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10760,i,18277790197752237794,12616361886758665642,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10912 --brver=26.6.0.1831 /prefetch:14
        2⤵
          PID:2728
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11044,i,16162619296850651989,2021288215653531921,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11056 --brver=26.6.0.1831 /prefetch:14
          2⤵
            PID:4572
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11204,i,3499947426792890703,1725812103650800952,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11216 --brver=26.6.0.1831 /prefetch:14
            2⤵
              PID:2480
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=11352,i,2374317856397500233,3585702939034496317,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11376 --brver=26.6.0.1831 /prefetch:14
              2⤵
                PID:3104
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=7304,i,4257145853621898271,1313308031221865843,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=5068 --brver=26.6.0.1831 /prefetch:14
                2⤵
                  PID:1304
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=2344,i,6003394902330956444,1411408460707458895,2097152 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=11360 /prefetch:1
                  2⤵
                  • System Time Discovery
                  PID:5964
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11400,i,6032314030172969980,6141738092163473839,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11520 --brver=26.6.0.1831 /prefetch:14
                  2⤵
                    PID:4244
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=5924,i,6682159384684318135,6288178692538461821,2097152 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=11352 /prefetch:1
                    2⤵
                    • System Time Discovery
                    PID:4924
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=11472,i,5189217006409907411,1039478257607210700,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=2164 --brver=26.6.0.1831 /prefetch:14
                    2⤵
                      PID:1336
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=3572,i,3884203312156237235,10751511178651649145,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=2400 --brver=26.6.0.1831 /prefetch:14
                      2⤵
                        PID:4572
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=1088,i,15742390619616948824,14408759325941691447,524288 --field-trial-handle=2296,i,7970153418089996827,2528938061809549162,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2300,i,4080180399436037394,9657059546338009303,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=2408 --brver=26.6.0.1831 /prefetch:14
                        2⤵
                          PID:3740
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:1596
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                          1⤵
                          • Modifies data under HKEY_USERS
                          PID:2608
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                          1⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:4428
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783401163 --annotation=last_update_date=1783401163 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4428 --annotation=metrics_client_id=e4a161855f0847719dbe30273261a0fb --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ff8740757f8,0x7ff874075804,0x7ff874075810
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:3848
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={940C9DA4-E821-452F-B97A-17172C6F0A26}
                          1⤵
                          • Drops file in Windows directory
                          • Enumerates system info in registry
                          PID:4972
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783401163 --annotation=last_update_date=1783401163 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4972 --annotation=metrics_client_id=e4a161855f0847719dbe30273261a0fb --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ff8740757f8,0x7ff874075804,0x7ff874075810
                            2⤵
                              PID:5860
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={4BF51AF2-6F35-428E-BAC3-AB3E5257E6B7}
                            1⤵
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:1544
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783401163 --annotation=last_update_date=1783401163 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1544 --annotation=metrics_client_id=e4a161855f0847719dbe30273261a0fb --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.0.1831 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ff8740757f8,0x7ff874075804,0x7ff874075810
                              2⤵
                                PID:1304
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2172,i,14969148270559415450,7227980635908140386,524288 --field-trial-handle=2304,i,32773367963149056,11564878188378844998,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2308,i,3607115409809859311,13162003048356533594,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2336 --brver=26.6.0.1831 /prefetch:11
                                2⤵
                                • System Time Discovery
                                PID:3492
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=e8b9c843-82f5-4228-b818-fe544410860d --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1968,i,7976900710902328548,5213801701703428619,262144 --field-trial-handle=2304,i,32773367963149056,11564878188378844998,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2308,i,3607115409809859311,13162003048356533594,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2300 /prefetch:2
                                2⤵
                                • Network Service Discovery
                                PID:6072

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Defense Evasion

                                  Modify Registry

                                  2
                                  T1112

                                  Subvert Trust Controls

                                  1
                                  T1553

                                  Install Root Certificate

                                  1
                                  T1553.004

                                  Credential Access

                                  Credentials from Password Stores

                                  1
                                  T1555

                                  Credentials from Web Browsers

                                  1
                                  T1555.003

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Network Service Discovery

                                  1
                                  T1046

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  Query Registry

                                  5
                                  T1012

                                  System Information Discovery

                                  4
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  System Time Discovery

                                  1
                                  T1124

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  e592fd3.rbs
                                  • Path C:\Config.Msi\e592fd3.rbs
                                  • Size 912B
                                  • SHA256 a9042f27ff3e7d9b1d29fe94b8d46d5fc8ec226055bffcd1c1f9b363413a46d2
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                  • Size 1KB
                                  • SHA256 627c15f0c0ea14e0541e3acb5fd60b39e3fe4edc31561d7479816954c400d3b6
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                  • Size 1KB
                                  • SHA256 f68ea3d5796abcb8d790b84999d69d44f3b19e00a851664b375f15b5e6d291f5
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                  • Size 1KB
                                  • SHA256 68ee358284a7570e659dd0c8109202a0072ac7c4323fbc252ac059d8c88bbf6a
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                  • Size 1KB
                                  • SHA256 3d3ac0a1bd2172a725084db7427c0db77e10eb33c73fb637d7cfc3d5a5bf502d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                  • Size 1KB
                                  • SHA256 bae20de6fd190a68aaba7f20ba26316f170d0e17fda0c088fd7c19ae94156c1b
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                  • Size 1KB
                                  • SHA256 f94d6ace1845f5d691892eed415ce8977d41985cc382b4535e3fbc40c5200cd7
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                  • Size 508B
                                  • SHA256 af8b8d1236c0c96a8c2ce62090069cd9383c6e0da67d8223f9e7df5183b4f255
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                  • Size 536B
                                  • SHA256 ccb2ffd0e306901db1c45b13e6e2e86db7f0c2147f2cdcdd86e8de7a2993f238
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                  • Size 536B
                                  • SHA256 2497ec6a126c78065344d05eda586861f3a7b7898ddde601fc3573cd77e3f4ab
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                  • Size 536B
                                  • SHA256 8620b0f13e1e00b5930bba41a66f55dbae3f14d2020ddca6d5790be9d8edca21
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                  • Size 536B
                                  • SHA256 08273fda05a19dd5ad82577fc9bd281109a1db7b3eaeac41a0d0c8c4f71efb3b
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                  • Size 506B
                                  • SHA256 72701c9d1ecb7b48e1d441f571c04e461f417dbd96dcbd447cea07ced4ca8fea
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  7228c13f863bc0854ba932dad661a565
                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rcs6t6yy.default-release\thumbnails\7228c13f863bc0854ba932dad661a565
                                  • Size 15KB
                                  • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  lite_installer.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\3F532C0C-7C95-46F6-8A56-4694E7EDC9BB\lite_installer.exe
                                  • Size 420KB
                                  • SHA256 abae05f38d9ffda8749f631a868c90a417b5ffb70f4a10ab10a63391588ee2a2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  YandexPackSetup.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                                  • Size 10.1MB
                                  • SHA256 4ebc87110eb920d39e95bc5c8fb9084b08eba1ecd533a1d04e2651189b81d9e2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sender.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\CDF37583-C295-43FD-B753-9829F8038804\sender.exe
                                  • Size 260KB
                                  • SHA256 4128b1566d599ef2fe9aa4a693fd9e715f45d6a4d1d11d6c31b49cabf804609b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  seederexe.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\DE83D09D-BE0A-4A1A-AB18-520A1F9AD45E\seederexe.exe
                                  • Size 8.5MB
                                  • SHA256 b06696eca2727f9cb18497c8afd630ab6294eb2f4c690628dffe8826f51ad23d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  BRAND_COMMON
                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\BRAND_COMMON
                                  • Size 25.6MB
                                  • SHA256 79a756a6076f144000823ab815fddb4ebcae4b7e885218457b61409f6e8300df
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  brand_yandex
                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\brand_yandex
                                  • Size 2.5MB
                                  • SHA256 cd74f5b6afb55dd6140bb93a2467421db2ea13dc5c091c8ed69ed1967c476d8e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  setup.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_1BA35.tmp\setup.exe
                                  • Size 7.5MB
                                  • SHA256 978e5ca279cf3bbf66abbd562486a7ddc8aa624881018c01fdee1e199c6432b5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  YandexSearch00000.log
                                  • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                  • Size 1KB
                                  • SHA256 91541d069ea1f8f1ea3a93ce0620b3ccbad732d032fac0811b32db964b8a4d83
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  clids-yasearch.xml
                                  • Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                  • Size 730B
                                  • SHA256 915254ed335c3c7380731e5d32a137d409b9dd140155f0cd05a138f9821e4a5d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  lite_installer.log
                                  • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                  • Size 8KB
                                  • SHA256 361ef5d41894a918fc16f23ab5073a475282eebbd5e64d641a1897610d7b84c4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  master_preferences
                                  • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                  • Size 542B
                                  • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  tmp5420aaaaaa
                                  • Path C:\Users\Admin\AppData\Local\Temp\tmp5420aaaaaa
                                  • Size 2.5MB
                                  • SHA256 28c615b45bf32be9eff49725dbd31f0309ef71d8d341dffd82c40c81eee211a6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  vendor00000.xml
                                  • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                  • Size 529B
                                  • SHA256 94ea670ec2bdc52217ddb90503277c9dedb4eae2484a2a587a944da247cf3467
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  yandex_browser_updater.log
                                  • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                                  • Size 5KB
                                  • SHA256 6ae5fe5dbec12d9fd61040d5157c3c33c7e27f86b2c4333e5096e014ad514805
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  yb4740.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\yb4740.exe
                                  • Size 12.0MB
                                  • SHA256 dcad7380898f693208db1018b4863c6fe1c7909e92f91e21152f12d80fe5d92b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  YandexSearch.msi
                                  • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                  • Size 9.7MB
                                  • SHA256 56cb451ba4365a80619ac33a64bee59c5864b82ff154bedb05f4e827aa8cf95b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Yandex.exe
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
                                  • Size 395KB
                                  • SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Yandex.lnk
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
                                  • Size 2KB
                                  • SHA256 e9a36d69bfe64f8dc4874a413353b9336b37900bff93da2f798696f8a076dcb6
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  ru.bdic
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\YandexDictionaries\ru.bdic
                                  • Size 4.5MB
                                  • SHA256 af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  brand_config
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\brand_config
                                  • Size 6KB
                                  • SHA256 799f57c84cd988d1fb653b950548bf2891e1539a10419339ca34b294689e7be0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  partner_config
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\partner_config
                                  • Size 341B
                                  • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  all_zip
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\resources\configs\all_zip
                                  • Size 1.3MB
                                  • SHA256 89a48f91ee799d6a571cf9355809abb631848aaae86f60e3a8e7811b830a5509
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  light_static.jpg
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\resources\wallpapers\light.title\light_static.jpg
                                  • Size 674KB
                                  • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sea_preview.jpg
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\resources\wallpapers\sea_preview.jpg
                                  • Size 59KB
                                  • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sea_static.jpg
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.0.1831\resources\wallpapers\sea_static.jpg
                                  • Size 300KB
                                  • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  8df6c666-b120-46b0-8b33-a33d4bc534fb.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\8df6c666-b120-46b0-8b33-a33d4bc534fb.tmp
                                  • Size 218KB
                                  • SHA256 c6ac398a0b8373d2967799d8c6de50bef2cfa90d603a1d04bf14bb1dee1b2a28
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                  • Size 48B
                                  • SHA256 1c2a1a322eac6bcefdb94209b142a4fefd7a7985e510ad20a22c335fadcade57
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  5e4a8894-5948-428f-b522-46c56381c7d4.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\5e4a8894-5948-428f-b522-46c56381c7d4.tmp
                                  • Size 8KB
                                  • SHA256 7562a0a5b89bfbc4decc0a217f9e557df30544ecad73ef3b134fec75540042f2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  8e4b3626-f6ce-47f6-a2a7-5a3dd22b8f20.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\8e4b3626-f6ce-47f6-a2a7-5a3dd22b8f20.tmp
                                  • Size 149KB
                                  • SHA256 4ef1f6b1b7027eae21e32c0e1b3566ab8dbdea73678c447378d785b8d2201584
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_0
                                  • Size 44KB
                                  • SHA256 bc5139ca80657f7eb5a654c8f37fdeb7df62d44cdeafd54e18353607074b1636
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  f_000004
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000004
                                  • Size 40KB
                                  • SHA256 5895185cf878a38cd172286ed97976e6ab620b2c5fd7f7810f9c9d2f7169da6d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  f_000006
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000006
                                  • Size 48KB
                                  • SHA256 b3cd587a747007fc5a365ceec5daa964c559e4862ae70aa98f5d0e1849d5ddf0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extension Rules\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 15KB
                                  • SHA256 2495619f57ac2f7d749b9bee8077342dbd55f4cea58a5b570d7e8464e7faf404
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 18KB
                                  • SHA256 1051ab75544c2fdd9365a8a9766ed183a3ba6752ca2276ae60c1c36b04612328
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 18KB
                                  • SHA256 016da2892257d18079a7e6bbce73d7e74d5cf65fe74cec24c3475669cd517c18
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 9KB
                                  • SHA256 719b1cd2eb414be8ee816134e3803b15761321c426fa8ca876d808627e2ade01
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 13KB
                                  • SHA256 03686bf7e36c605d828ce41c9f2a5e366b003702a210dd8a4570704ea90c46ae
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Secure Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                  • Size 15KB
                                  • SHA256 e195be5f4729d880bd862fd73e10451cf24a3dc5dffc1362849ccdef35d23fd1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Secure Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                  • Size 15KB
                                  • SHA256 6b1a939ade0e8572dab793fd51ed4b78ce7ffc7b64ce1f64840a2a82cb8ddb08
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Site Characteristics Database\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  128.png
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir4760_1726675062\Trusted Icons\Icons\128.png
                                  • Size 6KB
                                  • SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  256.png
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir4760_1726675062\Trusted Icons\Icons\256.png
                                  • Size 5KB
                                  • SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  64.png
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir4760_1726675062\Trusted Icons\Icons\64.png
                                  • Size 3KB
                                  • SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  96.png
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir4760_1726675062\Trusted Icons\Icons\96.png
                                  • Size 5KB
                                  • SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  d70d39af-e19f-4878-98d0-374a28b4af18.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\d70d39af-e19f-4878-98d0-374a28b4af18.tmp
                                  • Size 5KB
                                  • SHA256 4bd50108763f0841f716bdf716b7829e4345a2ef72e88b06ae994d746476a55f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GraphiteDawnCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                  • Size 423KB
                                  • SHA256 30f046c9f47f187161b255bc5d99ad11b23c065495610a937d4eeb7c6388ced5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                  • Size 226KB
                                  • SHA256 744b09a785df719d0bec560a74cfce0156214c011c2983cab251acc298a635b3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                  • Size 6KB
                                  • SHA256 2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                  • Size 21.6MB
                                  • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  metadata.json
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                  • Size 13B
                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  metadata.json
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                  • Size 236B
                                  • SHA256 df671539241fbc96e33ab6dbce06498e6dd1a0927a6f4c394b8f86ce27b541db
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Яндекс.website
                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
                                  • Size 516B
                                  • SHA256 298441c5f6374b5b4e62f332e403cf2a0bce01916fa3429df023293704748d0e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  places.sqlite
                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nrszjbh2.Admin\places.sqlite
                                  • Size 68KB
                                  • SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  clids-yabrowser.xml
                                  • Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
                                  • Size 756B
                                  • SHA256 b6115ba4466d57fccc62bb0f2aad52e844fc3e9dbd9a621f675243f2b0bd5c08
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  ui
                                  • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                  • Size 38B
                                  • SHA256 6bc4afb26bd68e7a1707f2c657b9a069fb2b549f715996369dce81de269b14e5
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  MSI3212.tmp
                                  • Path C:\Windows\Installer\MSI3212.tmp
                                  • Size 182KB
                                  • SHA256 17abe207cfb3e461605cc9b9c5deb643c806bde516dab4203d59ed94739ab9d2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  MSI3281.tmp
                                  • Path C:\Windows\Installer\MSI3281.tmp
                                  • Size 198KB
                                  • SHA256 8efc2893be422bca1300b507dafda0d62b74cdf9c359ccb2cad354c8353847f8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  yandex_browser_installer.log
                                  • Path C:\Windows\SystemTemp\yandex_browser_installer.log
                                  • Size 6KB
                                  • SHA256 407170c33a26b931d6ad2eb6d99bf88f037ada4cceafd8c61433dd77fe310bf8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  yandex_browser_service_update.log
                                  • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                  • Size 3KB
                                  • SHA256 3db64e85633f1daf476dd19b1812e69430b1f38dbfda9232a4b8883f0e87b88e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  yandex_browser_service_update.log
                                  • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                  • Size 5KB
                                  • SHA256 d4c4aee1523b0db214cf042ecc106597e62d5457dd9055ebb03f582bf14d02fa
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/1084-1447-0x0000020FF0330000-0x0000020FF0406000-memory.dmp
                                  Download

                                  memory/2500-965-0x00007FF896330000-0x00007FF896331000-memory.dmp
                                  Download

                                  memory/2600-1242-0x00000210CE0D0000-0x00000210CE1A6000-memory.dmp
                                  Download

                                  memory/2600-1111-0x00007FF895EC0000-0x00007FF895EC1000-memory.dmp
                                  Download

                                  memory/2600-1110-0x00007FF897A50000-0x00007FF897A51000-memory.dmp
                                  Download

                                  memory/3780-1471-0x000001F4A29B0000-0x000001F4A2A86000-memory.dmp
                                  Download

                                  memory/4924-1609-0x000001DDE52D0000-0x000001DDE53A6000-memory.dmp
                                  Download

                                  memory/5020-414-0x0000026B79D00000-0x0000026B7A6A4000-memory.dmp
                                  Download

                                  memory/5416-1401-0x000001C6ADBA0000-0x000001C6ADC76000-memory.dmp
                                  Download

                                  memory/5656-1446-0x00000280E2C50000-0x00000280E2D26000-memory.dmp
                                  Download

                                  memory/5964-1545-0x0000027F6A9E0000-0x0000027F6AAB6000-memory.dmp
                                  Download