Overview

overview

8

Static

static

3

2026-07-10...er.exe

windows10-2004-x64

8

2026-07-10...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 10:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_294808121ab6e1bd3b3a3a086075b69f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 225KB
  • Sample260710-mm9bcsax8x
  • SHA256 8d4cbdeb563c0cb13bfe0d65a700ce4c847f82947e73bd131a4c6933e8f54142
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 62 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 10 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 17 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_294808121ab6e1bd3b3a3a086075b69f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_294808121ab6e1bd3b3a3a086075b69f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:4112
    • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=226 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1684
    • C:\Users\Admin\AppData\Local\Temp\2026-07-10_294808121ab6e1bd3b3a3a086075b69f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-10_294808121ab6e1bd3b3a3a086075b69f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=937853/cnt=0/dt=2/ct=1/rt=0 --dh 2484 --st 1783679772
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1868
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4E81B73D8689C2C8675FFB10942F094A
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Users\Admin\AppData\Local\Temp\7F85615F-F200-44F2-B83F-190924B6A9D4\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\7F85615F-F200-44F2-B83F-190924B6A9D4\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5220
      • C:\Users\Admin\AppData\Local\Temp\F214C5D7-3B9A-45C3-964A-03927FECED73\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\F214C5D7-3B9A-45C3-964A-03927FECED73\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\8D4188F0-2D00-43C8-BD29-EAF0A315D8F4\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5704
        • C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
          C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5844
          • C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
            C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1480
        • C:\Users\Admin\AppData\Local\Temp\8D4188F0-2D00-43C8-BD29-EAF0A315D8F4\sender.exe
          C:\Users\Admin\AppData\Local\Temp\8D4188F0-2D00-43C8-BD29-EAF0A315D8F4\sender.exe --send "/status.xml?clid=12871334-226&uuid=469489fc-2cc4-42dc-99e2-d343d17bb1c8&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A45%0A57%0A61%0A89%0A102%0A103%0A111%0A123%0A124%0A125%0A"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3204
  • C:\Users\Admin\AppData\Local\Temp\{C0D46CD6-545B-48C8-9F48-3BB4EAD400DD}.exe
    "C:\Users\Admin\AppData\Local\Temp\{C0D46CD6-545B-48C8-9F48-3BB4EAD400DD}.exe" --job-name=yBrowserDownloader-{3797F7E3-BCEE-43D8-AB23-DBDBC41D26FC} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{C0D46CD6-545B-48C8-9F48-3BB4EAD400DD}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=12871316-226&ui={469489fc-2cc4-42dc-99e2-d343d17bb1c8} --use-user-default-locale
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Users\Admin\AppData\Local\Temp\ybCB36.tmp
      "C:\Users\Admin\AppData\Local\Temp\ybCB36.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\58606176-5cd7-4f61-a5c4-e3526c011796.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=612606786 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{3797F7E3-BCEE-43D8-AB23-DBDBC41D26FC} --local-path="C:\Users\Admin\AppData\Local\Temp\{C0D46CD6-545B-48C8-9F48-3BB4EAD400DD}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=12871316-226&ui={469489fc-2cc4-42dc-99e2-d343d17bb1c8} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\ed238d8b-675f-4648-a599-507f0cdc110d.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\58606176-5cd7-4f61-a5c4-e3526c011796.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=612606786 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{3797F7E3-BCEE-43D8-AB23-DBDBC41D26FC} --local-path="C:\Users\Admin\AppData\Local\Temp\{C0D46CD6-545B-48C8-9F48-3BB4EAD400DD}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=12871316-226&ui={469489fc-2cc4-42dc-99e2-d343d17bb1c8} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\ed238d8b-675f-4648-a599-507f0cdc110d.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\58606176-5cd7-4f61-a5c4-e3526c011796.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=612606786 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{3797F7E3-BCEE-43D8-AB23-DBDBC41D26FC} --local-path="C:\Users\Admin\AppData\Local\Temp\{C0D46CD6-545B-48C8-9F48-3BB4EAD400DD}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=12871316-226&ui={469489fc-2cc4-42dc-99e2-d343d17bb1c8} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\ed238d8b-675f-4648-a599-507f0cdc110d.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=654163079
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Time Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3216
          • C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3216 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.1.1039 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff721a482a0,0x7ff721a482ac,0x7ff721a482b8
            5⤵
            • Executes dropped EXE
            PID:5292
          • C:\Windows\SystemTemp\sdwra_3216_711639440\service_update.exe
            "C:\Windows\SystemTemp\sdwra_3216_711639440\service_update.exe" --setup
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4396
            • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe
              "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe" --install
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:5924
          • C:\Windows\SystemTemp\scoped_dir3216_39756558\explorer.exe
            "C:\Windows\SystemTemp\scoped_dir3216_39756558\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3948
            • C:\Windows\SystemTemp\scoped_dir3216_39756558\explorer.exe
              C:\Windows\SystemTemp\scoped_dir3216_39756558\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3948 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.1.1039 --initial-client-data=0x290,0x294,0x298,0xb8,0x29c,0x7ff726ce82a0,0x7ff726ce82ac,0x7ff726ce82b8
              6⤵
              • Executes dropped EXE
              PID:2892
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6112
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source3216_220353418\Browser-bin\clids_yandex_second.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3840
  • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe" --run-as-service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2840 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.1.1039 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff62d6e2b20,0x7ff62d6e2b2c,0x7ff62d6e2b38
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:5692
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe" --update-scheduler
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.1.1039\service_update.exe" --update-background-scheduler
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:5904
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:6064
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=612606786
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=4944 --annotation=metrics_client_id=a1cc5aa7ce914420932e8b2070956524 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.1.1039 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7ffe4cbd47f8,0x7ffe4cbd4804,0x7ffe4cbd4810
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5732
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=2000,i,15347057566475932855,6268110660838542785,262144 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2244 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4356
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2080,i,515728791724048054,11669810511065156585,262144 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2272 /prefetch:6
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1932
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2284,i,14824419485540337079,13463956295920703637,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2712 --brver=26.6.1.1039 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:3816
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2852,i,1736862349754768206,1435590531760827635,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2968 --brver=26.6.1.1039 /prefetch:13
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2092
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3360,i,16723727000342961775,1890460495528331820,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3428 --brver=26.6.1.1039 /prefetch:12
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1868
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3604,i,7439849882088242086,11790721744820330180,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3608 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3820
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4400,i,18262993113686118264,16462669415186381550,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4384 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1936
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --may-use-trampoline-gpu --metrics-shmem-handle=4632,i,6869773901664246685,15228798388887320076,2097152 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4644 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:3740
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --may-use-trampoline-gpu --metrics-shmem-handle=5256,i,6003494366361145908,8397167337232758743,2097152 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5264 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:4712
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5524,i,6496637329106035021,12862737170597822187,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5624 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5644
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=4900,i,3430189507780300102,8335597707586952652,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4960 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2664
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6008,i,10090227875736443552,2801873324372933214,2097152 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4956 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:6056
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4812,i,1049522104069818918,1729861040397017503,2097152 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5644 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:2700
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6356,i,9337988258122682191,763309537577227074,2097152 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6368 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5896
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7244,i,6128027617786954059,10590947027301099049,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7264 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1196
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7376,i,4478077120815629350,10819155199305840427,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7460 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2332
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7444,i,2020221259240199686,11236987333400642805,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7548 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3372
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7692,i,1225072296141921218,3912603669125156046,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7704 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5212
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7680,i,11469630688469414808,11205142687202531090,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7712 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1132
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7988,i,17031244884120704443,1806731998258505943,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=8000 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4804
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7328,i,830225993906512517,1896304161781556232,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7356 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4188
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7972,i,9617684706029866904,5179532514758072674,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7984 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3100
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8280,i,14325193447238399899,7419270566170506820,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8132 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3180
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8268,i,13465853885050704583,8388571711456671896,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8436 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2808
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8292,i,13144413290456221940,2167981643185767884,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8656 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3740
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8704,i,2289005647891521370,9653881095424548629,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8308 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3184
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8860,i,13175460923419056031,2302210712137317604,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8872 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5032
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8688,i,10224998517746999982,18144768537976621943,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8892 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2836
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8692,i,3845501261832818664,11511923529975975160,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8912 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:628
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9384,i,13098018756617254870,4540698512370347571,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9396 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:832
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9528,i,5586174679662451479,15794167968102145901,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9540 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4792
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9672,i,6237774563799956993,648270754089080569,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9684 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4460
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9844,i,3199701292821583390,10038982501342457679,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9900 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2536
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9920,i,10894739524329998158,13128813352304649215,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=10044 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2568
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10052,i,6164485064318278930,2556035594758256490,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10184 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:372
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10192,i,2795301617180821452,10695425046371950732,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10324 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3572
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10456,i,16529012813829076625,15327969960542239849,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10468 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4552
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10600,i,18327650905959358688,13176412082217992752,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10612 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3796
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10476,i,16190137496236037435,4886492642710721289,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10784 --brver=26.6.1.1039 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3688
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7240,i,13351317318701208590,4321174382746469457,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10928 --brver=26.6.1.1039 /prefetch:14
        2⤵
          PID:5288
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10932,i,12988643680961473400,4706215331097042895,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11072 --brver=26.6.1.1039 /prefetch:14
          2⤵
            PID:2636
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11236,i,7195696434808393929,18033769970033691662,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11252 --brver=26.6.1.1039 /prefetch:14
            2⤵
              PID:3088
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=4904,i,7083287323640800504,15602669027615142178,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11392 --brver=26.6.1.1039 /prefetch:14
              2⤵
                PID:5928
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=7332,i,15181051327450969742,1310225578019824939,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=11608 --brver=26.6.1.1039 /prefetch:14
                2⤵
                  PID:3384
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8016,i,8239195320368989565,587874250598901871,2097152 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=8072 /prefetch:1
                  2⤵
                  • System Time Discovery
                  PID:2724
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9620,i,4079572442035479850,3507978631945826932,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=9612 --brver=26.6.1.1039 /prefetch:14
                  2⤵
                    PID:1396
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=11564,i,4474728066624379339,8449496782847101465,2097152 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=9652 /prefetch:1
                    2⤵
                    • System Time Discovery
                    PID:3088
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8012,i,12040039613944936425,1801883889392398306,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=9612 --brver=26.6.1.1039 /prefetch:14
                    2⤵
                      PID:5584
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8052,i,14102824516597821143,18093418128459959083,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=7904 --brver=26.6.1.1039 /prefetch:14
                      2⤵
                        PID:2148
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=8860,i,16336975831090017376,6609223880367526583,524288 --field-trial-handle=2248,i,5276236243734818563,17613413160677884503,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2252,i,16679180211054461056,17918562726035365899,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=7856 --brver=26.6.1.1039 /prefetch:14
                        2⤵
                          PID:2368
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:4128
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                          1⤵
                          • Modifies data under HKEY_USERS
                          PID:376
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                          1⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:3164
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783679855 --annotation=last_update_date=1783679855 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3164 --annotation=metrics_client_id=a1cc5aa7ce914420932e8b2070956524 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.1.1039 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffe4cbd47f8,0x7ffe4cbd4804,0x7ffe4cbd4810
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1240
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={FA26C9D0-3AD7-4003-ADC3-716FA184D923}
                          1⤵
                          • Drops file in Windows directory
                          • Enumerates system info in registry
                          PID:2420
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783679855 --annotation=last_update_date=1783679855 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2420 --annotation=metrics_client_id=a1cc5aa7ce914420932e8b2070956524 --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.1.1039 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffe4cbd47f8,0x7ffe4cbd4804,0x7ffe4cbd4810
                            2⤵
                              PID:1264
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=dayuse --bits_job_guid={2EEA98B1-2506-4AF2-B747-9D01E6E140DB}
                            1⤵
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:4960
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1783679855 --annotation=last_update_date=1783679855 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4960 --annotation=metrics_client_id=a1cc5aa7ce914420932e8b2070956524 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.1.1039 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffe4cbd47f8,0x7ffe4cbd4804,0x7ffe4cbd4810
                              2⤵
                                PID:3700
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2140,i,8348237766034188005,1193532409721263247,524288 --field-trial-handle=2312,i,12983087957530663730,697227071578730998,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2316,i,13060894109789318400,6866428773176579764,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2344 --brver=26.6.1.1039 /prefetch:11
                                2⤵
                                • System Time Discovery
                                PID:4840
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=469489fc-2cc4-42dc-99e2-d343d17bb1c8 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1964,i,646482561611114762,17849781313544661736,262144 --field-trial-handle=2312,i,12983087957530663730,697227071578730998,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2316,i,13060894109789318400,6866428773176579764,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2308 /prefetch:2
                                2⤵
                                • Network Service Discovery
                                PID:2656

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Defense Evasion

                                  Modify Registry

                                  4
                                  T1112

                                  Subvert Trust Controls

                                  1
                                  T1553

                                  Install Root Certificate

                                  1
                                  T1553.004

                                  Credential Access

                                  Credentials from Password Stores

                                  1
                                  T1555

                                  Credentials from Web Browsers

                                  1
                                  T1555.003

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Network Service Discovery

                                  1
                                  T1046

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  Query Registry

                                  5
                                  T1012

                                  System Information Discovery

                                  4
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  System Time Discovery

                                  1
                                  T1124

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  e599b10.rbs
                                  • Path C:\Config.Msi\e599b10.rbs
                                  • Size 912B
                                  • SHA256 ee9b52a12207aeb98e4ded20f5414af07ed988516c94fa026949756c805774dc
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                  • Size 1KB
                                  • SHA256 f402af1ca9e37a10db5bbd6b36be1084b33baa0d9c94d93a214ae5e78b212002
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                  • Size 1KB
                                  • SHA256 dac19cf375716c60d4aa198a911c62e6542fde7b3ff3d0d45556a29e73fe6721
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                  • Size 1KB
                                  • SHA256 bab6c0406fb38bd1df17d98610bab1c5ae10ee52dad79a552fc068675a4fe778
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                  • Size 1KB
                                  • SHA256 62d9fbbe67ed0e1180aba93718ec88638eecd57002f23b4244476896d892f296
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                  • Size 1KB
                                  • SHA256 ac7946ca3d04bd26f87164c89614137a387e664a96d271f6f12c1da2ec3d487a
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                  • Size 1KB
                                  • SHA256 e52d6cb25f2af49f19ecd05340fc69fc4c33642819217e40b637fe1898fe6154
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                  • Size 508B
                                  • SHA256 3d6a8bc58148b1266cf266394d3e3ef8813906f9ead87b8806e6bd0b62e5274e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_1311B204CE641FD9C7F93B623858890F
                                  • Size 536B
                                  • SHA256 2a34fe2bb07c5d0085865fe53d278e58d594f00c0a5fbb83bd24790dbf465fc7
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                  • Size 536B
                                  • SHA256 147f205cca96f9d1b0a2b28cf8db15ee6ed494113ee2b7473ac12e8eaa9c7c31
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                  • Size 536B
                                  • SHA256 cd6e881fa612c1eb924ce06199ac48a368fc76d260f66fbfcd317291cfe175f2
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                  • Size 536B
                                  • SHA256 eef6929b9d91ae70e6da337f31810094e38e59e616b1be4f0bfbdb3f7baed75a
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                  • Size 506B
                                  • SHA256 22e18bdcb9b1629513e1c01d038854886f4fe9bcf4c776e40429753d5e25ad99
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  www.ya.ru.ico
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\www.ya.ru.ico
                                  • Size 5KB
                                  • SHA256 6bb91f1d74389b18bce6e71772e4c5573648c1a4823338193f700afdf8216be5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  2146b6d68f936ba479154f76bffb5592
                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\thumbnails\2146b6d68f936ba479154f76bffb5592
                                  • Size 15KB
                                  • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  43570bb56b5e7ff64a88f29cb89893d1
                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\thumbnails\43570bb56b5e7ff64a88f29cb89893d1
                                  • Size 6KB
                                  • SHA256 cbd302b0ea2218f495b9f0a814f34733f2c5f13a6634d74c6e85a5c0863b5621
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  YandexPackSetup.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                                  • Size 10.1MB
                                  • SHA256 aee3b363f4a43dd8a731282a3fdd5648b05376a6711b2f841fea2f098b0cb53d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  lite_installer.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\7F85615F-F200-44F2-B83F-190924B6A9D4\lite_installer.exe
                                  • Size 418KB
                                  • SHA256 d5afe2f333908aa0e84b59851f8208a9dfc0838d13d59b3d76f6f6c9245f6afb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sender.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\8D4188F0-2D00-43C8-BD29-EAF0A315D8F4\sender.exe
                                  • Size 258KB
                                  • SHA256 38483f6f7ac7ba9ebc7294448575673142a4cb2e8c6500987c0cf7de59a6a082
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  seederexe.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\F214C5D7-3B9A-45C3-964A-03927FECED73\seederexe.exe
                                  • Size 8.6MB
                                  • SHA256 71be9c579ff6385abc1a7c4157d73f126375ea722d6174d113077506a8936550
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  PartnerFile
                                  • Path C:\Users\Admin\AppData\Local\Temp\PartnerFile
                                  • Size 1.4MB
                                  • SHA256 211455e6e91edef14c893811d53355c8bdbe334a66c7834d5f30a95b4cd826c2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  BRAND_COMMON
                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\BRAND_COMMON
                                  • Size 25.6MB
                                  • SHA256 92e3fdf606ebfa87d72b35a49e08c9f272da92ff2d7d08848cb66c30a936466d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  brand_yandex
                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\brand_yandex
                                  • Size 2.5MB
                                  • SHA256 bbaf3db0c2291d65be8b2ab1237dda221fc20b16e755568b84bee80dbaa602db
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  setup.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_CB8E5.tmp\setup.exe
                                  • Size 7.5MB
                                  • SHA256 a76c451fb1e4a6c099151e8e1f63283a03d2a0b0491655663a915add866ad357
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  YandexSearch00000.log
                                  • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                  • Size 1KB
                                  • SHA256 3f52fbf5a7f732b191ff98a4f14a2aef9d1b36cdbdef9d70d09dea0dd0b4509d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  clids-yasearch.xml
                                  • Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                  • Size 729B
                                  • SHA256 1507f73dce564b7fe1822d666dbeda1bf122824b8030a13611957347b025467f
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  lite_installer.log
                                  • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                  • Size 11KB
                                  • SHA256 cb035ef8faca0a8d8af767e89701813995e6ec92acd1a43bb0feea58e410596a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  master_preferences
                                  • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                  • Size 542B
                                  • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  vendor00000.xml
                                  • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                  • Size 528B
                                  • SHA256 ac715d8635e832b50ebcda36d5ccaad739cf9b557b921598022e013375b36890
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  yandex_browser_updater.log
                                  • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                                  • Size 5KB
                                  • SHA256 27c5445b6961583e3607289894c35050907fc88c0891b0160860a623c7c449cb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  YandexSearch.msi
                                  • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                  • Size 9.8MB
                                  • SHA256 76495a2601ea7a6ce24927cbce165a211f8b341f83bc4f03bdc2d61bafc49ad0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  {C0D46CD6-545B-48C8-9F48-3BB4EAD400DD}.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\{C0D46CD6-545B-48C8-9F48-3BB4EAD400DD}.exe
                                  • Size 12.0MB
                                  • SHA256 d1228d71d7a9a496976ca507f9ebdcd640f07d246f8e3f5f191f40afb045b53f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Yandex.exe
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
                                  • Size 395KB
                                  • SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Yandex.lnk
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
                                  • Size 2KB
                                  • SHA256 6895bd17476a459c0bd2e1a62f4a4c203fef3ca5a58313242433566b93a71672
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  ru.bdic
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\YandexDictionaries\ru.bdic
                                  • Size 4.5MB
                                  • SHA256 af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  install_state.json
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\install_state.json
                                  • Size 1KB
                                  • SHA256 368c53b80e684ce3f7fdc654df9252303f8a46fc4816865bcc210131e8c86ee1
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  brand_config
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.1.1039\brand_config
                                  • Size 6KB
                                  • SHA256 7f0192385ecf58f16f0522fdeaaedb7192bc6cd6cf32bbab1fe4f9f0197ab0e7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  partner_config
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.1.1039\partner_config
                                  • Size 341B
                                  • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  all_zip
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.1.1039\resources\configs\all_zip
                                  • Size 1.3MB
                                  • SHA256 87fff65e56f9e046a238b8ae8831ff8347953e294d46f6f1c36a49951672c406
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  light_static.jpg
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.1.1039\resources\wallpapers\light.title\light_static.jpg
                                  • Size 674KB
                                  • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sea_preview.jpg
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.1.1039\resources\wallpapers\sea_preview.jpg
                                  • Size 59KB
                                  • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sea_static.jpg
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.1.1039\resources\wallpapers\sea_static.jpg
                                  • Size 300KB
                                  • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                  • Size 48B
                                  • SHA256 7fd9681e929535fc2fc6345976026a76703cb760cda2d5d2d4c49b4aa8b4b11a
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  92a22592-8e7a-4229-bf35-c633ae4f0ee5.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\92a22592-8e7a-4229-bf35-c633ae4f0ee5.tmp
                                  • Size 5KB
                                  • SHA256 6ee89fd775bb85e0173ea05fb4bc854800fc7166f054fc6506621e637bee1b6a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_0
                                  • Size 44KB
                                  • SHA256 ecba1ea564df6c3d52a179d464d9a275b2fe7dbe8de3067af56ae18c490fc8b5
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  f_000004
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000004
                                  • Size 40KB
                                  • SHA256 5895185cf878a38cd172286ed97976e6ab620b2c5fd7f7810f9c9d2f7169da6d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  f_000006
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000006
                                  • Size 48KB
                                  • SHA256 b3cd587a747007fc5a365ceec5daa964c559e4862ae70aa98f5d0e1849d5ddf0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  f_000017
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000017
                                  • Size 49KB
                                  • SHA256 71749109108dcaf2c654d92602d94eb6bba92fa59f5d533007254863d5c4ed60
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  92812910-90c3-43d9-8425-616d80518e5c.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\92812910-90c3-43d9-8425-616d80518e5c.tmp
                                  • Size 48B
                                  • SHA256 c3f9b05fe0fd0fd8796da7919b9c653853a31f74214414a2cb0c727687ea7747
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  the-real-index
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index
                                  • Size 864B
                                  • SHA256 fee4e1e848e2778c9c87ad2f751216f5cec68562ffa8771f994bbb87563a23f9
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extension Rules\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 18KB
                                  • SHA256 850c53cf0f44daa0360e2cf4f53c2fc207a2897b01db0e358861e071bae297c7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 18KB
                                  • SHA256 175037cdd6912115a9808ffebe5583423abc3bd37d071de09eae339c79def3fa
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 15KB
                                  • SHA256 83b3c6fe2a3bcb497a06f2c880aa17094dcfdf736749efc64c0ef63ba38c8097
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 13KB
                                  • SHA256 efcd85b485554e2d79192d18c208b0721653c12e7c91990bce600b724a11bf46
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                  • Size 9KB
                                  • SHA256 7263f41aae7120af3bf0b6aea30ddb517fe07cbcfa3d4f4a9f537520c0cd5b12
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Secure Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                  • Size 15KB
                                  • SHA256 284f6310b25f645abda5fdb76605f7f222c40cd291aec26e810e3fe522324a18
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Secure Preferences
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                  • Size 15KB
                                  • SHA256 155bc99c56ba08a278629a7bba655a6a6e6a9b64d34dfff9beafad0a614c3664
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Sync Data\LevelDB\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  128.png
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir4944_1629164081\Trusted Icons\Icons\128.png
                                  • Size 6KB
                                  • SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  256.png
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir4944_1629164081\Trusted Icons\Icons\256.png
                                  • Size 5KB
                                  • SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  64.png
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir4944_1629164081\Trusted Icons\Icons\64.png
                                  • Size 3KB
                                  • SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  96.png
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir4944_1629164081\Trusted Icons\Icons\96.png
                                  • Size 5KB
                                  • SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  e295be4d-bc71-489b-8e5a-bac3452f7252.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\e295be4d-bc71-489b-8e5a-bac3452f7252.tmp
                                  • Size 149KB
                                  • SHA256 a562db9f21ac722792a5c63080e715a473dcf408c2794bbd8039e13be5dc5b65
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  f015291d-5774-4765-b800-11a2c9110b73.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\f015291d-5774-4765-b800-11a2c9110b73.tmp
                                  • Size 8KB
                                  • SHA256 4cd08d1e4dcd06fe6a9b6fc834410cf18ee65d9d6922d8c5130bdf4edf9db253
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GrShaderCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  Local State
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                  • Size 236KB
                                  • SHA256 db207d832e108a9d87cc3aa620c57494d693ebf8cc0825680dbbacb6f14662bc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  c88e297b-82ac-4780-9829-4401f8489a98.tmp
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\c88e297b-82ac-4780-9829-4401f8489a98.tmp
                                  • Size 219KB
                                  • SHA256 78175ced0fd75ca92c95ba760f64c1578c1ea9515a4b11d5b462cd2dd4df370f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                  • Size 6KB
                                  • SHA256 2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                  • Size 21.6MB
                                  • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  metadata.json
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                  • Size 13B
                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  metadata.json
                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                  • Size 236B
                                  • SHA256 df671539241fbc96e33ab6dbce06498e6dd1a0927a6f4c394b8f86ce27b541db
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Яндекс.website
                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
                                  • Size 516B
                                  • SHA256 57d6df3e570a31a38fbe6d9bd50071527171c6e8ec9b1cf73a3b333357b73626
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  places.sqlite
                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cxykicyu.Admin\places.sqlite
                                  • Size 68KB
                                  • SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Bookmarks
                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks
                                  • Size 1KB
                                  • SHA256 2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Preferences
                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences
                                  • Size 319B
                                  • SHA256 4c41996870e9a46bd1cd6214f86addfeb3034e95a4adb52cfa103701213b2e0f
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  clids-yabrowser.xml
                                  • Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
                                  • Size 755B
                                  • SHA256 5749d95ed4629a29ad587450263c84b116b5618942ea45f8ab25a234d73bd56d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  ui
                                  • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                  • Size 38B
                                  • SHA256 959a1db4483b1ff6813b7fd6efa067f2dcfb13b8f2775ef0bc038981d5d3ee7d
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  MSI9E3A.tmp
                                  • Path C:\Windows\Installer\MSI9E3A.tmp
                                  • Size 182KB
                                  • SHA256 814b1644c8fe5f1af6b9207e5757c8bb80950e903cfb4e1166bb188ea8577bb7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  MSI9EB8.tmp
                                  • Path C:\Windows\Installer\MSI9EB8.tmp
                                  • Size 187KB
                                  • SHA256 2ceae73443e109cbdf36adcfdc0160f2363860dbfb4186cf47cb9130b0283205
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  yandex_browser_installer.log
                                  • Path C:\Windows\SystemTemp\yandex_browser_installer.log
                                  • Size 6KB
                                  • SHA256 9b60840a47f9a706475f68e88978b4b7511fa45f842b776948669321a0a3335b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  yandex_browser_service_update.log
                                  • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                  • Size 3KB
                                  • SHA256 52aa74b0c8e4de7d51d9e34818a05bbbba97c5ca6cf08b72332c09938ffc73f7
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  yandex_browser_service_update.log
                                  • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                  • Size 4KB
                                  • SHA256 b60e32522d1fda9e3fe93abad8c796b0ac0f78e7eccc05e7a36e655a77c4ce96
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/1932-1379-0x00000269F6030000-0x00000269F605F000-memory.dmp
                                  Download

                                  memory/2656-1667-0x00000223C4CC0000-0x00000223C4CEF000-memory.dmp
                                  Download

                                  memory/3740-1099-0x00007FFE6E910000-0x00007FFE6E911000-memory.dmp
                                  Download

                                  memory/3740-1098-0x00007FFE6E4C0000-0x00007FFE6E4C1000-memory.dmp
                                  Download

                                  memory/4356-961-0x00007FFE6F720000-0x00007FFE6F721000-memory.dmp
                                  Download

                                  memory/4356-1378-0x000001FE1D5A0000-0x000001FE1D5CF000-memory.dmp
                                  Download

                                  memory/4944-1312-0x0000022692220000-0x0000022692461000-memory.dmp
                                  Download